Re: [hrpc] from “Security Considerations” to “Threat Model Considerations”?

Hi Cory, Hi all, 

Where are the presentation slides that talk about “safety”?

I am curious what the recommendations / guidelines are but I was unable to attend the meeting due to a conflict.

Ciao

Hannes

From: hrpc <hrpc-bounces@irtf.org> On Behalf Of farzaneh badii
Sent: Montag, 6. November 2023 14:06
To: Cory Francis Myers <cfm@acm.org>
Cc: hrpc@irtf.org
Subject: Re: [hrpc] from “Security Considerations” to “Threat Model Considerations”?

Hi Cory,

I did not follow the presentation but the term "safety" is very ambiguous and has different meanings in different contexts and most of the time it is assumed that safety means cooperation with law enforcement (public safety). Some of my work is in the "trust and safety" field and I keep facing this challenge. "Threat models" will also expand the technical definition and it might even expand it so much that we include disinfo operation and a host of other non-technical ones or at least leave space for that. 

Farzaneh 

On Mon, Nov 6, 2023 at 6:46 AM Cory Francis Myers <cfm@acm.org <mailto:cfm@acm.org> > wrote:

The requirement for a “Security Considerations” section originates in 
RFC 2223 “Requirements to RFC Authors”.  The RFC 7322 style guide adds 
sections for IANA and internationalization considerations.

draft-irtf-hrpc-guidelines (how to think about human-rights 
considerations) is not quite like RFC 3552 (how to write “Security 
Considerations” sections)—because the *need* to think about as well as 
articulate the latter is taken for granted.  What would it take to:

1. Add a “Human Rights Considerations” section?

2. Add a “Privacy Considerations” *and* a “Safety Considerations” 
section (per Stephanie Mikkelson‘s slide today on safety, privacy, 
security by design[1])?

3. Broaden “Security Considerations” into “Threat Model 
Considerations”?[2]

I’m oversimplifying on purpose!  My goal in asking this question is to 
understand the obstacles to establishing the parity of these criteria 
with security considerations.

If I’m retreading old or fraught ground, as I suspect I may be, I’d 
welcome pointers into the archives.

Sincerely,

Cory Myers.

[1]: 
https://datatracker.ietf.org/meeting/118/materials/slides-118-hrpc-unfpa-gbv-tech-guidance-00.pdf 
(slide 15)

[2]: Although this risks framing all of these considerations as strictly 
meliorative of harms, rather than affirmative protections of affirmative 
rights.

_______________________________________________
hrpc mailing list
hrpc@irtf.org <mailto:hrpc@irtf.org> 
https://mailman.irtf.org/mailman/listinfo/hrpc