Re: [Pearg] [saag] Ten years after Snowden (2013 - 2023), is IETF keeping its promises?

[Tony Rutkowski <[e-mail]>]

The IETF clearly has zero authority to determine policy.  That is done 
by legal systems that include legislative enactments, resulting 
government regulations, treaties, service agreements, judicial 
decisions, and liability exposure.  It is also exercised through 
marketplace choices.  The IETF regrettably began straying from its 
competence as a technical body of innovators in the 1990s.

However, what is also missing here is consideration of the adverse 
consequences of IETF actions.  It is fun to shout Snowden and spend 
one's life pursuing academic exercises in endless transport encryption 
tweaking, encouraging use, and railing against the perceived 
opposition.  In reality, the result has demonstrably been an increase in 
the proliferation of malware and exploitation of the resulting 
capabilities by a broad array of actors ranging from the financial 
criminals to the GRU and all manner of extremist groups that have 
wreaked havoc on socio-political systems.  It has also given ordinary 
users a false sense of security/privacy/protection which is highlighted 
in the new US PBS Frontline special on Pegasus.

Perhaps the good news is that the EU appears to have stepped up to the 
plate to enact numerous legal provisions over the past few years with 
strong enforcement capabilities and exercise of extraterritorial 
jurisdiction.  Those actions - which are now being enforced with 
far-reaching new mandates coming into force - are designed to effect 
balances among a broad array of policy considerations, including 
security, expression, transparency and privacy.  It would serve the IETF 
well to better understand what is occurring in the real world normative 
space.

--tony


On 1/5/2023 8:19 AM, Brad Chen wrote:
> I question whether the IETF has the competence to unilaterally 
> determine policy in this space. Recent comments on this thread 
> reassure me that some of us are at least equipped to recognize the 
> limits of our competence and to recognize the discretion that the IETF 
> needs to exercise in how we impact policy.
>
> The right to privacy has never been absolute. The tension between 
> privacy, free expression and the public right to know represents some 
> of the most challenging questions in moral philosophy and law. When we 
> pretend we can unilaterally establish policy through technology, we 
> demonstrate our incompetence with regards to disciplines like law and 
> moral philosophy.
>
> For people interested in the legal and historical background on the 
> right to privacy, Amy Gajda's book "Seek and Hide" is excellent. 
> Regarding the philosophical foundations of rights and 
> responsibilities, Onora O'Neill has published a book "A Philosopher 
> Looks at Digital Communications" that provides a gentle introduction 
> to the basics, with some more thorough treatment in her book "Justice 
> without Boundaries." A foundational source is Immanuel Kant's 
> "Groundwork for the Metaphysics of Morals" which is not for the meek.
>
> The direction explored on this thread represents a tremendous and 
> important task. I'm pretty sure the way to fail is for engineers to go 
> it alone. To be competent, we need to figure out how to recognize the 
> relevance of disciplines like law and philosophy and history, and how 
> to benefit from their perspective on these issues.
>
> Brad
>
>
> On Thu, Jan 5, 2023 at 3:59 AM Tony Rutkowski 
> <[e-mail]> wrote:
>
>     With NIS2 coming now coming into force, and the CRA being
>     finalized, sorting out some of the threats is underway, although
>     there are now 50 relevant EU Directives and 55 EU Regulations in
>     force with 16 coming into force in 2023 at present count...plus an
>     assortment of Decisions and Resolutions that all effect electronic
>     communication mandates.  Most of them have extraterritorial
>     application.  In the real world, there are many competing
>     requirements, and as Meta recently found out, with significant
>     adverse consequences for non-compliance.  It is worth noting that
>     while this list resides in the IETF domain, there are several
>     hundred standards bodies - many of which are far larger,
>     encompassing more of industry, and more relevant than the IETF. 
>     So to borrow a Clint Eastwood phrase, a venue has got to know its
>     limitations.
>
>     --tony r
>
>     On 1/5/2023 6:13 AM, John Mattsson wrote:
>>
>>     Agree that there is not a single threat, and I don’t think it is
>>     so important to determine which one of the threats that are the
>>     biggest. The last 10 years IETF has been quite good at securing
>>     transit (which is great and something we should celebrate) while
>>     at the same time mostly ignoring endpoint threats. As Vittorio
>>     writes, this poses a risk to damage IETF’sreputation. Assuming
>>     that endpoints are not compromised, not malicious, and that the
>>     interests align with the interests of the end-users feels quite
>>     outdated with today’s zero trust principles.
>>
>>     Cheers,
>>     John
>>
>>     *From: *Ted Hardie <[e-mail]> <mailto:[e-mail]>
>>     *Date: *Thursday, 5 January 2023 at 11:36
>>     *To: *Vittorio Bertola <[e-mail]>
>>     <mailto:[e-mail]>
>>     *Cc: *Eric Rescorla <[e-mail]> <mailto:[e-mail]>, John
>>     Mattsson <[e-mail]>
>>     <mailto:[e-mail]>, [e-mail]
>>     <[e-mail]> <mailto:[e-mail]>, [e-mail]
>>     <[e-mail]> <mailto:[e-mail]>, [e-mail]
>>     <[e-mail]> <mailto:[e-mail]>, saag <[e-mail]>
>>     <mailto:[e-mail]>
>>     *Subject: *Re: [Pearg] [saag] Ten years after Snowden (2013 -
>>     2023), is IETF keeping its promises?
>>
>>     A quick response in-line.
>>
>>     On Thu, Jan 5, 2023 at 10:00 AM Vittorio Bertola
>>     <vittorio.bertola=[e-mail]> wrote:
>>
>>             Il 04/01/2023 20:33 CET Eric Rescorla <[e-mail]> ha
>>             scritto:
>>
>>                 I still think this was a big fail; in fact, this
>>                 implies that counteraction against surveillance
>>                 capitalism practices can only happen elsewhere, at
>>                 the regulatory level, as the IETF community either
>>                 does not know what to do about it, or does not want
>>                 to do anything about it.
>>
>>             I don't think this is true at all.
>>
>>             First, the IETF *is* working on issues around privacy and
>>             preventing various forms of surveillance capitalism.
>>             That's in part what initiatives like DoH, QUIC, TLS 1.3,
>>             ECH, OHAI, MASQUE etc. are about.
>>
>>         Of course you will disagree with what I am going to say, but
>>         here is the common (though not unanimous) viewpoint from the
>>         technical policy community of a different part of the world -
>>         no offense implied.
>>
>>         In Europe, "surveillance capitalism" is basically synonymous
>>         with a set of a few very big American companies that happen
>>         to be the ones promoting and deploying the standards you
>>         mention.
>>
>>     First, I'm not sure that it is reasonable to assume that there is
>>     a single European position on anything.  Brussels is not Lisbon
>>     and neither is Oslo or Budapest.  And within each of those,
>>     academics, regulators, and civil society may have different
>>     opinions. As in the US, there are folks cheering for DoH and
>>     people opposed; there are people delighted with OHAI and folks
>>     depressed about it.
>>
>>     Second, I think we have to be careful to talk as if there is a
>>     single threat model here.  At least one of the threat models is
>>     truly about pervasive surveillance, which reflects an updated
>>     understanding that an attacker may be omnipresent across the
>>     network and thus able to correlate activities that a sender or
>>     receiver previously assumed could not be linked.  That's what RFC
>>     7624, Section 5 described.   Many of the key characteristics of
>>     protocols like QUIC were designed with this threat model in mind;
>>     they provide increased confidentiality on the wire.  Because that
>>     threat model is focused on observation, rather than the
>>     capabilities of the parties, it has little to do with concerns
>>     that a small set of players is a party to many different sorts of
>>     communications.  That's a different threat, and some of the work
>>     to address it, like OHAI, starts from very different principles
>>     as a result.
>>
>>     Both amongst ourselves and when talking to those working in
>>     policy circles, I think it is very important to be clear on what
>>     threat we perceive and what responses target that. Lumping all
>>     the threats and all the responses together makes it difficult to
>>     see the progress that has been achieved and even more difficult
>>     to identify where work still needs to be done.
>>
>>     Just my personal opinion, of course,
>>
>>     regards,
>>
>>     Ted Hardie
>>
>>         So, it will be hard to convince people in Brussels or Berlin
>>         that those standards are meant to put the business model of
>>         their proponents under check. Actually, they are more likely
>>         to lead to the conclusion that the IETF is being used as an
>>         instrument to further that business model, and that the
>>         encrypted network architecture that it is promoting is meant
>>         to disempower end-users and any other party (including
>>         European law enforcement and privacy authorities) from
>>         checking what the endpoints do, which information they send
>>         and who they send it to, facilitating uncontrolled data
>>         extraction practices by the private companies that mostly
>>         control the endpoints, i.e. the above ones.
>>
>>         There is a general feeling that the bigger threats to user
>>         privacy are now not in transit, but in or before the
>>         endpoints. So, the fact that the IETF does not want to
>>         consider threats in the endpoints is seen as additional
>>         evidence for the above.
>>
>>         -- 
>>
>>         Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
>>         [e-mail]  
>>         Office @ Via Treviso 12, 10144 Torino, Italy
>>
>>
>>     _______________________________________________
>>     saag mailing list
>>     [e-mail]
>>     https://www.ietf.org/mailman/listinfo/saag
>     -- 
>     Pearg mailing list
>     [e-mail]
>     https://www.irtf.org/mailman/listinfo/pearg
>