Re: [hrpc] Protocol/Architecture consideration of Attribution & right of legal remedy (was: Re: I-D Action: draft-irtf-hrpc-guidelines-03.txt)

[John Curran <[e-mail]>]

On 10 Jun 2019, at 10:46 AM, Niels ten Oever <[e-mail]> wrote:
>> ...
>> 3.3.n  Attribution
>> 
>>   Question(s): Does your protocol/architecture prevent attribution of those parties 
>>   involved in communication, and can the protocol readily be used for communication
>>   which harm the security of recipient?  What, if any, mechanisms within the protocol 
>>   or architecture are provided for a recipient of communications to obtain redress
>>   from communication which causes harm?  If no such mechanisms available, does 
>>   the protocol/architecture provide sufficient information attributing the source of 
>>   communication to facilitate a recipient exercising their right to legal remedy? 
>> 
>>   Explanation: While anonymity and pseudonymity are very important attributes 
>>   for protecting several human rights (e.g. those related to freedom of expression 
>>   and association),  it is also possible for parties to use communication capabilities
>>   to harm others.  Protocols/architectures should consider the potential for harm in
>>   their use, the architectural mechanisms available to mitigate this risk of harm, the 
>>   protocol properties that might impact persons exercising their right of legal remedy,
>>   and the resulting impact to individuals right of security of person when using the 
>>   protocol. 
>> 
>>   Impacts:
>> 
>>   -  Right to security 
>> 
>>   -  Right to legal remedy
> 
> This is quite an interesting proposal, and one that I would not oppose. But maybe I could suggestion some granularity that is inspired by the current WHOIS discussions. Perhaps we can seek to provide attribution vis a vis responsible legal entities, and protection vis a vis natural persons?
> 
> This would for instance provide LEAs with a point of contact that they can approach with a warrant (for instance AS contact), but protect natural persons.
> 
> Would this make sense?

Neils - 

A very interesting question…  I was not so much advocating for a particular set of norms regarding attribution, but simply some recognition that protocol/architecture design decisions can impact the ability to attribute communications and thus can hinder exercise of rights (such as legal remedy) when attribution is necessary for exercise of same. 

While I think that much more dialogue would be necessary to understand if there is indeed an widely-accepted set of norm that should be used for protocol assessment in this area, your point regarding legal entity attribution vs natural persons is well taken, and might be raised in the mind of a potential protocol designer (or reviewer) by the addition of an additional question, as follows:

  Question(s): Does your protocol/architecture prevent attribution of those parties 
  involved in communication, and can the protocol readily be used for communication
  which harm the security of recipient?  What, if any, mechanisms within the protocol 
  or architecture are provided for a recipient of communications to obtain redress
  from communication which causes harm?  If no such mechanisms available, does 
  the protocol/architecture provide sufficient information attributing the source of 
  communication to facilitate a recipient exercising their right to legal remedy? 
  If attribution to a natural person is not available, does the protocol/architecture
  provide any mechanisms for obtaining contact information for a legal entity 
  responsible (or representing those responsible) for the communication?

This raises the very pragmatic point that attribution to natural persons is not necessarily a 
desirable outcome, but that some consideration of alternative mechanisms for attribution 
may still facilitate exercise of the "legal remedy" human right.

Thoughts?
/John

p.s. (Disclaimer: my views alone - no one else is foolish enough to claim them! ;-)