[arch-d] IAB statement on "Avoiding Unintended Harm to Internet Infrastructure"

[Vittorio Bertola <[e-mail]>]

Hello,

after a brief discussion on [e-mail], it was suggested that this is the appropriate list to discuss the recent IAB statement on "Avoiding Unintended Harm to Internet Infrastructure" ( https://www.iab.org/documents/correspondence-reports-documents/2019-2/avoiding-unintended-harm-to-internet-infrastructure/ ) - if not, please redirect me to the appropriate place.

It is unclear to me what prompted the IAB to release this statement at this point in time, so possibly I miss parts of the picture. Also I do not know if it has been discussed with the community and where. Still, I found it surprising in several points, and confusing in others.

In the DNS section, it is disheartening to read the IAB stating that "[a DNS resolver] returning the wrong (or no) address breaks the trust that users have in this infrastructure", after having spent months on the ADD list and elsewhere to explain that there are indeed lots of use cases in which users expect, or even actively request, that their resolver applies filters to the responses. In some cases it is actually the opposite - if I acquire a DNS-based service to prevent any accidental connection to malware-infected websites and then I get malware, that's when I lose trust in my DNS resolver; same for parental controls.

More generally, the entire document sounds like a claim that the Internet's infrastructure and those who run it need to be exempt from cooperation with law enforcement activities, and totally unregulated. However, there is some incoherence between the considerations in most of the text and the final recommendations.

For example, the second bullet in the recommendations asks to exempt *communication* between network operators/DNS operators/PKI vendors from any law enforcement requirements, i.e. "do not break encryption". 

However, the main text argues against other possible requests from law enforcement, such as CAs being asked to "issue a certificate improperly", or network operators redirecting traffic to law enforcement agencies. These practices are not related to communication between network operators, but to the actions of each single operator, so it is unclear whether the IAB in the end recommends against them or not; in the recommendations, it then mentions "endpoint-focused interventions" only to suggest that those who are subject to them should be listed explicitly in the regulation (which, by the way, is not how a law can work).

Similarly, the section titled "Impact on Internet evolution" seems to argue against regulation of the Internet, but in the final section there is no recommendation against regulation, just a request to involve all stakeholders when discussing it.

It would be nice if we could understand better what is the objective that the IAB wants to achieve with this statement and what does it actually recommend, before commenting further.

Thanks,
-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy