Re: [Pearg] [saag] Ten years after Snowden (2013 - 2023), is IETF keeping its promises?

[Brad Chen <[e-mail]>]

On Thu, Jan 5, 2023 at 5:50 AM Antoine FRESSANCOURT <
[e-mail]> wrote:

> Hello,
>
>
>
> I agree with most of what you mention about the right to privacy not being
> absolute, or about the fact that technical solutions that are designed and
> published by the IETF should conform to what the broader society and
> regulations around the globe need.
>
>
>
> My concern with the current state of affairs is that for privacy to be a
> purely philosophical or policy matter, we need to provide society (the
> user, regulators, involved parties) with the tools it needs to communicate
> the way it needs or want. In my view (that might be biased by my western
> philosophical background) it means that individuals need to be completely
> in control of what they use, and who they consent to communicate
> information with. Right now, in some aspects of our communications on the
> Internet, we are unconsciously leaking (meta)data on which we have little
> control, and that are accessible to a variety of parties that have a wide
> variety of reasons for de-anonymizing our communications. When we will be
> in a situation in which identifying the parties of a communication is a
> controlled process rather than the byproduct of unconscious design
> decisions, then we will be in a situation where we are in front of a
> philosophical dilemma, not before.
>
I agree on our charter to deliver the tools, in as much as the tools are
possible. Some are not. I would also point out that we can ameliorate the
situation without developing new technology, by developing understanding
and transparency about the technologies already in people's hands.

>
>
> Best regards,
>
>
>
> Antoine Fressancourt
>
>
>
> *From:* Pearg <[e-mail]> *On Behalf Of * Brad Chen
> *Sent:* jeudi 5 janvier 2023 14:19
> *To:* [e-mail]
> *Cc:* John Mattsson <john.mattsson=[e-mail]>; Ted
> Hardie <[e-mail]>; Vittorio Bertola <
> [e-mail]>; saag <[e-mail]>; [e-mail];
> [e-mail]; [e-mail]
> *Subject:* Re: [Pearg] [saag] Ten years after Snowden (2013 - 2023), is
> IETF keeping its promises?
>
>
>
> I question whether the IETF has the competence to unilaterally determine
> policy in this space. Recent comments on this thread reassure me that some
> of us are at least equipped to recognize the limits of our competence and
> to recognize the discretion that the IETF needs to exercise in how we
> impact policy.
>
>
>
> The right to privacy has never been absolute. The tension between privacy,
> free expression and the public right to know represents some of the most
> challenging questions in moral philosophy and law. When we pretend we can
> unilaterally establish policy through technology, we demonstrate our
> incompetence with regards to disciplines like law and moral philosophy.
>
>
>
> For people interested in the legal and historical background on the right
> to privacy, Amy Gajda's book "Seek and Hide" is excellent. Regarding the
> philosophical foundations of rights and responsibilities, Onora O'Neill has
> published a book "A Philosopher Looks at Digital Communications" that
> provides a gentle introduction to the basics, with some more thorough
> treatment in her book "Justice without Boundaries." A foundational source
> is Immanuel Kant's "Groundwork for the Metaphysics of Morals" which is not
> for the meek.
>
>
>
> The direction explored on this thread represents a tremendous and
> important task. I'm pretty sure the way to fail is for engineers to go it
> alone. To be competent, we need to figure out how to recognize the
> relevance of disciplines like law and philosophy and history, and how to
> benefit from their perspective on these issues.
>
>
>
> Brad
>
>
>
>
>
> On Thu, Jan 5, 2023 at 3:59 AM Tony Rutkowski <
> [e-mail]> wrote:
>
> With NIS2 coming now coming into force, and the CRA being finalized,
> sorting out some of the threats is underway, although there are now 50
> relevant EU Directives and 55 EU Regulations in force with 16 coming into
> force in 2023 at present count...plus an assortment of Decisions and
> Resolutions that all effect electronic communication mandates.  Most of
> them have extraterritorial application.  In the real world, there are many
> competing requirements, and as Meta recently found out, with significant
> adverse consequences for non-compliance.  It is worth noting that while
> this list resides in the IETF domain, there are several hundred standards
> bodies - many of which are far larger, encompassing more of industry, and
> more relevant than the IETF.  So to borrow a Clint Eastwood phrase, a venue
> has got to know its limitations.
>
> --tony r
>
> On 1/5/2023 6:13 AM, John Mattsson wrote:
>
> Agree that there is not a single threat, and I don’t think it is so
> important to determine which one of the threats that are the biggest. The
> last 10 years IETF has been quite good at securing transit (which is great
> and something we should celebrate) while at the same time mostly ignoring
> endpoint threats. As Vittorio writes, this poses a risk to damage IETF’s
> reputation. Assuming that endpoints are not compromised, not malicious, and
> that the interests align with the interests of the end-users feels quite
> outdated with today’s zero trust principles.
>
> Cheers,
> John
>
> *From: *Ted Hardie <[e-mail]> <[e-mail]>
> *Date: *Thursday, 5 January 2023 at 11:36
> *To: *Vittorio Bertola <[e-mail]>
> <[e-mail]>
> *Cc: *Eric Rescorla <[e-mail]> <[e-mail]>, John Mattsson
> <[e-mail]> <[e-mail]>, [e-mail]
> <[e-mail]> <[e-mail]>, [e-mail] <[e-mail]>
> <[e-mail]>, [e-mail] <[e-mail]> <[e-mail]>, saag
> <[e-mail]> <[e-mail]>
> *Subject: *Re: [Pearg] [saag] Ten years after Snowden (2013 - 2023), is
> IETF keeping its promises?
>
> A quick response in-line.
>
>
>
> On Thu, Jan 5, 2023 at 10:00 AM Vittorio Bertola <vittorio.bertola=
> [e-mail]> wrote:
>
>
>
> Il 04/01/2023 20:33 CET Eric Rescorla <[e-mail]> ha scritto:
>
>
>
> I still think this was a big fail; in fact, this implies that
> counteraction against surveillance capitalism practices can only happen
> elsewhere, at the regulatory level, as the IETF community either does not
> know what to do about it, or does not want to do anything about it.
>
>
>
> I don't think this is true at all.
>
>
>
> First, the IETF *is* working on issues around privacy and preventing
> various forms of surveillance capitalism. That's in part what initiatives
> like DoH, QUIC, TLS 1.3, ECH, OHAI, MASQUE etc. are about.
>
> Of course you will disagree with what I am going to say, but here is the
> common (though not unanimous) viewpoint from the technical policy community
> of a different part of the world - no offense implied.
>
>
>
> In Europe, "surveillance capitalism" is basically synonymous with a set of
> a few very big American companies that happen to be the ones promoting and
> deploying the standards you mention.
>
>
>
> First, I'm not sure that it is reasonable to assume that there is a single
> European position on anything.  Brussels is not Lisbon and neither is Oslo
> or Budapest.  And within each of those, academics, regulators, and civil
> society may have different opinions.  As in the US, there are folks
> cheering for DoH and people opposed; there are people delighted with OHAI
> and folks depressed about it.
>
>
>
> Second, I think we have to be careful to talk as if there is a single
> threat model here.  At least one of the threat models is truly about
> pervasive surveillance, which reflects an updated understanding that an
> attacker may be omnipresent across the network and thus able to correlate
> activities that a sender or receiver previously assumed could not be
> linked.  That's what RFC 7624, Section 5 described.   Many of the key
> characteristics of protocols like QUIC were designed with this threat model
> in mind; they provide increased confidentiality on the wire.  Because that
> threat model is focused on observation, rather than the capabilities of the
> parties, it has little to do with concerns that a small set of players is a
> party to many different sorts of communications.  That's a different
> threat, and some of the work to address it, like OHAI, starts from very
> different principles as a result.
>
>
>
> Both amongst ourselves and when talking to those working in policy
> circles, I think it is very important to be clear on what threat we
> perceive and what responses target that.   Lumping all the threats and all
> the responses together makes it difficult to see the progress that has been
> achieved and even more difficult to identify where work still needs to be
> done.
>
>
>
> Just my personal opinion, of course,
>
>
>
> regards,
>
>
>
> Ted Hardie
>
>
>
> So, it will be hard to convince people in Brussels or Berlin that those
> standards are meant to put the business model of their proponents under
> check. Actually, they are more likely to lead to the conclusion that the
> IETF is being used as an instrument to further that business model, and
> that the encrypted network architecture that it is promoting is meant to
> disempower end-users and any other party (including European law
> enforcement and privacy authorities) from checking what the endpoints do,
> which information they send and who they send it to, facilitating
> uncontrolled data extraction practices by the private companies that mostly
> control the endpoints, i.e. the above ones.
>
>
>
> There is a general feeling that the bigger threats to user privacy are now
> not in transit, but in or before the endpoints. So, the fact that the IETF
> does not want to consider threats in the endpoints is seen as additional
> evidence for the above.
>
>
>
> --
>
> Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
>
> [e-mail]
>
> Office @ Via Treviso 12, 10144 Torino, Italy
>
>
>
> _______________________________________________
>
> saag mailing list
>
> [e-mail]
>
> https://www.ietf.org/mailman/listinfo/saag
>
> --
> Pearg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/pearg
>
>