2015-03-27 11:52:06-0500 ------------------------ hrpc meeting 11:50-13:20 at IETF-92, Dallas, TX, US https://www.ietf.org/proceedings/92/slides/slides-92-hrpc-0.pdf Agenda ------ Status of the research group. Joana: october 27 I-D published. spoke at SAAG at IETF-91 26 ~45minute interviews at IETF-92 Temporary research group, after a year, there will be a review to see if this should be made more permanent. What is the purpose of the Internet? How does this map to human rights? Focusing on freedom of expression and association initially. slide 16- Andrew Sullivan: this approach conflates certain positive rights and negative rights. e.g. resilience requires that communications remain up, distributed arch requires ubiquity (positive rights). these are different from privacy and content-agnosticism (negative rights). Dave Crocker: resilience and robustness fall under connectivity. the definition of FoE is much more powerful than FoA. FoE is the right thing to show. I agree with Andrew's assesment that positive vs. negative is important. Also, on slide 11, you're missing e-mail as a bi-directional interconnectivity. Niels: FoE definition is quite abstract. Do we need to define these terms in a more detailed way? Robert Sparks: Yes, you have to get more detailed. Looking at the classification, i can't figure out where geolocation fits in. how do we distinguish how much your geoloc information leaks, from how do we know what others can do with it. Juan-Carlos Zuniga: Privacy isn't about hiding everything; it's about user being able to decide who gets access to what. I like the systematic approach, but slide 15: for FoA, how can i define this problem? FoA is not a two-person or a one-way problem. This meeting is a lot of people, but only a few people talk. is this association? we need to be clearer about this to be able to have the systematic approach. Niels: in 1908, Brecht said that radio can only be fully fulfiled if the audience is able to talk back. on the internet we seem to be closer to that. I don't think everyone needs to talk at the same time. J-C Z: people can talk back in other media; even if they only hear radio, the ther mechanisms provide feedback. Niels: to address your first question: transparency is also in the list, jabber scribe: Avri doria says she's pat of the assembly, though remotely. Larry Masinter: what about other rights that might infringe on FoE? copyright, right to be forgotten, etc. how can we address these countervailing rights? Fred Baker: FoA and FoE don't go together. FoA is about being able to be in a room together, online, it's maybe being in a group, like a mailing list or facebook friends or something, but it's not about Ladar: FoA is classically described as the ability of being in the room without being placed under suspicion. "something like metadata" Dave Crocker: slide 13 is an interesting list. have you written explanations why each item is important, and what the arguments against them might be? more detail would help get the list clearer. dkg: privacy belongs in FoA directly, not just as part of FoE. Niels: balancing rights is crucial. privacy vs. expression can come in conflict. We have ways to balance them outside of protocols. do we have a way to balance them technically? to Dave Crocker: we have a little bit more detail sorted out in the I-D Joana: FoA isn't quite as clear as it should be, so maybe we need to go back and clarify it. Niels: we did start with mailing lists, we appear to have lost the link between them. ----- back to presentation, at slide 16. Justin Richer: are you distinguishing between violations as a result of the protocol as designed, or in situations where the protocol has been perverted? Niels: i think both, though the research might want to start focusing on violations as a result of the protocol as designed. Stephane Bortzmeyer: I don't know that we can distinguish between these two as clearly as possible. In many cases you might not be able to tell. Niels: Justin, can you come up with a definition? Justin: a good example of a perversion would be a DDoS: you're technically doing everythign within the lines of the protocol, but not as it was intended to be used. Ladar: While not a protocol: an example of perversion might be the laws that were passed required every mobile phone to carry a gps chip for e-911. for the perversion, it would be activating it remotely to track everyone the whole time. Niels: in both cases, you've got a breach of intentionality. and sometimes innovation comes from the breach of original intention. Fred Baker: if i'm under DDoS, i'm not speaking, or attempting assembly. In a DDoS, the packets being used for ICMP are being used by the emitter for a purpose that is not the original purpose for ICMP. (ICMP was intended for measurement, but is being used for DDoS. Justin: there are different intentions in protocols. Dave Crocker: seconding fred, plus: this highlights differences between mechanics of protocols, administration and operations of protocols, intentions of protocol designers and specifiers, and the difference between "Policies and Procedures", which some people might call "politics". they are decreasingly in the technical space, but they're the layers above layer 7, which we cannot operate without. They factor in here essentially (we can't avoid them) and problematically (because ???) < transcription failure Andrew Sullivan: the distinction between Perverse vs. appropriate use won't help you. This assumes that we know the telos or goal of the protocol. Protocols are often used in ways that they didn't intend in the first place. To focus entirely on the protocol itself, you have to pay attention to how the protocol works *without* the intentionality of either the designer or the user. J-C Z: seconding Andrew. In privacy considerations, civic locations/address in e-911 is relevant in the privacy considerations. we have to enumerate these things so that we can understand the risks of using it in certain ways. ----- back to the slides, slide 17 Joana: please point the list to instances of protocol exploitation. https://lists.ghserv.net/mailman/listinfo/hrpc plan to continue interviews. also looking and discussion on the list. ----- slides done. Fred: making relationships explicit. in some cultures, women can only communicate through their husbands. Lee Howard: the same tools that can be used to find people and suppress individuals can also be used to find bad people and to suppress bad individuals -- i don't know how we figure out how to do one without the other. there are bad people in the world. I'd like to make sure that we're looking at both sides. I don't necessarily trust law enforcement, but i also need them. Niels: that's why transparency for these things and analysis is important. the better we understand our approaches, the better we can distinguish between the issues.