Subject: Re: [hrpc] I-D Action: draft-irtf-hrpc-guidelines-06.txt

From: John Curran <[email-masked]>
Date: Wed, 3 Mar 2021 05:34:25 -0500

On 22 Feb 2021, at 1:42 PM, Gurshabad Grover <[email-masked] <mailto:[email-masked]>> wrote:
> ...
> - discuss whether current text on attribution/legal remedy captures rg
> consensus [2]

Gurshabad - 

	Thanks for working on this!  

	It’s unclear if the revised text represents consensus, but it does introduce a significant new concept to the document.

	Specifically, the new statement - 
	
> Considering the adverse impact of attribution on the right to privacy and freedom of expression, enabling attribution on an individual level is probably not consistent with human rights.

	presumes that the goal of the document is to advocate for consistency with regard to a specific set of human rights (a set which does not include right to remedy), rather than providing guidance as to "whether the protocol adequately takes specific human rights threats into account.”  If that’s the case, then it’s probably best to be upfront about it and specify the preferred set of human rights and omit the attribution section completely.  

	If the goal remains to provide guidance that helps protocol authors consider the implications of their decisions on specific human rights, then the prior text did a much better job of it – despite making some readers uncomfortable.

Thanks again,
/John

---

From: Eliot Lear <[email-masked]>
Date: Wed, 3 Mar 2021 12:16:59 +0100

I largely agree with John, but there may also a simpler fix to this text:

> On 3 Mar 2021, at 11:34, John Curran <[email-masked]> wrote:
> 
OLD

> > Considering the adverse impact of attribution on the right to privacy and freedom of expression, enabling attribution on an individual level is probably not consistent with human rights.

NEW

> Considering the adverse impact of attribution on the right to privacy and freedom of expression, enabling attribution on an individual level may not be not consistent with those particular human rights.[cite if you can]

---

From: John Curran <[email-masked]>
Date: Wed, 3 Mar 2021 06:22:27 -0500

Yes - that would be excellent adjustment that retains the essence of the point without excess generalization.

Thanks Eliot!
/John

> On 3 Mar 2021, at 6:16 AM, Eliot Lear <lear=[email-masked]> wrote:
>

---

From: farzaneh badii <[email-masked]>
Date: Wed, 3 Mar 2021 07:21:33 -0500

Hello Gurshabad,

We discussed attribution some weeks ago again. We had some disagreement on
adding attribution and seems like I was not in the rough.

Mallory made a suggestion as to how to fix attribution:
“ My suggestion to resolve the text is simply to minimise and make it
netral. Perhaps something on attribution needs to be there as a reference
to what is already in RFC 8280 and, even better, to serve as a pointer to
future work that might deepen our collective understanding of attribution
and protocols, even if that more thorough research uncovers restraint as a
best practice.”

I think we should find ways to implement the above suggestion.

****
I can’t attend the meeting of HRPC. I have heard I need to pay a
registration fee which I can’t afford for one session.

So I just have to reiterate my objection to adding attribution to this
document.

I am not convinced at all that attribution provides you with access to
legal remedy. Attribution methods have have the potential to violate
people’s rights. One was a protocol that was not even designed for
“attribution” in a way it was used by security researchers but they did use
it for attribution and the law enforcement agencies and cybersecurity
researchers insisted on keeping WHOIS open meaning publishing personal
private information for 20 years because they simply could not come up with
a more creative way than to use people’s personal information to
“attribute” cyber attack. With the intellectual property and business
constituencies backing them up.

They are still insisting at ICANN that there should be a distinction
between natural and legal persons which has no rational other than
publishing more registrant information online instead of legitimately
requesting that data be disclosed to them. They even use the old argument
that businesses know better, because they are business savvy! Without even
thinking that legal persons might not be only businesses but vulnerable
orgs that are in danger of getting murdered. When we talk about the
Internet we have to think about the world. In some countries they still
have the death penalty for homosexuals. They still have political
prisoners. They still kill people in the name of national security. What
access to legal remedy are we talking about! Whose access to legal remedy?

And we know instances of attribution that was a mistake and cost the
defendant their freedom. Adding attribution to this document will not help
human rights and will legitimize unaccountable attribution practices that
violate people’s rights even today! I suggest rephrasing extensively and
make it neutral and not make it sound it’s a settled issue.

On Wednesday, March 3, 2021, John Curran <[email-masked]> wrote:

> Considering the adverse impact of attribution on the right to privacy and
> freedom of expression, enabling attribution on an individual level *may
> not be* not consistent with *those particular *human rights.[cite if you
> can]
>
>
>
>

-- 
Farzaneh

---

From: Colin Perkins <[email-masked]>
Date: Wed, 3 Mar 2021 12:49:07 +0000

> On 3 Mar 2021, at 12:21, farzaneh badii <[email-masked]> wrote:
...
> I can’t attend the meeting of HRPC. I have heard I need to pay a registration fee which I can’t afford for one session.

Since it’s perhaps not widely known: there’s a fee waiver available for IETF meetings for those whom the registration fee is a barrier to entry. This is available by following the Fee Waiver link in the Registration section of https://www.ietf.org/how/meetings/110/ <https://www.ietf.org/how/meetings/110/> 

IRTF meeting that colocate with the IETF, such as the upcoming HRPC meeting, are included.

Colin

-- 
Colin Perkins
https://csperkins.org/