Re: [hrpc] from “Security Considerations” to “Threat Model Considerations”?

On Mon, Nov 6, 2023 at 3:46 AM Cory Francis Myers <cfm@acm.org> wrote:

> The requirement for a “Security Considerations” section originates in
> RFC 2223 “Requirements to RFC Authors”.  The RFC 7322 style guide adds
> sections for IANA and internationalization considerations.
>
> draft-irtf-hrpc-guidelines (how to think about human-rights
> considerations) is not quite like RFC 3552 (how to write “Security
> Considerations” sections)—because the *need* to think about as well as
> articulate the latter is taken for granted.  What would it take to:
>
> 1. Add a “Human Rights Considerations” section?
>
> 2. Add a “Privacy Considerations” *and* a “Safety Considerations”
> section (per Stephanie Mikkelson‘s slide today on safety, privacy,
> security by design[1])?
>
> 3. Broaden “Security Considerations” into “Threat Model
> Considerations”?[2]
>
>
> I’m oversimplifying on purpose!  My goal in asking this question is to
> understand the obstacles to establishing the parity of these criteria
> with security considerations.
>

It would require a Standards Track RFC, which is to say that the work
would need to happen in IETF, not in HRPC.

With that said, I don't think it's very likely that the IETF will require
either
of these. When RFC 6793 was written there was an explicit decision not
to require Privacy Considerations in RFCs and I suspect that a Human Rights
Considerations Section would be even more difficult to come to consensus
on.

-Ekr

> If I’m retreading old or fraught ground, as I suspect I may be, I’d
> welcome pointers into the archives.
>
>
> Sincerely,
>
> Cory Myers.
>
>
> [1]:
>
> https://datatracker.ietf.org/meeting/118/materials/slides-118-hrpc-unfpa-gbv-tech-guidance-00.pdf
> (slide 15)
>
> [2]: Although this risks framing all of these considerations as strictly
> meliorative of harms, rather than affirmative protections of affirmative
> rights.
>
> _______________________________________________
> hrpc mailing list
> hrpc@irtf.org
> https://mailman.irtf.org/mailman/listinfo/hrpc
>