Re: [saag] Fwd: ubiquitous encryption draft feedback

[Joseph Lorenzo Hall <[e-mail]>]

(this was Kathleen forwarding Wes' feedback quoted here)

> Liability – I realize that IETF does not trade in legal advice, so this
> would have to be caveated pretty heavily, but I think it's a worthwhile part
> of the discussion since it's a direct result of a specific set of technical
> actions and should be weighed when considering whether the ends justify the
> means.
>
> Duty to take action – encrypted traffic (or unencrypted traffic that is not
> subject to DPI) comes with a hidden benefit for the SPs who carry it-
> plausible deniability. If a service provider or enterprise is decrypting
> traffic with intent to inspect it, whether with or without its users'
> knowledge, it can be argued that it is responsible for the traffic's content
> such that it is required to take action on content or activities that are
> banned by policy or law, including enforcing copyright, preventing
> exploitation of children, threats of violence, reporting potential
> violations to the proper authorities, etc. An SP must be ready to take
> responsibility for traffic that flows across its network if it chooses to
> inspect it.

Heya, as one of the resident policy wonks at IETF I should point out
that the above certainly isn't the case in the US, where
intermediaries generally have broad immunity from liability for
hosting or transmitting third-party content.*

As for the rest of the world, a recent and great UNESCO report by
Rebecca MacKinnon et al. summarizes the landscape by describing three
regimes: strict liability like in China and Thailand where even
ignorance is no excuse, conditional liability where upon receiving
notice the content has to be blocked or the intermediary risks a
lawsuit, etc., and broad immunity such as the case in the US. I'll
stop typing now as I doubt anyone on the SAAG list is as deep into
this stuff as we are at CDT... here's the report, you can start
reading a few pages around PDF p. 40:

http://unesdoc.unesco.org/images/0023/002311/231162e.pdf

All this is saying that I doubt a duty to monitor is a strong argument
here since nothing much exists like that now (and even in the strict
liability cases, which are few, you don't get much by monitoring over
other things like denying access at the onset).

best, Joe

* (Content hosts are required to report instances of child sexual
abuse imagery to the National Center for Missing and Exploited
Children (NCMEC) when they become aware of them, and to retain some
data about the image, but otherwise intermediaries typically don't
have a legal obligation to take action even when they become aware of
potentially unlawful content. The DMCA provides protection from
potential secondary copyright liability -- if the content host takes
down an allegedly infringing file upon notice from a rightsholder, it
can't be sued as having contributed to that infringement. But
technically an intermediary could ignore a DMCA demand and try its
luck in the courts.)

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[e-mail]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871