Subject: [hrpc] Censorship

From: Vittorio Bertola <[email-masked]>
Date: Fri, 11 Mar 2022 09:57:59 +0100 (CET)

Hello,

I think that this call for a global, multistakeholder process to block access to Russian military and news websites would be of interest for discussion here.

https://www.pch.net/resources/Papers/Multistakeholder-Imposition-of-Internet-Sanctions.pdf

I don't disagree with the concept, I would actually implement such a blocklist. I am worried that such a structured approach, and some names in the list of signatories, could weaponize the global Internet governance institutions and lead to the final fragmentation of the Internet, but this is not in topic here.

I am however puzzled by how this call could be compatible with the pretty maximalistic approach to Internet censorship that this group (or PEARG, in https://tools.ietf.org/html/draft-irtf-pearg-censorship) has been taking. Possibly, if we applied draft-guidelines to this proposal it would not pass the test.

I would like to understand the line of reasoning under which an ISP blocking access to child sexual abuse material or to phishing websites is a censor, but if a soon-to-be-formed Internet institution decides to block access to Russia Today globally as part of a war, then it's all good.

Was this discussed by the proponents? I'd guess so. Can anyone explain?

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked]  mailto:[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Bill Woodcock <[email-masked]>
Date: Fri, 11 Mar 2022 10:38:35 +0100

> On Mar 11, 2022, at 9:57 AM, Vittorio Bertola <vittorio.bertola=[email-masked]> wrote:
> I think that this call for a global, multistakeholder process to block access to Russian military and news websites

I encourage you to all read it for yourselves, because, as one of the authors and one of the signatories, that’s not what we said.  We said that we believe that the multistakeholder Internet governance community has a responsibility to make its own, more humanitarian, decisions in this realm, because the decisions being made by governments and corporations are enacting collective punishment in that they principally affect civilians, rather than those who wage war.

And, Vittorio, are you saying that all news is propaganda, or that all propaganda is news?  I view both of those propositions as excessively cynical.  The paper says that military and propaganda mechanisms, unlike civilians and non-military governance, are not out-of-scope for humanitarian reasons.  There’s no mention of news.

Russia is the issue at hand today.  A lot was written, and then cut in the editing process, about how one shouldn’t necessarily expect the multistakeholder process to be able to move quickly enough to achieve consensus on the Russia/Ukraine conflict, no matter how clear-cut it might seem.  That what’s important here is that we believe that the decisions being arrived at by governments and corporations are over-broad and not based in human rights philosophy, and thus have outcomes which are unjust.  We have a responsibility to do better.

> I am worried that such a structured approach, and some names in the list of signatories, could weaponize the global Internet governance institutions and lead to the final fragmentation of the Internet.

I’m not sure where to start with this.

First, the signatories of a call for consideration of an issue are unlikely to be the same people who eventually decide, or decide not, to implement it, by and large.

Second, are you advocating for an “unstructured approach?”  Because that’s what we have right now, and it’s a humanitarian disaster, that is, to some degree, cementing domestic Russian support for the conflict.

Third, this is a single Internet governance institution, if it comes into being, not multiple.  Each internet governance institution provides governance solutions in some specific area of the Internet space.  Although this has many technical similarities with the already-well-established IG mechanisms surrounding spam, malware, phishing, and ddos mitigation, it’s clearly recognized by all as being its own, independent decision-making process, and of a radically different scale.  One incident per several years, perhaps, rather than tens of millions per day.

How does ensuring that more civilians have access to the Internet during times of conflict “lead to the final fragmentation of the Internet?”  That seems like pure hyperbole.

> I am however puzzled by how this call could be compatible with the pretty maximalistic approach to Internet censorship that this group (or PEARG, in https://tools.ietf.org/html/draft-irtf-pearg-cen…

Indeed, this, and most forms of sanction, certainly including all the broader Internet sanctions already in effect, which this is intended to replace, would not pass a test of not-being-censorship.  Pretty much any sanction is also censorship.  This is governance: the weighing and balancing of competing interests.  Sanctions are deescalatory, non-kinetic, punishments, intended to walk aggressors back from actions which threaten society.  If aggressors face no consequences, they’re encouraged in their transgressions.  This is all very mature governance, at a national level. Our goal here is to prevent the humanitarian crisis that’s precipitated by poor understanding of Internet technology on the part of those presently implementing sanctions.  Sanctions which are implemented from a human rights perspective, rather than an all-or-nothing retaliatory perspective, will do less harm.  Narrower sanctions have fewer unintended consequences than broader ones.  This is an effort to narrow the scope of sanctions.

> I would like to understand the line of reasoning under which an ISP blocking access to child sexual abuse material or to phishing websites is a censor, but if a soon-to-be-formed Internet instituti…

Again, that’s a mischaracterization, and conflating disparate issues.

All of that is censorship.  Censorship is bad.  Murdering and raping civilians and destroying their homes and livelihoods is worse.  Governance is recognizing when a trade-off of a worse thing for a bad thing is achievable, and acting swiftly to enact it, to save lives.  Allowing people to continue dying, to preserve one’s self-image as “someone who takes a hard line against censorship” is immoral.

Sanctions are not “part of war.”  Sanctions are an alternative to war.  Military law is kind of an abomination of excuses and whitewashing, but it’s long-established, and not something any of us are going to overturn, no matter the very good work of the GCSC, etc.  Military law certainly allows the targeting of Russia Today, but that’s a military action by a military.  That’s cyber-offense.  I don’t do or support cyber-offense.

Choosing not to route packets to something is a commercial, or moral, or ideological, or governance decision.  Russia Today is not “owed anything” by ISPs of whom it is not a customer, and they’re under no obligation to spend their money supporting it.  Choosing not to spend that money to support it is not an act of war.  It’s a choice, in this case to not subsidize the propaganda effort supporting Russian militarism.

                                -Bill

---

From: Vittorio Bertola <[email-masked]>
Date: Fri, 11 Mar 2022 10:59:36 +0100 (CET)

> Il 11/03/2022 10:38 Bill Woodcock <[email-masked]> ha scritto:
> 
>  
> I encourage you to all read it for yourselves, because, as one of the authors and one of the signatories, that’s not what we said. 

Indeed people should read it, that's why it was linked.

Now, thanks for your reply - the document itself calls for a public discussion, though it does not specify where. I am afraid that most of the points you raise could be off topic for this group, but if the chairs think differently, I am happy to continue the discussion in detail here. Or, I am happy to join the public discussion wherever the signatories want it to happen.

The only point that IMHO is in topic for this group is that if all Internet protocols and services were designed in the way we advise in draft-guidelines, then the sanctions proposed by the document would be technically impossible; that seemed to me like something that we should discuss.

Perhaps we should recognize in draft-guidelines that, after all, censorship is sometimes desirable and there should be technical and policy hooks to implement it; so protocol designers should rather think at how to address this need while preventing such practices from becoming overbroad. I would be much in favour of this, as I do think that censorship is sometimes desirable, including in this case; but this did not seem to be the consensus of this group (and of PEARG) in the past.

-- vb.

---

From: Bill Woodcock <[email-masked]>
Date: Fri, 11 Mar 2022 12:05:25 +0100

> On Mar 11, 2022, at 10:59 AM, Vittorio Bertola <[email-masked]> wrote:
> 
> 
> 

Thank you, I appreciate that, and I appreciate that you’re arguing in good faith, as I’ve always observed you to do before.  I respect your opinion, and I want to make sure that both you understand what the goals of the letter were, and that I understand your objections or considerations.

> The document itself calls for a public discussion, though it does not specify where.  I am happy to join the public discussion wherever the signatories want it to happen.

I don’t believe any of us had any thought that we had any authority to dub anywhere the “correct” place.  But I think that, more specifically, we all share the view that Internet multistakeholder governance is bottom-up and non-exclusionary.  So there is no “wrong place” except perhaps forums that, as you point out, may deem it off-topic:

> The points you raise could be off topic for this group, but if the chairs think differently, I am happy to continue the discussion in detail here.

I as well, and I believe there are other signatories and authors on this list.  Also happy to try to constrain discussion here to aspects which lie at the intersection of the thoughts we expressed and the topic of this list.

> If all Internet protocols and services were designed in the way we advise in draft-guidelines, then the sanctions proposed by the document would be technically impossible

Can you explain that in more detail?  As someone who works in this field, and who has read https://datatracker.ietf.org/doc/draft-irtf-hrpc-guidelines/ it is not clear to me what portion of the proposed mechanism you believe would be made impossible.  Or for that matter, touched at all.  If you can direct me to something specific, I can give a more considered response.

> Perhaps we should recognize in draft-guidelines that, after all, censorship is sometimes desirable and there should be technical and policy hooks to implement it; so protocol designers should rathe…

I feel that others in this group have far deeper intellectual backgrounds upon which to draw on this topic.  Myself, I feel that it’s self-evident that there’s a moral imperative to choose the lesser of two possible evils, when one is compelled to make a choice on behalf of another.  That is, when one is making a choice with consequences only for one’s self, one is free to suffer a greater evil in order to support a rhetorical point.  But when the sacrifice is someone else’s, doing so is anathema.

If viewed in this light, _sufficiently constrained_ sanctions are the proper choice.  They may involve some minor sacrifice on the parts of some actors (if, for example, they are selling services to the Russian military, as Cloudflare recently reiterated their commitment to continuing to do), but relative to kinetic warfare and atrocities, it is an essentially deescalatory response, which is good.  It shows moral conviction and provides some allyship with victims, while simultaneously removing subsidies (in the form of societally-borne common costs) from the aggressor.  This is shunning, or outlawing, as Icelandic law established more than a thousand years ago. If someone flagrantly transgresses societal norms, they cannot expect to benefit from societally-provided goods, at society’s common expense.

Removing Russian military routes from our routing tables reduces a collective cost to society, and transfers those costs back to the Russian military and those who are selling them services, to carry individually.

You raised, initially, the question of whether this constituted “censorship.”  I would distinguish between individual efforts which have the effect of being in the direction of censorship, versus censorship as a measured effect.  The Internet famously “routes around damage” and “censorship is indistinguishable from damage.”  Thus if a network chooses to no longer carry Russian military routes, the Russian military has not been disconnected from the Internet… they simply have to carry a greater share of the cost of their connection individually, and leave less of the cost to be shared communally.  Every single one of some thirty thousand networks would have to withdraw Russian military routes before they became truly unreachable.  So in that sense, I would actually disagree that this is censorship, in that it’s not truly effective as censorship.  It is exactly effective as a sanction, however, since the sanction is intended to transfer the costs of aggressors’ actions back into their own wallets.

                                -Bill

---

From: Eliot Lear <[email-masked]>
Date: Fri, 11 Mar 2022 13:00:00 +0100

Bill,

The reason I believe that this RG is an appropriate venue to discuss 
your communique is that each of the assertions you and others make seem 
to me closer to research questions.  Full disclosure: my own view is 
that *if* the Internet community could effectively contribute to forcing 
Russia out of Ukraine, we have a moral obligation to do so.  However, I 
don't believe we can effectively contribute to that goal at the 
governance level, and maybe not at any other level.

Your assertions are:

>  *
>
>     ● Disconnecting the population of a country from the Internet is a
>     disproportionate and inappropriate sanction, since it hampers
>     their access to the very information that might lead them to
>     withdraw support for acts of war and leaves them with access to
>     only the information their own government chooses to furnish.
>
This is indeed the theory.  Nothing like a live experiment to test it.  
Anyone collecting data?

>  *
>
>     ● The effectiveness of sanctions should be evaluated relative to
>     predefined goals. Ineffective sanctions waste effort and willpower
>     and convey neither unity nor conviction.
>
There's a lot of devil hidden in the detail of "predefined goals", and 
there is a body of research around this.  Also, it doesn't follow that 
ineffective sanctions fail to convey unity or conviction.  If the goal 
is to get Russia out of Ukraine and they don't leave, does that mean 
that the west has failed to convey conviction?

>  *
>
>     ● Sanctions should be focused and precise. They should minimize
>     the chance of unintended consequences or collateral damage.
>     Disproportionate or over-broad sanctions risk fundamentally
>     alienating populations.
>
Again, there is a body of research around this.

>  *
>
>     ● Military and propaganda agencies and their information
>     infrastructure are potential targets of sanctions.
>
Is this meant to be an exclusive list?

>  *
>
>     ● The Internet, due to its transnational nature and
>     consensus-driven multistakeholder system of governance, currently
>     does not easily lend itself to the imposition of sanctions in
>     national conflicts.
>
I have my own view as to why this is true.  But it may be worth 
elaborating in detail.

>  *
>
>     ● It is inappropriate and counterproductive for governments to
>     attempt to compel Internet governance mechanisms to impose
>     sanctions outside of the community’s multistakeholder
>     decision-making process.
>
Yeah, this requires a discussion of supremecy and subservience. Who is 
supreme and why and where are the guns to back that up?

>  *
>
>     ● There are nonetheless appropriate, effective, and specific
>     sanctions the Internet governance community may wish to consider
>     in its deliberative processes.
>
Elaborate.

---

From: Bill Woodcock <[email-masked]>
Date: Fri, 11 Mar 2022 13:47:51 +0100

> On Mar 11, 2022, at 1:00 PM, Eliot Lear <[email-masked]> wrote:
> The reason I believe that this RG is an appropriate venue to discuss your communique is that each of the assertions you and others make seem to me closer to research questions.

Thank you.  If we stray outside the range of what you consider appropriate, please say so.

> My own view is that if the Internet community could effectively contribute to forcing Russia out of Ukraine, we have a moral obligation to do so.  However, I don't believe we can effectively contribute to that goal at the governance level, and maybe not at any other level.

Well, I think the question isn’t an absolute one… the question isn’t whether the Internet community can force Russia out of Ukraine.  The question is whether the Internet community can effect sanctions that act appropriately and effectively as sanctions in the general case where sanctions are being applied.  My suspicion is that the Internet community will be considerably more conservative about the application of sanctions than individual governments are.  But in cases of humanitarian crisis, the Internet community may also be quicker to act, or more willing to act on things that governments are hesitant to, lest they disrupt their westphalianism and open themselves to criticism as well.

So, not “can we stop Russia” but “can we place some of the societally-shared costs of Russia’s military connectivity back in their laps, and in the laps of those who are profiting from selling them services?”  Sanctions aren’t absolute, they build friction, a little at a time.

> Your assertions are:
> 
> 
>> 	• ● Disconnecting the population of a country from the Internet is a disproportionate and inappropriate sanction, since it hampers their access to the very information that might lead them to withdraw support for acts of war and leaves them with access to only the information their own government chooses to furnish.
> 
> This is indeed the theory.  Nothing like a live experiment to test it.  Anyone collecting data?

John Kristoff is leading the team that’s instrumenting the technical effects of this particular mechanism.  But that’s a technical measurement, not a geopolitical/economic/societal measurement.  Those are more difficult to do in concrete terms, and I’m _way_ out of my depth there.  One of my weaknesses is that I often suspect most everybody else is as well, at least in quantitative terms.

>> 	• ●  The effectiveness of sanctions should be evaluated relative to predefined goals. Ineffective sanctions waste effort and willpower and convey neither unity nor conviction.
> 
> There's a lot of devil hidden in the detail of "predefined goals", and there is a body of research around this.

There was a lot of text about governments having hundreds or thousands of years of experience in enacting sanctions, and the Internet community just coming in now, and acknowledging that we have much to learn.  I don’t remember offhand how much of that is on the cutting-room floor.

> Also, it doesn't follow that ineffective sanctions fail to convey unity or conviction.  If the goal is to get Russia out of Ukraine and they don't leave, does that mean that the west has failed to convey conviction?

Effectiveness doesn’t need to be measured by results, it can be measured by conviction and intent.  This is the difference between “hopes and prayers” and action.  Action may fail, but it’s not “hopes and prayers” bullshit.

>> 	• ●  Sanctions should be focused and precise. They should minimize the chance of unintended consequences or collateral damage. Disproportionate or over-broad sanctions risk fundamentally alienating populations.
> 

Yet it is not guiding the _current_ situation, so we hope to move in the direction of more precision and less collateral damage.

>> 	• ●  Military and propaganda agencies and their information infrastructure are potential targets of sanctions.
> 

Remember, this is a starting-point for a conversation, not an end-point.  With 87 authors, there was a bell-curve of thinking, which the letter tries to capture.  Everyone agreed on “military and propaganda.”  There was somewhat less agreement about “dual-use” and I think that was excised entirely from the final letter.  At the other end of the spectrum, everyone agreed that civilians should never be directly targeted by Internet sanctions, and civilian connectivity should never be impeded by sanction actions.  Also, government agencies which provide civil and social services shouldn’t be targeted.  There’s a fair bit of room in-between, and an acknowledgement that sanctioned parties may well attempt to use “human shields,” and to the degree that that brings about unintended harm on civilians, that’s on the sanctioned party, not on the sanctioning party.  But I think that’s a finer level of detail than made it out in the final letter, for length reasons rather than disagreement reasons.

>> 	• ●  The Internet, due to its transnational nature and consensus-driven multistakeholder system of governance, currently does not easily lend itself to the imposition of sanctions in national conflicts.
> 
> I have my own view as to why this is true.  But it may be worth elaborating in detail.

Perhaps.  Or we can each recognize what truth we see in this, for our own reasons, and move on to the actual work.  More debate yields better outcomes, at substantially higher costs in slowness and friction and so forth.  I don’t think that’s necessarily a weakness to be addressed; just a feature of multistakeholderism.  To the degree that we can get the full benefit of it, rather than thinking of it as a weakness, I’m happy.

>> 	• ●  It is inappropriate and counterproductive for governments to attempt to compel Internet governance mechanisms to impose sanctions outside of the community’s multistakeholder decision-making process.
> 
> Yeah, this requires a discussion of supremecy and subservience.  Who is supreme and why and where are the guns to back that up?

Guns aren’t the only mechanisms of power.  Money, people, etc.  Which is more powerful, Trinidad & Tobago, because they can issue laws and decrees, or NTT, because they can carry traffic around the world?  Apples and oranges, not a simple comparison.  And there are positive and negative forms of power.  Power demonstrated through denying things to people is negative.  Power demonstrated through creation and generosity is positive.  My open-source, potlatch-economy stripes are showing.  I’ll shut up now.

>> 	• ●  There are nonetheless appropriate, effective, and specific sanctions the Internet governance community may wish to consider in its deliberative processes.

“... after due process and consensus would publish sanctioned IP addresses and domain names in the form of public data feeds in standard forms (BGP and RPZ), to be consumed by any organization that chooses to subscribe to the principles and their outcome.”

Are you asking me to prognosticate on what specific networks or domain names, or categories of networks or domain names, future groups of stakeholders, might choose to include in those feeds?  I can guess that Russian military and propaganda agencies might be included if implementation goes fast enough, but beyond that, I don’t think it’s useful for me to speculate.

And before anyone goes off on the “well it’s irresponsible to build something if you can’t guarantee the outcome of every future decision ever” rant, nothing new is being built here. The mechanisms are all the same as are fully mature for other purposes.  The point here is to make it possible to use those mechanisms to enact sanctions more narrowly, with less humanitarian consequences, than is currently being done.

                                -Bill

---

From: Eliot Lear <[email-masked]>
Date: Fri, 11 Mar 2022 14:52:24 +0100

On 11.03.22 13:47, Bill Woodcock wrote:
>
>> On Mar 11, 2022, at 1:00 PM, Eliot Lear<[email-masked]>  wrote:

Well, my point is that this is a RESEARCH group so we can establish 
RESEARCH questions.  That was not the point of your communique, of 
course, but here we are.

> So, not “can we stop Russia” but “can we place some of the societally-shared costs of Russia’s military connectivity back in their laps, and in the laps of those who are profiting from selling them…

I stated my view just to expose my own biases, to be clear.

> John Kristoff is leading the team that’s instrumenting the technical effects of this particular mechanism.  But that’s a technical measurement, not a geopolitical/economic/societal measurement.  Th…

Figuring out what to measure here is beyond my own expertise. Popular 
opinion before and after cutoffs might be one good measure, tho.

> There was a lot of text about governments having hundreds or thousands of years of experience in enacting sanctions, and the Internet community just coming in now, and acknowledging that we have mu…

I'm not surprised.  Your communique wasn't meant to be a research 
paper.  But if we look at those predefined goals, can we develop real 
world experience in understanding whether/how they can be achieved, how 
to limit collateral damage in the instant and in the future, and what we 
might say differently in a rev of RFC 7754 (for instance)?

> Effectiveness doesn’t need to be measured by results, it can be measured by conviction and intent.  This is the difference between “hopes and prayers” and action.  Action may fail, but it’s not “ho…

Well, I think I detect some Camelism going on here. Effectiveness *is* 
measured by results.

> Yet it is not guiding the _current_ situation, so we hope to move in the direction of more precision and less collateral damage.

I don't think one should draw that conclusion, but instead try to 
characterize the differences.  Again, it's a question.  There's no need 
to answer it.

> Remember, this is a starting-point for a conversation, not an end-point.  With 87 authors, there was a bell-curve of thinking, which the letter tries to capture.  Everyone agreed on “military and p…

That sort of discussion is very good to expose. And very specifically to 
human rights, how are the human rights of people on both sides of the 
conflict being impacted/respected/neglected/... and by whom?

> Perhaps.  Or we can each recognize what truth we see in this, for our own reasons, and move on to the actual work.  More debate yields better outcomes, at substantially higher costs in slowness and…

Sure. But this is a research group.

> Guns aren’t the only mechanisms of power.  Money, people, etc.  Which is more powerful, Trinidad & Tobago, because they can issue laws and decrees, or NTT, because they can carry traffic around the…

Again, this is a research group, and I would claim that we do not know 
the full bounds of authority of multistakeholderism, nor 
multilateralism, nor unilateralism (or other isms).  I suspect that only 
experience provides us with answers, but this is a good time to lay out 
what we think those limits are.

Eliot

---

From: avri <[email-masked]>
Date: Fri, 11 Mar 2022 10:52:39 -0500

Hi,

Speaking for myself and not any organization i might be involved with, 
&c, I find the document an intriguing idea that should get further work. 
At this point the main thing that concerns me is the basis and strength 
of its multistakeholder claims, but that is something that could be 
fixed, and is not a topic for HRPC as far as I can tell.

As for it fitting into this group, while that seems slight stretch, one 
thing that has been discussed in the group at various times is the 
question of whether the HR Considerations only pertain to protocol 
creation or whether they extend to the implementation, deployment, and 
operation of those protocols. If the group accepts that protocol 
considerations extend beyond the creation of the protocol, then 
discussion of the HR consideration aspect of this proposal would seem to 
me to be fit as a research worthy goal for the HRPC.

avri

On 3/11/2022 8:52 AM, Eliot Lear wrote:
> world experience in understanding whether/how they can be achieved, 
> how to limit collateral damage in the instant and in the future, and 
> what we might say differently in a rev of RFC 7754 (for instance)?
>
>
> That sort of discussion is very good to expose. And very specifically 
> to human rights, how are the human rights of people on both sides of 
> the conflict being impacted/respected/neglected/... and by whom?
>
>
> multilateralism, nor unilateralism (or other isms).  I suspect that 
> only experience provides us with answers, but this is a good time to 
> lay out what we think those limits are.
>
> Eliot
>
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 11 Mar 2022 16:32:54 +0000

Hiya,

> https://www.pch.net/resources/Papers/Multistakeholder-Imposition-of-Internet-Sanctions.pdf

I have to say I'm not warming to the concept myself, for
a few reasons - the overall history of blocklists isn't so
clean and I'm unconvinced attempting to add transparency
is either doable or would be effective. Secondly, IIUC a
lot of the bad actors (that I'd envisage) already have a
modus-operandi where they originate traffic from other
people's networks, so a blocklist even if accurate might
be moot. And lastly, convincingly demonstrating correct
(or at least believable) attribution seems like it might
just not be possible in any open manner.

That said, having a venue for discussion of these topics
seems like a good idea, as would some discussion during
the upcoming IETF meeting. (I'm sure recent awful events
mean that last will happen in any case.)

Cheers,
S.

---

From: Bill Woodcock <[email-masked]>
Date: Fri, 11 Mar 2022 17:38:17 +0100

> On Mar 11, 2022, at 5:32 PM, Stephen Farrell <[email-masked]> wrote:

So, just block everybody and let god sort them out?

Because that’s the status quo, and the problem we’re trying to fix.

                                -Bill

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 11 Mar 2022 16:40:07 +0000

> So, just block everybody and let god sort them out?

Not what I said, nor implied.

> Because that’s the status quo, and the problem we’re trying to fix.

I accept that this is attempting an improvement and is
proposed in good faith. I'm just pretty unconvinced it's
a good plan.

Cheers,
S.

---

From: Bill Woodcock <[email-masked]>
Date: Fri, 11 Mar 2022 17:50:50 +0100

> On Mar 11, 2022, at 5:40 PM, Stephen Farrell <[email-masked]> wrote:

You appeared to be comparing to a hypothetical reality in which the alternative was fewer sanctions, which has never actually obtained.  So arguments based on that premise would not be in good faith.

> I'm just pretty unconvinced it’s a good plan.

So what would the characteristics of a better plan be?  More parties sanctioned?  Do you believe that governments could be convinced to accept _fewer_ parties sanctioned?

                                -Bill

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 11 Mar 2022 16:53:32 +0000

On 11/03/2022 16:50, Bill Woodcock wrote:
> You appeared to be comparing to a hypothetical reality in which the
> alternative was fewer sanctions, which has never actually obtained.
> So arguments based on that premise would not be in good faith.

You're jumping straight to accusing me of bad faith?
That seems wildly unwarranted. I'll be happy to discuss
more with you if that's not in fact the case.

S

> So what would the characteristics of a better plan be?  More parties
> sanctioned?  Do you believe that governments could be convinced to
> accept _fewer_ parties sanctioned?
> 
> -Bill
> 
> 
> _______________________________________________ hrpc mailing list 
> [email-masked] https://www.irtf.org/mailman/listinfo/hrpc

---

From: Bill Jouris <[email-masked]>
Date: Fri, 11 Mar 2022 17:30:45 +0000 (UTC)

The biggest problem I see is coming up with a good way to decide (objectively!) when in the future the same approach might be appropriate.  Russia's invasion of Ukraine is, in a sense, anomalous because it is so widely viewed  negatively.  But there are lots of other cases which some part of the world would see as similar, but other parts would not. 
Who decides? On what basis?  How much consensus is necessary?  All questions before we even look at technical feasibility or unintended consequences. 
Bill Jouris 

Sent from Yahoo Mail on Android 
 
  On Fri, Mar 11, 2022 at 8:33 AM, Stephen Farrell<[email-masked]> wrote:   
Hiya,

Cheers,
S.

---

From: Jens Finkhaeuser <[email-masked]>
Date: Fri, 11 Mar 2022 17:40:56 +0000

Hi!

I'm new on the list, bear with me please.

If I might add my 2 cents, the document essentially describes approaches that are *not* acceptable, and leaves three open as possible, all of which revolve around some kind of blocklist. These blocklists then would have to be implemented by other organizations, not this group.

Which means these list are at best advisory.

Well, there is a precedent for an advisory warning symbol by a research-adjacent org, the Doomsday Clock. It doesn't *do* anything, other than draw attention to changing circumstances.

Of course engineers being what they are, any blocklists that exist will be ingested into systems automatically, irrespective of whether they're meant as advisory or best practice. That said, if the org were to make explicit enough that these lists are advisory only, I do not see any harm in publishing them (provided appropriate governance as discussed already, etc).

I actually see a lot less harm in such a carefully curated "Doomsday Blocklist" than in the plethora of blocklists managed by individuals and security organizations in use now, mostly because there'd be some kind of humanitarian charter to steer things.

The way I interpret that paper is that it should be a little like I describe above, and less like your average firewall vendor's latest block list.

Hope that helps,
Jens

------- Original Message -------

On Friday, March 11th, 2022 at 12:05, Bill Woodcock <[email-masked]> wrote:

> > On Mar 11, 2022, at 10:59 AM, Vittorio Bertola [email-masked] wrote:
> > 

> > > Il 11/03/2022 10:38 Bill Woodcock [email-masked] ha scritto:
> > > 

> > > > On Mar 11, 2022, at 9:57 AM, Vittorio Bertola vittorio.bertola=[email-masked] wrote:
> > > > 

> If viewed in this light, sufficiently constrained sanctions are the proper choice. They may involve some minor sacrifice on the parts of some actors (if, for example, they are selling services to the Russian military, as Cloudflare recently reiterated their commitment to continuing to do), but relative to kinetic warfare and atrocities, it is an essentially deescalatory response, which is good. It shows moral conviction and provides some allyship with victims, while simultaneously removing subsidies (in the form of societally-borne common costs) from the aggressor. This is shunning, or outlawing, as Icelandic law established more than a thousand years ago. If someone flagrantly transgresses societal norms, they cannot expect to benefit from societally-provided goods, at society’s common expense.
>

---

From: Vittorio Bertola <[email-masked]>
Date: Fri, 11 Mar 2022 19:16:57 +0100 (CET)

> Il 11/03/2022 17:38 Bill Woodcock <[email-masked]> ha scritto:
> 

As that seems to be your strongest motivation, I am curious to understand why. I mean, I agree that your proposal would be far better than Ukraine's, but as far as I know, almost no one at ICANN or at RIPE has argued in favour of removing TLDs from the root, invalidating certificates or deleting IP space. Both institutions have clearly said that, while sympathizing with Ukraine's situation, they will not agree to the request. So how is that "the status quo"?

Personally, my motivation for supporting your proposal would actually be the opposite - enabling limited but focused sanctions as an alternative to doing nothing.

-- vb.

---

From: Paul Wouters <[email-masked]>
Date: Fri, 11 Mar 2022 13:41:43 -0500

The internet is infrastructure. It must always be there and when broken must be fixed. Punishing citizens for their government actions by crippling infrastructure is always wrong.

Paul

Sent using a virtual keyboard on a phone

> On Mar 11, 2022, at 13:17, Vittorio Bertola <vittorio.bertola=[email-masked]> wrote:
> 
> 
>

---

From: Eliot Lear <[email-masked]>
Date: Fri, 11 Mar 2022 21:25:57 +0100

> The internet is infrastructure. It must always be there and when broken must be fixed. Punishing citizens for their government actions by crippling infrastructure is always wrong.

Infrastructure isn't a magic word and the Internet being a network of 
networks, you can't speak quite so broadly.  And you have to show your 
homework when making statements, especially in a research group.

So let me help you:

  * Disrupting Internet connectivity within a region can hamper other
    civilian infrastructure, including traffic systems, healthcare
    services, and food distribution services.  It may hamper education
    during COVID, and actually cause the disease's spread by encouraging
    direct F2F communications.  It can hamper transportation
    infrastructure such as Taxi services, and the ability to book
    transit.  It can disrupt basic voice communications in as much as
    voice runs over the Internet.
  * The counter-measures that governments are likely to take may cause
    routing ambiguities, break secure DNS.

Note- there is little preventing the first bullet from happening after 
an extended period of time if international sanctions prevent hardware 
replacement and servicing of the infrastructure.

Eliot

**

---

From: Mallory Knodel <[email-masked]>
Date: Fri, 11 Mar 2022 15:29:09 -0500

Hi all,

I don't mean to hijack a discussion of one document with another, but, 
as everyone has probably noticed there is no shortage of these things 
being published every day. Rather I'm sharing this other statement 
because it's relevant to the discussion and takes a different approach, 
more like what Paul Wouters said earlier.

Dozens of human rights groups call for more clarity on sanctions, 
including authorisatinos for comms/internet (as was with Syria, Cuba, 
Iran): 
https://www.accessnow.org/cms/assets/uploads/2022/03/Civil-society-letter-to-Biden-Admin-re-Russia-sanctions-and-internet-access_10-March-2022-1.pdf

If you'd like to read more of a narrative on tech sanctions, there's 
this great piece by Wikimedia Foundation VP: 
https://techpolicy.press/the-invasion-of-ukraine-is-horrific-cutting-the-russian-people-off-from-the-internet-could-make-it-worse

As for my view, I'm with Stephen in that I don't think it's a 
particularly effective approach that the PCH letter takes and yet the 
political risks are tremendous. If we are to build the capacity in 
internet governance spaces like the IRTF/IETF-- and I would argue that 
is a far better goal than a new IG body-- it had better be on rock solid 
ground in terms of understanding efficacy and tradeoffs.

I think the statements that have been issued by internet governance 
bodies have so far come to the exact right conclusion. What would have 
made them better is more political analysis of Russia as a bad faith 
actor in these spaces, enumeration of bad behaviour that is unacceptable 
and already considered actionable offenses (like DDoS, spam, a rogue 
root operator, etc), and an offer of clear guidance to implementers and 
other tech companies or organisations who would look to those bodies for 
cues on what they should do (or not do) in these troubled times.

-Mallory

On 3/11/22 3:57 AM, Vittorio Bertola wrote:
> Hello,
>
> I think that this call for a global, multistakeholder process to block 
> access to Russian military and news websites would be of interest for 
> discussion here.
>
> I don't disagree with the concept, I would actually implement such a 
> blocklist. I am worried that such a structured approach, and some 
> names in the list of signatories, could weaponize the global Internet 
> governance institutions and lead to the final fragmentation of the 
> Internet, but this is not in topic here.
>
> I am however puzzled by how this call could be compatible with the 
> pretty maximalistic approach to Internet censorship that this group 
> (or PEARG, in https://tools.ietf.org/html/draft-irtf-pearg-censorship) 
> has been taking. Possibly, if we applied draft-guidelines to this 
> proposal it would not pass the test.
>
> I would like to understand the line of reasoning under which an ISP 
> blocking access to child sexual abuse material or to phishing websites 
> is a censor, but if a soon-to-be-formed Internet institution decides 
> to block access to Russia Today globally as part of a war, then it's 
> all good.
>
> [email-masked]  

-- 
Mallory Knodel
CTO, Center for Democracy and Technology
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 11 Mar 2022 21:31:55 +0100

> The internet is infrastructure. It must always be there and when broken must be fixed. Punishing citizens for their government actions by crippling infrastructure is always wrong.

 From the statement:

● Disconnecting the population of a country from the Internet is a disproportionate and inappropriate sanction,
since it hampers their access to the very information that might lead them to withdraw support for acts of war
and leaves them with access to only the information their own government chooses to furnish.

and

● Sanctions should be focused and precise. They should minimize the chance of unintended consequences or
collateral damage. Disproportionate or over-broad sanctions risk fundamentally alienating populations.

● Military and propaganda agencies and their information infrastructure are potential targets of sanctions.

Best,

Niels

-- 
Niels ten Oever, PhD
Postdoctoral Researcher - Media Studies Department - University of Amsterdam
Affiliated Faculty - Digital Democracy Institute - Simon Fraser University
Non-Resident Fellow 2022-2023 - Center for Democracy & Technology
Associated Scholar - Centro de Tecnologia e Sociedade - Fundação Getúlio Vargas
Research Fellow - Centre for Internet and Human Rights - European University Viadrina

W: https://nielstenoever.net
E: [email-masked]
T: @nielstenoever
P/S/WA: +31629051853
PGP: 2458 0B70 5C4A FD8A 9488 643A 0ED8 3F3A 468A C8B3

Read my latest article on Internet infrastructure governance in Globalizations here: https://www.tandfonline.com/doi/full/10.1080/14747731.2021.1953221

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 11 Mar 2022 21:37:00 +0100

On 11-03-2022 21:29, Mallory Knodel wrote:
> Hi all,
> 
> I don't mean to hijack a discussion of one document with another, but, as everyone has probably noticed there is no shortage of these things being published every day. Rather I'm sharing this other statement because it's relevant to the discussion and takes a different approach, more like what Paul Wouters said earlier.
> 

I don't see the two statements as being incompatible at all. Both seek to ensure that the ability of people to exercise their human rights are respected, but also seek to come up with a measured solution.

> Dozens of human rights groups call for more clarity on sanctions, including authorisatinos for comms/internet (as was with Syria, Cuba, Iran): https://www.accessnow.org/cms/assets/uploads/2022/03/Civil-society-letter-to-Biden-Admin-re-Russia-sanctions-and-internet-access_10-March-2022-1.pdf
> 
> If you'd like to read more of a narrative on tech sanctions, there's this great piece by Wikimedia Foundation VP: https://techpolicy.press/the-invasion-of-ukraine-is-horrific-cutting-the-russian-people-off-from-the-internet-could-make-it-worse
> 
> As for my view, I'm with Stephen in that I don't think it's a particularly effective approach that the PCH letter takes and yet the political risks are tremendous. If we are to build the capacity in internet governance spaces like the IRTF/IETF-- and I would argue that is a far better goal than a new IG body-- it had better be on rock solid ground in terms of understanding efficacy and tradeoffs.

But haven't existing IG bodies made abundantly clear that they do not want to take this up? (See statements from ISOC, RIPE, and ICANN)

> 
> I think the statements that have been issued by internet governance bodies have so far come to the exact right conclusion. 

The statements in which they claim neutrality and that they will do anything within their power to not accommodate sanctions? I found those pretty stark in the light of current events actually.

What would have made them better is more political analysis of Russia as a bad faith actor in these spaces, enumeration of bad behaviour that is unacceptable and already considered actionable offenses (like DDoS, spam, a rogue root operator, etc), and an offer of clear guidance to implementers and other tech companies or organisations who would look to those bodies for cues on what they should do (or not do) in these troubled times.

Now I am slightly confused, isn't this exactly what the PCH statement is trying to coordinate?

Best,

Niels

---

From: [email-masked]
Date: Sat, 12 Mar 2022 02:23:12 -0500

Since the 1970s I would demonstrate the net (ARPA, inter) to someone
and they would first be amazed and then invariably ask: So, who is in
charge of this thing?

In the mind's eye it seems like someone or some identifiable
organization must be in charge of such awesome power.

I take a deep breath and say: It's complicated, how much time do you
have?

That said the very idea of "cutting off" a nation may only exist in
that mind's eye. We may be debating the merits of a fiction, much like
how many angels can dance on a pin head.

Depending on organization and determination a nation can cut itself
off from the rest of the world.

Russia and China in particular have striven to make this possible by
limiting transit to state-controlled agencies which one assumes could
be shut down with a government-initiated order. There are no doubt
other such nations, not my point to be exhaustive.

The US for example probably cannot cut itself off, or not without some
vast effort. It's too distributed and transit is managed by many
private, non-governmental parties.

That said, many talk of such a sanction, cutting a nation off from the
internet, as "weaponizing" the internet.

I would argue a good topic for a RG is whether or not the net has
already been weaponized?

To that end I'll suggest there is positive and negative weaponization.

  1. Positive - weaponizing traffic such as through strategic and
     tactical use of malware, ransomware, disinformation, etc.

  2. Negative - blocking traffic associated with an entity.

One might have some effect with attempting to do #2, cutting off the
traffic of a nation like Russia.

But #1 is much like terminating someone's cell phone service on the
assumption that they would be unable to ever make a phone call
again. Nonsense.

However #1 has been presented as the justification for attempting #2.

All that said I do appreciate the symbolic value of Ukraine's request,
even if it can't be perfectly implemented.

Note that just about all the sanctions levied against Russia in
response to their invasion of Ukraine are very "leaky". Russian oil
etc. will be sold, the transactions will be paid for without access to
SWIFT, etc.

Hence, making the best the enemy of the good I would argue is a
terrible and naive debating point. We can't do #2 perfectly so let's
not try at all.

No reasonable person expects perfect compliance for any sanction.

They might reasonably expect a unified statement be made.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*

---

From: Bill Woodcock <[email-masked]>
Date: Sat, 12 Mar 2022 10:18:22 +0100

> On Mar 12, 2022, at 8:23 AM, [email-masked] wrote:
> organization must be in charge. The very idea of "cutting off”
> a nation may only exist in that mind's eye. We may be
> debating the merits of a fiction.

Exactly.  There is no authority.  Merely a lot of mechanisms that do different things.  This is a proposed mechanism, which may achieve an end for some people.  Anyone who doesn’t need it or doesn’t like it is free to ignore it.  Criticizing it serves no purpose.  Working constructively to ensure that it functions well is productive.  People who believe civilians should be targets of sanctions are welcome to not use it; if few enough people wind up agreeing that civilians should not be targeted, maybe nobody will be left to maintain the mechanism, and it will fade away and become a footnote in history.

None of this is any different than how the rest of the Internet works.

> Just about all the sanctions are very "leaky". Russian oil
> Making the best the enemy of the good I would argue is a

Exactly.

> They might reasonably expect a unified statement be made.

Not if they’re familiar with the IG debate club.  But I take your point.  :-)

                                -Bill

---

From: Bill Woodcock <[email-masked]>
Date: Sat, 12 Mar 2022 12:06:45 +0100

> On Mar 11, 2022, at 7:41 PM, Paul Wouters <[email-masked]> wrote:
> Punishing citizens for their government actions by crippling infrastructure is always wrong.

Exactly.  Collective punishment is anathema.

> As far as I know, almost no one at ICANN or at RIPE has argued in favour of removing TLDs from the root, invalidating certificates or deleting IP space.  So how is that "the status quo"?

How does that have anything to do with anything?

The European Commission has been clear in its directive, European governments are telling network operators that the directive is binding and doesn’t require individual governmental action, and operators in Europe have already begun implementing the European sanctions, which affect all of Russia, civilians as well as military.

In the United States, the wind is seen as blowing in that direction as well, and some of the world’s largest network operators have already announced that they are implementing as-yet-unrequired sanctions, in anticipation that the sanctions will exist before March bills come due on May 1.

No government has yet provided any carve-outs for Russian civilians, to the best of my knowledge.

Thus, the status quo is sanctions which affect all of Russia.  That’s what’s been required thus far (in Europe), the direction implementation has gone thus far, and what’s anticipated of the US and other governments which are still in process of formulating their policy.  And operators have to anticipate sixty days in advance.

> Personally, my motivation for supporting your proposal would actually be the opposite - enabling limited but focused sanctions as an alternative to doing nothing.

Well, “doing nothing” isn’t a legal option in Europe, and probably shortly won’t be an option in the US, either, where many of the networks are legally headquartered.  So, again, that’s a hypothetical situation, and not one which applies in the current situation, but for the future, yes, exactly.  The moral compass of the Internet community may hold more sway if it’s able to take action when necessary, without fear of humanitarian mis-effects.

> On Mar 11, 2022, at 9:29 PM, Mallory Knodel <[email-masked]> wrote:
> I don't think it's a particularly effective approach that the PCH letter takes.

C’mon now, that’s just trolling.  If you’re going to try to insinuate that it wasn’t a multistakeholder document by discounting the other 86 authors, you’d do better to call it a European Parliament document, or an ICANN document, since they’re both more heavily represented among the signatories.  PCH isn’t even a signatory to the letter.  The only organizational signatory is the Internet Archive.  The only reason it’s available on the PCH web site as well as the Archive is because the Archive’s spam filter was acting up when it was time to upload the final version for the press, and it was the middle of the night in California.

> The political risks are tremendous

Please enumerate the ones you see?

                                -Bill

---

From: Bill Woodcock <[email-masked]>
Date: Sat, 12 Mar 2022 13:35:10 +0100

> On Mar 11, 2022, at 6:40 PM, Jens Finkhaeuser <[email-masked]> wrote:
> The way I interpret that paper is that it should be a little like I describe above.

I believe others of the authors besides myself and Niels are on the list and could answer as well, but yes, your understanding certainly comports with mine.

                                -Bill

---

From: Bill Jouris <[email-masked]>
Date: Sat, 12 Mar 2022 17:44:17 +0000 (UTC)

Let's be serious.  ANY sanctions applied to a country are "collective punishment."  Even if they are nominally only impacting the government (which isn't usual), they are still collective punishment. 
You can, of course, argue that sanctions applied on any basis except to individuals are off the table.  (Even sanctions at a company level impact employees who had nothing to do with whatever behavior we're objecting to.)  It's a valid position to take.  But be clear that that's what you are doing.   Bill

---

From: Bill Woodcock <[email-masked]>
Date: Sun, 13 Mar 2022 05:24:13 +0100

> On Mar 12, 2022, at 6:44 PM, Bill Jouris <b_jouris=[email-masked]> wrote:
> Let's be serious.  ANY sanctions applied to a country are "collective punishment."

Hang on, really?  You’re saying that you view sanctions applied to the military of a country that’s conducting offensive military action, which occasioned the sanction, as “collective punishment?”

If so, at what degree of individuality do you believe sanctions must be applied in order to meet the test of not constituting collective punishment?

Or is no mass-murderer so vile as to warrant being inconvenienced in their online shopping?

                                -Bill

---

From: farzaneh badii <[email-masked]>
Date: Sat, 12 Mar 2022 23:59:43 -0500

On Sat, Mar 12, 2022 at 11:24 PM Bill Woodcock <[email-masked]> wrote:

> Hang on, really?  You’re saying that you view sanctions applied to the
> military of a country that’s conducting offensive military action, which
> occasioned the sanction, as “collective punishment?”
>
> If so, at what degree of individuality do you believe sanctions must be
> applied in order to meet the test of not constituting collective punishment?

> Or is no mass-murderer so vile as to warrant being inconvenienced in their

The problem is you won’t inconvenience “their online shopping”! As
evidenced in every other program, you won't stop anybody but ordinary
people. It will affect people’s access to the Internet. every day all sorts
of mass murderers conveniently use the Internet to do what they want. But
what you are proposing is like having a visa regime in place. The mass
murders love having it in place too. Because they can deprive ordinary
people easily.  And that visa regime allows a lot of the Ruling parties
with dubious pasts to cross the borders. What a sad future we will have in
that case. Getting visas to go from one place to another on the Internet
makes it hard for ordinary people to do so,while the rich/ruling party can
have a blast. Probably the masse murderers will also be able to gain
passports that immunizes them from punishment on the Internet. While
ordinary people won't. They will wait in line. While the elites decide who
is a good person and who is not, using the rule of man.

---

From: Paul Wouters <[email-masked]>
Date: Sun, 13 Mar 2022 08:49:35 -0400

> Let's be serious.  ANY sanctions applied to a country are "collective punishment." 

This the trend of sanctions against government officials and their families who are taking the spoils of their country abuse to spend their wealth in the free world.

https://en.m.wikipedia.org/wiki/Magnitsky_Act

Internet is infrastructure. Like medicine, water, sewage, hospitals, electricity, heating  and food. You don’t exhaust or destroy that.  If you do, YOU are the oppressor in the view of those people without basic necessities.

Paul

---

From: Paul Wouters <[email-masked]>
Date: Sun, 13 Mar 2022 11:11:28 -0400

> Or is no mass-murderer so vile as to warrant being inconvenienced in their online shopping?

This is a bit of a false dichotomy. It’s hard to cut of “online shopping” yet keep the internet running for more basic necessities.

Things like cutting of social media definitely impacts the oppressed more than the oppressor who has no need for it (other than disinformation which could be cut of separately).

Revoking SSL certificates for all Russian sites is similarly crippling the wrong people, and has other side effects like people disabling SSL or needing to install questionable root CAs

Paul

---

From: Bill Woodcock <[email-masked]>
Date: Sun, 13 Mar 2022 18:03:23 +0100

> On Mar 13, 2022, at 4:11 PM, Paul Wouters <[email-masked]> wrote:

Okay… and?  Does anyone disagree with any of that?  Everything you just said seems self-evident, but unrelated to the previous conversation.

                                -Bill

---

From: Andrew Sullivan <[email-masked]>
Date: Sun, 13 Mar 2022 17:40:33 -0400

Dear colleagues,

ObDisclaimer: I work at the Internet Society, but I am not speaking for them in this posting and do not participate in the work of this RG in my professional capacity either.

On Sat, Mar 12, 2022 at 10:18:22AM +0100, Bill Woodcock wrote:

>Exactly.  There is no authority.  Merely a lot of mechanisms that do different things.  This is a proposed mechanism, which may achieve an end for some people.  Anyone who doesn’t need it or doesn’t like it is free to ignore it.

That is not what "sanction" means, or at least not what it means in this context.

The "sanctions statement" as written starts out comparing the case of possible sanctions to be imposed by "the global Internet governance community" to the ones imposed by governments.  Governments impose economic sanctions through the force of law, and anyone subject to that government's jurisdiction and who does not comply with the sanctions faces penalties that usually include things like serious fines and jail time.

If parties A, B, and C curtail their economic activity with party T, and invite any other party to come along, but do not use any coercive effort to bring those others along, it's not "sanction".  It's a boycott.  If the proposal were for a new list to be published that enabled the rest of the world to understand the official Western Internet goodguys' opinion of who on the Internet is an official Internet badguy who ought therefore to be boycotted, I might still think it gross but I might not think it a mortal threat to the Internet.  This sanctions statement, however, does threaten the Internet because of the very use of the word "sanction". That will automatically be read by governments as "Here's the list you should encode in your laws of people not to talk to."

In any case, in the hope of talking here about something related to this RG's charter, I went and had a look at the latest at https://datatracker.ietf.org/doc/draft-irtf-hrpc-association/, in light of the sanctions statement.

It seemed to me that, if there is some kind of freedom of association on the Internet, then protocols that tend to create advantages for connectivity would be preferable to those that do not. Now, the sanctions statement proposes a kind of "shunning shutdown" in which an official list of networks to be shunned on political grounds is to be published and, presumably, acted upon by other networks under some kind of threat. One supposes that networks who did not operate in the desired way would also find themselves on the political sanction list, because there isn't really another threat possible.  Such effects would erode connectivity.

It follows from this that one should prefer protocols that are resistant to this sort of shunning shutdown, because they are better enablers of people's freedom of assiciation than protocols that enable shunning shutdown.

I was surprised that this fairly straightforward entailment did not ring out clearly to me from the text of draft-irtf-hrpc-association.  (To be honest, I find the dcument extremely wooly and hard to follow, so nothing really rings out clearly from it.)  There was, however, a tantalizing observation in the conclusion that

		non-interoperable
    platforms in chat and social media networks have a significant impact
    on the distributed and open nature of the Internet.

A protocol by which some networks are targetted for shunning shutdown will, by its very nature, lead to an increase in non-interoperation.  I therefore conclude that the sanctions statement proposes that a new protocol should be designed that would be harmful to human rights on the Internet.

By the way, I note that I appear in the Acknowledgements of draft-irtf-hrpc-association.  If it's all the same to the editors, I don't think I had anything to do with the document and I'd just as soon not be associated with it.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: [email-masked]
Date: Sun, 13 Mar 2022 19:08:25 -0400

One of the goals of disrupting the economy is to foment resurrection,
either internal or popular.

I'd agree that too many see sanctions analogously to spanking (or
similar) a child, a punishment to improve the government's behavior.

So any immediate inconvenience appeals to some, spank that leader!

As you say autocrats and their circle tend to be mostly immune and
lead comfortable lives under even quite extreme sanctions
regimes. That was the case with Saddam Hussein.

So the major motivations are:

1. To send a message which is louder than a statement of disapproval.

2. Possibly to weaken their warmaking etc apparatus.

3. Possibly to expose them as having miscalculated and thus bringing
misery and suffering on many which in turn might make them worry about
either internal or popular insurrection against them.

On March 12, 2022 at 23:59 [email-masked] (farzaneh badii) wrote:
 > The problem is you won’t inconvenience “their online shopping”! As evidenced in
 > every other program, you won't stop anybody but ordinary people. It will affect
 > people’s access to the Internet. every day all sorts of mass murderers
 > conveniently use the Internet to do what they want. But what you are proposing 
 > is like having a visa regime in place. The mass murders love having it in place
 > too. Because they can deprive ordinary people easily.  And that visa regime
 > allows a lot of the Ruling parties with dubious pasts to cross the borders.
 > What a sad future we will have in that case. Getting visas to go from one place
 > to another on the Internet makes it hard for ordinary people to do so,while the
 > rich/ruling party can have a blast. Probably the masse murderers will also be
 > able to gain passports that immunizes them from punishment on the Internet.
 > While ordinary people won't. They will wait in line. While the elites decide
 > who is a good person and who is not, using the rule of man. 
 > 
 > 
 > 
 > 
 >                                     -Bill
 > 

-- 
        -Barry Shein

---

From: [email-masked]
Date: Sun, 13 Mar 2022 19:14:04 -0400

There is nothing in history more dangerous than tolerating a
government one should not have tolerated.

That may not be fair, but it is true.

  Vox Populi, Vox Dei -- The Voice of the People is the Voice of God.

On March 13, 2022 at 08:49 [email-masked] (Paul Wouters) wrote:
 > This the trend of sanctions against government officials and their families who
 > are taking the spoils of their country abuse to spend their wealth in the free
 > world.
 > 
 > Internet is infrastructure. Like medicine, water, sewage, hospitals,
 > electricity, heating  and food. You don’t exhaust or destroy that.  If you do,
 > YOU are the oppressor in the view of those people without basic necessities.
 > 
 > 
 > Paul

-- 
        -Barry Shein

---

From: Jens Finkhaeuser <[email-masked]>
Date: Mon, 14 Mar 2022 08:53:11 +0000

Hi all,

I've had similar discussions in other places; this is by no means the only venue in which this is being discussed. In some of those other places, it's become apparent - just as you are describing here - that people interpret words such as "sanctions" or "censorship" differently from each other.

Personally, I am working on ways to make the Internet less liable to be controlled by any single entity, so you can imagine that "sanctions" and "censorship" are not concepts I support lightly, if at all.

I've had the fortune to live and work with people who have had their existence or lives threatened, and that has opened my eyes to one thing that often seems to be left aside in such discussions on principles: when lives are at stake, people will self-impose draconian rules quite readily. When lives are not at stake, those draconian rules are anathema to the same people. Safety trumps principles; principles are (for the most part) only important when you're safe.

What this tells me is the mechanisms for "cutting off" parts of the Internet must exist, as a self-defense measure. We seem to be discussing things here, however, as if those mechanisms were the exact same thing as legally mandating their use.

To put it simply:

1.  A blocklist by itself is just data.
2.  A blocklist that is published with some rationale for its existence is a call for boycott.

3.  A blocklist implemented to defend against attacks is often necessary (and we see this mechanism in firewall rules, spam filtering, etc. everywhere), and definitely not censorship; it's self-defense.

4.  A blocklist that is to be applied mandatorily is censorship.

>From what I read by everybody's contribution, nobody here is arguing that #4 is a good idea. Yet much of the discussion seems to revolve around that.

Let's move on to #3 then. If we have blocklists in wide use already, who currently authors these? There will be plenty of answers to this question, but they all have one characteristic: none of the authors are a multi-stakeholder organization that thinks #4 is an atrocity.

Which means, by definition, any of the plethora of blocklists already in use is more suspect than any hyopthetical blocklist being discussed here. Let's please not lose sight of that.

What people seem to fear - some have expressed as much - that #2 automatically will led to #4. I can see that as well, and that is the part that worries me. Additionally, elsewhere I've seen it being said that mathematics is against us: adding one more blocklist to the Internet isn't going to make it more free. And in isolation, that argument is entirely valid.

So... and bear with me here... let's have this org that maintains such blocklists. Let's have a charter for them that focuses on humanitarian values, and treats access to the Internet as, essentially, a human right (which IMHO is not wrong nowadays).

Let's make the major factor in deciding what to add to the list whether this part of the Internet poses more of a threat to human rights than it helps promote it. For example, the "online shopping" part previously mentioned clearly does not satisfy these criteria, while some aggressive nation's military sites might.

Nobody is forced to implement these lists. In fact, it might be possible to copyleft this, in spirit as well as in fact. Publish it under a license that if you do implement the list, it cannot be a copy; it cannot be automatically extracted from the published list and applied to your part of the network. It must require manual intervention, and a published rationale for the addition that is not a mere copy of the original. Make people work for adopting it, or make them liable. Serial offenders to this might find themselves on the list as well.

I'm not suggesting that this is a fully formed idea above any criticism, for what it's worth. Consider it more of a starting point.

What I see in this discussion here is much the same range of arguments as what I see in discussions on how one can defend against fascism; as a German (yes, yes, Godwin etc.) I have had my share of these. The point is, I keep coming back to Karl Popper's paradox of tolerance; I'm going to lazily quote this from Wikipedia because it's easiest:

"Less well known [than other paradoxes] is the paradox of tolerance: Unlimited tolerance must lead to the disappearance of tolerance. If we extend unlimited tolerance even to those who are intolerant, if we are not prepared to defend a tolerant society against the onslaught of the intolerant, then the tolerant will be destroyed, and tolerance with them.—In this formulation, I do not imply, for instance, that we should always suppress the utterance of intolerant philosophies; as long as we can counter them by rational argument and keep them in check by public opinion, suppression would certainly be most unwise. But we should claim the right to suppress them if necessary even by force; for it may easily turn out that they are not prepared to meet us on the level of rational argument, but begin by denouncing all argument; they may forbid their followers to listen to rational argument, because it is deceptive, and teach them to answer arguments by the use of their fists or pistols. We should therefore claim, in the name of tolerance, the right not to tolerate the intolerant. We should claim that any movement preaching intolerance places itself outside the law and we should consider incitement to intolerance and persecution as criminal, in the same way as we should consider incitement to murder, or to kidnapping, or to the revival of the slave trade, as criminal."

In much the same way, I think the Internet community should reserve the right to suppress that with destroys the Internet community. It's abundantly clear that blocklists created by single stakeholder interests are destructive and not something the community should support. It's also abundantly clear, I think, that unfettered disinformation campaigns pose genuine threats to a tolerant Internet community.

It seems to me that (details to be worked out, of course) publishing a blocklist of parties known to subvert the tolerant Internet community is exactly the kind of defensive mechanism one must adopt to uphold the community; what is emphatically not required and should be discouraged is for this blocklist to be implemented without further checks and balances in place.

So maybe a multi-stakeholder org doing this (in a copyleft-ish way?) is not a bad idea at all, but exactly the kind of thing that exercises the open Internet community to its fullest extent?

For what it's worth, I fully understand people reacting with frustration and cynicism to this. I have the same voice within me. But it is a reactionary voice responding to fear; I am not convinced that either fear-responses or re-action are the right voice to listen to.

The point is, there's not much need to reply with criticism, not because this view is above criticism, but because I've probably told myself the same things already. Instead I would invite people to ask themselves what the Internet community can do to actively strengthen its values (however diverse, there is overlap, as evidenced by this discussion)?

Thank you for bearing with this rather lengthy response, and especially since I'm quite new here!

Jens

---

From: Bill Woodcock <[email-masked]>
Date: Mon, 14 Mar 2022 10:47:31 +0100

> On Mar 14, 2022, at 9:53 AM, Jens Finkhaeuser <[email-masked]> wrote:
> To put it simply:
> 	1) A blocklist by itself is just data.
> 	2) A blocklist that is published with some rationale for its existence is a call for boycott.
> 	3) A blocklist implemented to defend against attacks is often necessary (and we see this mechanism in firewall rules, spam filtering, etc. everywhere), and definitely not censorship; it's self-defense.
> 	4) A blocklist that is to be applied mandatorily is censorship.

Since none of those are what Vittorio and I were discussing, I’ll add (2.5) A principles-based blocklist that is published to give network operators a compliance mechanism that is less draconian than what is otherwise required of them.

The _application_ of a sanction is _not_ self-defense, except in as much as it may also be implemented by the victim.  It is punitive and retaliatory.  In the case of kinetic warfare, and humanitarian crimes, it is also deescalatory.  It could be argued that the use of the proposed blocklist is self-defense by network operators against their regulatory agencies, but that seems to not be of interest to folks on this list.

> From what I read by everybody's contribution, nobody here is arguing that #4 is a good idea.

Correct.

> Yet much of the discussion seems to revolve around that.

Indeed, there seems to be a preference for straw men.

> Let's move on to #3 then. If we have blocklists in wide use already, who currently authors these?

I would argue that that’s immaterial.  What matters is that there is no barrier to entry.  Thus, the answer is: “whoever wants to.”  And that’s the right answer, and the answer that matters.

> They all have one characteristic: none of the authors are a multi-stakeholder organization that thinks #4 is an atrocity.

…because that would not be the defining characteristic of the multistakeholder organizations that fight spam and malware.  So that’s tautological.

> Which means, by definition, any of the plethora of blocklists already in use is more suspect than any hyopthetical blocklist being discussed here. Let's please not lose sight of that.

Uh…  I’m not sure that “more suspect” is an objective thing, but, moving forward...

> What people seem to fear - some have expressed as much - that #2 automatically will lead to #4. I can see that as well, and that is the part that worries me.

Ok, let’s first put aside the (in this context) meaningless semantics of whether a “boycott” is what you call what the private sector is required to do by “sanctions” or whether it’s “networked governance” or we just don’t want to partake of the Russian military’s services.  What matters is that governments are imposing sanctions and decreeing that network operators impose them.  The question at hand is what form the implementation takes.

If you feel like debating something else, that’s fine, but my interest, and that of my co-authors, is in minimizing the scope and humanitarian impact of the sanctions.  If you have thoughts on that matter, we would love to be educated.  That is what I’m here for.

So, we’re at (4), with a blocklist which includes a whole country, including its schoolchildren, its dissidents, and its journalists, and we’re trying to walk it back to (2.5), a blocklist of networks and domains which the multistakeholder IG community can agree represent military and propaganda agencies of the sanctioned entity, and excludes civilians.

Any worrying about (4) is pointless hand-wringing.  It was overtaken by events long ago.  The question is whether you can do anything to improve the situation, not whether deploring the status quo makes you virtuous.  That’s feckless.  (And I’m not saying that to you, Jens, I fully appreciate that that’s not where you’re at.)

> let's have this org that maintains such blocklists. Let's have a charter for them that focuses on humanitarian values, and treats access to the Internet as, essentially, a human right.

Yep.  Acknowledging that this is the Internet, and it’s governed by those who show up, and we can’t constrain future behavior in an environment free from barriers to entry.  But the above is exactly the point.

> Let's make the major factor in deciding what to add to the list whether this part of the Internet poses more of a threat to human rights than it helps promote it. For example, some aggressive nation's military sites might.

Exactly.

I expect there are valid arguments against sanctions, but the world as a whole appears to have come to the conclusion that sanctions are a reasonable thing to do in some circumstances.  _Whether or not_ sanctions are ever reasonable is not a hill I care about, and certainly not one I’m inclined to die on.  That seems to be a decided issue and I have no cause to dispute the outcome.  _How_ sanctions are effected within my community of interest, which is Internet infrastructure is, however, of great interest to me.  I signed the letter because its principles reflect my own: sanctions, when enacted, should not be over-broad; they should not effect civilians; they must be easy to roll out and easy to roll back; and there’s no point in deploying sanctions that we already know would be ineffective.

> Nobody is forced to implement these lists.

Correct.  They’re free to block more broadly.  What they are not free to do is to not block at all, because they are required to do so by their governments.  Networks outside the set which are required to block can do what they like; they’re not part of the problem we’re attempting to solve.

> It might be possible to copyleft this, in spirit as well as in fact. Publish it under a license that if you do implement the list, it cannot be a copy; it cannot be automatically extracted from the published list and applied to your part of the network. It must require manual intervention, and a published rationale for the addition that is not a mere copy of the original. Make people work for adopting it, or make them liable.

You can do that one.

I’ll put my work into the one that’s cc0.

Again, what’s critical is that this is the Internet, and there’s no barrier to entry.  You can bet on a restrictive one, I can bet on an open one, someone else can bet on a subscription one…  whatever.  As long as they’re all solving real problems, they’ll all thrive.

> Popper's paradox of tolerance

Yep.  That seems like a likely reason we’ve wound up with society generally accepting sanctions as a good response to violence.

> I think the Internet community should reserve the right to suppress that with destroys the Internet community.

It always has.  That part of the IG community works very hard.

> I fully understand people reacting with frustration and cynicism to this.

I do not, but that’s immaterial.  Anyone who wants to react with new information or philosophy not yet reflected within the proposed process is humbly and gratefully requested to do so, though.  As I said, that’s why I’m here: to further expand the base of thought on which this is being built.

> I would invite people to ask themselves what the Internet community can​ do to actively strengthen its values (however diverse, there is overlap, as evidenced by this discussion)?

Exactly.  Thank you for putting that more eloquently than I’m capable of.

                                -Bill

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 14 Mar 2022 12:25:18 +0100

On 13-03-2022 22:40, Andrew Sullivan wrote:
> If parties A, B, and C curtail their economic activity with party T, and invite any other party to come along, but do not use any coercive effort to bring those others along, it's not "sanction".  It's a boycott. 

A boycott implies consumer choice. A 'coordinated infrastructural boycott' is as much a hard to grasp concept as 'multistakeholder sanctions', both concepts are imperfect, as is often the case with new initiatives.

  If the proposal were for a new list to be published that enabled the rest of the world to understand the official Western Internet goodguys' opinion of who on the Internet is an official Internet badguy who ought therefore to be boycotted, I might still think it gross but I might not think it a mortal threat to the Internet.  This sanctions statement, however, does threaten the Internet because of the very use of the word "sanction". That will automatically be read by governments as "Here's the list you should encode in your laws of people not to talk to."

In my conversations with government officials about this topic, that was not my impression at all.

> It seemed to me that, if there is some kind of freedom of association on the Internet, then protocols that tend to create advantages for connectivity would be preferable to those that do not. Now,…

This really is a misrepresentation of the position. Especially since that would not at all proportional, which is one of the main concepts in the statement.

What really is bad for connectivity is the Russian government bombing connectivity infrastructure and Internet users, as well as the filtering they do on their own networks. That is what is eroding connectivity.

> It follows from this that one should prefer protocols that are resistant to this sort of shunning shutdown, because they are better enablers of people's freedom of assiciation than protocols that e…

No, because some networks and their operators limit others networks and people's connection and interconnection. Limiting them in order to do that might lead to an overall increase. This very much comes back to Popper's Open Society and It's Enemies that there should be measures that ensure intolerance for intolerance.

> 
> I was surprised that this fairly straightforward entailment did not ring out clearly to me from the text of draft-irtf-hrpc-association.  (To be honest, I find the dcument extremely wooly and hard to follow, so nothing really rings out clearly from it.)

This discussion perhaps does not belong here, but this is most probably due to the fact that change control of the RG documents lies with the RG, and we implemented every change proposed by the RG. So maybe indeed too many consensus opinions makes thing wooly. On the other hand that means that a lot of opinions are included.

   There was, however, a tantalizing observation in the conclusion that
> A protocol by which some networks are targetted for shunning shutdown will, by its very nature, lead to an increase in non-interoperation.  I therefore conclude that the sanctions statement propose…

Again, not taking into account how such a network and its operators might negatively impact other users. See the (extensive) discussions that were held on DDoS here.

> By the way, I note that I appear in the Acknowledgements of draft-irtf-hrpc-association.  If it's all the same to the editors, I don't think I had anything to do with the document and I'd just as s…

You helped us come up with some defitions as the Acknowledgements section describes, but if you want I'll remove you right away:

https://github.com/IRTF-HRPC/draft-association/commit/d80db8b3c0034235c351362f229d2aa83dd2556c

Best,

Niels

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 14 Mar 2022 11:11:11 -0400

Hi,

[Still employed, still not speaking for them.  This note is too long.
I didn't have time to write a short one.]

On Mon, Mar 14, 2022 at 08:53:11AM +0000, Jens Finkhaeuser wrote:
>
>What this tells me is the mechanisms for "cutting off" parts of the Internet must exist, as a self-defense measure.

There are lots of network-operational reasons for one network not to
speak to another part of the network.  This is true both at the level
of particular applications and at the level of the network itself.
The IAB published a document about this some time ago (I was on the
IAB that approved it): https://www.rfc-editor.org/rfc/rfc7754.txt

What I believe the sanctions statement is claiming is that there is a
legitimate category of blocklist that filters networks based on
political considerations related to who controls those target networks
or where they are located or something like that.  It may be claiming
(or it may be motivated by a belief even if it is not claiming) that
not _every_ such filter is legitimate, but it does fundamentally
depend on granting the premise that it is sometimes legitimate to
institute such a filter.  This is perhaps a subclass of RFC 7754
section 3.2 bullet 2 or bullet 3, but I tend to think it is a category
that 7754 didn't actually consider fully.  To be clear, I do not grant
the premise that it is ever legitimate to block networks on such
political grounds (I find the very premise to be a mistake) but I
want to take the argument seriously in its own terms.

It is not reasonable in my opinion to claim such filters are
"self-defense", at least in the network sense.  They are, rather, an
attempt to use one economic good (connectivity) to cause other kinds
of political change.

I claim in my prior note to this list that such a weaponization[1] of
the Internet appears to be bad for freedom of association.  I would
claim further that, to the extent such weaponization is mandatory
under some government policy, it is an abridgement of that freedom by
that government.

>We seem to be discussing things here, however, as if those mechanisms were the exact same thing as legally mandating their use.
>

When one uses a term that is currently widely used to denote
government-imposed restrictions on trade and other economic activities
at the risk of fine and imprisonment, one should not be surprised when
other people interpret one's intent as supporting legal mandates.

>3.  A blocklist implemented to defend against attacks is often necessary (and we see this mechanism in firewall rules, spam filtering, etc. everywhere), and definitely not censorship; it's self-defe…

This is, as I argue above, insufficiently nuanced analysis for the
purposes to which it is being put.  I would suggest that the framework
in RFC 7754 section 4 offers a better mechanism for undertaking the
evaluation of any of the proposed blocklists.  Here is how I'd do it:

	• Any blocklist sufficient to achieve the political goals of the
	blocklist will automatically need to be large in scope (section
	4.1.1), because there are many networks that would inevitably be
	affected.  The sanctions statement is either naïve or disingenuous
	when it proposes limiting its effects only to military or
	propaganda targets: an army that invades another country, bombing
	hospitals along the way, is hardly likely to cavil at the thought
	of using a supposedly-civilian network for its purposes.  In
	addition, because of considerations of efficacy, either the
	blocklist would be totally ineffective or else it would rapidly
	grow and splinter the Internet very badly.

	• Any blocklist sufficient to achieve the political goals of the
	blocklist would be low in granularity (section 4.1.2), largely for
	the same reasons above.  When cutting off networks completely, one
	affects every use from within that network.

	• Any blocklist sufficient to achieve the political goals of the
	blocklist would need to block not only the networks that are
	directly implicated in the undesirable political operations of the
	target, but also any network that provided communication to those
	networks.  That is the only way the blocklist could be efficacious
	(section 4.1.3).  This would entail serious consequences for the
	very idea of the Internet.  It might be politically unacceptable
	to do such damage to the Internet, in which case the blocklist
	would have low efficacy and would really be a symbolic gesture.  A
	symbolic gesture seems all but guaranteed to be useless (and
	unsatisfying to those who want the desired political effect).

	• Any blocklist likely to be proposed would probably have negative
     consequences for security (section 4.1.4) given the realities of
     how the X.509 certificate system works.  In particular, since
     even the most granular blocklist would doubtless cover certain
     government sites, those sites would not be able to obtain their
     certificates through usual means. This will inevitably cause the
     target government authorities to issue their own CAs that are to
     be trusted for communication with the government. Given that the
     working theory behind the blocklist is that said government is not
     benevolent (otherwise it would presumably not be a target for
     sanction), there are good reasons to doubt that such a CA would
     secure communications in the ways one might desire.

In sum, there are two possibilities.  In one case, the blocklist will
be overbroad and have negative consequences for ordinary citizens, and
therefore fails the sanctions statement's principle, "Disconnecting
the population of a country from the Internet is a disproportionate
and inappropriate sanction."  As I argued in my previous post, such a
blocklist protocol would have negative consequences for the right of
freedom of association.  Alternatively, the blocklist will be too
small to be effective, and so fails the statement's principle,
"Ineffective sanctions waste effort and willpower and convey neither
unity nor conviction."  Such a blocklist and its associated protocol,
if required by law, would _still_ have negative effects for freedom of
association, because it would prevent some networks who might want to
connect to other networks from making those connections. And of
course, if the regime were totally voluntary then it would likely be
ignored, and the foreign policy preferences of the governments that
desired to use economic sanctions would not be implemented at all (but
that branch of the logic seems to me off-topic for this RG, so I won't
consider it further here).

[1] What we today call sanctions were called, at the time of their
adoption as a tool of the League of Nations, "the economic weapon".
See Mulder, Nicholas, _The Ecomomic Weapon: The Rise of Sanctions as a
Tool of Modern War_. New Haven: YUP, 2022.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 14 Mar 2022 11:18:45 -0400

Hi,

[still employed, still not speaking for them]

>This discussion perhaps does not belong here, but this is most probably due to the fact that change control of the RG documents lies with the RG, and we implemented every change proposed by the RG.…

I think I argued previously that attempting to make the documents the collective product of the RG was harmful to the quality of the documents, because they had the effect you note.  Please don't take it as a criticism of the editors, who have I think laboured to get contradictory opionions into some kind of coherence. That task is, however, pretty hard to make end well, and I think the draft suffers in clarity as a result.  I wish I had something to contribute that could help, but I don't.  It was in part my frustration with this path for documents that led me to conclude I couldn't contribute meaningfully here, which is why I mostly went silent.

>You helped us come up with some defitions as the Acknowledgements section describes, but if you want I'll remove you right away:

Well, to the extent I contributed anything it was as a participant in the RG, which is already captured, so thanks for the adjustment!

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 14 Mar 2022 16:26:31 +0100

On 14-03-2022 16:18, Andrew Sullivan wrote:
> I think I argued previously that attempting to make the documents the collective product of the RG was harmful to the quality of the documents, because they had the effect you note. 

I agree with you. We worked very hard to get consensus on documents and I think this did not increase the quality of the documents.

> Please don't take it as a criticism of the editors, who have I think laboured to get contradictory opionions into some kind of coherence. That task is, however, pretty hard to make end well, and I think the draft suffers in clarity as a result.  I wish I had something to contribute that could help, but I don't.  It was in part my frustration with this path for documents that led me to conclude I couldn't contribute meaningfully here, which is why I mostly went silent.

I understand - but this also really saddens me.

Maybe we should drop the consensus requirement for RG docs, but then again, we don't want to publish everything. I hope the chair(s) can come up with a way to address this.
> 
>> You helped us come up with some definitions as the Acknowledgements section describes, but if you want I'll remove you right away:
>>
> 

My pleasure.

Best,

Niels

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 14 Mar 2022 19:41:43 +0100

Deaar Andrew,

> attempt to use one economic good (connectivity) to cause other kinds

A-ha! Here we might have found a root of some miscommunication. You see connectivity as economic good. I through we were talking about connectivity as the ability of people to exercise article 19 of the UDHR and the ICCPR, in other words, to communicate.

If this is the case, that provides a lot of frames around previous discussions about this. Then I also understand why you don't see it as 'political' that BGP does take into account economic considerations, but not other political considerations. Because you see connectivity as an inherent economic good.

My question would then be, is connectivity for you _only_ an economic good?

> under some government policy, it is an abridgement of that freedom by

It might be bad from the freedom of association of some actors, but again, human rights are indivisible, unalienable, and interrelated. And any limitation on human rights should be proportionate. So here we would need to take into account the whole impact of the actions within scope.

Best,

Niels

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 14 Mar 2022 15:29:02 -0400

Hi,

[disclaimer as before]

>A-ha! Here we might have found a root of some miscommunication. You see connectivity as economic good. I through we were talking about connectivity as the ability of people to exercise article 19 of…

I think I'd rather say that in this context it is being handled as an economic good, because that's what economic sanctions regimes are about.  That's why it was called "the economic weapon" in the first place.

>My question would then be, is connectivity for you _only_ an economic good?

No, of course not.

>rights are indivisible, unalienable, and interrelated. And any limitation on human rights should be proportionate. So here we would need to take into account the whole impact of the actions within scope.
>

Yes, that was the point of the rest of the analysis I offered, which among other things argued that either the sanctions could be catastrophic for the Internet to be effective, or could be proportionate but ineffective.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Jens Finkhaeuser <[email-masked]>
Date: Mon, 14 Mar 2022 20:17:15 +0000

Hi,

------- Original Message -------

> I think I'd rather say that in this context it is being handled as an economic good, because that's what economic sanctions regimes are about. That's why it was called "the economic weapon" in the…

That's fair, and understandable. I was viewing connectivity as more in line with Niels' interpretation as related to UDHR 19.

> Yes, that was the point of the rest of the analysis I offered, which among other things argued that either the sanctions could be catastrophic for the Internet to be effective, or could be proporti…

But I think that is exactly the point that the paper makes. It just goes on to actually support those proportionate measures.

Bill's last reply and my reading of the paper suggests that the main point here is to create a defensible position for network operators against too much filtering: they can hardly be accused of doing nothing if they filter something. And if the filters are created carefully by a multi-stakeholder organization in full consideration of their impact on human rights, calls for stricter measures automatically cast a bad light on the party doing the calling - and network operators may use that in the Internet's favour.

I do - maybe naively - see value in this.

At this point it seems I am starting to repeat myself, however, and I don't want to impose that on anyone - so don't be surprised if I reply less.

Jens

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 14 Mar 2022 23:43:49 +0000

Hiya,

(In general, I agree with Andrew's analysis, but one other
aspect below.)

On 14/03/2022 20:17, Jens Finkhaeuser wrote:
> Bill's last reply and my reading of the paper suggests that the main
> point here is to create a defensible position for network operators
> against too much filtering: they can hardly be accused of doing
> nothing if they filter something. And if the filters are created
> carefully by a multi-stakeholder organization in full consideration
> of their impact on human rights, calls for stricter measures
> automatically cast a bad light on the party doing the calling - and
> network operators may use that in the Internet's favour.
> 
I'm skeptical.

But aside from considering efficacy, do we have any examples
of blocklists for which the evidence justifying a block, and
all the process steps leading to a decision to add an entry,
are public?

I can't think of one, but they may exist.

It might be that if the proponents here fleshed out the idea
another level deeper, then it'd be easier to understand just
what's envisaged. Personally, I can't really see how to setup
anything resembling what's envisaged, but I may be missing
something.

Cheers,
S.

---

From: [email-masked]
Date: Mon, 14 Mar 2022 21:01:15 -0400

One can find many good articles on sanctions and their history, for
example one paywalled Economist article:

  https://www.economist.com/finance-and-economics/2021/04/22/sanctions-are-now-a-central-tool-of-governments-foreign-policy

Brief Summary:

1. Modern economic sanction regimes arose from the League of Nations
as an alternative to warfare after the War To End All Wars #1.

2. An historical review of the past 100 years indicates they only very
rarely work except perhaps in situations where the targeted party is
not very committed to whatever the others wish changed.

More often the target finds ways to retaliate (e.g., the US sanctions
China, China sanctions the US.)

3. One consistent failure of sanctions is they're rarely removed other
than the rare case where some measurable compliance is achieved.

The US has had severe sanctions against Cuba for well over 50
years. Rather than considering their goals and whether they should or
should not continue to be pursued the sanctions themselves become an
internal political football, a litmus test of which side one is on
philosophically (e.g., do you or do you not tolerate small, tropical
communist governments.)

Which is why I keep asking those who would like to impose sanctions
such as interfering with Russia's internet connectivity: Under what
specific circumstances would you end those sanctions?

-- 
        -Barry Shein

---

From: Alexandre Petrescu <[email-masked]>
Date: Tue, 15 Mar 2022 13:13:31 +0100

> specific circumstances would you end those sanctions?

When there is peace and everyone is happy again :-)

The answer to that question might have to do with the ongoing 
negotiations Ukr-Rus.  They have a number of publicly known, and other 
private, requests and positions to fulfill.  Among the publicly known 
requests are claims to territory, troop movements, humanitarian 
corridories.  Some less known, put still public, requests are 
'orientation' requests, i.e. a country requests another country where to 
'orient', to look more at some thing than another thing.  The private 
requests are only known by them at this time.

What can be said now, is probably that a timeline to end Internet 
connection sanctions might be closely following the timeline of 
discussion and implementaiton of the Ukr-Rus negotiations.

Also, in the current requests often words like 'never do this' or 'do 
this forever', are hard to implement.

There is a timeline of EU sanctions since 2014.   In it, one can see 
that some sanctions are indefinite, some are prolonged every X months, 
and others I couldnt have time to read. 
https://www.consilium.europa.eu/en/policies/sanctions/restrictive-measures-ukraine-crisis/history-ukraine-crisis/

Alex

---

From: Mallory Knodel <[email-masked]>
Date: Tue, 15 Mar 2022 10:50:40 -0400

Hi,

> all the process steps leading to a decision to add an entry,

I have seen leaked lists but none are public. Some stretching into the 
tens of thousands. Some mandatory, some as guidance.

This speaks to yet another paradox of this exercise. If you publish the 
blocklist and make recommendations on how to do it technically then you 
are facilitating circumvention. As Andrew said before, you can be 
proportionate (and accountable) but then you are ineffective.

This itself is a proportionality test. And I don't believe the authors 
have presented a tradeoff that is proportionate given the political 
risks. I'll answer Bill's previous question to me about political risks. 
In the case of censoring, or boycotting through internet cutoff, the 
Russian military, you are:

  * Provoking Russia on national security and it will have ramifications 
at the UN on the cybercrime treaty and any future hope of a 
cybersecurity treaty,

  * Giving Russia an excuse to continue building its own internet, 
splintering further away,

  * Undermining civil society's prior positioning firmly against all 
internet censorship even to advocate for carve outs in sanctions,

  * Normalising blocking by intermediaries that haven't the in-house 
capacity to take a political position, when instead we should be helping 
build their capacity to resist unjust blocking,

  * Moving out of alignment what is best for the internet and what is 
best for people,

  * Making more incoherent messaging and guidance about is "right" to 
do, not less.

  * Abstracting the nascent capacity to govern the internet with 
political considerations away from where those decisions should instead 
be made.

> anything resembling what's envisaged, but I may be missing

This is what I have said, though not to the list: Follow through with 
the blocklist as proposed. Who are you waiting for to start this work?

As Bill said, no one has to ask permission to do things like this on the 
internet. So do the thing. Form your group and give the world a 
blocklist. Of course you'll never get the civil society sector to come 
to consensus about it, so you can't call it that (as you do in your 
letter). The list will represent the views of the people who are in the 
group. If your advice has managed to persuade everyone, is valuable, is 
actionable and makes a difference, then your idea will succeed.

Gentle reminder to everyone in the discussion that we are meant here to 
identify research topics related to human rights and internet protocols.

My view on that is that I do see potential here, but it is as I have 
said already: what's important is for each existing internet governance 
body to identify objectionable behaviour within its mandate and to 
document how objectionable behaviour is actioned. HRPC could could 
survey the existing space for best practice and how that has already 
been done. Then outline how existing guidance might play out in various 
scenarios like war, what we think might be missing, and make 
recommendations for how to do fill those gaps.

-Mallory

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 15 Mar 2022 16:41:52 +0100

On 14-03-2022 16:11, Andrew Sullivan wrote:
> unity nor conviction."  

Why would a small blocklist not be effective? This is unclear to me.

> Such a blocklist and its associated protocol,
> connect to other networks from making those connections. 

As laid out in the FoA draft, there are legitimate limitations to FoAA, especially where it comes to violence.

> And of
> ignored

For me it is also not clear why this is the case. It could be that many network operators don't have the capacity to come up with a solid and weighted reasoning. This is what the proposed body could offer.

>, and the foreign policy preferences of the governments that

Sure, they were called that when they were used by states. But they don't have to be when they are deployed by network operators.

Best,

Niels

---

From: Bill Woodcock <[email-masked]>
Date: Tue, 15 Mar 2022 16:50:29 +0100

> On Mar 15, 2022, at 3:50 PM, Mallory Knodel <[email-masked]> wrote:
> I'll answer Bill's previous question to me about political risks. In the case of censoring, or boycotting through internet cutoff, the Russian military, you are:
> 
>  * Provoking Russia on national security and it will have ramifications at the UN on the cybercrime treaty and any future hope of a cybersecurity treaty,

You think it’s _substantially more_ prevocational to block their military than to block their whole country?

>  * Giving Russia an excuse to continue building its own internet, splintering further away,

First. they don’t need an excuse.  Second, can you present a rationale for why you believe military-only is more of an excuse than whole-country?  That seems radically counterintuitive to me.

>  * Undermining civil society's prior positioning firmly against all internet censorship even to advocate for carve outs in sanctions,

If party A and party B are in disagreement, and party C is somewhere in-between, how does party C’s position “undermine” party A’s position?  Are people not free to have disagreeing positions?

>  * Normalising blocking by intermediaries that haven't the in-house capacity to take a political position, when instead we should be helping build their capacity to resist unjust blocking,

How does blocking less normalize more than blocking more does?

>  * Moving out of alignment what is best for the internet and what is best for people,

How is blocking civilians “what is best for people?"

>  * Making more incoherent messaging and guidance about is "right" to do, not less.

?  Explain?

>  * Abstracting the nascent capacity to govern the internet with political considerations away from where those decisions should instead be made.

Where do you think they should be made?  Governments are very clear that they should be made in government.

If you don’t believe the governmentally-proposed solution is the right one, and you believe they should be made elsewhere, what’s your plan for doing that?

> You'll never get the civil society sector to come to consensus about it

Agreed.

> so you can't call it that (as you do in your letter).

Where do you see that?

> Gentle reminder to everyone in the discussion that we are meant here to identify research topics related to human rights and internet protocols.

I’m always happy to discuss in private email, I don’t have any burning desire to use public-mailing-list bandwidth.  I do want to make sure I fully understand all cautions, additional information, arguments against, etc.  So please do follow up with me if you feel like I’m not understanding what you’re saying (anyone, this isn’t specifically with respect to Mallory).

                                -Bill

---

From: Mallory Knodel <[email-masked]>
Date: Tue, 15 Mar 2022 11:58:22 -0400

Bill,

Suffice to say only that in your effort to build this multi stakeholder
sanctions group and develop considered advice, purportedly to tackle thorny
political questions, you’ve not considered some obvious points that I, and
others, have raised as to the knock on effects in other more consequential
political fora.

This conversation demonstrates the lack of consensus and as well as a huge
gap in the proposed approach.

I don’t feel it’s critical to continue debating it point by point and agree
the list shouldn’t continue down this thread either.

-Mallory

On Tuesday, March 15, 2022, Bill Woodcock <[email-masked]> wrote:

> > I'll answer Bill's previous question to me about political risks. In the
> case of censoring, or boycotting through internet cutoff, the Russian
> military, you are:
> >
> at the UN on the cybercrime treaty and any future hope of a cybersecurity
> treaty,
>
> First. they don’t need an excuse.  Second, can you present a rationale for
> why you believe military-only is more of an excuse than whole-country?
> That seems radically counterintuitive to me.
>
> If party A and party B are in disagreement, and party C is somewhere
> in-between, how does party C’s position “undermine” party A’s position?
> Are people not free to have disagreeing positions?
>
> political considerations away from where those decisions should instead be
> made.
>
> If you don’t believe the governmentally-proposed solution is the right
> one, and you believe they should be made elsewhere, what’s your plan for
> doing that?
>
> I’m always happy to discuss in private email, I don’t have any burning
> desire to use public-mailing-list bandwidth.  I do want to make sure I
> fully understand all cautions, additional information, arguments against,
> etc.  So please do follow up with me if you feel like I’m not understanding
> what you’re saying (anyone, this isn’t specifically with respect to
> Mallory).
>
>                                 -Bill
>
>

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 15 Mar 2022 16:59:08 +0100

On 15-03-2022 15:50, Mallory Knodel wrote:
> I have seen leaked lists but none are public. Some stretching into the tens of thousands. Some mandatory, some as guidance.
> 
> This speaks to yet another paradox of this exercise. If you publish the blocklist and make recommendations on how to do it technically then you are facilitating circumvention. As Andrew said before, you can be proportionate (and accountable) but then you are ineffective.

I am not convinced this is necessarily the case. It would indeed be a cat and mouse game, but it would definitely have consequences. It would both send a message (what some have been calling 'feel good', but which I think is more than that) and cause labor for an institution that is currently using all of its capacity for violence against another population and censorship against its own.

> 
> This itself is a proportionality test. And I don't believe the authors have presented a tradeoff that is proportionate given the political risks. 

No, the authors of the statement have only proposed principles and a

>   * Provoking Russia on national security and it will have ramifications at the UN on the cybercrime treaty and any future hope of a cybersecurity treaty,

How would that be different from the current positioning of Russia?
>   * Giving Russia an excuse to continue building its own internet, splintering further away,

Again, seeing the position of Russia during WTSA and the passing of its recent regulations, how would this be different? Now that it still is connected, this connection could be leveraged.
>   * Undermining civil society's prior positioning firmly against all internet censorship even to advocate for carve outs in sanctions,

I don't think civil society has positioned itself again all filtering.

>   * Normalising blocking by intermediaries that haven't the in-house capacity to take a political position, when instead we should be helping build their capacity to resist unjust blocking,

I don't see why these can't happen at the same time. By developing capacity in a multistakeholder body brings the discussion in the open and brings together more capacity, perspective, and experience.
>   * Moving out of alignment what is best for the internet and what is best for people,

Not sure what is meant with this.

>   * Making more incoherent messaging and guidance about is "right" to do, not less.

Not sure what is meant with this.

>   * Abstracting the nascent capacity to govern the internet with political considerations away from where those decisions should instead be made.

If we come to the conclusion that internet governance should explicitly not do this but leave this to states, this I think should be reflected in statements such as that of RIPE, and not say: we will do everything lawfully possible fight this.

> This is what I have said, though not to the list: Follow through with the blocklist as proposed. Who are you waiting for to start this work?

Work is being done, but I think it is also important to bring people along.

> 
> As Bill said, no one has to ask permission to do things like this on the internet. So do the thing. Form your group and give the world a blocklist. Of course you'll never get the civil society sector to come to consensus about it, so you can't call it that (as you do in your letter). 

In my experience, there is never civil society consensus on anything, but that does not mean we should exhaustively try.

> The list will represent the views of the people who are in the group.

As it is with any multistakeholder decision making process, for better or for worse.

Best,

Niels

> If your advice has managed to persuade everyone, is valuable, is actionable and makes a difference, then your idea will succeed.
> 
> My view on that is that I do see potential here, but it is as I have said already: what's important is for each existing internet governance body to identify objectionable behaviour within its mandate and to document how objectionable behaviour is actioned. HRPC could could survey the existing space for best practice and how that has already been done. Then outline how existing guidance might play out in various scenarios like war, what we think might be missing, and make recommendations for how to do fill those gaps.
> 
> -Mallory
>

---

From: Eliot Lear <[email-masked]>
Date: Tue, 15 Mar 2022 19:57:12 +0100

Just on this point:

On 15.03.22 15:50, Mallory Knodel wrote:
>
>  * Provoking Russia on national security and it will have 
> ramifications at the UN on the cybercrime treaty and any future hope 
> of a cybersecurity treaty, 

This in and of itself is worthy of discussion.  Is the UN the right 
venue for such a treaty?  What do we envision the teeth in such a treaty 
would be?  I have seen argument out of Sec. Blinken and his State 
Department that there is room for either direction.

Eliot

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 15 Mar 2022 15:30:40 -0400

Hi,

[disclaimer still in effect]

>Why would a small blocklist not be effective? This is unclear to me.

I thought I laid out in some detail in the text you quoted why I thought that.

>As laid out in the FoA draft, there are legitimate limitations to FoAA, especially where it comes to violence.

Sure, but it is totally unclear to me how an Official Baddies List prepared by the a self-appointed Company of Internet Goodies does anything about violence.  To bring this back again to the topic we're supposed to be discussing on this list, there is I suppose a right of association that the people who come up with some blocklist are exercising when they create a list, and I guess one can exercise such a right in deciding to (or not to) use such a list.  That freedom would, of course be abrogated if you _had_ to use the list, so there is a rights dimension to this question.  Government imposed economic sanctions are always in some sense a limitation of FoAA.

It is certainly true that there are rights being violated in instances of violence.  But I thought it was a matter of pretty universal consensus that, if you're going to claim to violate a right for legitimate reasons, those reasons actually need to be legitimate. It would appear to me to be self-evident that, if the avowed purpose of the violation has low chance of succeeding, then there is poor evidence of the legitimate basis for the violation.  No?

>For me it is also not clear why this is the case.

Because at least some operators would not care what the sanctioned party was doing, and would prefer to make the profit.  This is why economic sanctions are government-imposed via laws (I should think it obvious).  But I guess that topic of discussion leads away from the purpose of the RG, so I'm not sure it's on topic here.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Mallory Knodel <[email-masked]>
Date: Tue, 15 Mar 2022 15:56:01 -0400

Hi,

On 3/15/22 2:57 PM, Eliot Lear wrote:
> venue for such a treaty?  What do we envision the teeth in such a 
> treaty would be?  I have seen argument out of Sec. Blinken and his 
> State Department that there is room for either direction.
>
We have already the Budapest Convention from the EC but it is old (22 
years!) and has not-so-great bits (intellectual property gets 
disproportionate treatment, etc). Cybercrime treaties are easier to 
create and "enforce" than cybersecurity because their teeth are almost 
all incentives, not punishments. Those incentives are expanded 
jurisdiction and increased cooperation between law enforcement and 
intelligence agencies.

The best we can do in the public interest is limit scope and mandate as 
much as possible or else 'every crime in the digital age is a 
cybercrime'. Civil society has consistently held the line that 
cybercrime must not touch content issues and rather focus on 
core-cybercrimes and it undermines our efforts when there is discord 
about what where content issues are handled, how, and by whom. For 
example, if a cybercrime treaty MUST NOT deal with issues like hate 
speech and incitement to violence because those are already covered by 
other treaty mechanisms and have nothing at their core to do with the 
internet, then we ought not to be seen recommending that we mitigate 
them with internet-specific mechanisms.

Rather than "let god sort them out", can we start saying "let the 
content layer sort them out".

-Mallory

---

From: Melinda Shore <[email-masked]>
Date: Tue, 15 Mar 2022 13:10:04 -0800

On 3/15/22 7:58 AM, Mallory Knodel wrote:
> I don’t feel it’s critical to continue debating it point by point and 
> agree the list shouldn’t continue down this thread either.

Right, this discussion seems pretty unlikely to contribute to research
group products, unless someone can start narrowing down questions with
an eye to the research group charter.  But it may be worth seeing if
there's value or interest in setting up a non-working group IETF mailing
list (or not).

Melinda

-- 
Melinda Shore
[email-masked]

Software longa, hardware brevis

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 16 Mar 2022 01:41:51 +0000

Hiya,

> the list shouldn’t continue down this thread either.

FWIW, I think this is a good list to debate these topics.
(While at the same time disagreeing with the proponents
of the purported blocklist.)

My main reason is that there seem to be reasonable people
who are otherwise engaged with this list/HRPC and who are
arguing different sides. That seems to me like a fertile
setup so worth exploring, regardless of whether or not we've
identified a PhD-worthy research topic. (If the RG chairs
continue to disagree that's fine by me but I'd love a ptr
to where discussion continues as I of course want to keep
arguing against:-)

I'm also still perplexed as to how any blocklist could ever
be governed in an open multi-stakeholder manner though and
have yet to see arguments (here or elsewhere) as to how
that's even possible. If (as I think for now) that's a
killer argument against this proposition, then it'd IMO
be good to see that argument approach resolution somewhere.

Cheers,
S.

PS: Apologies for introducing the string "**SPAM**" into
the subject line - our dept migrated to using an external
mail service provider last year and while that's had some
good effects, one of the crap ones is that mail gets badly
classified according to unknowable blocklists and robots
into spam/ham. And I forgot to edit the polluted subject
line, sorry.

---

From: Eliot Lear <[email-masked]>
Date: Wed, 16 Mar 2022 07:06:13 +0100

On 15.03.22 20:56, Mallory Knodel wrote:
> disproportionate treatment, etc). 

You suggested that a provocation "will have ramifications at the UN on 
the cybercrime treaty and any future hope of a cybersecurity treaty".  I 
presumed (and presume) you are referring to the ongoing activity in New 
York.  There is a fundamental presumption that Russia should be a party 
to such a treaty in the first place, and that the UN is the correct 
venue to establish such an instrument.  As you point out, the last one 
was established *not* by the UN but by the Council of Europe.  There is 
at least one other analogue in Africa.

Before he was Secretary of State, Anthony Blinken along with Dr. David 
Hagan argued for a different security arrangement involving a "league of 
democracies or a democratic network".[1]  My point is that your concern 
would be obviated if Russia isn't going to be a part of that, at least 
under their current regime, who views cyberattacks as a legitimate 
foreign policy instrument: Putin's not going to give that up.  And 
perhaps neither should the US in certain circumstances (e.g., Stuxnet).

On the other hand, there has been at least cooperation in NY between 
Russia and the US at the HLEG, so the administration is clearly at least 
willing to entertain some development of the ideas there.

> Cybercrime treaties are easier to create and "enforce" than 
> cybersecurity because their teeth are almost all incentives, not 
> punishments. Those incentives are expanded jurisdiction and increased 
> cooperation between law enforcement and intelligence agencies.

The fundamental assumption made is that there is agreement that 
cyberattacks are not legitimate.  See above.  But on the whole, tho, 
democracies don't attack one another and so incentives align well.

So... who would administer a blocklist?  It sounds very much like such a 
"league".

Eliot

[1] 
https://www.brookings.edu/blog/order-from-chaos/2019/01/04/america-first-is-only-making-the-world-worse-heres-a-better-approach/

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 16 Mar 2022 12:21:30 +0100

I agree with Stephen that I could hardly think of a better place to discuss this that here. Many relevant actors are here, there is a good discussion, and I think a lot of research questions and considerations are coming from this that touch on human rights, geopolitics, and the internet infrastructure. Furthermore, the relationship between DDoS, spam, and human rights has also been extensively discussed here.

I could imagine research that is similar to this (very much recommended) could result from this:
https://firstmonday.org/ojs/index.php/fm/article/view/11700/10128

However, if it is the opinion of the chair that this is not relevant for the RG, I can live with that.

Best,

Niels