[hrpc] Thoughts on the end-to-end principle and Human Rights

[Fred Baker <[e-mail]>]

Following up on the ISOC Policy Fellows discussion yesterday and a conversation I had with Corrine later. 

I found myself disconcerted, as I usually do (I have made this comment before, but this time I have a little more noodling behind it), when Niels showed the slide that referred to RFC 1958's comment on the end-to-end principle and human rights. Here's my discomfort point.

I'm glad to see that the principles that underly the Internet lend themselves to a Human Rights discussion; that's a good thing, and I might be bothered if they didn't. However, the assertion that the designers of the Internet were thinking about Human Rights doesn't hold. The End-to-End Principle is stated twice in Saltzer's paper; the statement in the abstract is the one I concern myself with (a lower layer should perform the intent of a higher layer, so that a message sent by one system to another arrives at the intended system, and the message delivered is the one that was sent), as the one made in the body of the text doesn't hold in the Internet (routing is done by the network without help from or reference to the opinions of an application; the application identifies its intended correspondent by name or address, and the network gets the packet there). 

The reason we assert that a lower layer should perform the intent of a higher layer has nothing to do with rights, human or otherwise. It has everything to do with the operation of a reliable and predictable service. When I communicate with a peer, if I find myself communicating with someone else or the message delivered is changed, I have a security issue and a privacy issue. In time, people will learn that this happens, and cease using the service - as their intentions are thwarted. The objectives of the principles by which the Internet is designed are about the usefulness of a service for the purpose of communication, nothing more and nothing less.

This distinction becomes very important in the Internet of Things. In IoT, there is no human in the loop. If our intentions are about human rights, the rules could be completely different when there is no human to have a right. But if the principle is about providing a reliable and predictable service, the principle always applies.

I also commented to Corrine that I'm far less concerned about "rights" than I am about "responsibilities", and would prefer that the discussion were framed in those terms. A "right", to me, is a license to get upset and perhaps to sue. If I ask what "rights" might apply to TCP, I guess the TCP user would have the "right" to send a SYN, to attempt to open a session. That's not much of a right. But the responsibilities of a TCP would include management of the window to maximize good put without undue interaction or stress on the network or other TCP sessions, the responsibility to respond to an incoming SYN, and so on. As someone who writes RFCs, if I'm asked to enumerate the "rights" impacts of a protocol, procedure, or white paper, I'm likely to be a little lost - beyond dealing with personally identifiable information, which doesn't occur below the application layer except by inference in the presence of other data, I'm not sure I have anything to say. Responsibilities, however, can be pretty apparent.

I personally would wish that the discussion were framed as being about the responsibilities of a person or system that communicates, not the rights of a human being that may or may not even exist in the context.