Re: [hrpc] HRPC recharter

[Eric Rescorla <[e-mail]>]

On Wed, Jan 4, 2023 at 12:07 PM Mallory Knodel <[e-mail]> wrote:

> Hi Eric,
> On 12/26/22 1:49 PM, Eric Rescorla wrote:
>
>
> As an outsider, when HRPC was first started, it seemed to have a real
> BCP-72ish vibe in which there would be:
>
> - Some common set of expectations for a what it would mean for a
>   document to be analyzed from a human rights perspective (presumably
>   documented in RFC 8280)
>
> - Some process for external review for those factors (presumably done
>   by HRPC)
>
> That is indeed what we are hoping to achieve with draft-guidelines. But to
> the latter, I think the "external" bit has been troubled completely and for
> good reason. There's agreement that this work should happen in the WG to
> the extent possible, and ideally even done by the group itself and not
> dispatched from HRPC.
>
OK, but then it's not clear to me what HRPC's role is in this.


> And of course there is the the "Considerations" name of the RG
> itself.
>
> Whatever the intentions at the time, I think it's pretty clear that
> this has not been the outcome: there haven't been that many of these
> reviews and I don't think there's really broad consensus on how to
> think about human rights in protocol design (see my separate review of
> the 8280 revision [0]). More generally, at least from my perspective,
> the work of HRPC has not had much impact on IETF operational practice
> in terms of protocol design (even less so than there is around Privacy
> Considerations).
>
> But perhaps more indicatively, do you think there have been missed
> opportunities since HRPC was chartered?
>
> I would charge that one reason there hasn't been a lot of visible impact
> is that there haven't been visible opportunity, reason, or occasion to
> intervene.
>
Well, given that 8280 is now over 5 years old, then this seems like an
argument that
this part of the project isn't really very plausible, no? It's certainly
not like there
haven't been plenty of specifications published in IETF and plenty of them
needed and got review for security, etc.

I see that the proposed charter revises this bullet somewhat to remove
> the comparison to 6973, but I think it would be good to be clearer in
> the charter that the intent for the HRPC is not to be some
> human-rights flavored version of secdir or opsdir. In particular, if
> guidelines for how to design protocols so that they protect human
> rights are to have any normative force, they need to come out of the
> IETF, not the IRTF. And if the intent is to provide something
> informative, then I think what's needed is something much more like an
> analysis of problems and a catalog of techniques than guidelines. This
> is, for instance, what PEARG does.
>
> That's why we removed the reference so if there's more we could do to make
> clear this intention, I'd be happy to re-work other parts of the text as
> well. (I like to delete things, rather than add them, where possible.)
>
> Could you give an example of where PEARG has published a doc that does
> this well.
>
So, for instance,
https://www.ietf.org/archive/id/draft-irtf-pearg-website-fingerprinting-01.html
does a good job
of capturing the technical state of play.

And
https://www.ietf.org/archive/id/draft-irtf-pearg-ip-address-privacy-considerations-01.html
talks about the problem of IP tracking.

What I think differentiates these documents from (say) 8280 or 8280-bis is
that they actually are of assistance to someone trying to build a system
that addresses these problems. By contrast, 8280 just kind of lays out the
various concerns, but doesn't actually help you resolve them (see my quite
extensive review for more).

And alternatively if you can point to a place in the charter where this
> sort of thing appears and is described better than what we have?
>
I'm sorry,  I don't think I understand that question.

-Ekr


>
>
> The two other objectives have a more public awareness type flavor:
>
>  * To expose the relations between protocols and values, with a focus
>    on the human rights framework.
>  * To increase the awareness in both the policy community and the
>    technical community on the importance of the technical workings of
>    the Internet and its impact on human rights and the public
>    interest.
>
> I don't track the work in these areas as closely, so I'm less able
> to say whether that work is going well or not. For what it's worth,
> I don't typically refer to the artifacts of this group as the main
> sources for the human rights impacts of protocols, but perhaps
> others have a different experience.
>
> I do think I have a better sense of these things, but irrespective of
> that, I think re-writing the charter on these two points is unlikely to
> have an effect. We're expressing the objectives in the best way, I believe,
> already, but open to suggested changes.
>
>
> In any case, I think rather than just spinning a new charter, it
> would be helpful to take a bigger picture look at what this RG
> should be trying to accomplish.
>
> I'd like to say this is a great time to be doing both. Thanks for engaging
> and happy to take both conversations forward in the ways you've outlined
> above,
>
> -Mallory
>
> -Ekr
>
>
> [0]
> https://mailarchive.ietf.org/arch/msg/hrpc/I2mP4Wehcj3UTSGqh4uwH6QoA4Y/
>
> On Thu, Dec 22, 2022 at 9:30 AM Mallory Knodel <[e-mail]> wrote:
>
>> Dear RG,
>>
>> Hope everyone is well.
>>
>> At the 115 meeting HRPC was reviewed by the IAB [0], notes of which are
>> forthcoming from the IAB.
>>
>> Partially as a result, though this activity predates the review itself,
>> Sofia and I have been reviewing the HRPC charter. In particular we are
>> keen to expand HRPC slightly, though arguably our area of work will
>> remain the same (more on that later), to explicitly welcome policy
>> discussions.
>>
>> The recharter text is available in GitHub [1] where you can view a diff
>> [2]. It is also in a plaintext format with more visual indications of
>> where the changes have been made [3].
>>
>> My view on the proposed change to include "policy" as a replacement for
>> "protocol" in the name and charter text have been shaped by both of the
>> past chairs of HRPC and Colin's feedback, which is that the human rights
>> framework can apply to virtually any policy discussion and therefore
>> HRPC has all along according to its charter had a mandate to talk about
>> these issues. However I do think that the slight rephrasing in places
>> gives us necessary updates that reflect the current political moment as
>> well as learning from past lessons since the group was chartered the
>> first time. Additionally I think there is value in the group name and
>> its charter text being written so as to explicitly attract researchers
>> and research that discuss policy, as a "place to land" in the IETF/IRTF.
>>
>> We welcome any comments on the proposed changes.
>>
>> Happy new year and best wishes to everyone,
>>
>> -Chairs, Mallory & Sofia
>>
>> [0] https://www.iab.org/wiki/index.php/RG_Reviews
>>
>> [1] https://github.com/IRTF-HRPC/IRTF-HRPC/blob/main/hrpccharter.md
>>
>> [2]
>>
>> https://github.com/IRTF-HRPC/IRTF-HRPC/commit/1a029b31ab3521e8da1490924c94397a99497d19
>>
>> [3] https://pad.riseup.net/p/Qgq2TJuWLbFSY1Jrcxgm
>>
>>
>> --
>> Mallory Knodel
>> CTO, Center for Democracy and Technology
>> gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780
>>
>> _______________________________________________
>> hrpc mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/hrpc
>>
> --
> Mallory Knodel
> CTO, Center for Democracy and Technology
> gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780
>
>