Subject: [hrpc] comments, draft association

From: Sandra Braman <[email-masked]>
Date: Sat, 6 Feb 2021 02:35:56 -0600

First, to the authors, congratulations on this piece.  Clearly a lot of
effort has gone into this.  Following are some thoughts regarding how this
piece could be strengthened if it is to serve as an informational RFC
rather than a journal article, organized by topic.  It is a background
assumption of these comments that the document is intended to have utility
to those involved in protocol design work via the IETF.  Long email alert.

Sandra Braman

----------------------------------------------------------------------------------

*Legal authorities used as justification*

*International Treaties*

The international treaties discussed in this draft are not a part of the
scholarly literature covered in literature reviews, but the legal
authorities on the basis of which claims made here are justified.  Although
I agree with the authors that this is not the place for a comprehensive
discussion and synthesis of the scholarly literature, coverage of the
pertinent treaty provisions *should* be comprehensive.  Treaty provisions
only matter, though, where treaties have been ratified.  It would also be
useful to the reader to know the extent to which these provisions have been
interpreted in courts in cases that have come their way involving assembly
and association.

Breaking out a paragraph for each treaty provision would highlight each for
the reader and provide the space to include information on how many
countries have actually ratified and thus are bound by the treaty, the
kinds of conflicts that have arisen historically under each provision in
the digital environment, and how those conflicts have been resolved.
Organizing the provisions chronologically by when the treaties were
initially signed (signing treaties and ratifying them are two separate
steps) would offer the authors an opportunity to present a sense of a
rising tide of appreciation of the importance of protecting the rights of
assembly and association.

*National Laws*

There is reference to protection of the rights of assembly and association
in national constitutions and laws.  It would strengthen the argument being
made here to provide information on how many geopolitically recognized
states (that is, those recognized by the UN) protect these rights and
trends in this area.  There is discussion by American authors of American
law in the literature review, by European Union groups about European law,
and about international law -- can literature about national law by
non-American authors about non-American treatment of assembly and
association also be included?

*Jurisprudence*

The word "jurisprudence" shows up towards the close of the piece but
jurisprudence is actually not discussed here.  An analysis of how courts
have treated assembly and association in the digital environment would be
invaluable.  There is a significant scholarly literature on this (that
could usefully be expanded), but it is strongly recommended that the
authors also actually go to the court opinions, which are themselves
sources of law as well and thus included in this section of these comments.

*Corporate Social Responsibility*

The issue of the relative importance of the private sector in many of the
factors affecting the rights to assembly and association runs throughout
the document.  It is now widely recognized that, effectively, "governance"
now includes not just what governments do, but also the formal and informal
processes, rules, and practices of private sector entities; indeed, ICANN,
the IAB, and the IETF are important examples of this.  The relative
importance of third party intermediaries in facilitating, controlling, or
preventing assembly and association makes this particularly important.
Finally and far from trivially, since so many of those involved in the IETF
are employees of corporations, including attention to this would speak very
directly to them.

It would thus significantly strengthen this document to include a section
on treatment of assembly and association by those who analyze, audit, and
develop best practices (*cum* rules) for private sector entities.  What
does Ranking Digital Rights, for example, have to say about this?  Whether
such entities do or do not explicitly address association and assembly, the
reader wants to know.  This section should look both at what such auditing
and best practice-setting organizations are doing, and at the significant
literature on corporate social responsibility in the digital environment.

*Literature Review*

In my view, so few items are relied upon, with those relied upon quite
heavily, that it is inaccurate to use "literature review" as a
sub-heading.  That is particularly the case since much of the discussion in
this draft's section by that title is actually not about the literature,
but about treaties -- legal authorities, as discussed above.  My personal
preference would be to see the authors taking advantage of more of the
really strong literature in these areas (the gap between what is here and
being comprehensive is very large), but whether or not that is done, I
encourage you to drop the sub-heading. Doing so would be a form of
"defensive writing," warding off an attack before it comes from those who
know the literature in this area and know what is out there that you
haven't taken advantage of.  You can attribute ideas and information from
items you rely on without using the phrase "literature review."

*Concepts*

*Public vs Private*

The tension between the sense of public discursive space and private
ownership of the infrastructure is in the opening of this document and runs
throughout.  However, that is not a binary distinction.  Rather, there is a
spectrum of types of relationships between the two developed long before we
entered the digital world.  In addition to "ownership" as a criterion of
determining what is what, other criteria include "control of the space" and
"history of use" in US law.  (I will discuss US law here as the body of law
which I know best, and also as a body of law that has been particularly
influential globally in areas such as this, but I strongly encourage the
authors to go further in their reading to learn more about how these
distinctions are made elsewhere both by states and in the international
environment -- again, jurisprudence will be invaluable here.)

The distinction as drawn in US law includes not only spaces that are purely
public (e.g., public parks and streets) and purely private (e.g., the
home), but also those that are quasi-public and quasi-private.
Quasi-public spaces are those that are owned and controlled by the public
(the government), but are devoted to very specific uses that courts and
legislatures have said justify restrictions on speech and assembly under
certain conditions.  Jails and military bases are examples of such spaces.
Quasi-private spaces are those that are owned and controlled by private
entities, but have specific uses that are experienced as public by people.
Because of that public dimension of these spaces, owners and/or controllers
must meet certain specific requirements in order to legally restrict speech
and assembly.  Examples of such spaces include shopping malls, company
towns, and fairgrounds.  Courts use the "strict scrutiny" test in either of
these conditions when conflicts over the exercise of rights arise.  Even in
purely public environments, legal systems justify restricting speech under
the kinds of conditions brought up in this document (e.g., threats to
national security) as a question although not discussed.

The concepts of quasi-public and quasi-private space have been used in
analysis of speech and assembly rights in the digital environments.  Over
the last couple of years, additional very interesting arguments are being
put forward to claim things like social media data as public rather than
private, drawing on analogues with telecommunications regulation.  The
notion that private entities must serve as "trustees" on behalf of the
public has been used to justify regulating telecommunications companies
since at least the 1930s and is now being discussed in association with
private companies that exert significant control over what we can do
online.  The notion that data about the public should be treated as a
public resource has been put forward in analog with treatment of the
electromagnetic spectrum as a public resource used by private entities.
More can be done here.

All of this is to say that in my view this document would be much stronger
if it unpacked the public/private problem rather than just mentioning it
several times in passing, as the issue of the kind of space involved is so
often important to assembly and association issues.  One place in the text
that invites this kind of unfolding is in your definition of connectivity,
which says it is "the *extent* to which a device or network is able to
reach other devices or networks," suggesting there is a spectrum of
possibilities.

*Assembly and Association*

The authors do a nice job of opening up the question of the distinction
between assembly and association.  The danger of not being very clear about
these concepts runs through some of the cases later discussed, as you don't
want to conflate either of these concepts with simply the right to
communicate.  I encourage the authors to go a further on this front,
drawing on explicit legal formulations in international law and exemplar
national and EU law.

The US government faced great difficulty when trying to figure out who
could be held liable for the massive WikiLeaks data dump that wound up with
Chelsea Manning in prison for a long while and Julian Assange in the
Ecuadorian Embassy in London.  Since autonomous networks don't exist as a
legal subject, efforts to determine accountability ranged from Manning only
all the way through to everyone who had looked at a tweet about the case (
https://ijoc.org/index.php/ijoc/article/view/2668).

You will want to conclude your discussion of assembly and association with
clear rules for how you would distinguish assembly from association in the
digital environment.  Which is WikiLeaks, given the shifting and anonymous
membership?  The distinction between the two matters for how each is
treated by legal systems.  In the case of the Jan. 6, 2021, event at the US
Capitol, legal matters are proceeding with great care to ensure that people
who assembled in the space but were not a part of an association committed
to violence are not treated as if they were a part of that association.
Legal liability for actions goes up in US law, and I'm sure under many
bodies of law, where there is association.  Thus the importance of
"conspiracy," "racketeering," and "collusion" as terms of importance in
resolving legal cases involving, in turn, illegal violent political action,
crime, and competition/antitrust law.

*Cases*

Any selection of cases needs justification.  The authors state at the
opening of the section discussing cases that not all of what is mentioned
is actually addressable at the protocol level that is the business of the
IETF to which this document is directed.  *By doing so, the authors provide
strong, active support for those who insist that the human rights issues
being discussed are just not the business of the IETF.*  I strongly
encourage the authors to include only cases for which they can demonstrate
the role of protocol design and network architecture.  For every such case,
the piece would be much stronger if an actual recommendation regarding
alternative choices for protocol design or network architecture are
offered. Dave Clark's *Designing an Internet* provides a superb model for
how this kind of linkage between the two kinds of concerns can be drawn.

*Writing Issues*

"Assembly" and "association" should be included among the terms defined at
the opening of the piece.

The pertinence of the cases will be more clear to the reader if you are
explicit in each one just how assembly or association are involved.

Bring the three separate notes on what the Internet is together into an
internally coherent paragraph.

The cases rely too much on quotes.

The reference list should include full citations in addition to links for
professionalism, and needs some cleaning up.

There are a number of word use, punctuation, and grammatical errors
throughout.

This draft concludes with some high-level statements and then all of a
sudden turns to introducing a new issue.  You can find a better close.

*Utility for IETF Readers*

Assuming you would like this to be actually used by IETF participants, can
you include, in the conclusion, a checklist of things that those involved
in protocol design and network architecture can actually look out for in
the course of their work?