Subject: [hrpc] status on draft-irtf-hrpc-political

From: avri doria <[email-masked]>
Date: Mon, 2 Sep 2019 09:29:15 -0400

Hi,

Recently there has been an ongoing discussion about taking this draft to
Research group last call and then toward RFC using the IRTF process.
Mallory and I have also been discussing it for a bit.   We are trying to
determine whether its time for the last call.

During the Montreal session, from my remote perspective it seemed that
there was a willingness for it move to last call, or at least no
objection.  At least one person indicated they would do a review. Are
there reviews in progress that are on their way?

At this point I wanted to ask the list, is it ready for a last call and
are there people who have read it who either agree or who do not agree
with taking it a step toward RFC. Does anyone object to taking it to
last call. If you have read it and have a opinion/analysis, please do tell.

I also want to confirm that the latest copy is still -03 as found in
datatracker (17 May)

https://datatracker.ietf.org/doc/draft-irtf-hrpc-political/
<https://datatracker.ietf.org/doc/draft-irtf-hrpc-political/?include_text=1>

I have one other question about the draft at this point.

<https://datatracker.ietf.org/doc/draft-irtf-hrpc-political/?include_text=1>

In the Abstract, it claims  that it is 'undisputed' that the IETF
process of developing standards is a political process. While I
personally agree that it is a political process, reading through the
history of the discussions on this issue, makes me hesitate to call it
undisputed. While the question of the degree to which it is a political
process does not necessarily need to be definitively resolved in a
draft, it is enough to discuss the idea, we should probably be confident
on the degree to which it is  indisputable, or not. 

Thanks

avri

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 2 Sep 2019 17:41:06 +0200

> I also want to confirm that the latest copy is still -03 as found in

Thanks for progressing on this discussion! -03 is indeed the most recent version.

I have on little change ready, based on a suggestion of SM, to replace the sentence:

The discussion list for the IRTF Human Rights Protocol Considerations working group is located at the e-mail address <[email-masked]>. Information on the group and information on how to subscribe to the list is at:

with:

The discussion list for the IRTF Human Rights Protocol Considerations Research Group is located at the e-mail address <[email-masked]>. Information on the group and information on how to subscribe to the list is at:

https://github.com/IRTF-HRPC/drafts/commit/89dd530ce663750d14fb9647a4e4908c29552ad7#diff-fb9d617868a367dd946ef225cc5e6de1

But am not sure that warrants a new version already.

Best,

Niels
-- 
Niels ten Oever
Researcher and PhD Candidate
DATACTIVE Research Group
University of Amsterdam

PGP fingerprint	   2458 0B70 5C4A FD8A 9488  
                   643A 0ED8 3F3A 468A C8B3

---

From: Eliot Lear <[email-masked]>
Date: Mon, 2 Sep 2019 20:11:37 +0200

Hi Avri,

> On 2 Sep 2019, at 15:29, avri doria <[email-masked]> wrote:
> 
> Hi,
> 

I do not think this work is ready.  There are several major issues:

The abstract does not clearly state what the paper attempts to address, and thus it is not clear whether the goal has been achieved.
Section 3 states a thesis (in exactly one sentence).  Section 4 addresses the thesis.  And then there’s a Section 5 which has nothing to do with the thesis.  I presume the correction is to combine section 3 and 4, but it leaves open what questions are meant to be answered in this document, and to what end.
There is not a clear delineation between protocols and standards.  Why are they viewed separately?
Section 6 makes the following statement: 

it is undisputed that standards and protocols are both products of a political process, and they can also be used for political means.

If it’s not disputed, then what were the earlier sections meant to answer?
The use of the terms “normative” and “de facto” requires clarity.  The author is essentially saying that standards are in effect normative, even if we claim them to be voluntary.  That should be stated more explicitly, because seems central.  People differ on what constitutes “de facto” vs. “de jure”.  In some people’s view, IETF standards are de facto (I don’t hold that view myself, but some government types certainly do).
Most importantly, I am left with a major question: So what?  What are the implications of the answer to this question and why is it important to ask.

In addition, I have some questions about the supporting material.

Regarding this text in Section 4.5:

The process that led to [RFC6973] is similar: the Snowden disclosures, which occured[sic] in the political space, engendered the IETF to act.

I believe the author is actually referring to RFC 7258 (6973 was in the RFC Editor queue when Snowden hit, and is the product of the IAB), but even here, some additional support is necessary.  7258 was indeed motivated by Snowden.  But it addresses what is viewed as a technical problem.  That technical problem itself has political ramifications, but this isn’t really teased out well.  Keep in mind that people supported the publication of that document for reasons of their own, and we cannot really ascribe motivations.

Section 1 of the document references RFC 49 with regard to privacy and security.  I understand the mention of security in that document, but not privacy.  Perhaps the author can clarify?

I have not checked the other references, but I suggest that they be checked.

Eliot

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 9 Sep 2019 12:50:43 +0200

Hi Eliot,

Thank you very for you review.

> The abstract does not clearly state what the paper attempts to address, and thus it is not clear whether the goal has been achieved.

I have added the following sentence to the abstract:

This document aims to bring about a better understanding on the political nature of standards and protocols.

> Section 3 states a thesis (in exactly one sentence).  

As you know this part expanded and then got boiled down again to exactly show what this draft is about. 

> Section 4 addresses the thesis.  

This section addresses what opinions on the question exist within the community, and seeks to locate them within academic debates on this topic.

> And then there’s a Section 5 which has nothing to do with the thesis.  

Section 5 documents the political nature of standard setting processes in general, so it does related to the question.

> I presume the correction is to combine section 3 and 4, but it leaves open what questions are meant to be answered in this document, and to what end.

I think it is quite clear that the political nature of protocols has been extensively discussed both on ietf@ietf, on this list, in plenary sessions and in the hallways. Documenting those discussions in a structured manner, and providing a framework to understand them will hopefully help us to progress in this discussion.

> There is not a clear delineation between protocols and standards.  Why are they viewed separately?

Not all standards are protocols. 

> If it’s not disputed, then what were the earlier sections meant to answer?

Because it shows a qualified and nuanced answer to the research question.

> The use of the terms “normative” and “de facto” requires clarity.  The author is essentially saying that standards are in effect normative, even if we claim them to be voluntary.  

Exactly, that is what emerges from the research.

> That should be stated more explicitly, because seems central.  

Does section 5 not do this sufficiently?

> People differ on what constitutes “de facto” vs. “de jure”.  In some people’s view, IETF standards are de facto (I don’t hold that view myself, but some government types certainly do).> Most importantly, I am left with a major question: So what?  What are the implications of the answer to this question and why is it important to ask.

As you know, previous versions of this document came up with recommendations. But it was then brought up that a research cannot make recommendations for the IETF. Therefore this document serves as a platform for further discussion, and thus ensuring we don't need to repeat all the doscussions we've had.

> I believe the author is actually referring to RFC 7258 (6973 was in the RFC Editor queue when Snowden hit, and is the product of the IAB), but even here, some additional support is necessary.  7258…

The argument that is made is that is was a technical argument, which was also a political position. It does not say what the psotion it, but it foregrounds the socio-political nature of a technical statement.

> Section 1 of the document references RFC 49 with regard to privacy and security.  I understand the mention of security in that document, but not privacy.  Perhaps the author can clarify?

I have added a semicolon to make sure it is understood that that reference is only understood to link to security, and not privacy AND security.

Thanks again for the review. I'll push a new version based on the changes.

Best,

Niels

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

-- 

Niels ten Oever

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 9 Sep 2019 22:13:29 +0200

Hi Eliot,

Of course I meant to say 'thank you very much for your review', was typing in a tight airplane seat, that probably did not help.

Am currently struggling a bit with xml2rfc, but expect to push a new version soon. The changes can already be found here:

https://github.com/IRTF-HRPC/drafts/commits/master/draft-political.md

Best,

Niels

On 9/9/19 12:50 PM, Niels ten Oever wrote:
> Hi Eliot,
> 
> Thank you very much for your review.
>

---

From: Eliot Lear <[email-masked]>
Date: Tue, 10 Sep 2019 08:26:00 +0200

Hi Niels,

I will look for your update.  I understand your enthusiasm and impatience to publish (I share with you both of those traits myself after a certain point).

Now please see below.

> On 9 Sep 2019, at 12:50, Niels ten Oever <[email-masked]> wrote:
> 
> Hi Eliot,
> 

I think there’s more to be said.  Please read down.

> This section addresses what opinions on the question exist within the community, and seeks to locate them within academic debates on this topic.

Again, think about it from the reader’s perspective.  How many papers have you read that has a single sentence section?  My suggestion is simply to state the question in Section 1 and eliminate Section 3.  In fact, it might make for a good first sentence.  It’s bold and invites exploration.

> Section 5 documents the political nature of standard setting processes in general, so it does related to the question.

Ok, on closer reading I think you’re right, and I was wrong on that point.

I still think your exploration should go a bit further.  While I like that you talk about interference in order to promote de facto standards, one can also show examples of interference to disrupt de facto standards.  In fact, the entire de jure standardization process is a form of that disruption.

In addition, one can find a great many examples of where purported de jure standards are never implemented, even absent interference.  One need only look at certain international standards bodies’ work to see it littered with science experiments (that includes the IETF), and the sad state of affairs with regard to network security.  A simple imprimatur does not guarantee implementation – thus the notion of “voluntary”.  There has to be something more: there has to be an economic need for the standard (de jure or de facto).  Professor Rebecca Henderson @ Harvard has done a lot of work on this subject, and on technology in general (I’m a big fan).  May be worth adding to your literature review, but it goes beyond the bounds of Section 4, which is really focused on a single question.

Putting that previous paragraph more simply, it would be useful to bound the effects you are attempting to characterize.  You might even show a few examples.  To name a few, we can borrow a bit from the ITAT workshop report in RFC 7305 and RFC 5218, looking at Bitcoin (see Böhme[1]), DNSSEC (see Eklund Löwinder[2]), and of course our two favorites, IPv6 and HTTP.  In fact, such a correlation would be, I think, a great addition, even if it is follow-on work.

If you want to go even further in terms of formal analysis, you may wish to review Greenstein and Stango.[3]. The nice thing about that book is that it gets well beyond the IETF or even Internet technology, but also includes some.  Its examples are a bit dated, tho.

> Exactly, that is what emerges from the research.

Then isn’t that a far stronger thesis?  The question you are asking in Section 3 is trivially true, IMHO.  It boils down to the old maxim, that politics exists in a room of more than one person.  Which brings me to my next point.

> 
>> I am left with a major question: So what?  What are the implications of the answer to this question and why is it important to ask.
> 
> As you know, previous versions of this document came up with recommendations. But it was then brought up that a research cannot make recommendations for the IETF. Therefore this document serves as a platform for further discussion, and thus ensuring we don't need to repeat all the discussions we've had.

I fear you may have taken away the wrong conclusion from those discussions.  It is perfectly fine to make recommendations to the IETF.  Indeed I would say that the IRTF is at its best when it can make recommendations.  You just cannot do so in a normative fashion from the IRTF.  More importantly, showing some example of societal benefit/harm will ground the work.  Just be sure to ground your analysis in your recommendations.

> The argument that is made is that is was a technical argument, which was also a political position. It does not say what the position it, but it foregrounds the socio-political nature of a technical statement.

Yes- but your statement could be read to infer political motivations on the part of the IETF.  And that is what I would be cautious about.  I think this is editorial.

Regards,

Eliot

[1] https://www.iab.org/wp-content/IAB-uploads/2013/06/itat-2013_submission_5.docx
[2] https://www.iab.org/wp-content/IAB-uploads/2013/06/itat-2013_submission_17.pdf
[3] https://www.cambridge.org/core/books/standards-and-public-policy/9439DB66D660C8131578652F547A9E82

---

From: Mallory Knodel <[email-masked]>
Date: Tue, 10 Sep 2019 08:52:21 +0200

> Then isn’t that a far stronger thesis?  The question you are asking in Section 3 is trivially true, IMHO.  It boils down to the old maxim, that politics exists in a room of more than one person.  W…

Agree that this is trivially true, but surprisingly difficult to reference, a problem that is central to the existence of this document.

I would be very interested in works that go deeper and beyond this, but for the moment we haven’t established this by consensus within the community.

-M

-- 
Mallory Knodel
Head of Digital :: article19.org
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9  B071 0C32 A271 BD3C C780

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 10 Sep 2019 15:01:03 +0200

> I will look for your update.  I understand your enthusiasm and impatience to publish (I share with you both of those traits myself after a certain point).

It's been over two years since the publication of the first version, so I think I am doing relativley OK on the impatience part ;)

BTW, anyone ever seen this make error for xml2rfc? Am a bit at a loss:

$ make
xml2rfc draft-political.xml --html
Traceback (most recent call last):
  File "/usr/bin/xml2rfc", line 11, in <module>
    load_entry_point('xml2rfc==2.25.0', 'console_scripts', 'xml2rfc')()
  File "/usr/lib/python3/dist-packages/xml2rfc/run.py", line 482, in main
    htmlwriter.write(filename)
  File "/usr/lib/python3/dist-packages/xml2rfc/writers/base.py", line 1430, in write
    self._build_document()
  File "/usr/lib/python3/dist-packages/xml2rfc/writers/base.py", line 1376, in _build_document
    self.write_reference_list(references[0])
  File "/usr/lib/python3/dist-packages/xml2rfc/writers/legacy_html.py", line 569, in write_reference_list
    initials, surname = short_author_name_parts(author)
  File "/usr/lib/python3/dist-packages/xml2rfc/util/name.py", line 26, in short_author_name_parts
    initials = get_initials(a)
  File "/usr/lib/python3/dist-packages/xml2rfc/util/name.py", line 22, in get_initials
    initials = initials.split('.')[0]
AttributeError: 'NoneType' object has no attribute 'split'
make: *** [Makefile:12: draft-political.html] Error 1

> If you want to go even further in terms of formal analysis, you may wish to review Greenstein and Stango.[3]. The nice thing about that book is that it gets well beyond the IETF or even Internet te…

Thanks a lot for these suggestion Eliot, really appreciated. I would really like to build on this draft by studying adoption and non-adoption and the complex of economic, political, and technical reasons of adoption and implementation, but I don't think it should take place in this draft. This draft is meant to be a platform for those discussions and analyses, and thus for for a iterative, or if you will layered, approach.

> Then isn’t that a far stronger thesis?  The question you are asking in Section 3 is trivially true, IMHO.  It boils down to the old maxim, that politics exists in a room of more than one person.  W…

These discussions come back again and again, and this makes it very hard to have a deeper discussion on the topic. That is why I think this document is important, because sometimes I feel we are spinning our wheels. I hope this draft will give us a platform on which we can continue the work, without repeating older discussions.

Best,

Niels 

-- 

Niels ten Oever