Subject: Re: [hrpc] Bob asks Alice about human rights

From: Eliot Lear <[email-masked]>
Date: Tue, 1 Aug 2017 10:53:58 +0200

Stephen,

On 8/1/17 12:03 AM, Stephen Farrell wrote:
> Hi Eliot,
>
> On 31/07/17 22:47, Eliot Lear wrote:
>>  provably true[1]
> ...
>
>> [1] See Donnie Brasco as an example.
> Provably true based on fiction? I guess F=>anything is
> logical yes, but it doesn't seem useful.

Forgive me for being inexact with the reference, but you are wrong.

The FBI rolled up vast numbers of mafia members along the east coast in
the 70s and 80s by using taps.   Donnie Brasco is the recounting of one
of the most successful efforts that combined FBI agent Joe Pistone's
undercover work with the taps that were taking place.   The evidence is
incontrovertible that by pursuing these criminals with taps and other
means, the government protected the rights of those who were or would
have been, assaulted, shaken down, or murdered.  One could quite
reasonably argue that this was in support of Article 3 of the UDHR.

This doesn't speak to the government abuse that can and has occurred
through snooping.  That's the other side of the equation, and the Stasi
and KGB demonstrated their effectiveness of essentially acting like
mafioso.  That, it seems to me, is where a number of other articles,
including Article 19, come into play, leading to a balancing test that
is not well stated or recognized in the charter, even though it is at
least perfunctorily recognized in draft-irtf-hrpc-research.

By the way, that same Article 3 is itself a tradeoff.  Consider the
example I mentioned when we saw each other in Prague about a bank that
had been MITM'd, and how TLS saved the day for them, their investors,
and their depositors from vast amounts of theft.  Governments blocking
encryption would have facilitated that theft.  The charter also gives
this example short shrift by focusing on freedom of speech and expression.

Eliot

>
> If you want to claim the RG isn't well chartered, you
> need, IMO, a far better argument than that.
>
> And while yes, many governments will defend snooping
> of various kinds, when one considers real examples,
> things get far less simple, for example, a bunch of
> governments don't have purely monolithic opinions in
> that (snooping) space but rather have different bits
> of the same government with different angles.
>

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 1 Aug 2017 13:50:38 +0200

Hi all,

On Mon, Jul 31, 2017 at 11:47:47PM +0200, Eliot Lear wrote:
> Hi,
> 
> 
> On 7/31/17 8:25 PM, Mando Rachovitsa wrote:
> > Hi All.
> >
> > Thanks for the feedback.
> >
> > Re Eliot: I think that what Niels mentioned reflects what I was
> > thinking. All human rights may be/are applicable and they are
> > interrelated, interdependent and unalienable. In the text I am
> > referring to figuring out which human rights are relevant when
> > discussing a specific technical decision in the content of the IETF.
> > Admittedly, the answer to this question may not be always be
> > straightforward. Perhaps the text needs to clarify these points.
> 
> I'll elaborate on my example: some governments would probably argue that
> human rights are being preserved through snooping activities, because
> they would say that they are preventing physical harm to others and
> following through on their responsibility to protect their citizens. 
> That statement is provably true[1] in at least small numbers, but that
> doesn't make the best course of action to avoid/circumvent/outlaw
> encryption.  This is why I believe the hrpc is poorly chartered.
> 
> Perhaps we could spend some time elaborating on which human rights are
> protected, which are violated, and when, but it very much depends on
> your overall view of government.
> 

Luckily human rights are not defined by individual governments (an example of this are the Universal Periodic Reviews in which every government get assessed on their human rights performance by the UN officer for Human Rights), and there has been quite some literature on how human rights should be interpreted and implemented. On this specific issue of encryption you can for instance have a look at the report on the UN Special Rapporteur on this issue:

http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForSubmission.aspx

Or the landmark resolution that was accepted by the UN General Assembly - the right to privacy in a digital age:

http://www.un.org/ga/search/view_doc.asp?symbol=A/C.3/71/L.39/Rev.1

All the best,

Niels

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

-- 

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint	   2458 0B70 5C4A FD8A 9488  
                   643A 0ED8 3F3A 468A C8B3

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 1 Aug 2017 13:52:33 +0200

> http://www.un.org/ga/search/view_doc.asp?symbol=A/C.3/71/L.39/Rev.1

Also quite some work has been done on defining when and how surveillance could be legally legitimate, have a look here:

https://necessaryandproportionate.org/principles

Best,

Niels

-- 

Niels ten Oever
Head of Digital

Article 19
www.article19.org

---

From: Pranesh Prakash <[email-masked]>
Date: Tue, 1 Aug 2017 22:37:21 +0530

> https://necessaryandproportionate.org/principles

Folks here might particularly be interested in this:

++++
Principle 11: Integrity of communications and systems
In order to ensure the integrity, security and privacy of communications 
systems, and in recognition of the fact that compromising security for 
State purposes almost always compromises security more generally, States 
should not compel service providers or hardware or software vendors to 
build surveillance or monitoring capability into their systems, or to 
collect or retain particular information purely for State Communications 
Surveillance purposes. A priori data retention or collection should 
never be required of service providers. Individuals have the right to 
express themselves anonymously; States should therefore refrain from 
compelling the identification of users.
++++

It would be interesting to look at (informational) RFC 3924[1] in light 
of this principle.

I also find it interesting how while the rest of the principles seem to 
promote balancing tests, this particular principle outright bans a 
priori data retention or collection requirements.  Is there any data 
retention or collection regime currently in place anywhere in the world 
that is 'a posteriori'?  It seems to me that all general data retention 
requirements (say, keeping all call detail records for a period of X 
months, or keeping all web server logs with IP addresses for X months) 
are thus a violation of Principle 11.

  [1]: https://tools.ietf.org/html/rfc3924

-- 
Pranesh Prakash
Policy Director, Centre for Internet and Society
http://cis-india.org | tel:+91 80 40926283
sip:[email-masked] | xmpp:[email-masked]
https://twitter.com/pranesh

---

From: Bob Harold <[email-masked]>
Date: Tue, 1 Aug 2017 14:33:29 -0400

On Tue, Aug 1, 2017 at 1:07 PM, Pranesh Prakash <[email-masked]>
wrote:

>> Also quite some work has been done on defining when and how surveillance
>> could be legally legitimate, have a look here:
>>
> Surveillance purposes. A priori data retention or collection should never
> be required of service providers. Individuals have the right to express
> themselves anonymously; States should therefore refrain from compelling the
> identification of users.
> ++++
>
> It would be interesting to look at (informational) RFC 3924[1] in light of
> this principle.
>
> promote balancing tests, this particular principle outright bans a priori
> data retention or collection requirements.  Is there any data retention or
> collection regime currently in place anywhere in the world that is 'a
> posteriori'?  It seems to me that all general data retention requirements
> (say, keeping all call detail records for a period of X months, or keeping
> all web server logs with IP addresses for X months) are thus a violation of
> Principle 11.
>
What pops into mind for a data retention case is DHCP logs so that a DMCA
notice can be forwarded to the person who had a particular IP at a
particular time.

-- 
Bob Harold

---

From: [email-masked]
Date: Tue, 1 Aug 2017 15:40:11 -0400

Perhaps this seems a little far-fetched on first glance but I think,
for grey areas such as the favorite fishing expeditions for
"terrorists", there needs to be accounting and a cost.

If we the people are supposedly benefiting from such operations then
we should accept responsibility, including financial.

Major telcos were paid hundreds of millions by the US govt under CALEA
and other wiretap programs.

  http://www.cbsnews.com/news/verizon-att-get-most-bucks-from-feds-for-wiretaps/

  http://gizmodo.com/5898964/this-is-how-much-carriers-charge-for-cellphone-wiretaps

Why not something for those found innocent or otherwise impacted?

Maybe that seems out of scope but do we even have a notion of
accounting for such activity? Obviously the telcos do a very good job
of accounting for this.

To account for something requires protocol modifications.

So this presents three situations:

  1. No human rights etc issues, most communications.

  2. Violation of human rights, stop it.

  3. A huge gray area where intrusion might do some good in terms of
  safety and security.

This idea addresses primarily #3.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*

---

From: Eliot Lear <[email-masked]>
Date: Wed, 2 Aug 2017 09:46:11 +0200

Barry,

The 451 error message was something of a sop to that concept, so that
there is at least transparency when material is taken down.  The
transparency reports that many services issue provide some of this
information.  But from a protocol design standpoint, it's not clear to
me what sorts of elements would be useful in this context.  Pretty
typically we seem to be in the business of removing as much as possible
that might be subject to abuse (Stephen has been particularly careful to
raise those sorts of concerns).

But perhaps you have an example in mind?

Eliot