Subject: [hrpc] comments on Anonymity draft

From: Sandra Braman <[email-masked]>
Date: Tue, 14 Nov 2017 01:33:07 +0800

No one can accuse this group of not being fearless. This is a complicated
one, for so many reasons . . . . comments on the current draft follow.
Sandra Braman

-------------------------------------

*Why do we care?*

It is distracting to have the reference to harassment as a motivation for
thinking about why we care about anonymity. If a single reason why is to be
mentioned, history and the scholarly literature would point to the need to
protect full participation in public discourse about matters of shared
public concern -- the need to protect those who wish to be involved in
political speech in fraught environments in which that could be dangerous.

*Who is the legal subject?*

Anonymity in combination with the new modes of association we have in the
online environment yields some interesting problems for identifying the
legal subject altogether. Those interested in this issue and authors of
this draft text may be interested in analysis of the US government's effort
to identify the legal subject in the Bradley/Chelsea Manning court case
involving WikiLeaks, attached here.

*Is there a market for anonymity?*

I disagree with the authors of this draft text regarding whether or not
there is a market for anonymity. There is a hefty and growing market for
privacy and an ever-larger industry of those providing various means of
coping with privacy issues. Privacy and anonymity are not the same thing
but a fair proportion of what the privacy industry provides is of use to
those interested in anonymity as well.

The GDPR will be a great stimulus to this industry on the personnel side.
There is already an association for individuals working in this industry (
https://iapp.org/) that includes resources for dealing with a wide range of
types of companies offering many different types of goods and services
related to privacy (
https://iapp.org/resources/article/privacy-industry-index-pii-vendors/),
etc.  There is a scholarly literature on the privacy industry going back at
least 15 years, etc.

The industry question is an important one. In David Clark's important book
on alternative approaches for designing an internet-like network, *Designs
for an Internet* -- a significantly revised version of the text that is up
on his website is about to go to press as a book in the Information Policy
series at MIT Press -- he is both insightful and persuasive about the
necessity of industrial support for any architectural decisions if they are
to succeed at all. Without that, he notes, things simply won't happen.

*They are not the same, but how are they different?*

Privacy and anonymity are not the same, but this draft text would be
enormously enriched if it directly addressed the question of what would be
*different* about what would be done with a protocol to protect anonymity
as distinct from privacy? What would the differences between the two things
look like in a protocol? Is the goal to have separate requirements for
addressing anonymity and privacy in the protocol design process? Or would
you add consideration of anonymity to privacy considerations?  Or . . . ?

*Differential Anonymity?*

This draft text makes the point that anonymity is not binary. Can an analog
with differential privacy be developed for anonymity -- differential
anonymity? What would that approach mean for protocol design?

*Set-defined Anonymity?*

The definition of anonymity used here refers to it relative to a known set.
It is entirely possible, though, that the desired anonymity would not be
set-based . . . unless the "set" is "all users of the Internet." I
understand the conceptual origins of this approach but do not believe it is
adequate for the Internet context.

*Writing Issues*

- The first sentence is self-contradictory.  The authors start with the
hedge word "seems" but then make a strong assertion about the nature of the
need.

- Cutting and pasting the URL for the Pew study doesn't get one to the
study. I wanted to review it because the authors make a very broad
generalization on the basis of what may well have been a single survey of
American Internet users only. I would agree with the generalization, but
can't use that survey on its own to support it. Either drop the cite or add
text referring to other types of evidence and/or more generally referring
to the kinds of evidence available.

- There are a number of typos throughout.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 15 Nov 2017 10:51:58 +0800

On Tue, Nov 14, 2017 at 01:33:07AM +0800,
 Sandra Braman <[email-masked]> wrote 
 a message of 334 lines which said:

> No one can accuse this group of not being fearless.

Or crazy :-)

> *Why do we care?*
> 
> It is distracting to have the reference to harassment as a
> motivation for thinking about why we care about anonymity.

To me, it is just an example (and the text could be changed to make
this clearer). 

> the need to protect full participation in public discourse about
> matters of shared public concern

Good example (it is already in the draft, just after the issue of
harassment), too but some people would dismiss it as "I'm not involved
in politics so I don't care anout anonymity". I think both examples
are fine.

> I disagree with the authors of this draft text regarding whether or
> not there is a market for anonymity. There is a hefty and growing
> market for privacy and an ever-larger industry of those providing
> various means of coping with privacy issues.

I would be interested by specific examples. VPN providers? Encryption
solutions vendors? 

> The industry question is an important one. In David Clark's
> important book on alternative approaches for designing an
> internet-like network, *Designs for an Internet* -- a significantly
> revised version of the text that is up on his website is about to go
> to press as a book in the Information Policy series at MIT Press --
> he is both insightful and persuasive about the necessity of
> industrial support for any architectural decisions if they are to
> succeed at all. Without that, he notes, things simply won't happen.

I strongly disagree here. The interests of "the industry" (a quite
vague term, when people in the US say "the industry", they typically
mean "capitalist corporations in the OECD world") are not always
aligned with human rights. Often the self-interest of "the industry"
is to violate these rights. I remember a discussion with a software
vendor: I suggested to them to implement a RFC-standardized technique
that improves privacy, pointing to them that they already implemented
several techniques that are dangerous to privacy. They simply replied
"yes, but the people who asked for them put money on the table, and
nobody ever pays us for privacy-enhancing techniques". As Schneier
said "the business model of the Internet is surveillance".

On some issues, we will never have "industrial support". That's
because there are many stakeholders and they have clearly different
self-interests, different political opinions, they belong to different
social classes, etc.

> enormously enriched if it directly addressed the question of what
> would be *different* about what would be done with a protocol to
> protect anonymity as distinct from privacy? What would the
> differences between the two things look like in a protocol?

Good question (but difficult). This is clearly a difficult and
important thing for this project.

> hedge word "seems" but then make a strong assertion about the nature of the

Yes. "There IS a clear need for anonymity online" would be better.
 
> study.

It works for me. Error message you get?