Re: [hrpc] My suggestion for the attribution paragraph

[John Curran <[e-mail]>]

On 19 Mar 2021, at 11:52 AM, Niels ten Oever <[e-mail]> wrote:
> 
> Your framing [attribution results in or can help with legal remedy] is problematic because it brings jurisdictional issues to this document.
> 
> It is a core component of the UN Guiding Principles for Human Rights. This is not necessarily part of jurisdiction. Remedy does not necessarily need to be offered by a state.

Agreed - remedy doesn’t necessarily have to be offered by a state, or even be “legal remedy” per se.   However, when an individual suffers harm as a result of communications and has no ability to attribute the harm to the specific perpetrator, it’s fairly clear that their options for legal remedy may be reduced as a result. 

Does a reduction in ability to obtain legal remedy (due to lack of attribution) against someone who has harmed you in communications result in a reduction in your access to human rights?  I’m not immersed in the vernacular of human rights practitioners, but it seems apparent that lack of attribution can readily reduce one’s access to legal remedies. 

> I heard that people were saying we are not trying to bring one set of legal systems into the discussion. And it's not even clear how you can create a direct link between attribution and legal remedy. Access to legal remedy in the human rights law field does not mean that a private protocol developer helps victims or law enforcement with gathering evidence!

There is no assertion in the least that support for “gathering evidence” is required.  Rather, inclusion of the attribution capability (and the potential impact on ability to obtain legal remedies when it is not present) suggests that protocol designers might want to give some thought to what other technical measures are provided to help ameliorate harm to users when relying on legal recourse isn’t an option.   Email is a fine example - it’s clear that we lack attribution for most actors in the email space – and thus recourse from harm through tradition law enforcement or civil litigation is rather limited – but we’ve come up with an entire ecosystem for providing various degrees of sender assertion, reputation systems for bulk solicitation protection, etc. 

To some extent, social media networks are doing the very same thing - their lack of true attribution to legal identify of users isn’t necessary “right” or “wrong”, but does mean it is worth giving some thought to how users address harms suffered, as the lack of attribution prevents users as a practical matter from pursuing legal remedies.

Thanks,
/John

p.s.  Disclaimer:  my views alone (no one else would claim them anyway ;-)