Subject: [hrpc] My suggestion for the attribution paragraph

From: farzaneh badii <[email-masked]>
Date: Thu, 11 Mar 2021 12:49:36 -0500

Seems like the suggestion I made did not come through because I
strike-through
 that didn't appear on the mailing list archive so I took a screenshot of
the changes I suggested which is attached.

I will rewrite it here.
Farzaneh

---

From: Gurshabad Grover <[email-masked]>
Date: Thu, 11 Mar 2021 23:30:13 +0530

Thanks, Farzaneh.

I was referring to these suggestions (which came through well to my mail
at least), which I mostly incorporated. I realised from your chat
messages during hrpc today that you were highlighting the importance of
removing the reference to 'law enforcement agencies'. Taking that and
the recent suggestions into account, would this text be fine?

"""
Question(s): Can your protocol facilitate a negatively impacted party's
right to the appropriate remedy without disproportionately impacting
other parties' human rights, especially their right to privacy?

Explanation: Attribution (i.e. mechanisms in protocols or architectures
that are designed to make communications or artifacts attributable to a
certain computer or individual) may help victims of crimes in seeking
appropriate remedy.  However, attribution mechanisms may impede the
exercise of the right to privacy.  The Special Rapporteur for Freedom of
Expression has also argued that anonymity is an inherent part of freedom
of expression. [Kaye] Considering the adverse impact of attribution on
the right to privacy and freedom of expression, enabling attribution on
an individual level may not be consistent with those particular human
rights.
"""

On a finer point: I do not think that it is appropriate to remove 'the
right to remedy' from the 'Impacts' section, because it is precisely
what this section about (regardless of the final position it takes).

-Gurshabad

On 3/11/21 11:19 PM, farzaneh badii wrote:
> Screen Shot 2021-03-11 at 12.44.34 PM.png
>  that didn't appear on the mailing list archive so I took a screenshot
> of the changes I suggested which is attached.
> 
> I will rewrite it here. 
> Farzaneh
> 
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: farzaneh badii <[email-masked]>
Date: Thu, 11 Mar 2021 13:34:09 -0500

Thank you Gurshabad,

Yes this is fine, though I would have removed "may.. be" from the following
sentence and replace it with "is".
attribution on an individual level [may] *is not [*be] consistent with
those particular human rights.  and would have removed individual from "i.e.
mechanisms in protocols or architectures
that are designed to make communications or artifacts attributable to a certain
computer* or individual)*"

I can't think of a text that captures Mallory's suggestion right now but I
am not insistent on further changes to be applied. So don't want to hold
you back.
All good and thank you for your hard and excellent work.

An annoying P.S.: just for the record I hope this paragraph does not
encourage protocol developers to design protocols that can attribute
certain action to an individual or lead to identification of people. I hope
it doesn't legitimize attribution using protocols, with no accountability
or checks and balances. Attribution features can be abused. I still don't
think attribution should have been included at all, but that ship has
sailed. So, I compromise.

Farzaneh

---

From: Mark Perkins <[email-masked]>
Date: Fri, 12 Mar 2021 08:27:25 +1100

An annoying P.S.: just for the record I hope this paragraph does not 
encourage protocol developers to design protocols that can attribute 
certain action to an individual or lead to identification of people. I 
hope it doesn't legitimize attribution using protocols, with no 
accountability or checks and balances. Attribution features can be 
abused. I still don't think attribution should have been included at 
all, but that ship has sailed. So, I compromise.

MP>> This is exactly my fear, excepting that I disagree that "that ship 
has sailed", and am still not sure that consensus has been reached on 
this issue...

Mark P.

Le 12/03/2021 à 05:34, farzaneh badii a écrit :
> Thank you Gurshabad,
>
> Yes this is fine, though I would have removed "may.. be" from the 
> following sentence and replace it with "is".
> those particular human rights.  and would have removed individual from 
> "i.e. mechanisms in protocols or architectures
> that are designed to make communications or artifacts attributable to 
> acertain computer*or individual)*"
>
> I can't think of a text that captures Mallory's suggestion right now 
> but I am not insistent on further changes to be applied. So don't want 
> to hold you back.
> certain action to an individual or lead to identification of people. I 
> hope it doesn't legitimize attribution using protocols, with no 
> accountability or checks and balances. Attribution features can be 
> abused. I still don't think attribution should have been included at 
> all, but that ship has sailed. So, I compromise.
>
>
>
> Farzaneh
>
>
> On Thu, Mar 11, 2021 at 1:00 PM Gurshabad Grover 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     Thanks, Farzaneh.
>
>     > [email-masked] <mailto:[email-masked]>
>     <https://www.irtf.org/mailman/listinfo/hrpc>
>     >
>
>

-- 
L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast.
https://www.avast.com/antivirus

---

From: farzaneh badii <[email-masked]>
Date: Tue, 16 Mar 2021 08:18:45 -0400

Thank you Mark.
If that is the case, then perhaps we shouldn’t add this paragraph. I had
suggested it and still support that approach.

On Thursday, March 11, 2021, Mark Perkins <marknoumea=40yahoo.com@dmarc.
ietf.org> wrote:

> has sailed", and am still not sure that consensus has been reached on this
> issue...
>
> Mark P.
> hrpc mailing [email-masked]://www.irtf.org/mailman/listinfo/hrpc
>
>
>
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> Garanti
> sans virus. www.avast.com
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
> <#m_140600057450132848_m_-6419674917296323565_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>

-- 
Farzaneh

---

From: Eliot Lear <[email-masked]>
Date: Tue, 16 Mar 2021 13:41:18 +0100

Hi,

I really don’t know what you are expecting.  What is your risk tolerance?  A fork can be a dangerous instrument, and not having attribution can lead to awkward questions like, “Why didn’t you credit my account for a payment my bank sent you?”  OAUTH, SAML, AAA, and a host of other tools will allow for attribution.  For some it’s a primary feature.

The concern shouldn’t be that the ship sailed, but rather that it not run aground.

Eliot

> On 11 Mar 2021, at 22:27, Mark Perkins <marknoumea=[email-masked]> wrote:
> 
> An annoying P.S.: just for the record I hope this paragraph does not encourage protocol developers to design protocols that can attribute certain action to an individual or lead to identification of people. I hope it doesn't legitimize attribution using protocols, with no accountability or checks and balances. Attribution features can be abused. I still don't think attribution should have been included at all, but that ship has sailed. So, I compromise.
> 
> MP>> This is exactly my fear, excepting that I disagree that "that ship has sailed", and am still not sure that consensus has been reached on this issue...
> 
> Mark P.
> 
>> Yes this is fine, though I would have removed "may.. be" from the following           sentence and replace it with "is".
>> attribution on an individual level [may] is not [be] consistent with those particular human rights.  and would have removed individual from "i.e. mechanisms in protocols or architectures
>> that are designed to make communications or artifacts attributable to a certain computer or individual)"
>> 
>> I can't think of a text that captures Mallory's suggestion right now but I am not insistent on further changes to be applied. So don't want to hold you back.
>> An annoying P.S.: just for the record I hope this paragraph does not encourage protocol developers to design protocols that can attribute certain action to an individual or lead to identification of people. I hope it doesn't legitimize attribution using protocols, with no accountability or checks and balances. Attribution features can be abused. I still don't think attribution should have been included at all, but that ship has sailed. So, I compromise.
>> 
>> 
>> 
>> Farzaneh
>> 
>> 
>> On Thu, Mar 11, 2021 at 1:00 PM Gurshabad Grover <[email-masked] <mailto:[email-masked]>> wrote:
>> Thanks, Farzaneh.
>> 
>> > https://www.irtf.org/mailman/listinfo/hrpc <https://www.irtf.org/mailman/listinfo/hrpc>
>> >
>> 
>> 
>> https://www.irtf.org/mailman/listinfo/hrpc <https://www.irtf.org/mailman/listinfo/hrpc>
> 
>  <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>	Garanti sans virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> <x-msg://12/#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>_______________________________________________
> hrpc mailing list
> [email-masked]

---

From: John Curran <[email-masked]>
Date: Tue, 16 Mar 2021 09:20:33 -0400

Mark - 

The fact that protocol support for attribution is important to support some human rights (i.e. the right to legal remedy) 
but poses important concerns regarding potential implications for other rights would seem to me to argue more strongly on the need for its inclusion in the guidelines rather than its omission, However, I’ll admit that I haven’t done direct protocol development in more than two decades and lacking as I am in recent first-hand experience, I'll leave it to this group to decide as it deems best. 

All I do ask is that the IETF document be accurate regarding scope – i.e. if there is a determination to omit inclusion of some human rights from the guidelines because they are inconvenient, then the document should clearly indicate that it provides guidelines for _select_ human rights (and this would also suggest that the language "this is by no means an attempt to exclude specific rights or prioritize some rights over others. If other rights seem relevant, please contact the authors.” should probably be struck.)  I think this would be major step backward (and do not recommend such an approach), but see no other way to address your concerns about the potential risk to inexperienced protocol developers being led astray by the inclusion of the right to legal remedy.

Thanks,
/John

> On 11 Mar 2021, at 4:27 PM, Mark Perkins <marknoumea=[email-masked]> wrote:
> 
>  <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>	Garanti sans virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> <x-msg://4/#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>_______________________________________________
> hrpc mailing list
> [email-masked]

---

From: Mallory Knodel <[email-masked]>
Date: Fri, 19 Mar 2021 10:26:14 -0400

> but poses important concerns regarding potential implications for other rights would seem to me to argue more strongly on the need for its inclusion in the guidelines rather than its omission, Howe…

I agree-- it would be odd to leave it out, especially when we've taken 
the opportunity to discuss it in depth.

If we need a deeper dive into the discussion at a later time, let's do 
that. But we can't simply erase in the document that this group of 
experts has discussed it. We don't actually need to have full consensus, 
but a succinct summary barring a value judgement shouldn't be so 
objectionable.

-Mallory

>> On 11 Mar 2021, at 4:27 PM, Mark Perkins<marknoumea=[email-masked]>  wrote:
>>
>>   <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>	Garanti sans virus.www.avast.com  <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>  <x-msg://4/#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>_______________________________________________
>> hrpc mailing list
>> [email-masked]

-- 
Mallory Knodel
CTO, Center for Democracy and Technology
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780

---

From: farzaneh badii <[email-masked]>
Date: Fri, 19 Mar 2021 11:24:11 -0400

We have raised the problem of cherry-picking in previous papers when
criticizing the approach of HRPC, but in this case I don't think
cherry-picking is involved. Your framing [attribution results in or can
help with legal remedy] is problematic because it brings jurisdictional
issues to this document. What legal remedy, based on which law? I heard
that people were saying we are not trying to bring one set of legal systems
into the discussion. And it's not even clear how you can create a direct
link between attribution and legal remedy. Access to legal remedy in the
human rights law field does not mean that a private protocol developer
helps victims or law enforcement with gathering evidence! Help with
gathering evidence does not result in legal remedy. Access to legal remedy
is much more nuanced than that.

I think we just did not discuss this issue carefully for the past couple of
years. We didn't have legal experts and human rights law experts that could
analyze this in depth and give us their perspective. I am very concerned
about including this paragraph. I tried to help with revising it so it is
not that I want to stop progress but as I have said, this paragraph can be
potentially against human rights more than for it.

Farzaneh

On Tue, Mar 16, 2021 at 9:20 AM John Curran <[email-masked]> wrote:

> Mark -
>
> The fact that protocol support for attribution is important to
> support some human rights (i.e. the right to legal remedy)
> but poses important concerns regarding potential implications for other
> rights would seem to me to argue more strongly on the need for its
> inclusion in the guidelines rather than its omission, However, I’ll admit
> that I haven’t done direct protocol development in more than two decades
> and lacking as I am in recent first-hand experience, I'll leave it to this
> group to decide as it deems best.
>
> All I do ask is that the IETF document be accurate regarding scope – i.e.
> if there is a determination to omit inclusion of some human rights from the
> guidelines because they are inconvenient, then the document should clearly
> indicate that it provides guidelines for _select_ human rights (and this
> would also suggest that the language "this is by no means an attempt to
> exclude specific rights or prioritize some rights over others. If other
> rights seem relevant, please contact the authors.” should probably be
> struck.)  I think this would be major step backward (and do not recommend
> such an approach), but see no other way to address your concerns about the
> potential risk to inexperienced protocol developers being led astray by the
> inclusion of the right to legal remedy.
>
> Thanks,
> /John
>
>
> On 11 Mar 2021, at 4:27 PM, Mark Perkins <
> marknoumea=[email-masked]> wrote:
>

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 19 Mar 2021 16:52:24 +0100

Dear Farzaneh,

On 19-03-2021 16:24, farzaneh badii wrote:
> We have raised the problem of cherry-picking in previous papers when criticizing the approach of HRPC, but in this case I don't think cherry-picking is involved. 

So I guess this means that it is not an issue?

Your framing [attribution results in or can help with legal remedy] is problematic because it brings jurisdictional issues to this document.

It is a core component of the UN Guiding Principles for Human Rights. This is not necessarily part of jurisdiction. Remedy does not necessarily need to be offered by a state.

 What legal remedy, based on which law? 

As described, UNGPs. Have a look here: https://www.ohchr.org/EN/Issues/Business/Pages/AccessToRemedy.aspx

I heard that people were saying we are not trying to bring one set of legal systems into the discussion. And it's not even clear how you can create a direct link between attribution and legal remedy. Access to legal remedy in the human rights law field does not mean that a private protocol developer helps victims or law enforcement with gathering evidence!

Organizations that develop and deploy protocols do have responsibilities and this questionnaire is a way of considering them in different contexts. 

> Help with gathering evidence does not result in legal remedy. Access to legal remedy is much more nuanced than that. 
> 
> I think we just did not discuss this issue carefully for the past couple of years. We didn't have legal experts and human rights law experts that could analyze this in depth and give us their perspective. 

By saying this you're not doing justice to the lawyers and human rights experts that have weight in and advised on this. 

I am very concerned about including this paragraph. I tried to help with revising it so it is not that I want to stop progress but as I have said, this paragraph can be potentially against human rights more than for it.

According to you it would be harmful for human rights to say write that 'using protocols to achieve remedy and attribution on an individual level is probably not consistent with human rights' ?

Best,

Niels

> 
> 
> 
> 
> 
> 
> 
> 
> Farzaneh
> 
> 
> On Tue, Mar 16, 2021 at 9:20 AM John Curran <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     Mark - 
> 
>>     On 11 Mar 2021, at 4:27 PM, Mark Perkins <marknoumea=[email-masked] <mailto:marknoumea=[email-masked]>> wrote:
>>
>>>     attribution on an individual level [may] *is not [*be] consistent with those particular human rights.  and would have removed individual from "i.e. mechanisms in protocols or architectures
>>>     that are designed to make communications or artifacts attributable to acertain computer*or individual)*"
>>>
>>     <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient> 	Garanti sans virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
>>

-- 
Niels ten Oever, PhD
Postdoctoral Researcher - Media Studies Department - University of Amsterdam
Research Fellow - Centre for Internet and Human Rights - European University Viadrina
Associated Scholar - Centro de Tecnologia e Sociedade - Fundação Getúlio Vargas

https://nielstenoever.net - [email-masked] - @nielstenoever - +31629051853
PGP: 2458 0B70 5C4A FD8A 9488 643A 0ED8 3F3A 468A C8B3

Read my latest article on Internet infrastructure governance in New Media & Society here: https://journals.sagepub.com/doi/full/10.1177/1461444820929320

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 19 Mar 2021 16:57:00 +0100

Might it be that the discussion arises from the way attribution is used within the cybersecurity debate? Because here it has a very different meaning. 

Best,

Niels

On 19-03-2021 16:24, farzaneh badii wrote:
> We have raised the problem of cherry-picking in previous papers when criticizing the approach of HRPC, but in this case I don't think cherry-picking is involved. Your framing [attribution results in or can help with legal remedy] is problematic because it brings jurisdictional issues to this document. What legal remedy, based on which law? I heard that people were saying we are not trying to bring one set of legal systems into the discussion. And it's not even clear how you can create a direct link between attribution and legal remedy. Access to legal remedy in the human rights law field does not mean that a private protocol developer helps victims or law enforcement with gathering evidence! Help with gathering evidence does not result in legal remedy. Access to legal remedy is much more nuanced than that. 
> 
> I think we just did not discuss this issue carefully for the past couple of years. We didn't have legal experts and human rights law experts that could analyze this in depth and give us their perspective. I am very concerned about including this paragraph. I tried to help with revising it so it is not that I want to stop progress but as I have said, this paragraph can be potentially against human rights more than for it.
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Farzaneh
> 
>

---

From: Mark Perkins <[email-masked]>
Date: Sat, 20 Mar 2021 09:49:07 +1100

Niels

I think that this could be a factor.

A few points;

Attribution (whichever meaning) does not equal remedy

Attribution is an argument many governments are using against anonymity 
(India)  and end to end encryption (EU)

Banks ensure payments over Internet via apps rather than underlying 
protocol; even on their proper network (ATM), payments are assured by 
law rather than protocol (given that banks had a poor track record...)

'Baking' attribution in at protocol level to aid with 'remedy' I fear 
will undermine the very human rights it is meant to help - something 
that human rights law is explictly opposed to (no right may be used to 
undermine / annul other rights)

While I am opposed to including 'attribution', I understand that this 
may be a minority position; if it is included I think the paragraph 
should be much more nuanced, including the problems mentioned by myself  
others

Mark P.

Le 20/03/2021 à 02:57, Niels ten Oever a écrit :
>>>      <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>  	Garanti sans virus.www.avast.com  <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient>
>>>

---

From: Niels ten Oever <[email-masked]>
Date: Sat, 20 Mar 2021 00:04:01 +0100

Excellent - so perhaps we should be dropping 'attribution' from the title and make a rewrite to focus on 'remedy'. I hope that will then fix the discussion. 

Would that approach make sense to you (specifically asking Mark, Farzaneh, and John :) )?

Best,

Niels

On 19-03-2021 23:49, Mark Perkins wrote:
> Attribution is an argument many governments are using against anonymity (India)  and end to end encryption (EU)
> 
> Banks ensure payments over Internet via apps rather than underlying protocol; even on their proper network (ATM), payments are assured by law rather than protocol (given that banks had a poor track record...)
> 
> 'Baking' attribution in at protocol level to aid with 'remedy' I fear will undermine the very human rights it is meant to help - something that human rights law is explictly opposed to (no right may be used to undermine / annul other rights)
> 
> While I am opposed to including 'attribution', I understand that this may be a minority position; if it is included I think the paragraph should be much more nuanced, including the problems mentioned by myself  others
> 
> Mark P.
> 
>>>>>          > Seems like the suggestion I made did not come through because I
>>>>>          > strike-through
>>>>>          > Screen Shot 2021-03-11 at 12.44.34 PM.png
>>>>>          >  that didn't appear on the mailing list archive so I took a screenshot
>>>>>          > of the changes I suggested which is attached.
>>>>>          >
>>>>>          > I will rewrite it here.
>>>>>          > Farzaneh
>>>>>          >
>>>>>          > _______________________________________________
>>>>>          > hrpc mailing list
>>>>>          >[email-masked]  <mailto:[email-masked]>
>>>>>          >https://www.irtf.org/mailman/listinfo/hrpc  <https://www.irtf.org/mailman/listinfo/hrpc>
>>>>>          >
>>>>>
>>>>>

---

From: farzaneh badii <[email-masked]>
Date: Fri, 19 Mar 2021 21:03:00 -0400

I don’t think that’s an objectionable change.
Thank you.

On Friday, March 19, 2021, Niels ten Oever <[email-masked]> wrote:

> Excellent - so perhaps we should be dropping 'attribution' from the title
> and make a rewrite to focus on 'remedy'. I hope that will then fix the
> discussion.
>
> protocol; even on their proper network (ATM), payments are assured by law
> rather than protocol (given that banks had a poor track record...)
> >
> will undermine the very human rights it is meant to help - something that
> human rights law is explictly opposed to (no right may be used to undermine
> / annul other rights)
> >
> may be a minority position; if it is included I think the paragraph should
> be much more nuanced, including the problems mentioned by myself  others
> >
> > Mark P.
> >
> >> Might it be that the discussion arises from the way attribution is used
> within the cybersecurity debate? Because here it has a very different
> meaning.
> >>
> >> Best,
> >>
> >> Niels
> >>
> >>> I think we just did not discuss this issue carefully for the past
> couple of years. We didn't have legal experts and human rights law experts
> that could analyze this in depth and give us their perspective. I am very
> concerned about including this paragraph. I tried to help with revising it
> so it is not that I want to stop progress but as I have said, this
> paragraph can be potentially against human rights more than for it.
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> Farzaneh
> >>>
> >>>
> >>>      but poses important concerns regarding potential implications for
> other rights would seem to me to argue more strongly on the need for its
> >>>      All I do ask is that the IETF document be accurate regarding
> scope – i.e. if there is a determination to omit inclusion of some human
> rights from the guidelines because they are inconvenient, then the document
> should clearly indicate that it provides guidelines for _select_ human
> rights (and this would also suggest that the language "this is by no means
> an attempt to exclude specific rights or prioritize some rights over
> others. If other rights seem relevant, please contact the authors.” should
> probably be struck.)  I think this would be major step backward (and do not
> recommend such an approach), but see no other way to address your concerns
> about the potential risk to inexperienced protocol developers being led
> astray by the inclusion of the right to legal remedy.
> >>>
> >>>      Thanks,
> >>>      /John
> >>>
> >>>
> >>>>      On 11 Mar 2021, at 4:27 PM, Mark Perkins <marknoumea=
> [email-masked]  <mailto:marknoumea=[email-masked]>>
> wrote:
> >>>>
> >>>>      An annoying P.S.: just for the record I hope this paragraph does
> not encourage protocol developers to design protocols that can attribute
> >>>>      MP>> This is exactly my fear, excepting that I disagree that
> "that ship has sailed", and am still not sure that consensus has been
> reached on this issue...
> >>>>
> >>>>      Mark P.
> >>>>
> >>>>>      Yes this is fine, though I would have removed "may.. be" from
> the following sentence and replace it with "is".
> >>>>>      attribution on an individual level [may] *is not [*be]
> consistent with those particular human rights.  and would have removed
> individual from "i.e. mechanisms in protocols or architectures
> >>>>>      that are designed to make communications or artifacts
> attributable to acertain computer*or individual)*"
> >>>>>
> >>>>>      I can't think of a text that captures Mallory's suggestion
> right now but I am not insistent on further changes to be applied. So don't
> want to hold you back.
> >>>>>      An annoying P.S.: just for the record I hope this paragraph
> does not encourage protocol developers to design protocols that can
> attribute certain action to an individual or lead to identification of
> people. I hope it doesn't legitimize attribution using protocols, with no
> accountability or checks and balances. Attribution features can be abused.
> I still don't think attribution should have been included at all, but that
> ship has sailed. So, I compromise.
> >>>>>
> >>>>>
> >>>>>
> >>>>>      Farzaneh
> >>>>>
> >>>>>
> >>>>>      On Thu, Mar 11, 2021 at 1:00 PM Gurshabad Grover <
> [email-masked]  <mailto:[email-masked]>> wrote:
> >>>>>
> >>>>>          Thanks, Farzaneh.
> >>>>>
> >>>>>          >https://www.irtf.org/mailman/listinfo/hrpc  <
> https://www.irtf.org/mailman/listinfo/hrpc>
> >>>>>          >
> >>>>>
> >>>>>
> >>>>>      https://www.irtf.org/mailman/listinfo/hrpc  <
> https://www.irtf.org/mailman/listinfo/hrpc>
> >>>>      <https://www.avast.com/sig-email?utm_medium=email&utm_
> source=link&utm_campaign=sig-email&utm_content=emailclient>      Garanti
> sans virus.www.avast.com  <https://www.avast.com/sig-
> email?utm_medium=email&utm_source=link&utm_campaign=sig-
> email&utm_content=emailclient>
> >>>>
> >>>>      https://www.irtf.org/mailman/listinfo/hrpc  <
> https://www.irtf.org/mailman/listinfo/hrpc>
> >>>      https://www.irtf.org/mailman/listinfo/hrpc  <
> https://www.irtf.org/mailman/listinfo/hrpc>
> >>>
> >>>
> Read my latest article on Internet infrastructure governance in New Media
> & Society here: https://journals.sagepub.com/doi/full/10.1177/
> 1461444820929320
>

-- 
Farzaneh

---

From: Mark Perkins <[email-masked]>
Date: Sat, 20 Mar 2021 17:45:42 +1100

Hi & thanks Niels

If this replacement can be done great- can we see how that will look?

If we can also insert the principle 'no right may be used to undermine / 
annul other rights', as per Gurshabad Grover's text regarding remedy 
(originally attribution) re privacy/anonymity/freedom of speech, then 
things would be excellent

Regards

Mark P.

---

From: John Curran <[email-masked]>
Date: Sun, 21 Mar 2021 10:34:35 -0400

> It is a core component of the UN Guiding Principles for Human Rights. This is not necessarily part of jurisdiction. Remedy does not necessarily need to be offered by a state.

Agreed - remedy doesn’t necessarily have to be offered by a state, or even be “legal remedy” per se.   However, when an individual suffers harm as a result of communications and has no ability to attribute the harm to the specific perpetrator, it’s fairly clear that their options for legal remedy may be reduced as a result. 

Does a reduction in ability to obtain legal remedy (due to lack of attribution) against someone who has harmed you in communications result in a reduction in your access to human rights?  I’m not immersed in the vernacular of human rights practitioners, but it seems apparent that lack of attribution can readily reduce one’s access to legal remedies. 

> I heard that people were saying we are not trying to bring one set of legal systems into the discussion. And it's not even clear how you can create a direct link between attribution and legal remed…

There is no assertion in the least that support for “gathering evidence” is required.  Rather, inclusion of the attribution capability (and the potential impact on ability to obtain legal remedies when it is not present) suggests that protocol designers might want to give some thought to what other technical measures are provided to help ameliorate harm to users when relying on legal recourse isn’t an option.   Email is a fine example - it’s clear that we lack attribution for most actors in the email space – and thus recourse from harm through tradition law enforcement or civil litigation is rather limited – but we’ve come up with an entire ecosystem for providing various degrees of sender assertion, reputation systems for bulk solicitation protection, etc. 

To some extent, social media networks are doing the very same thing - their lack of true attribution to legal identify of users isn’t necessary “right” or “wrong”, but does mean it is worth giving some thought to how users address harms suffered, as the lack of attribution prevents users as a practical matter from pursuing legal remedies.

Thanks,
/John

p.s.  Disclaimer:  my views alone (no one else would claim them anyway ;-)

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 22 Mar 2021 10:26:04 +0100 (CET)

> Il 20/03/2021 07:45 Mark Perkins <marknoumea=[email-masked]> ha scritto:
> 
>  
> Hi & thanks Niels
> 

This is also true in the opposite direction: if you suffer damage, vital threats, harassment etc. and you cannot get the harasser identified because of their right to anonymity, then anonymity is undermining your right to personal safety. So it's fine to restate in general that rights may often conflict among themselves - and someone's rights with someone else's rights - but that seems quite obvious anyway. If what you are suggesting is instead that some rights should always take precedence over others, then I disagree. 

In terms of advice to protocol designers, the advice should IMHO always be to consider and mediate the impact on all rights when conceiving a new technology, rather than on advancing some to deny others. The document focuses almost entirely on individual rights, less so on the collective right to live safely and under the rule of law, for which attribution is a pre-requisite. In my opinion, the document would need more focus on this latter issue, not less or none, also because this is the real rights problem that technologists face today. It is very easy today to design super-anonymous, super-private protocols; it is much harder to find good ways to preserve privacy while ensuring controlled access to law enforcement under due judicial process when this is necessary to uphold someone else's rights and safety.

-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy