[Pearg] draft-irtf-pearg-safe-internet-measurement review, implied consent

[Nick Doty <[e-mail]>]

Some comments on the safe internet measurement draft:

Thanks for doing this! Safe measurement is important and I expect
that's a concept that will come up more and more often as we try to
improve the privacy and safety properties of lots of Internet and Web
functionality.

## impersonation

I didn't follow how impersonation risks would take place. These
attacks could maybe use examples of each.

## implied consent

Is "implied consent" what's happening in the case where data is
collected where the potential harm is de minimis and part of the
everyday course of interactions? If I were proposing this to my
university IRB, I would expect to explain the normality and lack of
harm in testing the TLS version numbers and have them conclude that I
don't need to gain consent, not that the server operators do consent
in some way even though they have no idea that the study is happening.
Similarly, under European and similar data protection law, consent
isn't universal, it's not that every data processing takes place with
some kind of consent, but rather that you need informed consent when
something of a particular weight is happening and there isn't another
justification and in other cases it's reasonable for you to do the
processing without getting consent (because it's not personal data,
say), not that you did have some implied consent.

Bandwidth seems like another case where consent isn't the determining
factor. You're right to note that even small amounts of bandwidth may
have a cost. I don't think we would conclude that all servers would
have consented or have implicitly consented to all studies that use
their bandwidth. The justification seems to be more, the costs are
small, reasonable, and part of the course of typical activity. I think
the section on analyzing risk and weighing the costs and benefits
likely needs to be expanded here. That seems to be another fundamental
basis of institutional research ethics, and it would be better to have
it elaborated rather than relying on implied consent.

## minimization

There may be more detail and citations to add to minimization; I can
see that those sections aren't completed yet. I'll be happy to help
contribute to that, although probably not before 117.

Hope this helps,
Nick

-- 
Nick Doty | https://npdoty.name
Senior Fellow, Internet Architecture
Center for Democracy & Technology | https://cdt.org