idnits 2.17.1 draft-irtf-hrpc-guidelines-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The abstract seems to contain references ([RFC6973], [RFC8280]), which it shouldn't. Please replace those with straight textual mentions of the documents in question. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (March 11, 2019) is 1873 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '1' on line 1271 -- Looks like a reference, but probably isn't: '2' on line 1273 -- Looks like a reference, but probably isn't: '3' on line 1275 -- Obsolete informational reference (is this intentional?): RFC 793 (Obsoleted by RFC 9293) -- Obsolete informational reference (is this intentional?): RFC 3979 (Obsoleted by RFC 8179) -- Obsolete informational reference (is this intentional?): RFC 4941 (Obsoleted by RFC 8981) Summary: 1 error (**), 0 flaws (~~), 1 warning (==), 7 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Human Rights Protocol Considerations Research GroupN. ten Oever (editor) 3 Internet-Draft University of Amsterdam 4 Intended status: Informational G. Grover (editor) 5 Expires: September 12, 2019 Centre for Internet and Society 6 March 11, 2019 8 Guidelines for Human Rights Protocol and Architecture Considerations 9 draft-irtf-hrpc-guidelines-02 11 Abstract 13 This document sets guidelines for human rights considerations in 14 networking protocols, similar to the work done on the guidelines for 15 privacy considerations [RFC6973]. This is an updated version of the 16 guidelines for human rights considerations in [RFC8280]. 18 Status of This Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at https://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on September 12, 2019. 35 Copyright Notice 37 Copyright (c) 2019 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (https://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 Table of Contents 52 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 53 2. Vocabulary used . . . . . . . . . . . . . . . . . . . . . . . 3 54 3. Guidelines for developing human rights protocol 55 considerations . . . . . . . . . . . . . . . . . . . . . . . 3 56 3.1. Human rights threats . . . . . . . . . . . . . . . . . . 3 57 3.2. Conducting human rights reviews . . . . . . . . . . . . . 4 58 3.2.1. Analyzing drafts based on guidelines for human rights 59 considerations model . . . . . . . . . . . . . . . . 5 60 3.2.2. Analyzing drafts based on their perceived or 61 speculated impact . . . . . . . . . . . . . . . . . . 5 62 3.2.3. Expert interviews . . . . . . . . . . . . . . . . . . 5 63 3.2.4. Interviews with impacted persons and communities . . 5 64 3.2.5. Tracing impacts of implementations . . . . . . . . . 6 65 3.3. Guidelines for human rights considerations . . . . . . . 6 66 3.3.1. Connectivity . . . . . . . . . . . . . . . . . . . . 7 67 3.3.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . 7 68 3.3.3. Content agnosticism . . . . . . . . . . . . . . . . . 8 69 3.3.4. Security . . . . . . . . . . . . . . . . . . . . . . 8 70 3.3.5. Internationalization . . . . . . . . . . . . . . . . 9 71 3.3.6. Censorship resistance . . . . . . . . . . . . . . . . 10 72 3.3.7. Open Standards . . . . . . . . . . . . . . . . . . . 11 73 3.3.8. Heterogeneity Support . . . . . . . . . . . . . . . . 12 74 3.3.9. Pseudonymity . . . . . . . . . . . . . . . . . . . . 13 75 3.3.10. Accessibility . . . . . . . . . . . . . . . . . . . . 14 76 3.3.11. Localization . . . . . . . . . . . . . . . . . . . . 15 77 3.3.12. Decentralization . . . . . . . . . . . . . . . . . . 15 78 3.3.13. Reliability . . . . . . . . . . . . . . . . . . . . . 16 79 3.3.14. Confidentiality . . . . . . . . . . . . . . . . . . . 17 80 3.3.15. Integrity . . . . . . . . . . . . . . . . . . . . . . 18 81 3.3.16. Authenticity . . . . . . . . . . . . . . . . . . . . 19 82 3.3.17. Adaptability . . . . . . . . . . . . . . . . . . . . 20 83 3.3.18. Outcome Transparency . . . . . . . . . . . . . . . . 20 84 3.3.19. Anonymity . . . . . . . . . . . . . . . . . . . . . . 21 85 4. Document Status . . . . . . . . . . . . . . . . . . . . . . . 22 86 5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 22 87 6. Security Considerations . . . . . . . . . . . . . . . . . . . 22 88 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 89 8. Research Group Information . . . . . . . . . . . . . . . . . 22 90 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 22 91 9.1. Informative References . . . . . . . . . . . . . . . . . 22 92 9.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 27 93 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27 95 1. Introduction 97 This document outlines a set of human rights protocol considerations 98 for protocol developers. It provides questions engineers should ask 99 themselves when developing or improving protocols if they want to 100 understand their potential human rights impact. It should however be 101 noted that the impact of a protocol cannot solely be deduced from its 102 design, but its usage and implementation should also be studied to 103 form a full protocol human rights impact assessment. 105 The questions are based on the research performed by the hrpc 106 research group which has been documented before these considerations. 107 The research establishes that human rights relate to standards and 108 protocols, and offers a common vocabulary of technical concepts that 109 impact human rights and how these technical concepts can be combined 110 to ensure that the Internet remains an enabling environment for human 111 rights. With this the contours of a model for developing human 112 rights protocol considerations has taken shape. 114 This document is a further iteration of the guidelines that can be 115 found in [RFC8280]. 117 2. Vocabulary used 119 3. Guidelines for developing human rights protocol considerations 121 3.1. Human rights threats 123 Human rights threats on the Internet come in a myriad of forms. 124 Protocols and standards can harm or enable the right to freedom of 125 expression, right to non-discrimination, right to equal protection, 126 right to participate in cultural life, arts and science, right to 127 freedom of assembly and association, and the right to security. An 128 end-user who is denied access to certain services, data or websites 129 may be unable to disclose vital information about the malpractices of 130 a government or other authority. A person whose communications are 131 monitored may be prevented from exercising their right to freedom of 132 association or participate in political processes [Penney]. In a 133 worst-case scenario, protocols that leak information can lead to 134 physical danger. A realistic example to consider is when individuals 135 perceived as threats to the state are subjected to torture or 136 extrajudicial killing or detention on the basis of information 137 gathered by state agencies through information leakage in protocols. 139 This document details several 'common' threats to human rights, 140 indicating how each of these can lead to human rights violations/ 141 harms and present several examples of how these threats to human 142 rights materialize on the Internet. This threat modeling is inspired 143 by [RFC6973] Privacy Considerations for Internet Protocols, which is 144 based on security threat analysis. This method is a work in progress 145 and by no means a perfect solution for assessing human rights risks 146 in Internet protocols and systems. Certain specific human rights 147 threats are indirectly considered in Internet protocols as part of 148 the security considerations [BCP72], but privacy considerations 149 [RFC6973] or reviews, let alone human rights impact assessments of 150 protocols are not standardized or implemented. 152 Many threats, enablers and risks are linked to different rights. 153 This is not unsurprising if one takes into account that human rights 154 are interrelated, interdependent and indivisible. Here however we're 155 not discussing all human rights because not all human rights are 156 relevant to ICTs in general and protocols and standards in particular 157 [Bless]: "The main source of the values of human rights is the 158 International Bill of Human Rights that is composed of the Universal 159 Declaration of Human Rights [UDHR] along with the International 160 Covenant on Civil and Political Rights [ICCPR] and the International 161 Covenant on Economic, Social and Cultural Rights [ICESCR]. In the 162 light of several cases of Internet censorship, the Human Rights 163 Council Resolution 20/8 was adopted in 2012 [UNHRC2016], affirming ". 164 . . that the same rights that people have offline must also be 165 protected online. . . " . In 2015, the Charter of Human Rights and 166 Principles for the Internet [IRP] was developed and released. 167 According to these documents, some examples of human rights relevant 168 for ICT systems are human dignity (Art. 1 UDHR), non-discrimination 169 (Art. 2), rights to life, liberty and security (Art. 3), freedom of 170 opinion and expression (Art. 19), freedom of assembly and association 171 (Art. 20), rights to equal protection, legal remedy, fair trial, due 172 process, presumed innocent (Art. 7-11), appropriate social and 173 international order (Art. 28), participation in public affairs (Art. 174 21), participation in cultural life, protection of the moral and 175 material interests resulting from any scientific, literary or 176 artistic production of which [they are] the author (Art. 27), and 177 privacy (Art. 12)." A partial catalog of human rights related to 178 Information and Communications technologies, including economic 179 rights, can be found in [Hill2014]. 181 This is by no means an attempt to exclude specific rights or 182 prioritize some rights over others. If other rights seem relevant, 183 please contact the authors. 185 3.2. Conducting human rights reviews 187 Human rights reviews can take place in different parts of the 188 development process of an Internet Draft. However, generally 189 speaking, it is easier to influence the development of a technology 190 at earlier stages than at later stages. This does not mean that 191 reviews at last-call are not relevant, but they are less likely to 192 result in significant changes in the reviewed document. 194 Methods for analyzing technology for specific human rights impacts 195 are still quite nascent. Currently three five methods have been 196 explored by the Human Rights Review Team, often in conjunction with 197 each other: 199 3.2.1. Analyzing drafts based on guidelines for human rights 200 considerations model 202 This analysis of Internet-Drafts uses the model as described below. 203 The outlined categories and questions are used to review an Internet 204 Draft an generally the review is also presented in that order. The 205 advantage of this is that it provides a known overview, and document 206 authors can go back to this document as well as [RFC8280] to 207 understand the background and the context. 209 3.2.2. Analyzing drafts based on their perceived or speculated impact 211 When reviewing an Internet-Draft specific human rights impacts might 212 become apparent by doing a close reading of the draft and seeking to 213 understand how it might provide a different ordering of the network 214 or society. While less structured than the straight use of the human 215 rights considerations model, this analysis might lead to new 216 speculative understandings between human rights and protocols. 218 3.2.3. Expert interviews 220 Interviews with document authors, active members of the Working 221 Group, or experts in the field can help explore the characteristics 222 of the protocol and their effects. There are two main advantages to 223 this approach: one the one hand, it allows the reviewer to gain a 224 deeper understanding of the (intended) workings of the protocol; on 225 the other hand, it also allows for the reviewer to start a discussion 226 with experts or even document authors about certain aspects, which 227 might help gain the review gain traction when it is published. 229 3.2.4. Interviews with impacted persons and communities 231 Protocols impact users of the Internet. There it might help the 232 review to understand how it impacts the people that use the protocol, 233 and the people whose lives are impacted by the protocol. Since human 234 rights should always be understood from the rightsholder, this 235 approach will improve the understanding of the real world effects of 236 the technology. At the same time, it can be hard to attribute 237 specific changes to a particular protocol, this is of course even 238 harder when a protocol has not been (widely) deployed. 240 3.2.5. Tracing impacts of implementations 242 When an Internet Draft is describing running code that has already 243 been implemented, the code could be analyzed either in an 244 experimental setting or on the Internet where its impact can be 245 observed. Other than reviewing a draft, this allows the reviewer to 246 understand how the document works in practice and potentially also 247 what unknown or unexpected effects the technology might have. 249 3.3. Guidelines for human rights considerations 251 This section provides guidance for document authors in the form of a 252 questionnaire about protocols and their (potential) impact. The 253 questionnaire may be useful at any point in the design process, 254 particularly after document authors have developed a high-level 255 protocol model as described in [RFC4101]. These guidelines do not 256 seek to replace any existing referenced specifications, but rather 257 contribute to them and look at the design process from a human rights 258 perspective. 260 Protocols and Internet Standard might benefit from a documented 261 discussion of potential human rights risks arising from potential 262 misapplications of the protocol or technology described in the RFC. 263 This might be coupled with an Applicability Statement for that RFC. 265 Note that the guidance provided in this section does not recommend 266 specific practices. The range of protocols developed in the IETF is 267 too broad to make recommendations about particular uses of data or 268 how human rights might be balanced against other design goals. 269 However, by carefully considering the answers to the following 270 questions, document authors should be able to produce a comprehensive 271 analysis that can serve as the basis for discussion on whether the 272 protocol adequately takes specific human rights threats into account. 273 This guidance is meant to help the thought process of a human rights 274 analysis; it does not provide specific directions for how to write a 275 human rights considerations section (following the example set in 276 [RFC6973]), and the addition of a human rights considerations section 277 has also not yet been proposed. 279 In considering these questions, authors will need to be aware of the 280 potential of technical advances or the passage of time to undermine 281 protections. In general, considerations of rights are likely to be 282 more effective if they are considered given a purpose and specific 283 use cases, rather than as abstract absolute goals. 285 3.3.1. Connectivity 287 Question(s): Does your protocol add application-specific functions to 288 intermediary nodes? Could this functionality be added to end nodes 289 instead of intermediary nodes? Is your protocol optimized for low 290 bandwidth and high latency connections? Could your protocol also be 291 developed in a stateless manner? 293 Explanation: The end-to-end principle [Saltzer] holds that 'the 294 intelligence is end to end rather than hidden in the network' 295 [RFC1958]. The end-to-end principle is important for the robustness 296 of the network and innovation. Such robustness of the network is 297 crucial to enabling human rights like freedom of expression. 299 Example: Middleboxes (which can be Content Delivery Networks, 300 Firewalls, NATs or other intermediary nodes that provide 'services' 301 besides routing) serve many legitimate purposes. However, protocols 302 relying on middleboxes can create potential for abuse, and 303 intentional and unintentional censoring, thereby influencing 304 individuals' ability to communicate online freely and privately. 306 Impacts: 308 - Right to freedom of expression 310 - Right to freedom of assembly and association 312 3.3.2. Privacy 314 Question(s): Did you have a look at the Guidelines in the Privacy 315 Considerations for Internet Protocols [RFC6973] section 7? Does your 316 protocol maintain the confidentiality of metadata? Could your 317 protocol counter traffic analysis? Does your protocol adhere to data 318 minimization principles? Does your document identify potentially 319 sensitive data logged by your protocol and/or for how long that needs 320 to be retained for technical reasons? 322 Explanation: Privacy refers to the right of an entity (normally a 323 person), acting in its own behalf, to determine the degree to which 324 it will interact with its environment, including the degree to which 325 the entity is willing to share its personal information with others. 326 [RFC4949]. If a protocol provides insufficient privacy protection it 327 may have a negative impact on freedom of expression as users self- 328 censor for fear of surveillance, or find themselves unable to express 329 themselves freely. 331 Example: See [RFC6973] 332 Impacts: 334 - Right to freedom of expression 336 - Right to non-discrimination 338 3.3.3. Content agnosticism 340 Question(s): If your protocol impacts packet handling, does it use 341 user data (packet data that is not included in the header)? Is it 342 making decisions based on the payload of the packet? Does your 343 protocol prioritize certain content or services over others in the 344 routing process? Is the protocol transparent about the 345 prioritization that is made (if any)? 347 Explanation: Content agnosticism refers to the notion that network 348 traffic is treated identically regardless of payload, with some 349 exception where it comes to effective traffic handling, for instance 350 where it comes to delay tolerant or delay sensitive packets, based on 351 the header. 353 Example: Content agnosticism prevents payload-based discrimination 354 against packets. This is important because changes to this principle 355 can lead to a two-tiered Internet, where certain packets are 356 prioritized over others on the basis of their content. Effectively 357 this would mean that although all users are entitled to receive their 358 packets at a certain speed, some users become more equal than others. 360 Impacts: 362 - Right to freedom of expression 364 - Right to non-discrimination 366 - Right to equal protection 368 3.3.4. Security 370 Question(s): Did you have a look at Guidelines for Writing RFC Text 371 on Security Considerations [BCP72]? Have you found any attacks that 372 are somewhat related to your protocol yet considered out of scope of 373 your document? Would these attacks be pertinent to the human rights 374 enabling features of the Internet (as described throughout this 375 document)? 377 Explanation: Security is not a single monolithic property of a 378 protocol or system, but rather a series of related but somewhat 379 independent properties. Not all of these properties are required for 380 every application. Since communications are carried out by systems 381 and access to systems is through communications channels, security 382 goals obviously interlock, but they can also be independently 383 provided. [BCP72]. 385 Example: See [BCP72]. 387 Impacts: 389 - Right to freedom of expression 391 - Right to freedom of assembly and association 393 - Right to non-discrimination 395 - Right to security 397 3.3.5. Internationalization 399 Question(s): Does your protocol have text strings that have to be 400 understood or entered by humans? Does your protocol allow Unicode? 401 If so, do you accept texts in one charset (which must be UTF-8), or 402 several (which is dangerous for interoperability)? If character sets 403 or encodings other than UTF-8 are allowed, does your protocol mandate 404 a proper tagging of the charset? Did you have a look at [RFC6365]? 406 Explanation: Internationalization refers to the practice of making 407 protocols, standards, and implementations usable in different 408 languages and scripts (see Localization). In the IETF, 409 internationalization means to add or improve the handling of non- 410 ASCII text in a protocol. [RFC6365] A different perspective, more 411 appropriate to protocols that are designed for global use from the 412 beginning, is the definition used by W3C: 414 "Internationalization is the design and development of a 415 product, application or document content that enables easy 416 localization for target audiences that vary in culture, region, 417 or language." {{W3Ci18nDef}} 419 Many protocols that handle text only handle one charset (US-ASCII), 420 or leave the question of what coded character set and encoding are 421 used up to local guesswork (which leads, of course, to 422 interoperability problems). If multiple charsets are permitted, they 423 must be explicitly identified [RFC2277]. Adding non-ASCII text to a 424 protocol allows the protocol to handle more scripts, hopefully 425 representing users across the world. In today's world, that is 426 normally best accomplished by allowing Unicode encoded in UTF-8 only. 428 In the current IETF policy [RFC2277], internationalization is aimed 429 at user-facing strings, not protocol elements, such as the verbs used 430 by some text-based protocols. (Do note that some strings are both 431 content and protocol elements, such as the identifiers.) If the 432 Internet wants to be a global network of networks, the protocols 433 should work with languages apart from English and character sets 434 apart from Latin characters. It is therefore crucial that at least 435 the content carried by the protocol can be in any script, and that 436 all scripts are treated equally. 438 Example: See localization 440 Impacts: 442 - Right to freedom of expression 444 - Right to political participation 446 - Right to participate in cultural life, arts and science 448 3.3.6. Censorship resistance 450 Question(s): Does your protocol introduce new identifiers or reuse 451 existing identifiers (e.g. MAC addresses) that might be associated 452 with persons or content? Does your protocol make it apparent or 453 transparent when access to a resource it restricted? Can your 454 protocol contribute to filtering in a way it could be implemented to 455 censor data or services? Could this be designed to ensure this 456 doesn't happen? 458 Explanation: Censorship resistance refers to the methods and measures 459 to prevent Internet censorship. 461 Example: In the development of the IPv6 protocol, it was discussed to 462 embed a Media Access Control (MAC) address into unique IP addresses. 463 This would make it possible for 'eavesdroppers and other information 464 collectors to identify when different addresses used in different 465 transactions actually correspond to the same node. [RFC4941] This is 466 why Privacy Extensions for Stateless Address Autoconfiguration in 467 IPv6 have been introduced. [RFC4941] 469 Identifiers of content exposed within a protocol might be used to 470 facilitate censorship, as in the case of Application Layer based 471 censorship, which affects protocols like HTTP. In HTTP, denial or 472 restriction of access can be made apparent by the use of status code 473 451, which allows server operators to operate with greater 474 transparency in circumstances where issues of law or public policy 475 affect their operation [RFC7725]. 477 Impacts: 479 - Right to freedom of expression 481 - Right to political participation 483 - Right to participate in cultural life, arts and science 485 - Right to freedom of assembly and association 487 3.3.7. Open Standards 489 Question(s): Is your protocol fully documented in a way that it could 490 be easily implemented, improved, built upon and/or further developed? 491 Do you depend on proprietary code for the implementation, running or 492 further development of your protocol? Does your protocol favor a 493 particular proprietary specification over technically-equivalent 494 competing specification(s), for instance by making any incorporated 495 vendor specification "required" or "recommended" [RFC2026]? Do you 496 normatively reference another standard that is not available without 497 cost (and could you do without it)? Are you aware of any patents 498 that would prevent your standard from being fully implemented 499 [RFC3979] [RFC6701]? 501 Explanation: The Internet was able to be developed into the global 502 network of networks because of the existence of open, non-proprietary 503 standards [Zittrain]. They are crucial for enabling 504 interoperability. Yet, open standards are not explicitly defined 505 within the IETF. On the subject, [RFC2026] states: "Various national 506 and international standards bodies, such as ANSI, ISO, IEEE, and ITU- 507 T, develop a variety of protocol and service specifications that are 508 similar to Technical Specifications defined at the IETF. National 509 and international groups also publish "implementors' agreements" that 510 are analogous to Applicability Statements, capturing a body of 511 implementation-specific detail concerned with the practical 512 application of their standards. All of these are considered to be 513 "open external standards" for the purposes of the Internet Standards 514 Process." Similarly, [RFC3935] does not define open standards but 515 does emphasize the importance of an "open process", i.e. "any 516 interested person can participate in the work, know what is being 517 decided, and make his or her voice heard on the issue." 519 Open standards are important as they allow for permissionless 520 innovation, which is important to maintain the freedom and ability to 521 freely create and deploy new protocols on top of the communications 522 constructs that currently exist. It is at the heart of the Internet 523 as we know it, and to maintain its fundamentally open nature, we need 524 to be mindful of the need for developing open standards. 526 All standards that need to be normatively implemented should be 527 freely available and with reasonable protection for patent 528 infringement claims, so it can also be implemented in open source or 529 free software. Patents have often held back open standardization or 530 been used against those deploying open standards, particularly in the 531 domain of cryptography [newegg]. An exemption of this is sometimes 532 made when a protocol is standardized that normatively relies on 533 specifications produced by others SDOs that are not freely available. 534 Patents in open standards or in normative references to other 535 standards should have a patent disclosure [notewell], royalty-free 536 licensing [patentpolicy], or some other form of fair, reasonable and 537 non-discriminatory terms. 539 Example: [RFC6108] describes a system for providing critical end-user 540 notifications to web browsers, which has been deployed by Comcast, an 541 Internet Service Provider (ISP). Such a notification system is being 542 used to provide near-immediate notifications to customers, such as to 543 warn them that their traffic exhibits patterns that are indicative of 544 malware or virus infection. There are other proprietary systems that 545 can perform such notifications, but those systems utilize Deep Packet 546 Inspection (DPI) technology. In contrast, that document describes a 547 system that does not rely upon DPI, and is instead based on open IETF 548 standards and open source applications. 550 Impacts: 552 - Right to freedom of expression 554 - Right to participate in cultural life, arts and science 556 3.3.8. Heterogeneity Support 558 Question(s): Does your protocol support heterogeneity by design? 559 Does your protocol allow for multiple types of hardware? Does your 560 protocol allow for multiple types of application protocols? Is your 561 protocol liberal in what it receives and handles? Will it remain 562 usable and open if the context changes? Does your protocol allow 563 there to be well-defined extension points? Do these extension points 564 allow for open innovation? 566 Explanation: The Internet is characterized by heterogeneity on many 567 levels: devices and nodes, router scheduling algorithms and queue 568 management mechanisms, routing protocols, levels of multiplexing, 569 protocol versions and implementations, underlying link layers (e.g., 570 point-to-point, multi-access links, wireless, FDDI, etc.), in the 571 traffic mix and in the levels of congestion at different times and 572 places. Moreover, as the Internet is composed of autonomous 573 organizations and Internet service providers, each with their own 574 separate policy concerns, there is a large heterogeneity of 575 administrative domains and pricing structures. As a result, the 576 heterogeneity principle proposed in [RFC1958] needs to be supported 577 by design [FIArch]. 579 Example: Heterogeneity is inevitable and needs be supported by 580 design. Multiple types of hardware must be allowed for, e.g. 581 transmission speeds differing by at least 7 orders of magnitude, 582 various computer word lengths, and hosts ranging from memory-starved 583 microprocessors up to massively parallel supercomputers. Multiple 584 types of application protocol must be allowed for, ranging from the 585 simplest such as remote login up to the most complex such as 586 distributed databases [RFC1958]. 588 Impacts: 590 - Right to freedom of expression 592 - Right to political participation 594 3.3.9. Pseudonymity 596 Question(s): Have you considered the Privacy Considerations for 597 Internet Protocols [RFC6973], especially section 6.1.2 ? Does the 598 protocol collect personally derived data? Does the protocol generate 599 or process anything that can be, or be tightly correlated with, 600 personally identifiable information? Does the protocol utilize data 601 that is personally-derived, i.e. derived from the interaction of a 602 single person, or their device or address? Does this protocol 603 generate personally derived data, and if so how will that data be 604 handled? 606 Explanation: Pseudonymity - the ability to use a persistent 607 identifier not linked to one's offline identity - is an important 608 feature for many end-users, as it allows them different degrees of 609 disguised identity and privacy online. 611 Example: While designing a standard that exposes personal data, it is 612 important to consider ways to mitigate the obvious impacts. While 613 pseudonyms cannot be simply reverse engineered - some early 614 approaches simply took approaches such as simple hashing of IP 615 addresses, these could then be simply reversed by generating a hash 616 for each potential IP address and comparing it to the pseudonym - 617 limiting the exposure of personal data remains important. 619 Pseudonymity means using a pseudonym instead of one's "real" name. 620 There are many reasons for users to use pseudonyms, for instance to: 621 hide their gender, protect themselves against harassment, protect 622 their families' privacy, frankly discuss sexuality, or develop a 623 artistic or journalistic persona without repercussions from an 624 employer, (potential) customers, or social surrounding. 625 [geekfeminism] The difference between anonymity and pseudonymity is 626 that a pseudonym often is persistent. "Pseudonymity is strengthened 627 when less personal data can be linked to the pseudonym; when the same 628 pseudonym is used less often and across fewer contexts; and when 629 independently chosen pseudonyms are more frequently used for new 630 actions (making them, from an observer's or attacker's perspective, 631 unlinkable)." [RFC6973] 633 Impacts: 635 - Right to non-discrimination 637 - Right to freedom of assembly and association 639 3.3.10. Accessibility 641 Question(s): Is your protocol designed to provide an enabling 642 environment for people who are not able-bodied? Have you looked at 643 the W3C Web Accessibility Initiative for examples and guidance? 645 Explanation: The Internet is fundamentally designed to work for all 646 people, whatever their hardware, software, language, culture, 647 location, or physical or mental ability. When the Internet meets 648 this goal, it is accessible to people with a diverse range of 649 hearing, movement, sight, and cognitive ability [W3CAccessibility]. 650 Sometimes in the design of protocols, websites, web technologies, or 651 web tools, barriers are created that exclude people from using the 652 Web. 654 Example: The HTML protocol as defined in [HTML5] specifically 655 requires that every image must have an alt attribute (with a few 656 exceptions) to ensure images are accessible for people that cannot 657 themselves decipher non-text content in web pages. 659 Impacts: 661 - Right to non-discrimination 663 - Right to freedom of assembly and association 665 - Right to education 667 - Right to political participation 669 3.3.11. Localization 671 Question(s): Does your protocol uphold the standards of 672 internationalization? Have you made any concrete steps towards 673 localizing your protocol for relevant audiences? 675 Explanation: Localization refers to the adaptation of a product, 676 application or document content to meet the language, cultural and 677 other requirements of a specific target market (a locale) 678 [W3Ci18nDef]. It is also described as the practice of translating an 679 implementation to make it functional in a specific language or for 680 users in a specific locale (see Internationalization). 682 Example: The Internet is a global medium, but many of its protocols 683 and products are developed with a certain audience in mind, that 684 often share particular characteristics like knowing how to read and 685 write in ASCII and knowing English. This limits the ability of a 686 large part of the world's online population from using the Internet 687 in a way that is culturally and linguistically accessible. An 688 example of a protocol that has taken into account the view that 689 individuals like to have access to data in their native language can 690 be found in [RFC5646]. This protocol labels the information content 691 with an identifier for the language in which it is written. And this 692 allows information to be presented in more than one language. 694 Impacts: 696 - Right to non-discrimination 698 - Right to participate in cultural life, arts and science 700 - Right to freedom of expression 702 3.3.12. Decentralization 704 Question(s): Can your protocol be implemented without a single point 705 of control? If applicable, can your protocol be deployed in a 706 federated manner? What is the potential for discrimination against 707 users of your protocol? How can your protocol be used to implicate 708 users? Does your protocol create additional centralized points of 709 control? 711 Explanation: Decentralization is one of the central technical 712 concepts of the architecture of the networks, and embraced as such by 713 the IETF [RFC3935]. It refers to the absence or minimization of 714 centralized points of control, a feature that is assumed to make it 715 easy for new users to join and new uses to unfold [Brown]. It also 716 reduces issues surrounding single points of failure, and distributes 717 the network such that it continues to function even if one or several 718 nodes are disabled. With the commercialization of the Internet in 719 the early 1990s, there has been a slow move away from 720 decentralization, to the detriment of the technical benefits of 721 having a decentralized Internet. 723 Example: The bits traveling the Internet are increasingly susceptible 724 to monitoring and censorship, from both governments and Internet 725 service providers, as well as third (malicious) parties. The ability 726 to monitor and censor is further enabled by the increased 727 centralization of the network that creates central infrastructure 728 points that can be tapped in to. The creation of peer-to-peer 729 networks and the development of voice-over-IP protocols using peer- 730 to-peer technology in combination with distributed hash table (DHT) 731 for scalability are examples of how protocols can preserve 732 decentralization [Pouwelse]. 734 Impacts: 736 - Right to freedom of expression 738 - Right to freedom of assembly and association 740 3.3.13. Reliability 742 Question(s): Is your protocol fault tolerant? Does it downgrade 743 gracefully? Can your protocol resist malicious degradation attempts? 744 Do you have a documented way to announce degradation? Do you have 745 measures in place for recovery or partial healing from failure? Can 746 your protocol maintain dependability and performance in the face of 747 unanticipated changes or circumstances? 749 Explanation: Reliability ensures that a protocol will execute its 750 function consistently and error resistant as described, and function 751 without unexpected result. A system that is reliable degenerates 752 gracefully and will have a documented way to announce degradation. 753 It also has mechanisms to recover from failure gracefully, and if 754 applicable, allow for partial healing. It is important here to draw 755 a distinction between random degradation and malicious degradation. 756 Many current attacks against TLS, for example, exploit TLS' ability 757 to gracefully downgrade to older cipher suites - from a functional 758 perspective, this is good; from a security perspective, this can be 759 very bad. As with confidentiality, the growth of the Internet and 760 fostering innovation in services depends on users having confidence 761 and trust [RFC3724] in the network. For reliability, it is necessary 762 that services notify the users if a delivery fails. In the case of 763 real-time systems in addition to the reliable delivery the protocol 764 needs to safeguard timeliness. 766 Example: In the modern IP stack structure, a reliable transport layer 767 requires an indication that transport processing has successfully 768 completed, such as given by TCP's ACK message [RFC0793], and not 769 simply an indication from the IP layer that the packet arrived. 770 Similarly, an application layer protocol may require an application- 771 specific acknowledgment that contains, among other things, a status 772 code indicating the disposition of the request (See [RFC3724]). 774 Impacts: 776 - Right to freedom of expression 778 - Right to security 780 3.3.14. Confidentiality 782 Question(s): Does this protocol expose information related to 783 identifiers or data? If so, does it do so to each other protocol 784 entity (i.e., recipients, intermediaries, and enablers) [RFC6973]? 785 What options exist for protocol implementers to choose to limit the 786 information shared with each entity? What operational controls are 787 available to limit the information shared with each entity? 789 What controls or consent mechanisms does the protocol define or 790 require before personal data or identifiers are shared or exposed via 791 the protocol? If no such mechanisms or controls are specified, is it 792 expected that control and consent will be handled outside of the 793 protocol? 795 Does the protocol provide ways for initiators to share different 796 pieces of information with different recipients? If not, are there 797 mechanisms that exist outside of the protocol to provide initiators 798 with such control? 800 Does the protocol provide ways for initiators to limit the sharing or 801 express individuals' preferences to recipients or intermediaries with 802 regard to the collection, use, or disclosure of their personal data? 803 If not, are there mechanisms that exist outside of the protocol to 804 provide users with such control? Is it expected that users will have 805 relationships that govern the use of the information (contractual or 806 otherwise) with those who operate these intermediaries? Does the 807 protocol prefer encryption over clear text operation? 809 Explanation: Confidentiality refers to keeping your data secret from 810 unintended listeners [BCP72]. The growth of the Internet depends on 811 users having confidence that the network protects their personal data 812 [RFC1984]. 814 Example: Protocols that do not encrypt their payload make the entire 815 content of the communication available to the idealized attacker 816 along their path. Following the advice in [RFC3365], most such 817 protocols have a secure variant that encrypts the payload for 818 confidentiality, and these secure variants are seeing ever-wider 819 deployment. A noteworthy exception is DNS [RFC1035], as DNSSEC 820 [RFC4033] does not have confidentiality as a requirement. This 821 implies that, in the absence of the use of more recent standards like 822 DNS over TLS [RFC7858] or DNS over HTTPS [RFC8484], all DNS queries 823 and answers generated by the activities of any protocol are available 824 to the attacker. When store-and-forward protocols are used (e.g., 825 SMTP [RFC5321]), intermediaries leave this data subject to 826 observation by an attacker that has compromised these intermediaries, 827 unless the data is encrypted end-to-end by the application-layer 828 protocol or the implementation uses an encrypted store for this data 829 [RFC7624]. 831 Impacts: 833 - Right to privacy 835 - Right to security 837 3.3.15. Integrity 839 Question(s): Does your protocol maintain, assure and/or verify the 840 accuracy of payload data? Does your protocol maintain and assure the 841 consistency of data? Does your protocol in any way allow for the 842 data to be (intentionally or unintentionally) altered? 844 Explanation: Integrity refers to the maintenance and assurance of the 845 accuracy and consistency of data to ensure it has not been 846 (intentionally or unintentionally) altered. 848 Example: Integrity verification of data is important to prevent 849 vulnerabilities and attacks, like man-in-the-middle-attacks. These 850 attacks happen when a third party (often for malicious reasons) 851 intercepts a communication between two parties, inserting themselves 852 in the middle changing the content of the data. In practice this 853 looks as follows: 855 Alice wants to communicate with Bob. 856 Corinne forges and sends a message to Bob, impersonating Alice. 857 Bob cannot see the data from Alice was altered by Corinne. 858 Corinne intercepts and alters the communication as it is sent between 859 Alice and Bob. 860 Corinne is able to control the communication content. 862 Impacts: 864 - Right to freedom of expression 866 - Right to security 868 3.3.16. Authenticity 870 Question(s): Do you have sufficient measures to confirm the truth of 871 an attribute of a single piece of data or entity? Can the attributes 872 get garbled along the way (see security)? If relevant, have you 873 implemented IPsec, DNSsec, HTTPS and other Standard Security Best 874 Practices? 876 Explanation: Authenticity ensures that data does indeed come from the 877 source it claims to come from. This is important to prevent certain 878 attacks or unauthorized access and use of data. 880 Example: Authentication of data is important to prevent 881 vulnerabilities and attacks, like man-in-the-middle-attacks. These 882 attacks happen when a third party (often for malicious reasons) 883 intercepts a communication between two parties, inserting themselves 884 in the middle and posing as both parties. In practice this looks as 885 follows: 887 Alice wants to communicate with Bob. 888 Alice sends data to Bob. 889 Corinne intercepts the data sent to Bob. 890 Corinne reads (and potentially alters) the message to Bob. 891 Bob cannot see the data did not come from Alice but from Corinne. 893 When there is proper authentication the scenario would be as follows: 895 Alice wants to communicate with Bob. 896 Alice sends data to Bob. 897 Corinne intercepts the data sent to Bob. 898 Corinne reads and alters the message to Bob. 899 Bob can see the data did not come from Alice but from Corinne. 901 Impacts: 903 - Right to privacy 905 - Right to freedom of expression 907 - Right to security 909 3.3.17. Adaptability 911 Question(s): Is your protocol written in such a way that is would be 912 easy for other protocols to be developed on top of it, or to interact 913 with it? Does your protocol impact permissionless innovation? (See 914 Connectivity) 916 Explanation: Adaptability is closely interrelated with permissionless 917 innovation: both maintain the freedom and ability to freely create 918 and deploy new protocols on top of the communications constructs that 919 currently exist. It is at the heart of the Internet as we know it, 920 and to maintain its fundamentally open nature, we need to be mindful 921 of the impact of protocols on maintaining or reducing permissionless 922 innovation to ensure the Internet can continue to develop. 924 Example: WebRTC generates audio and/or video data. In order to 925 ensure that WebRTC can be used in different locations by different 926 parties, it is important that standard Javascript APIs are developed 927 to support applications from different voice service providers. 928 Multiple parties will have similar capabilities, in order to ensure 929 that all parties can build upon existing standards these need to be 930 adaptable, and allow for permissionless innovation. 932 Impacts: 934 - Right to education 936 - Freedom of expression 938 - Freedom of assembly and association 940 3.3.18. Outcome Transparency 942 Question(s): Are the effects of your protocol fully and easily 943 comprehensible, including with respect to unintended consequences of 944 protocol choices? 946 Explanation: Certain technical choices may have unintended 947 consequences. 949 Example: Lack of authenticity may lead to lack of integrity and 950 negative externalities, of which spam is an example. Lack of data 951 that could be used for billing and accounting can lead to so-called 952 "free" arrangements which obscure the actual costs and distribution 953 of the costs, for example the barter arrangements that are commonly 954 used for Internet interconnection; and the commercial exploitation of 955 personal data for targeted advertising which is the most common 956 funding model for the so-called "free" services such as search 957 engines and social networks. Other unexpected outcomes might not be 958 technical, but rather architectural, social or economical. 960 Impacts: - Freedom of expression - Privacy - Freedom of assembly and 961 association - Access to information 963 3.3.19. Anonymity 965 Question(s): Does you protocol make use of persistent identifiers? 966 Can it be done without them? Did you have a look at the Privacy 967 Considerations for Internet Protocols [RFC6973], especially section 968 6.1.1 of that document? 970 Explanation: Anonymity refers to the condition of an identity being 971 unknown or concealed [RFC4949]. Even though full anonymity is hard 972 to achieve, it is a non-binary concept. Making pervasive monitoring 973 and tracking harder is important for many users as well as for the 974 IETF [RFC7258]. Achieving a higher level of anonymity is an 975 important feature for many end-users, as it allows them different 976 degrees of privacy online. Anonymity is an inherent part of the 977 right to freedom of opinion and expression and the right to privacy. 978 Avoid adding identifiers, options or configurations that create or 979 might lead to patterns or regularities that are not explicitly 980 required by the protocol. 982 If your protocol collects data and distributes it (see [RFC6235]), 983 you should anonymize the data, but keep in mind that "anonymizing" 984 data is notoriously hard. Do not think that just dropping the last 985 byte of an IP address "anonymizes" data. If your protocol allows for 986 identity management, there should be a clear barrier between the 987 identities to ensure that they cannot (easily) be associated with 988 each other. 990 Often protocols expose personal data, it is important to consider 991 ways to mitigate the obvious privacy impacts. A protocol that uses 992 data that could help identify a sender (items of interest) should be 993 protected from third parties. For instance, if one wants to hide the 994 source/destination IP addresses of a packet, the use of IPsec in 995 tunneling mode (e.g., inside a virtual private network) can be 996 helpful to protect from third parties likely to eavesdrop packets 997 exchanged between the tunnel endpoints. 999 Example: An example is DHCP where sending a persistent identifier as 1000 the client name was not mandatory but, in practice, done by many 1001 implementations, before [RFC7844]. 1003 Impacts: 1005 - Right to non-discrimination 1007 - Right to political participation 1009 - Right to freedom of assembly and association 1011 - Right to security 1013 4. Document Status 1015 This RG document is currently documenting best practices and 1016 guidelines for human rights reviews of networking protocols and other 1017 Internet-Drafts and RFCs 1019 5. Acknowledgements 1021 Thanks to: - Corinne Cath for work on [RFC8280]. - Theresa Engelhard 1022 and the hrpc list for suggestions. - The Human Rights Review Team 1023 for implementing the guidelines and helping them improve. 1025 6. Security Considerations 1027 As this document concerns a research document, there are no security 1028 considerations. 1030 7. IANA Considerations 1032 This document has no actions for IANA. 1034 8. Research Group Information 1036 The discussion list for the IRTF Human Rights Protocol Considerations 1037 Research Group is located at the e-mail address hrpc@ietf.org [1]. 1038 Information on the group and information on how to subscribe to the 1039 list is at https://www.irtf.org/mailman/listinfo/hrpc [2] 1041 Archives of the list can be found at: https://www.irtf.org/mail- 1042 archive/web/hrpc/current/index.html [3] 1044 9. References 1046 9.1. Informative References 1048 [BCP72] IETF, "Guidelines for Writing RFC Text on Security 1049 Considerations", 2003, 1050 . 1052 [Bless] Bless, R. and C. Orwat, "Values and Networks", 2015. 1054 [Brown] Brown, I. and M. Ziewitz, "A Prehistory of Internet 1055 Governance", Research Handbook on Governance of the 1056 Internet. Cheltenham, Edward Elgar. , 2013. 1058 [FIArch] "Future Internet Design Principles", January 2012, 1059 . 1062 [geekfeminism] 1063 Geek Feminism Wiki, "Pseudonymity", 2015, 1064 . 1066 [Hill2014] 1067 Hill, R., "Partial Catalog of Human Rights Related to ICT 1068 Activities", 2014, 1069 . 1071 [HTML5] W3C, "HTML5", 2014, . 1073 [ICCPR] United Nations General Assembly, "International Covenant 1074 on Civil and Political Rights", 1976, 1075 . 1078 [ICESCR] United Nations General Assembly, "International Covenant 1079 on Economic, Social and Cultural Rights", 1966, 1080 . 1083 [IRP] Internet Rights and Principles Dynamic Coalition, "10 1084 Internet Rights & Principles", 2014, 1085 . 1089 [newegg] Mullin, J., "Newegg on trial: Mystery company TQP rewrites 1090 the history of encryption", 2013, . 1094 [notewell] 1095 IETF, "Note Well", 2015, 1096 . 1098 [patentpolicy] 1099 W3C, "W3C Patent Policy", 2004, 1100 . 1102 [Penney] Penney, J., "Chilling Effects: Online Surveillance and 1103 Wikipedia Use", 2016, . 1106 [Pouwelse] 1107 Pouwelse, Ed, J., "Media without censorship", 2012, 1108 . 1111 [RFC0793] Postel, J., "Transmission Control Protocol", STD 7, 1112 RFC 793, DOI 10.17487/RFC0793, September 1981, 1113 . 1115 [RFC1035] Mockapetris, P., "Domain names - implementation and 1116 specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, 1117 November 1987, . 1119 [RFC1958] Carpenter, B., Ed., "Architectural Principles of the 1120 Internet", RFC 1958, DOI 10.17487/RFC1958, June 1996, 1121 . 1123 [RFC1984] IAB and IESG, "IAB and IESG Statement on Cryptographic 1124 Technology and the Internet", BCP 200, RFC 1984, 1125 DOI 10.17487/RFC1984, August 1996, 1126 . 1128 [RFC2026] Bradner, S., "The Internet Standards Process -- Revision 1129 3", BCP 9, RFC 2026, DOI 10.17487/RFC2026, October 1996, 1130 . 1132 [RFC2277] Alvestrand, H., "IETF Policy on Character Sets and 1133 Languages", BCP 18, RFC 2277, DOI 10.17487/RFC2277, 1134 January 1998, . 1136 [RFC3365] Schiller, J., "Strong Security Requirements for Internet 1137 Engineering Task Force Standard Protocols", BCP 61, 1138 RFC 3365, DOI 10.17487/RFC3365, August 2002, 1139 . 1141 [RFC3724] Kempf, J., Ed., Austein, R., Ed., and IAB, "The Rise of 1142 the Middle and the Future of End-to-End: Reflections on 1143 the Evolution of the Internet Architecture", RFC 3724, 1144 DOI 10.17487/RFC3724, March 2004, 1145 . 1147 [RFC3935] Alvestrand, H., "A Mission Statement for the IETF", 1148 BCP 95, RFC 3935, DOI 10.17487/RFC3935, October 2004, 1149 . 1151 [RFC3979] Bradner, S., Ed., "Intellectual Property Rights in IETF 1152 Technology", RFC 3979, DOI 10.17487/RFC3979, March 2005, 1153 . 1155 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. 1156 Rose, "DNS Security Introduction and Requirements", 1157 RFC 4033, DOI 10.17487/RFC4033, March 2005, 1158 . 1160 [RFC4101] Rescorla, E. and IAB, "Writing Protocol Models", RFC 4101, 1161 DOI 10.17487/RFC4101, June 2005, 1162 . 1164 [RFC4941] Narten, T., Draves, R., and S. Krishnan, "Privacy 1165 Extensions for Stateless Address Autoconfiguration in 1166 IPv6", RFC 4941, DOI 10.17487/RFC4941, September 2007, 1167 . 1169 [RFC4949] Shirey, R., "Internet Security Glossary, Version 2", 1170 FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007, 1171 . 1173 [RFC5321] Klensin, J., "Simple Mail Transfer Protocol", RFC 5321, 1174 DOI 10.17487/RFC5321, October 2008, 1175 . 1177 [RFC5646] Phillips, A., Ed. and M. Davis, Ed., "Tags for Identifying 1178 Languages", BCP 47, RFC 5646, DOI 10.17487/RFC5646, 1179 September 2009, . 1181 [RFC6108] Chung, C., Kasyanov, A., Livingood, J., Mody, N., and B. 1182 Van Lieu, "Comcast's Web Notification System Design", 1183 RFC 6108, DOI 10.17487/RFC6108, February 2011, 1184 . 1186 [RFC6235] Boschi, E. and B. Trammell, "IP Flow Anonymization 1187 Support", RFC 6235, DOI 10.17487/RFC6235, May 2011, 1188 . 1190 [RFC6365] Hoffman, P. and J. Klensin, "Terminology Used in 1191 Internationalization in the IETF", BCP 166, RFC 6365, 1192 DOI 10.17487/RFC6365, September 2011, 1193 . 1195 [RFC6701] Farrel, A. and P. Resnick, "Sanctions Available for 1196 Application to Violators of IETF IPR Policy", RFC 6701, 1197 DOI 10.17487/RFC6701, August 2012, 1198 . 1200 [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., 1201 Morris, J., Hansen, M., and R. Smith, "Privacy 1202 Considerations for Internet Protocols", RFC 6973, 1203 DOI 10.17487/RFC6973, July 2013, 1204 . 1206 [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an 1207 Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May 1208 2014, . 1210 [RFC7624] Barnes, R., Schneier, B., Jennings, C., Hardie, T., 1211 Trammell, B., Huitema, C., and D. Borkmann, 1212 "Confidentiality in the Face of Pervasive Surveillance: A 1213 Threat Model and Problem Statement", RFC 7624, 1214 DOI 10.17487/RFC7624, August 2015, 1215 . 1217 [RFC7725] Bray, T., "An HTTP Status Code to Report Legal Obstacles", 1218 RFC 7725, DOI 10.17487/RFC7725, February 2016, 1219 . 1221 [RFC7844] Huitema, C., Mrugalski, T., and S. Krishnan, "Anonymity 1222 Profiles for DHCP Clients", RFC 7844, 1223 DOI 10.17487/RFC7844, May 2016, 1224 . 1226 [RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., 1227 and P. Hoffman, "Specification for DNS over Transport 1228 Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 1229 2016, . 1231 [RFC8280] ten Oever, N. and C. Cath, "Research into Human Rights 1232 Protocol Considerations", RFC 8280, DOI 10.17487/RFC8280, 1233 October 2017, . 1235 [RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS 1236 (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018, 1237 . 1239 [Saltzer] Saltzer, J., Reed, D., and D. Clark, "End-to-End Arguments 1240 in System Design", ACM TOCS, Vol 2, Number 4, November 1241 1984, pp 277-288. , 1984. 1243 [UDHR] United Nations General Assembly, "The Universal 1244 Declaration of Human Rights", 1948, 1245 . 1247 [UNHRC2016] 1248 United Nations Human Rights Council, "UN Human Rights 1249 Council Resolution "The promotion, protection and 1250 enjoyment of human rights on the Internet" (A/HRC/32/ 1251 L.20)", 2016, . 1255 [W3CAccessibility] 1256 W3C, "Accessibility", 2015, 1257 . 1259 [W3Ci18nDef] 1260 W3C, "Localization vs. Internationalization", 2010, 1261 . 1263 [Zittrain] 1264 Zittrain, J., "The Future of the Internet - And How to 1265 Stop It", Yale University Press , 2008, 1266 . 1269 9.2. URIs 1271 [1] mailto:hrpc@ietf.org 1273 [2] https://www.irtf.org/mailman/listinfo/hrpc 1275 [3] https://www.irtf.org/mail-archive/web/hrpc/current/index.html 1277 Authors' Addresses 1279 Niels ten Oever 1280 University of Amsterdam 1282 EMail: mail@nielstenoever.net 1284 Gurshabad Grover 1285 Centre for Internet and Society 1287 EMail: gurshabad@cis-india.org