Re: [hrpc] HRPC recharter

[Mallory Knodel <[e-mail]>]

Hi,

On 1/5/23 10:09 AM, Eric Rescorla wrote:
>
> On Thu, Jan 5, 2023 at 6:59 AM Mallory Knodel <[e-mail]> wrote:
>
>     Hi,
>
>     On 1/4/23 4:17 PM, Eric Rescorla wrote:
>>
>>         I see that the proposed charter revises this bullet somewhat
>>         to remove
>>         the comparison to 6973, but I think it would be good to be
>>         clearer in
>>         the charter that the intent for the HRPC is not to be some
>>         human-rights flavored version of secdir or opsdir. In
>>         particular, if
>>         guidelines for how to design protocols so that they protect human
>>         rights are to have any normative force, they need to come out
>>         of the
>>         IETF, not the IRTF. And if the intent is to provide something
>>         informative, then I think what's needed is something much
>>         more like an
>>         analysis of problems and a catalog of techniques than
>>         guidelines. This
>>         is, for instance, what PEARG does.
>>
>     ...
>>
>>         And alternatively if you can point to a place in the charter
>>         where this sort of thing appears and is described better than
>>         what we have?
>>
>>     I'm sorry,  I don't think I understand that question.
>
>     In an effort to keep this conversation specific to the charter
>     text, I am wondering if you feel that PEARG's success in analysis
>     of problems and a catalog of techniques lies in the way it's
>     charter is written on these points? Because this is what I'm
>     seeing in their charter:
>
>>     Provide a forum for discussion and analysis of the cryptographic
>>     and practical aspects of privacy protocols e.g.
>>     Analyse dependencies between protocols in the larger Internet
>>     ecosystem and understand the privacy implications in a wider context
>>     Understand why some protocol design efforts have succeeded and
>>     other have not
>>     Formulate better models for analyzing and quantifying privacy risks
>>     Offer guidance on the use of emerging techniques and new uses of
>>     existing ones. 
>     It does not in fact look that different than ours. I think that
>     execution and interest in bringing research to HRPC is what we
>     need to focus on to fix much of what is being raised in the
>     conversation, not necessarily charter text.
>
>
> I agree that charter text is not the problem, and I don't think my 
> initial comments
> implied otherwise. Rather, my position is that the charter text 
> *reflects* a misguided
> view of what this group is for and can accomplish and that we should 
> converge
> on a better view and write a charter that memorialized that view.
>
Understood that this is your view. On the other hand, the feedback we 
are consistently getting in our actual meetings and through our most 
recent IAB review is that in fact HRPC is contributing and doing well 
and we don't need to be overwrought in our attempts to do more work.

This is why I want to make very incisive changes to the charter that 
very slightly expand the work into policy, though as I stated there are 
those that disagree that we even need to specify this change given that 
policy already is under the purview of talking about human rights.

In other words: I don't believe it is widely accepted that HRPC has a 
misguided view of its own purpose. Others may, but that has 
unequivocally improved since it was first chartered.

> With that said, however, I think that the charter text is different in 
> two very material ways:
>
> 1. It actually does specifically say to provide the kind of guidance 
> I'm talking about
> (see the last bullet).

Just to compare, this is ours:

> # To propose guidelines to protect the Internet as a 
> human-rights-enabling environment and a global public good in future 
> protocol development.
This is PEARG's:

> Offer guidance on the use of emerging techniques and new uses of 
> existing ones. 
We were talking about how PEARG does "analysis of problems and a catalog 
of techniques" but that doesn't appear in their charter. And while there 
might be anti-/privacy techniques, there aren't human rights equivalents 
here. So we are left with analysis of problems. I think that "protect" 
in our bullet point in fact implies that we analyse problems, see 
draft-association.

Issues and PRs always welcome: 
https://github.com/IRTF-HRPC/IRTF-HRPC/blob/main/hrpccharter.md

-Mallory

-- 
Mallory Knodel
CTO, Center for Democracy and Technology
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780