idnits 2.17.1
draft-irtf-hrpc-guidelines-04.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
https://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
** The abstract seems to contain references ([RFC6973], [RFC8280]), which
it shouldn't. Please replace those with straight textual mentions of the
documents in question.
-- The draft header indicates that this document updates RFC8280, but the
abstract doesn't seem to directly say this. It does mention RFC8280
though, so this could be OK.
Miscellaneous warnings:
----------------------------------------------------------------------------
== The copyright year in the IETF Trust and authors Copyright Line does not
match the current year
-- The document date (March 09, 2020) is 1509 days in the past. Is this
intentional?
Checking references for intended status: Informational
----------------------------------------------------------------------------
-- Looks like a reference, but probably isn't: '1' on line 1330
-- Looks like a reference, but probably isn't: '2' on line 1332
-- Looks like a reference, but probably isn't: '3' on line 1334
-- Obsolete informational reference (is this intentional?): RFC 793
(Obsoleted by RFC 9293)
-- Duplicate reference: RFC2026, mentioned in 'RFC2026', was also mentioned
in 'BCP9'.
-- Obsolete informational reference (is this intentional?): RFC 4941
(Obsoleted by RFC 8981)
Summary: 1 error (**), 0 flaws (~~), 1 warning (==), 8 comments (--).
Run idnits with the --verbose option for more detailed information about
the items above.
--------------------------------------------------------------------------------
2 Human Rights Protocol Considerations Research Group G. Grover (editor)
3 Internet-Draft Centre for Internet and Society
4 Updates: 8280 (if approved) N. ten Oever (editor)
5 Intended status: Informational University of Amsterdam
6 Expires: September 10, 2020 March 09, 2020
8 Guidelines for Human Rights Protocol and Architecture Considerations
9 draft-irtf-hrpc-guidelines-04
11 Abstract
13 This document sets guidelines for human rights considerations in
14 networking protocols, similar to the work done on the guidelines for
15 privacy considerations [RFC6973]. This is an updated version of the
16 guidelines for human rights considerations in [RFC8280].
18 Status of This Memo
20 This Internet-Draft is submitted in full conformance with the
21 provisions of BCP 78 and BCP 79.
23 Internet-Drafts are working documents of the Internet Engineering
24 Task Force (IETF). Note that other groups may also distribute
25 working documents as Internet-Drafts. The list of current Internet-
26 Drafts is at https://datatracker.ietf.org/drafts/current/.
28 Internet-Drafts are draft documents valid for a maximum of six months
29 and may be updated, replaced, or obsoleted by other documents at any
30 time. It is inappropriate to use Internet-Drafts as reference
31 material or to cite them other than as "work in progress."
33 This Internet-Draft will expire on September 10, 2020.
35 Copyright Notice
37 Copyright (c) 2020 IETF Trust and the persons identified as the
38 document authors. All rights reserved.
40 This document is subject to BCP 78 and the IETF Trust's Legal
41 Provisions Relating to IETF Documents
42 (https://trustee.ietf.org/license-info) in effect on the date of
43 publication of this document. Please review these documents
44 carefully, as they describe your rights and restrictions with respect
45 to this document. Code Components extracted from this document must
46 include Simplified BSD License text as described in Section 4.e of
47 the Trust Legal Provisions and are provided without warranty as
48 described in the Simplified BSD License.
50 Table of Contents
52 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
53 2. Vocabulary used . . . . . . . . . . . . . . . . . . . . . . . 3
54 3. Guidelines for developing human rights protocol
55 considerations . . . . . . . . . . . . . . . . . . . . . . . 3
56 3.1. Human rights threats . . . . . . . . . . . . . . . . . . 3
57 3.2. Conducting human rights reviews . . . . . . . . . . . . . 5
58 3.2.1. Analyzing drafts based on guidelines for human rights
59 considerations model . . . . . . . . . . . . . . . . 5
60 3.2.2. Analyzing drafts based on their perceived or
61 speculated impact . . . . . . . . . . . . . . . . . . 5
62 3.2.3. Expert interviews . . . . . . . . . . . . . . . . . . 5
63 3.2.4. Interviews with impacted persons and communities . . 6
64 3.2.5. Tracing impacts of implementations . . . . . . . . . 6
65 3.3. Guidelines for human rights considerations . . . . . . . 6
66 3.3.1. Connectivity . . . . . . . . . . . . . . . . . . . . 7
67 3.3.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . 7
68 3.3.3. Content agnosticism . . . . . . . . . . . . . . . . . 8
69 3.3.4. Security . . . . . . . . . . . . . . . . . . . . . . 9
70 3.3.5. Internationalization . . . . . . . . . . . . . . . . 9
71 3.3.6. Censorship resistance . . . . . . . . . . . . . . . . 10
72 3.3.7. Open Standards . . . . . . . . . . . . . . . . . . . 11
73 3.3.8. Heterogeneity Support . . . . . . . . . . . . . . . . 13
74 3.3.9. Pseudonymity . . . . . . . . . . . . . . . . . . . . 13
75 3.3.10. Accessibility . . . . . . . . . . . . . . . . . . . . 14
76 3.3.11. Localization . . . . . . . . . . . . . . . . . . . . 15
77 3.3.12. Decentralization . . . . . . . . . . . . . . . . . . 16
78 3.3.13. Reliability . . . . . . . . . . . . . . . . . . . . . 17
79 3.3.14. Confidentiality . . . . . . . . . . . . . . . . . . . 17
80 3.3.15. Integrity . . . . . . . . . . . . . . . . . . . . . . 19
81 3.3.16. Authenticity . . . . . . . . . . . . . . . . . . . . 19
82 3.3.17. Adaptability . . . . . . . . . . . . . . . . . . . . 20
83 3.3.18. Outcome Transparency . . . . . . . . . . . . . . . . 21
84 3.3.19. Anonymity . . . . . . . . . . . . . . . . . . . . . . 21
85 3.3.20. Misc. considerations . . . . . . . . . . . . . . . . 22
86 4. Document Status . . . . . . . . . . . . . . . . . . . . . . . 23
87 5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 23
88 6. Security Considerations . . . . . . . . . . . . . . . . . . . 23
89 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 23
90 8. Research Group Information . . . . . . . . . . . . . . . . . 23
91 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 24
92 9.1. Informative References . . . . . . . . . . . . . . . . . 24
93 9.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 29
94 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 29
96 1. Introduction
98 This document outlines a set of human rights protocol considerations
99 for protocol developers. It provides questions engineers should ask
100 themselves when developing or improving protocols if they want to
101 understand their potential human rights impact. It should however be
102 noted that the impact of a protocol cannot solely be deduced from its
103 design, but its usage and implementation should also be studied to
104 form a full protocol human rights impact assessment.
106 The questions are based on the research performed by the Human Rights
107 Protocol Considerations (hrpc) research group which has been
108 documented before these considerations. The research establishes
109 that human rights relate to standards and protocols, and offers a
110 common vocabulary of technical concepts that impact human rights and
111 how these technical concepts can be combined to ensure that the
112 Internet remains an enabling environment for human rights. With
113 this, the contours of a model for developing human rights protocol
114 considerations has taken shape.
116 This document is a further iteration of the guidelines that can be
117 found in [RFC8280]. The methods for conducting human rights reviews
118 (Section 3.2), and guidelines for human rights considerations
119 (Section 3.3) in this document are being tested for relevance,
120 accuracy and validity.
122 2. Vocabulary used
124 3. Guidelines for developing human rights protocol considerations
126 3.1. Human rights threats
128 Human rights threats on the Internet come in a myriad of forms.
129 Protocols and standards can harm or enable the right to freedom of
130 expression, right to non-discrimination, right to equal protection,
131 right to participate in cultural life, arts and science, right to
132 freedom of assembly and association, and the right to security. An
133 end-user who is denied access to certain services, data or websites
134 may be unable to disclose vital information about the malpractices of
135 a government or other authority. A person whose communications are
136 monitored may be prevented from exercising their right to freedom of
137 association or participate in political processes [Penney]. In a
138 worst-case scenario, protocols that leak information can lead to
139 physical danger. A realistic example to consider is when individuals
140 perceived as threats to the state are subjected to torture or extra-
141 judicial killing or detention on the basis of information gathered by
142 state agencies through information leakage in protocols.
144 This document details several 'common' threats to human rights,
145 indicating how each of these can lead to human rights violations/
146 harms and present several examples of how these threats to human
147 rights materialize on the Internet. This threat modeling is inspired
148 by [RFC6973] Privacy Considerations for Internet Protocols, which is
149 based on security threat analysis. This method is a work in progress
150 and by no means a perfect solution for assessing human rights risks
151 in Internet protocols and systems. Certain specific human rights
152 threats are indirectly considered in Internet protocols as part of
153 the security considerations [BCP72], but privacy considerations
154 [RFC6973] or reviews, let alone human rights impact assessments of
155 protocols are not standardized or implemented.
157 Many threats, enablers and risks are linked to different rights.
158 This is not unsurprising if one takes into account that human rights
159 are interrelated, interdependent and indivisible. Here however we're
160 not discussing all human rights because not all human rights are
161 relevant to ICTs in general and protocols and standards in particular
162 [Bless]: "The main source of the values of human rights is the
163 International Bill of Human Rights that is composed of the Universal
164 Declaration of Human Rights [UDHR] along with the International
165 Covenant on Civil and Political Rights [ICCPR] and the International
166 Covenant on Economic, Social and Cultural Rights [ICESCR]. In the
167 light of several cases of Internet censorship, the Human Rights
168 Council Resolution 20/8 was adopted in 2012 [UNHRC2016], affirming ".
169 . . that the same rights that people have offline must also be
170 protected online. . . " . In 2015, the Charter of Human Rights and
171 Principles for the Internet [IRP] was developed and released.
172 According to these documents, some examples of human rights relevant
173 for ICT systems are human dignity (Art. 1 UDHR), non-discrimination
174 (Art. 2), rights to life, liberty and security (Art. 3), freedom of
175 opinion and expression (Art. 19), freedom of assembly and association
176 (Art. 20), rights to equal protection, legal remedy, fair trial, due
177 process, presumed innocent (Art. 7-11), appropriate social and
178 international order (Art. 28), participation in public affairs (Art.
179 21), participation in cultural life, protection of the moral and
180 material interests resulting from any scientific, literary or
181 artistic production of which [they are] the author (Art. 27), and
182 privacy (Art. 12)." A partial catalog of human rights related to
183 Information and Communications technologies, including economic
184 rights, can be found in [Hill2014].
186 This is by no means an attempt to exclude specific rights or
187 prioritize some rights over others. If other rights seem relevant,
188 please contact the authors.
190 3.2. Conducting human rights reviews
192 Human rights reviews can take place in different parts of the
193 development process of an Internet Draft. However, generally
194 speaking, it is easier to influence the development of a technology
195 at earlier stages than at later stages. This does not mean that
196 reviews at last-call are not relevant, but they are less likely to
197 result in significant changes in the reviewed document.
199 Methods for analyzing technology for specific human rights impacts
200 are still quite nascent. Currently five methods have been explored
201 by the Human Rights Review Team, often in conjunction with each
202 other:
204 3.2.1. Analyzing drafts based on guidelines for human rights
205 considerations model
207 This analysis of Internet-Drafts uses the model as described below.
208 The outlined categories and questions are used to review an Internet
209 Draft an generally the review is also presented in that order. The
210 advantage of this is that it provides a known overview, and document
211 authors can go back to this document as well as [RFC8280] to
212 understand the background and the context.
214 3.2.2. Analyzing drafts based on their perceived or speculated impact
216 When reviewing an Internet-Draft, specific human rights impacts might
217 become apparent by doing a close reading of the draft and seeking to
218 understand how it might affect networks or society. While less
219 structured than the straight use of the human rights considerations
220 model, this analysis might lead to new speculative understandings
221 between human rights and protocols.
223 3.2.3. Expert interviews
225 Interviews with document authors, active members of the Working
226 Group, or experts in the field can help explore the characteristics
227 of the protocol and their effects. There are two main advantages to
228 this approach: one the one hand, it allows the reviewer to gain a
229 deeper understanding of the (intended) workings of the protocol; on
230 the other hand, it also allows for the reviewer to start a discussion
231 with experts or even document authors about certain aspects, which
232 might help gain the review gain traction when it is published.
234 3.2.4. Interviews with impacted persons and communities
236 Protocols impact users of the Internet. There it might help the
237 review to understand how it impacts the people that use the protocol,
238 and the people whose lives are impacted by the protocol. Since human
239 rights should always be understood from the rightsholder, this
240 approach will improve the understanding of the real world effects of
241 the technology. At the same time, it can be hard to attribute
242 specific changes to a particular protocol, this is of course even
243 harder when a protocol has not been (widely) deployed.
245 3.2.5. Tracing impacts of implementations
247 When an Internet Draft is describing running code that has already
248 been implemented, the code could be analyzed either in an
249 experimental setting or on the Internet where its impact can be
250 observed. Other than reviewing a draft, this allows the reviewer to
251 understand how the document works in practice and potentially also
252 what unknown or unexpected effects the technology might have.
254 3.3. Guidelines for human rights considerations
256 This section provides guidance for document authors in the form of a
257 questionnaire about protocols and their (potential) impact. The
258 questionnaire may be useful at any point in the design process,
259 particularly after document authors have developed a high-level
260 protocol model as described in [RFC4101]. These guidelines do not
261 seek to replace any existing referenced specifications, but rather
262 contribute to them and look at the design process from a human rights
263 perspective.
265 Protocols and Internet Standards might benefit from a documented
266 discussion of potential human rights risks arising from potential
267 misapplications of the protocol or technology described in the RFC.
268 This might be coupled with an Applicability Statement for that RFC.
270 Note that the guidance provided in this section does not recommend
271 specific practices. The range of protocols developed in the IETF is
272 too broad to make recommendations about particular uses of data or
273 how human rights might be balanced against other design goals.
274 However, by carefully considering the answers to the following
275 questions, document authors should be able to produce a comprehensive
276 analysis that can serve as the basis for discussion on whether the
277 protocol adequately takes specific human rights threats into account.
278 This guidance is meant to help the thought process of a human rights
279 analysis; it does not provide specific directions for how to write a
280 human rights considerations section (following the example set in
281 [RFC6973]).
283 In considering these questions, authors will need to be aware of the
284 potential of technical advances or the passage of time to undermine
285 protections. In general, considerations of rights are likely to be
286 more effective if they are considered given a purpose and specific
287 use cases, rather than as abstract absolute goals.
289 Also note that while the section uses the word, 'protocol', the
290 principles identified in these questions may be applicable to other
291 types of solutions (extensions to existing protocols, architecture
292 for solutions to specific problems, etc.).
294 3.3.1. Connectivity
296 Question(s): Does your protocol add application-specific functions to
297 intermediary nodes? Could this functionality be added to end nodes
298 instead of intermediary nodes? Is your protocol optimized for low
299 bandwidth and high latency connections? Could your protocol also be
300 developed in a stateless manner?
302 Explanation: The end-to-end principle [Saltzer] holds that 'the
303 intelligence is end to end rather than hidden in the network'
304 [RFC1958]. Using the end-to-end principle in protocol design is
305 important to ensure the reliability and security of data
306 transmissions.
308 Considering the fact that network quality and conditions vary across
309 geography and time, it is also important to design protocols such
310 that they are reliable even on low bandwidth and high latency
311 connections. [add examples]
313 Example: Middleboxes (which can be Content Delivery Networks,
314 Firewalls, NATs or other intermediary nodes that provide 'services'
315 besides routing) serve many legitimate purposes. However, protocols
316 relying on middleboxes can create potential for abuse, and
317 intentional and unintentional censoring, thereby influencing
318 individuals' ability to communicate online freely and privately.
320 Impacts:
322 - Right to freedom of expression
324 - Right to freedom of assembly and association
326 3.3.2. Privacy
328 Question(s): Did you have a look at the Guidelines in the Privacy
329 Considerations for Internet Protocols [RFC6973] section 7? Does your
330 protocol maintain the confidentiality of metadata? Could your
331 protocol counter traffic analysis? Does your protocol adhere to data
332 minimization principles? Does your document identify potentially
333 sensitive data logged by your protocol and/or for how long that needs
334 to be retained for technical reasons?
336 Explanation: Privacy refers to the right of an entity (normally a
337 person), acting in its own behalf, to determine the degree to which
338 it will interact with its environment, including the degree to which
339 the entity is willing to share its personal information with others.
340 [RFC4949]. If a protocol provides insufficient privacy protection it
341 may have a negative impact on freedom of expression as users self-
342 censor for fear of surveillance, or find themselves unable to express
343 themselves freely.
345 Example: See [RFC6973]
347 Impacts:
349 - Right to freedom of expression
351 - Right to non-discrimination
353 3.3.3. Content agnosticism
355 Question(s): If your protocol impacts packet handling, does it use
356 user data (packet data that is not included in the header)? Is it
357 making decisions based on the payload of the packet? Does your
358 protocol prioritize certain content or services over others in the
359 routing process? Is the protocol transparent about the
360 prioritization that is made (if any)?
362 Explanation: Content agnosticism refers to the notion that network
363 traffic is treated identically regardless of payload, with some
364 exception where it comes to effective traffic handling, for instance
365 where it comes to delay tolerant or delay sensitive packets, based on
366 the header.
368 Example: Content agnosticism prevents payload-based discrimination
369 against packets. This is important because changes to this principle
370 can lead to a two-tiered Internet, where certain packets are
371 prioritized over others on the basis of their content. Effectively
372 this would mean that although all users are entitled to receive their
373 packets at a certain speed, some users become more equal than others.
375 Impacts:
377 - Right to freedom of expression
378 - Right to non-discrimination
380 - Right to equal protection
382 3.3.4. Security
384 Question(s): Did you have a look at Guidelines for Writing RFC Text
385 on Security Considerations [BCP72]? Have you found any attacks that
386 are somewhat related to your protocol yet considered out of scope of
387 your document? Would these attacks be pertinent to the human rights
388 enabling features of the Internet (as described throughout this
389 document)?
391 Explanation: Security is not a single monolithic property of a
392 protocol or system, but rather a series of related but somewhat
393 independent properties. Not all of these properties are required for
394 every application. Since communications are carried out by systems
395 and access to systems is through communications channels, security
396 goals obviously interlock, but they can also be independently
397 provided. [BCP72].
399 Example: See [BCP72].
401 Impacts:
403 - Right to freedom of expression
405 - Right to freedom of assembly and association
407 - Right to non-discrimination
409 - Right to security
411 3.3.5. Internationalization
413 Question(s): Does your protocol have text strings that have to be
414 understood or entered by humans? Does your protocol allow Unicode?
415 If so, do you accept texts in one charset (which must be UTF-8), or
416 several (which is dangerous for interoperability)? If character sets
417 or encodings other than UTF-8 are allowed, does your protocol mandate
418 a proper tagging of the charset? Did you have a look at [RFC6365]?
420 Explanation: Internationalization refers to the practice of making
421 protocols, standards, and implementations usable in different
422 languages and scripts (see Localization). In the IETF,
423 internationalization means to add or improve the handling of non-
424 ASCII text in a protocol. [RFC6365] A different perspective, more
425 appropriate to protocols that are designed for global use from the
426 beginning, is the definition used by W3C:
428 "Internationalization is the design and development of a
429 product, application or document content that enables easy
430 localization for target audiences that vary in culture, region,
431 or language." {{W3Ci18nDef}}
433 Many protocols that handle text only handle one charset (US-ASCII),
434 or leave the question of what coded character set and encoding are
435 used up to local guesswork (which leads, of course, to
436 interoperability problems). If multiple charsets are permitted, they
437 must be explicitly identified [RFC2277]. Adding non-ASCII text to a
438 protocol allows the protocol to handle more scripts, hopefully
439 representing users across the world. In today's world, that is
440 normally best accomplished by allowing Unicode encoded in UTF-8 only.
442 In the current IETF policy [RFC2277], internationalization is aimed
443 at user-facing strings, not protocol elements, such as the verbs used
444 by some text-based protocols. (Do note that some strings are both
445 content and protocol elements, such as the identifiers.) If IETF
446 wants the Internet to be a global network of networks, the protocols
447 should work with languages apart from English and character sets
448 apart from Latin characters. It is therefore crucial that at least
449 the content carried by the protocol can be in any script, and that
450 all scripts are treated equally.
452 Example: See localization
454 Impacts:
456 - Right to freedom of expression
458 - Right to political participation
460 - Right to participate in cultural life, arts and science
462 3.3.6. Censorship resistance
464 Question(s): Does your protocol make it apparent or transparent when
465 access to a resource it restricted? Can your protocol contribute to
466 filtering in a way it could be implemented to censor data or
467 services? Could this be designed to ensure this doesn't happen?
468 Does your protocol introduce new identifiers or reuse existing
469 identifiers (e.g. MAC addresses) that might be associated with
470 persons or content?
471 Explanation: Censorship resistance refers to the methods and measures
472 to prevent Internet censorship. See [draft-irtf-pearg-censorship]
473 for a survey of censorship techniques employed across the world,
474 which lays out protocol properties that have been exploited to censor
475 access to information.
477 Example: In the development of the IPv6 protocol, it was discussed to
478 embed a Media Access Control (MAC) address into unique IP addresses.
479 This would make it possible for 'eavesdroppers and other information
480 collectors to identify when different addresses used in different
481 transactions actually correspond to the same node. This is why
482 Privacy Extensions for Stateless Address Autoconfiguration in IPv6
483 have been introduced. [RFC4941]
485 Identifiers of content exposed within a protocol might be used to
486 facilitate censorship, as in the case of Application Layer based
487 censorship, which affects protocols like HTTP. In HTTP, denial or
488 restriction of access can be made apparent by the use of status code
489 451, which allows server operators to operate with greater
490 transparency in circumstances where issues of law or public policy
491 affect their operation [RFC7725].
493 Impacts:
495 - Right to freedom of expression
497 - Right to political participation
499 - Right to participate in cultural life, arts and science
501 - Right to freedom of assembly and association
503 3.3.7. Open Standards
505 Question(s): Is your protocol fully documented in a way that it could
506 be easily implemented, improved, built upon and/or further developed?
507 Do you depend on proprietary code for the implementation, running or
508 further development of your protocol? Does your protocol favor a
509 particular proprietary specification over technically-equivalent
510 competing specification(s), for instance by making any incorporated
511 vendor specification "required" or "recommended" [RFC2026]? Do you
512 normatively reference another standard that is not available without
513 cost (and could you do without it)? Are you aware of any patents
514 that would prevent your standard from being fully implemented
515 [RFC8179] [RFC6701]?
517 Explanation: The Internet was able to be developed into the global
518 network of networks because of the existence of open, non-proprietary
519 standards [Zittrain]. They are crucial for enabling
520 interoperability. Yet, open standards are not explicitly defined
521 within the IETF. On the subject, [RFC2026] states: "Various national
522 and international standards bodies, such as ANSI, ISO, IEEE, and ITU-
523 T, develop a variety of protocol and service specifications that are
524 similar to Technical Specifications defined at the IETF. National
525 and international groups also publish "implementors' agreements" that
526 are analogous to Applicability Statements, capturing a body of
527 implementation-specific detail concerned with the practical
528 application of their standards. All of these are considered to be
529 "open external standards" for the purposes of the Internet Standards
530 Process." Similarly, [RFC3935] does not define open standards but
531 does emphasize the importance of an "open process", i.e. "any
532 interested person can participate in the work, know what is being
533 decided, and make his or her voice heard on the issue."
535 Open standards are important as they allow for permissionless
536 innovation, which is important to maintain the freedom and ability to
537 freely create and deploy new protocols on top of the communications
538 constructs that currently exist. It is at the heart of the Internet
539 as we know it, and to maintain its fundamentally open nature, we need
540 to be mindful of the need for developing open standards.
542 All standards that need to be normatively implemented should be
543 freely available and with reasonable protection for patent
544 infringement claims, so it can also be implemented in open source or
545 free software. Patents have often held back open standardization or
546 been used against those deploying open standards, particularly in the
547 domain of cryptography [newegg]. An exemption of this is sometimes
548 made when a protocol is standardized that normatively relies on
549 specifications produced by others SDOs that are not freely available.
550 Patents in open standards or in normative references to other
551 standards should have a patent disclosure [notewell], royalty-free
552 licensing [patentpolicy], or some other form of fair, reasonable and
553 non-discriminatory terms.
555 Example: [RFC6108] describes a system for providing critical end-user
556 notifications to web browsers, which has been deployed by Comcast, an
557 Internet Service Provider (ISP). Such a notification system is being
558 used to provide near-immediate notifications to customers, such as to
559 warn them that their traffic exhibits patterns that are indicative of
560 malware or virus infection. There are other proprietary systems that
561 can perform such notifications, but those systems utilize Deep Packet
562 Inspection (DPI) technology. In contrast, that document describes a
563 system that does not rely upon DPI, and is instead based on open IETF
564 standards and open source applications.
566 Impacts:
568 - Right to freedom of expression
570 - Right to participate in cultural life, arts and science
572 3.3.8. Heterogeneity Support
574 Question(s): Does your protocol support heterogeneity by design?
575 Does your protocol allow for multiple types of hardware? Does your
576 protocol allow for multiple types of application protocols? Is your
577 protocol liberal in what it receives and handles? Will it remain
578 usable and open if the context changes? Does your protocol allow
579 there to be well-defined extension points? Do these extension points
580 allow for open innovation?
582 Explanation: The Internet is characterized by heterogeneity on many
583 levels: devices and nodes, router scheduling algorithms and queue
584 management mechanisms, routing protocols, levels of multiplexing,
585 protocol versions and implementations, underlying link layers (e.g.,
586 point-to-point, multi-access links, wireless, FDDI, etc.), in the
587 traffic mix and in the levels of congestion at different times and
588 places. Moreover, as the Internet is composed of autonomous
589 organizations and Internet service providers, each with their own
590 separate policy concerns, there is a large heterogeneity of
591 administrative domains and pricing structures. As a result, the
592 heterogeneity principle proposed in [RFC1958] needs to be supported
593 by design [FIArch].
595 Example: Heterogeneity is inevitable and needs be supported by
596 design. Multiple types of hardware must be allowed for, e.g.
597 transmission speeds differing by at least 7 orders of magnitude,
598 various computer word lengths, and hosts ranging from memory-starved
599 microprocessors up to massively parallel supercomputers. Multiple
600 types of application protocols must be allowed for, ranging from the
601 simplest such as remote login up to the most complex such as commit
602 protocols for distributed databases. [RFC1958].
604 Impacts:
606 - Right to freedom of expression
608 - Right to political participation
610 3.3.9. Pseudonymity
612 Question(s): Have you considered the Privacy Considerations for
613 Internet Protocols [RFC6973], especially section 6.1.2 ? Does the
614 protocol collect personally derived data? Does the protocol generate
615 or process anything that can be, or be tightly correlated with,
616 personally identifiable information? Does the protocol utilize data
617 that is personally-derived, i.e. derived from the interaction of a
618 single person, or their device or address? Does this protocol
619 generate personally derived data, and if so how will that data be
620 handled?
622 Explanation: Pseudonymity - the ability to use a persistent
623 identifier not linked to one's offline identity - is an important
624 feature for many end-users, as it allows them different degrees of
625 disguised identity and privacy online.
627 Example: While designing a standard that exposes personal data, it is
628 important to consider ways to mitigate the obvious impacts. While
629 pseudonyms cannot be simply reverse engineered - some early
630 approaches simply took approaches such as simple hashing of IP
631 addresses, these could then be simply reversed by generating a hash
632 for each potential IP address and comparing it to the pseudonym -
633 limiting the exposure of personal data remains important.
635 Pseudonymity means using a pseudonym instead of one's "real" name.
636 There are many reasons for users to use pseudonyms, for instance to:
637 hide their gender, protect themselves against harassment, protect
638 their families' privacy, frankly discuss sexuality, or develop a
639 artistic or journalistic persona without repercussions from an
640 employer, (potential) customers, or social surrounding.
641 [geekfeminism] The difference between anonymity and pseudonymity is
642 that a pseudonym often is persistent. "Pseudonymity is strengthened
643 when less personal data can be linked to the pseudonym; when the same
644 pseudonym is used less often and across fewer contexts; and when
645 independently chosen pseudonyms are more frequently used for new
646 actions (making them, from an observer's or attacker's perspective,
647 unlinkable)." [RFC6973]
649 Impacts:
651 - Right to non-discrimination
653 - Right to freedom of assembly and association
655 3.3.10. Accessibility
657 Question(s): Is your protocol designed to provide an enabling
658 environment for people who are not able-bodied? Have you looked at
659 the W3C Web Accessibility Initiative for examples and guidance?
661 Explanation: Sometimes in the design of protocols, websites, web
662 technologies, or web tools, barriers are created that exclude people
663 from using the Web. The Internet should be designed to work for all
664 people, whatever their hardware, software, language, culture,
665 location, or physical or mental ability. When the Internet
666 technologies meet this goal, it will be accessible to people with a
667 diverse range of hearing, movement, sight, and cognitive ability.
668 [W3CAccessibility]
670 Example: The HTML protocol as defined in [HTML5] specifically
671 requires that every image must have an alt attribute (with a few
672 exceptions) to ensure images are accessible for people that cannot
673 themselves decipher non-text content in web pages.
675 Impacts:
677 - Right to non-discrimination
679 - Right to freedom of assembly and association
681 - Right to education
683 - Right to political participation
685 3.3.11. Localization
687 Question(s): Does your protocol uphold the standards of
688 internationalization? Have you made any concrete steps towards
689 localizing your protocol for relevant audiences?
691 Explanation: Localization refers to the adaptation of a product,
692 application or document content to meet the language, cultural and
693 other requirements of a specific target market (a locale)
694 [W3Ci18nDef]. It is also described as the practice of translating an
695 implementation to make it functional in a specific language or for
696 users in a specific locale (see Internationalization).
698 Example: The Internet is a global medium, but many of its protocols
699 and products are developed with a certain audience in mind, that
700 often share particular characteristics like knowing how to read and
701 write in ASCII and knowing English. This limits the ability of a
702 large part of the world's online population from using the Internet
703 in a way that is culturally and linguistically accessible. An
704 example of a protocol that has taken into account the view that
705 individuals like to have access to data in their native language can
706 be found in [RFC5646]. This protocol labels the information content
707 with an identifier for the language in which it is written. And this
708 allows information to be presented in more than one language.
710 Impacts:
712 - Right to non-discrimination
714 - Right to participate in cultural life, arts and science
716 - Right to freedom of expression
718 3.3.12. Decentralization
720 Question(s): Can your protocol be implemented without a single point
721 of control? If applicable, can your protocol be deployed in a
722 federated manner? What is the potential for discrimination against
723 users of your protocol? How can your protocol be used to implicate
724 users? Does your protocol create additional centralized points of
725 control?
727 Explanation: Decentralization is one of the central technical
728 concepts of the architecture of the networks, and embraced as such by
729 the IETF [RFC3935]. It refers to the absence or minimization of
730 centralized points of control, a feature that is assumed to make it
731 easy for new users to join and new uses to unfold [Brown]. It also
732 reduces issues surrounding single points of failure, and distributes
733 the network such that it continues to function even if one or several
734 nodes are disabled. With the commercialization of the Internet in
735 the early 1990s, there has been a slow move away from
736 decentralization, to the detriment of the technical benefits of
737 having a decentralized Internet.
739 Example: The bits traveling the Internet are increasingly susceptible
740 to monitoring and censorship, from both governments and Internet
741 service providers, as well as third (malicious) parties. The ability
742 to monitor and censor is further enabled by the increased
743 centralization of the network that creates central infrastructure
744 points that can be tapped in to. The creation of peer-to-peer
745 networks and the development of voice-over-IP protocols using peer-
746 to-peer technology in combination with distributed hash table (DHT)
747 for scalability are examples of how protocols can preserve
748 decentralization [Pouwelse].
750 Impacts:
752 - Right to freedom of expression
754 - Right to freedom of assembly and association
756 3.3.13. Reliability
758 Question(s): Is your protocol fault tolerant? Does it downgrade
759 gracefully? Can your protocol resist malicious degradation attempts?
760 Do you have a documented way to announce degradation? Do you have
761 measures in place for recovery or partial healing from failure? Can
762 your protocol maintain dependability and performance in the face of
763 unanticipated changes or circumstances?
765 Explanation: Reliability ensures that a protocol will execute its
766 function consistently and error resistant as described, and function
767 without unexpected result. A system that is reliable degenerates
768 gracefully and will have a documented way to announce degradation.
769 It also has mechanisms to recover from failure gracefully, and if
770 applicable, allow for partial healing. It is important here to draw
771 a distinction between random degradation and malicious degradation.
772 Many current attacks against TLS, for example, exploit TLS' ability
773 to gracefully downgrade to older cipher suites - from a functional
774 perspective, this is good; from a security perspective, this can be
775 very bad. As with confidentiality, the growth of the Internet and
776 fostering innovation in services depends on users having confidence
777 and trust [RFC3724] in the network. For reliability, it is necessary
778 that services notify the users if a delivery fails. In the case of
779 real-time systems in addition to the reliable delivery the protocol
780 needs to safeguard timeliness.
782 Example: In the modern IP stack structure, a reliable transport layer
783 requires an indication that transport processing has successfully
784 completed, such as given by TCP's ACK message [RFC0793], and not
785 simply an indication from the IP layer that the packet arrived.
786 Similarly, an application layer protocol may require an application-
787 specific acknowledgment that contains, among other things, a status
788 code indicating the disposition of the request (See [RFC3724]).
790 Impacts:
792 - Right to freedom of expression
794 - Right to security
796 3.3.14. Confidentiality
798 Question(s): Does this protocol expose information related to
799 identifiers or data? If so, does it do so to each other protocol
800 entity (i.e., recipients, intermediaries, and enablers) [RFC6973]?
801 What options exist for protocol implementers to choose to limit the
802 information shared with each entity? What operational controls are
803 available to limit the information shared with each entity?
804 What controls or consent mechanisms does the protocol define or
805 require before personal data or identifiers are shared or exposed via
806 the protocol? If no such mechanisms or controls are specified, is it
807 expected that control and consent will be handled outside of the
808 protocol?
810 Does the protocol provide ways for initiators to share different
811 pieces of information with different recipients? If not, are there
812 mechanisms that exist outside of the protocol to provide initiators
813 with such control?
815 Does the protocol provide ways for initiators to limit the sharing or
816 express individuals' preferences to recipients or intermediaries with
817 regard to the collection, use, or disclosure of their personal data?
818 If not, are there mechanisms that exist outside of the protocol to
819 provide users with such control? Is it expected that users will have
820 relationships that govern the use of the information (contractual or
821 otherwise) with those who operate these intermediaries? Does the
822 protocol prefer encryption over clear text operation?
824 Explanation: Confidentiality refers to keeping your data secret from
825 unintended listeners [BCP72]. The growth of the Internet depends on
826 users having confidence that the network protects their personal data
827 [RFC1984].
829 Example: Protocols that do not encrypt their payload make the entire
830 content of the communication available to the idealized attacker
831 along their path. Following the advice in [RFC3365], most such
832 protocols have a secure variant that encrypts the payload for
833 confidentiality, and these secure variants are seeing ever-wider
834 deployment. A noteworthy exception is DNS [RFC1035], as DNSSEC
835 [RFC4033] does not have confidentiality as a requirement. This
836 implies that, in the absence of the use of more recent standards like
837 DNS over TLS [RFC7858] or DNS over HTTPS [RFC8484], all DNS queries
838 and answers generated by the activities of any protocol are available
839 to the attacker. When store-and-forward protocols are used (e.g.,
840 SMTP [RFC5321]), intermediaries leave this data subject to
841 observation by an attacker that has compromised these intermediaries,
842 unless the data is encrypted end-to-end by the application-layer
843 protocol or the implementation uses an encrypted store for this data
844 [RFC7624].
846 Impacts:
848 - Right to privacy
850 - Right to security
852 3.3.15. Integrity
854 Question(s): Does your protocol maintain, assure and/or verify the
855 accuracy of payload data? Does your protocol maintain and assure the
856 consistency of data? Does your protocol in any way allow for the
857 data to be (intentionally or unintentionally) altered?
859 Explanation: Integrity refers to the maintenance and assurance of the
860 accuracy and consistency of data to ensure it has not been
861 (intentionally or unintentionally) altered.
863 Example: Integrity verification of data is important to prevent
864 vulnerabilities and attacks from on-path attackers. These attacks
865 happen when a third party (often for malicious reasons) intercepts a
866 communication between two parties, inserting themselves in the middle
867 changing the content of the data. In practice this looks as follows:
869 Alice wants to communicate with Bob.
870 Corinne forges and sends a message to Bob, impersonating Alice.
871 Bob cannot see the data from Alice was altered by Corinne.
872 Corinne intercepts and alters the communication as it is sent between
873 Alice and Bob.
874 Corinne is able to control the communication content.
876 Impacts:
878 - Right to freedom of expression
880 - Right to security
882 3.3.16. Authenticity
884 Question(s): Do you have sufficient measures to confirm the truth of
885 an attribute of a single piece of data or entity? Can the attributes
886 get garbled along the way (see security)? If relevant, have you
887 implemented IPsec, DNSsec, HTTPS and other Standard Security Best
888 Practices?
890 Explanation: Authenticity ensures that data does indeed come from the
891 source it claims to come from. This is important to prevent certain
892 attacks or unauthorized access and use of data.
894 At the same time, authentication should not be used as a way to
895 prevent heterogeneity support, as is often done for vendor lock-in or
896 digital rights management.
898 Example: Authentication of data is important to prevent
899 vulnerabilities, and attacks from on-path attackers. These attacks
900 happen when a third party (often for malicious reasons) intercepts a
901 communication between two parties, inserting themselves in the middle
902 and posing as both parties. In practice this looks as follows:
904 Alice wants to communicate with Bob.
905 Alice sends data to Bob.
906 Corinne intercepts the data sent to Bob.
907 Corinne reads (and potentially alters) the message to Bob.
908 Bob cannot see the data did not come from Alice but from Corinne.
910 When there is proper authentication the scenario would be as follows:
912 Alice wants to communicate with Bob.
913 Alice sends data to Bob.
914 Corinne intercepts the data sent to Bob.
915 Corinne reads and alters the message to Bob.
916 Bob can see the data did not come from Alice.
918 Impacts:
920 - Right to privacy
922 - Right to freedom of expression
924 - Right to security
926 3.3.17. Adaptability
928 Question(s): Is your protocol written in such a way that is would be
929 easy for other protocols to be developed on top of it, or to interact
930 with it? Does your protocol impact permissionless innovation? (See
931 Connectivity)
933 Explanation: Adaptability is closely interrelated with permissionless
934 innovation: both maintain the freedom and ability to freely create
935 and deploy new protocols on top of the communications constructs that
936 currently exist. It is at the heart of the Internet as we know it,
937 and to maintain its fundamentally open nature, we need to be mindful
938 of the impact of protocols on maintaining or reducing permissionless
939 innovation to ensure the Internet can continue to develop.
941 Example: WebRTC generates audio and/or video data. In order to
942 ensure that WebRTC can be used in different locations by different
943 parties, it is important that standard Javascript APIs are developed
944 to support applications from different voice service providers.
945 Multiple parties will have similar capabilities, in order to ensure
946 that all parties can build upon existing standards these need to be
947 adaptable, and allow for permissionless innovation.
949 Impacts:
951 - Right to education
953 - Freedom of expression
955 - Freedom of assembly and association
957 3.3.18. Outcome Transparency
959 Question(s): Are the effects of your protocol fully and easily
960 comprehensible, including with respect to unintended consequences of
961 protocol choices?
963 Explanation: Certain technical choices may have unintended
964 consequences.
966 Example: Lack of authenticity may lead to lack of integrity and
967 negative externalities, of which spam is an example. Lack of data
968 that could be used for billing and accounting can lead to so-called
969 "free" arrangements which obscure the actual costs and distribution
970 of the costs, for example the barter arrangements that are commonly
971 used for Internet interconnection; and the commercial exploitation of
972 personal data for targeted advertising which is the most common
973 funding model for the so-called "free" services such as search
974 engines and social networks. Other unexpected outcomes might not be
975 technical, but rather architectural, social or economical.
977 Impacts:
979 - Freedom of expression
981 - Privacy
983 - Freedom of assembly and association
985 - Access to information
987 3.3.19. Anonymity
989 Question(s): Does your protocol make use of persistent identifiers?
990 Can it be done without them? Did you have a look at the Privacy
991 Considerations for Internet Protocols [RFC6973], especially section
992 6.1.1 of that document?
994 Explanation: Anonymity refers to the condition of an identity being
995 unknown or concealed [RFC4949]. Even though full anonymity is hard
996 to achieve, it is a non-binary concept. Making pervasive monitoring
997 and tracking harder is important for many users as well as for the
998 IETF [RFC7258]. Achieving a higher level of anonymity is an
999 important feature for many end-users, as it allows them different
1000 degrees of privacy online. Anonymity is an inherent part of the
1001 right to freedom of opinion and expression and the right to privacy.
1002 Avoid adding identifiers, options or configurations that create or
1003 might lead to patterns or regularities that are not explicitly
1004 required by the protocol.
1006 If your protocol collects data and distributes it (see [RFC6235]),
1007 you should anonymize the data, but keep in mind that "anonymizing"
1008 data is notoriously hard. Do not think that just dropping the last
1009 byte of an IP address "anonymizes" data. If your protocol allows for
1010 identity management, there should be a clear barrier between the
1011 identities to ensure that they cannot (easily) be associated with
1012 each other.
1014 Often protocols expose personal data, it is important to consider
1015 ways to mitigate the obvious privacy impacts. A protocol that uses
1016 data that could help identify a sender (items of interest) should be
1017 protected from third parties. For instance, if one wants to hide the
1018 source/destination IP addresses of a packet, the use of IPsec in
1019 tunneling mode (e.g., inside a virtual private network) can be
1020 helpful to protect from third parties likely to eavesdrop packets
1021 exchanged between the tunnel endpoints.
1023 Example: An example is DHCP where sending a persistent identifier as
1024 the client name was not mandatory but, in practice, done by many
1025 implementations, before [RFC7844].
1027 Impacts:
1029 - Right to non-discrimination
1031 - Right to political participation
1033 - Right to freedom of assembly and association
1035 - Right to security
1037 3.3.20. Misc. considerations
1039 Question(s): Is your document
1041 Explanation: Publication of a particular RFC under a certain status
1042 has consequences. Publication as an Internet Standard as part of the
1043 Standards Track may signal to implementers that the specification has
1044 a certain level of maturity, operational experience, and consensus.
1046 Similarly, publication of a specification an experimental document as
1047 part of the non-standards track would signal to the community that
1048 the document "may be intended for eventual standardization but [may]
1049 not yet [be] ready" for wide deployment. The extent of the
1050 deployment, and consequently its overall impact on end-users, may
1051 depend on the document status presented in the RFC. See [BCP9] and
1052 updates to it for a fuller explanation.
1054 4. Document Status
1056 This RG document is currently documenting best practices and
1057 guidelines for human rights reviews of networking protocols and other
1058 Internet-Drafts and RFCs
1060 5. Acknowledgements
1062 Thanks to:
1064 - Corinne Cath for work on [RFC8280].
1066 - Theresa Engelhard, Joe Hall, Avri Doria and the hrpc list for
1067 reviews and suggestions.
1069 - Individuals who conducted human rights reviews for their work and
1070 feedback: Amelia Andersdotter, Beatrice Martini, Karan Saini and
1071 Shivan Kaul Sahib.
1073 6. Security Considerations
1075 As this document concerns a research document, there are no security
1076 considerations.
1078 7. IANA Considerations
1080 This document has no actions for IANA.
1082 8. Research Group Information
1084 The discussion list for the IRTF Human Rights Protocol Considerations
1085 Research Group is located at the e-mail address hrpc@ietf.org [1].
1086 Information on the group and information on how to subscribe to the
1087 list is at https://www.irtf.org/mailman/listinfo/hrpc [2]
1089 Archives of the list can be found at: https://www.irtf.org/mail-
1090 archive/web/hrpc/current/index.html [3]
1092 9. References
1094 9.1. Informative References
1096 [BCP72] IETF, "Guidelines for Writing RFC Text on Security
1097 Considerations", 2003,
1098 .
1100 [BCP9] Bradner, S. and IETF, "The Internet Standards Process --
1101 Revision 3", 1996,
1102 .
1104 [Bless] Bless, R. and C. Orwat, "Values and Networks", 2015.
1106 [Brown] Brown, I. and M. Ziewitz, "A Prehistory of Internet
1107 Governance", Research Handbook on Governance of the
1108 Internet. Cheltenham, Edward Elgar. , 2013.
1110 [draft-irtf-pearg-censorship]
1111 Hall, J., Aaron, M., Adams, S., Jones, B., and N.
1112 Feamster, "A Survey of Worldwide Censorship Techniques",
1113 2020,
1114 .
1116 [FIArch] "Future Internet Design Principles", January 2012,
1117 .
1120 [geekfeminism]
1121 Geek Feminism Wiki, "Pseudonymity", 2015,
1122 .
1124 [Hill2014]
1125 Hill, R., "Partial Catalog of Human Rights Related to ICT
1126 Activities", 2014,
1127 .
1129 [HTML5] W3C, "HTML5", 2014, .
1131 [ICCPR] United Nations General Assembly, "International Covenant
1132 on Civil and Political Rights", 1976,
1133 .
1136 [ICESCR] United Nations General Assembly, "International Covenant
1137 on Economic, Social and Cultural Rights", 1966,
1138 .
1141 [IRP] Internet Rights and Principles Dynamic Coalition, "10
1142 Internet Rights & Principles", 2014,
1143 .
1147 [newegg] Mullin, J., "Newegg on trial: Mystery company TQP rewrites
1148 the history of encryption", 2013, .
1152 [notewell]
1153 IETF, "Note Well", 2015,
1154 .
1156 [patentpolicy]
1157 W3C, "W3C Patent Policy", 2004,
1158 .
1160 [Penney] Penney, J., "Chilling Effects: Online Surveillance and
1161 Wikipedia Use", 2016, .
1164 [Pouwelse]
1165 Pouwelse, Ed, J., "Media without censorship", 2012,
1166 .
1169 [RFC0793] Postel, J., "Transmission Control Protocol", STD 7,
1170 RFC 793, DOI 10.17487/RFC0793, September 1981,
1171 .
1173 [RFC1035] Mockapetris, P., "Domain names - implementation and
1174 specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
1175 November 1987, .
1177 [RFC1958] Carpenter, B., Ed., "Architectural Principles of the
1178 Internet", RFC 1958, DOI 10.17487/RFC1958, June 1996,
1179 .
1181 [RFC1984] IAB and IESG, "IAB and IESG Statement on Cryptographic
1182 Technology and the Internet", BCP 200, RFC 1984,
1183 DOI 10.17487/RFC1984, August 1996,
1184 .
1186 [RFC2026] Bradner, S., "The Internet Standards Process -- Revision
1187 3", BCP 9, RFC 2026, DOI 10.17487/RFC2026, October 1996,
1188 .
1190 [RFC2277] Alvestrand, H., "IETF Policy on Character Sets and
1191 Languages", BCP 18, RFC 2277, DOI 10.17487/RFC2277,
1192 January 1998, .
1194 [RFC3365] Schiller, J., "Strong Security Requirements for Internet
1195 Engineering Task Force Standard Protocols", BCP 61,
1196 RFC 3365, DOI 10.17487/RFC3365, August 2002,
1197 .
1199 [RFC3724] Kempf, J., Ed., Austein, R., Ed., and IAB, "The Rise of
1200 the Middle and the Future of End-to-End: Reflections on
1201 the Evolution of the Internet Architecture", RFC 3724,
1202 DOI 10.17487/RFC3724, March 2004,
1203 .
1205 [RFC3935] Alvestrand, H., "A Mission Statement for the IETF",
1206 BCP 95, RFC 3935, DOI 10.17487/RFC3935, October 2004,
1207 .
1209 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
1210 Rose, "DNS Security Introduction and Requirements",
1211 RFC 4033, DOI 10.17487/RFC4033, March 2005,
1212 .
1214 [RFC4101] Rescorla, E. and IAB, "Writing Protocol Models", RFC 4101,
1215 DOI 10.17487/RFC4101, June 2005,
1216 .
1218 [RFC4941] Narten, T., Draves, R., and S. Krishnan, "Privacy
1219 Extensions for Stateless Address Autoconfiguration in
1220 IPv6", RFC 4941, DOI 10.17487/RFC4941, September 2007,
1221 .
1223 [RFC4949] Shirey, R., "Internet Security Glossary, Version 2",
1224 FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
1225 .
1227 [RFC5321] Klensin, J., "Simple Mail Transfer Protocol", RFC 5321,
1228 DOI 10.17487/RFC5321, October 2008,
1229 .
1231 [RFC5646] Phillips, A., Ed. and M. Davis, Ed., "Tags for Identifying
1232 Languages", BCP 47, RFC 5646, DOI 10.17487/RFC5646,
1233 September 2009, .
1235 [RFC6108] Chung, C., Kasyanov, A., Livingood, J., Mody, N., and B.
1236 Van Lieu, "Comcast's Web Notification System Design",
1237 RFC 6108, DOI 10.17487/RFC6108, February 2011,
1238 .
1240 [RFC6235] Boschi, E. and B. Trammell, "IP Flow Anonymization
1241 Support", RFC 6235, DOI 10.17487/RFC6235, May 2011,
1242 .
1244 [RFC6365] Hoffman, P. and J. Klensin, "Terminology Used in
1245 Internationalization in the IETF", BCP 166, RFC 6365,
1246 DOI 10.17487/RFC6365, September 2011,
1247 .
1249 [RFC6701] Farrel, A. and P. Resnick, "Sanctions Available for
1250 Application to Violators of IETF IPR Policy", RFC 6701,
1251 DOI 10.17487/RFC6701, August 2012,
1252 .
1254 [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J.,
1255 Morris, J., Hansen, M., and R. Smith, "Privacy
1256 Considerations for Internet Protocols", RFC 6973,
1257 DOI 10.17487/RFC6973, July 2013,
1258 .
1260 [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
1261 Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May
1262 2014, .
1264 [RFC7624] Barnes, R., Schneier, B., Jennings, C., Hardie, T.,
1265 Trammell, B., Huitema, C., and D. Borkmann,
1266 "Confidentiality in the Face of Pervasive Surveillance: A
1267 Threat Model and Problem Statement", RFC 7624,
1268 DOI 10.17487/RFC7624, August 2015,
1269 .
1271 [RFC7725] Bray, T., "An HTTP Status Code to Report Legal Obstacles",
1272 RFC 7725, DOI 10.17487/RFC7725, February 2016,
1273 .
1275 [RFC7844] Huitema, C., Mrugalski, T., and S. Krishnan, "Anonymity
1276 Profiles for DHCP Clients", RFC 7844,
1277 DOI 10.17487/RFC7844, May 2016,
1278 .
1280 [RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D.,
1281 and P. Hoffman, "Specification for DNS over Transport
1282 Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May
1283 2016, .
1285 [RFC8179] Bradner, S. and J. Contreras, "Intellectual Property
1286 Rights in IETF Technology", BCP 79, RFC 8179,
1287 DOI 10.17487/RFC8179, May 2017,
1288 .
1290 [RFC8280] ten Oever, N. and C. Cath, "Research into Human Rights
1291 Protocol Considerations", RFC 8280, DOI 10.17487/RFC8280,
1292 October 2017, .
1294 [RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS
1295 (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018,
1296 .
1298 [Saltzer] Saltzer, J., Reed, D., and D. Clark, "End-to-End Arguments
1299 in System Design", ACM TOCS, Vol 2, Number 4, November
1300 1984, pp 277-288. , 1984.
1302 [UDHR] United Nations General Assembly, "The Universal
1303 Declaration of Human Rights", 1948,
1304 .
1306 [UNHRC2016]
1307 United Nations Human Rights Council, "UN Human Rights
1308 Council Resolution "The promotion, protection and
1309 enjoyment of human rights on the Internet" (A/HRC/32/
1310 L.20)", 2016, .
1314 [W3CAccessibility]
1315 W3C, "Accessibility", 2015,
1316 .
1318 [W3Ci18nDef]
1319 W3C, "Localization vs. Internationalization", 2010,
1320 .
1322 [Zittrain]
1323 Zittrain, J., "The Future of the Internet - And How to
1324 Stop It", Yale University Press , 2008,
1325 .
1328 9.2. URIs
1330 [1] mailto:hrpc@ietf.org
1332 [2] https://www.irtf.org/mailman/listinfo/hrpc
1334 [3] https://www.irtf.org/mail-archive/web/hrpc/current/index.html
1336 Authors' Addresses
1338 Gurshabad Grover
1339 Centre for Internet and Society
1341 EMail: gurshabad@cis-india.org
1343 Niels ten Oever
1344 University of Amsterdam
1346 EMail: mail@nielstenoever.net