[hrpc] from “Security Considerations” to “Threat Model Considerations”?

[Cory Francis Myers <[e-mail]>]

The requirement for a “Security Considerations” section originates in 
RFC 2223 “Requirements to RFC Authors”.  The RFC 7322 style guide adds 
sections for IANA and internationalization considerations.

draft-irtf-hrpc-guidelines (how to think about human-rights 
considerations) is not quite like RFC 3552 (how to write “Security 
Considerations” sections)—because the *need* to think about as well as 
articulate the latter is taken for granted.  What would it take to:

1. Add a “Human Rights Considerations” section?

2. Add a “Privacy Considerations” *and* a “Safety Considerations” 
section (per Stephanie Mikkelson‘s slide today on safety, privacy, 
security by design[1])?

3. Broaden “Security Considerations” into “Threat Model 
Considerations”?[2]


I’m oversimplifying on purpose!  My goal in asking this question is to 
understand the obstacles to establishing the parity of these criteria 
with security considerations.

If I’m retreading old or fraught ground, as I suspect I may be, I’d 
welcome pointers into the archives.


Sincerely,

Cory Myers.


[1]: 
https://datatracker.ietf.org/meeting/118/materials/slides-118-hrpc-unfpa-gbv-tech-guidance-00.pdf 
(slide 15)

[2]: Although this risks framing all of these considerations as strictly 
meliorative of harms, rather than affirmative protections of affirmative 
rights.