From nobody Wed Jan 5 07:11:22 2022 Return-Path: X-Original-To: txauth@ietfa.amsl.com Delivered-To: txauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3AB93A0B9C for ; Wed, 5 Jan 2022 07:11:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.138 X-Spam-Level: X-Spam-Status: No, score=-1.138 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t838VlI6qOOn for ; Wed, 5 Jan 2022 07:11:14 -0800 (PST) Received: from mail-qk1-f175.google.com (mail-qk1-f175.google.com [209.85.222.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AABCC3A0B9A for ; Wed, 5 Jan 2022 07:11:14 -0800 (PST) Received: by mail-qk1-f175.google.com with SMTP id t66so27079391qkb.4 for ; Wed, 05 Jan 2022 07:11:14 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OoH38FC3JLas7cCrvwwA5/KatBPn1tfHCBi1TuFNUug=; b=Gyb3lYY360e3c6WTE2IWh2o6N4EGX3RFPPa4Q0qJKVYlJO+Nv9lcDGn77WXD7eUS/J MKlkmUG+kPIw2RZ6UBEDFWU0h1QkRIf1TWH8sBUtrhP+UDjsjzRrmapA3Tw0LsFcfk6L 2IQPb+iGLEc1ZcO9wQrlEhPx1j5YhSF2GPvaL3k44n/6ZUUERNqKrnox9iZF9pguBGmC kTrN8azRkrXxNquIRFeoFJIX8f28EPerelLEFU14DdvFVVXe/LvoHnXAIHmJt8rt5Xy0 qUGZt7a8Hqj+CofkXxwlUeOplDI99XYcKBsnQas1iq71cCgi/IA0r8etxr5oNCKxy+D+ LpMg== X-Gm-Message-State: AOAM532roR7gN0BFPPmY/51gIPp/U8sVyUvDaZ6pnZ8V6Gjns3PyhmGc q6mmHEAT9z1yOCd2GJU0ZIYUnoaOyhjm8up369xKdHHAgJA= X-Google-Smtp-Source: ABdhPJxjyNeLXjdR9jjESBoUW5CKI3RC5DDBi7PftoP9Wg7sWlAZCSGeNVggIfXTWuICPZxgQzgdP/mhVZTeeaSxl3E= X-Received: by 2002:a05:620a:103a:: with SMTP id a26mr38867667qkk.785.1641395473433; Wed, 05 Jan 2022 07:11:13 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Adrian Gropper Date: Wed, 5 Jan 2022 10:11:02 -0500 Message-ID: To: Bob Wyman Cc: GNAP Mailing List , W3C Credentials Community Group Content-Type: multipart/alternative; boundary="00000000000021476205d4d72abc" Archived-At: Subject: Re: [GNAP] Human rights perspective on W3C and IETF protocol interaction X-BeenThere: txauth@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: GNAP List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jan 2022 15:11:20 -0000 --00000000000021476205d4d72abc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Bob's are important questions in the context of our specific protocol work. I do not mean to scope this thread to general W3C or IETF groups or their governance. *Bold* is used below to link to Bob's specific questions. I might also argue to limit the scope to protocols and not VC, DID, biometric templates, or other data models even though effective standards for these drive quantitative and possibly qualitative improvements in the efficiency of surveillance because a common language seems essential to discussing protocols. Adverse consequences of the efficiency of common interoperable language can be mitigated at the protocol level. I'm responding in personal terms to Bob's questions. *I urge all of us engaged in the protocol engineering effort to bring their own perspective on "Human Rights" and to advocate for specific technical solutions in specific workgroups.* For example, I have chosen to focus attention on authorization for verifiable credential issue. I hope others will prioritize human rights impact of authentication protocols especially where biometrics could be involved. *The specific aspects of our protocol work that give rise to human rights issues relate to the efficiency of standardized digital credentials to human persons.* What works for drugs in a supply chain or cattle on a farm can and usually will be misused on people. Also, transferring responsibility from an issuer to a subject of a VC is a burden that needs to be recognized and mitigated. With respect to the UDHRs, I would point to 12 (privacy and confidentiality), 13 (anonymity), 14 (limit the reach of DHS and other state actors), 17 (the right to associate with and delegate to others), 18 (associate with and delegate to communities one chooses), 20 (association, again), 21 (secret elections), 22 (anonymity), 23 (trade unions as delegates), 24 (burden of managing decisions in an asymmetric power relationship with the state or with dominant private platforms), 29 (duties to and scope of the community). *I'm suggesting that we formally address the issue of human rights as applied to the VC-API standardization process.* I'm also suggesting that we use a process in VC-API that formally harmonizes our work with IETF GNAP. Adrian On Tue, Jan 4, 2022 at 11:45 PM Bob Wyman wrote: > Adrian, > Given that you're starting a new thread, I would appreciate it if you > could do some context setting and clarifying: > > - *What do you mean by "Human Rights?" *Hopefully, you won't consider > that a foolish question. The issue is, of course, that since Internet > standards are developed in a multicultural, multinational context, it = isn't > obvious, without reference to some external authority, what a > standards group should classify as a human right. Different cultures a= nd > governments tend to differ on this subject... As far as I know, the "b= est" > source of what might be considered a broad consensus definition of hum= an > rights is found in the UN's 1948 Universal Declaration of Human Rights > > (UDHR). > - Does the UDHR contain the full set of rights that you think > should be addressed by standards groups? If not, are there addition= al > rights that you think should be considered? > - In his document, Human Rights Are Not a Bug > , > Niels ten Oever refers to the UN Guiding Principles for Business > and Human Rights > , > which adds to the rights enumerated in the UDHR a number of additio= nal > rights described in the International Labour Organization=E2=80=99s= Declaration > on Fundamental Principles and Rights at Work > . Given that > you appear to endorse ten Oever's report, do you also propose the s= ame > combined set of rights? (ie. UDHR + ILO DFPRW?) > - Some have argued that the Internet introduces a need to recognize > rights that have not yet been enumerated either in the UDHR or in a= ny other > broadly accepted documents. If this is the case, how is a standards= group > to determine what set of rights they must respect? > - *What specific aspects of the issues being addressed by this > community group give rise to human rights issues?* Also, if you accept > that one or some number of documents contain a useful list of such rig= hts, > can you identify which specific, enumerated rights are at risk? (e.g. = if > the UDHR is the foundation text, then I assume privacy issues would > probably be considered in the context of the UDHR's Article 12 > > .) > - *Are you suggesting that this group should formally address the > issue of rights*, with some sort of process, or just that we should be > aware of the issues? > - ten Oever suggests that "Those who design, standardize, and > maintain the infrastructure on which we run our information societi= es, > should assess their actions, processes, and technologies on their s= ocietal > impact." You apparently agree. Can you say how this should be done? > - The UN Guiding Principles for Business and Human Rights describe > a number of procedural steps that should be taken by either governm= ents or > corporations. Are you aware of a similar procedural description tha= t would > apply to standards groups? > - I think it was in the video that it was suggested that, in > Internet standards documents, "a section on human rights considerat= ions > should become as normal as one on security considerations." Do you = agree? > If so, can you suggest how such a section would be written? > > bob wyman > > > On Tue, Jan 4, 2022 at 9:05 PM Adrian Gropper > wrote: > >> This is a new thread for a new year to inspire deeper cooperation betwee= n >> W3C and IETF. This is relevant to our formal objection issues in W3C DID= as >> well as the harmonization of IETF SECEVENT DIDs and GNAP with ongoing >> protocol work in W3C and DIF. >> >> The Ford Foundation paper attached provides the references. However, thi= s >> thread should not be about governance philosophy but rather a focus on >> human rights as a design principle as we all work on protocols that will >> drive adoption of W3C VCs and DIDs at Internet scale. >> >> https://redecentralize.org/redigest/2021/08/ says: >> >> *Human rights are not a bug* >>> Decisions made by engineers in internet standards bodies (such as IETF >>> and W3C ) have a large >>> influence on internet technology, which in turn influences people=E2=80= =99s lives =E2=80=94 >>> people whose needs may or may not have been taken into account. In the >>> report Human Rights Are Not a Bug >>> >>> (see also its launch event >>> ), >>> Niels ten Oever asks *=E2=80=9Chow internet governance processes could = be >>> updated to deeply embed the public interest in governance decisions and= in >>> decision-making culture=E2=80=9D*. >>> =E2=80=9CInternet governance organizations maintain a distinct governan= ce >>> philosophy: to be consensus-driven and resistant to centralized >>> institutional authority over the internet. But these fundamental values >>> have limitations that leave the public interest dangerously neglected i= n >>> governance processes. In this consensus culture, the lack of institutio= nal >>> authority grants disproportionate power to the dominant corporate >>> participants. While the governance bodies are open to non-industry memb= ers, >>> they are essentially forums for voluntary industry self-regulation. Voi= ces >>> advocating for the public interest are at best limited and at worst abs= ent.=E2=80=9D >>> The report describes how standards bodies, IETF in particular, focus >>> narrowly on facilitating interconnection between systems, so that *=E2= =80=9Cmany >>> rights-related topics such as privacy, free expression or exclusion are >>> deemed =E2=80=9Ctoo political=E2=80=9D=E2=80=9D*; this came hand in han= d with the culture of >>> techno-optimism: >>> =E2=80=9CThere was a deeply entrenched assumption that the internet is = an engine >>> for good=E2=80=94that interconnection and rough consensus naturally pro= mote >>> democratization and that the open, distributed design of the network ca= n by >>> itself limit the concentration of power into oligopolies. >>> This has not proved to be the case.=E2=80=9D >>> To improve internet governance, the report recommends involving all >>> stakeholders in decision procedures, and adopting human rights impact >>> assessments (a section on *human rights considerations* should become >>> as normal as one on *security considerations*). >>> The report only briefly touches what seems an important point: that >>> existing governance bodies may become altogether irrelevant as both tec= h >>> giants and governments move on without them: >>> =E2=80=9CTransnational corporations and governments have the power to d= rive >>> internet infrastructure without the existing governance bodies, through= new >>> technologies that set de facto standards and laws that govern =E2=80=9C= at=E2=80=9D the >>> internet not =E2=80=9Cwith=E2=80=9D it.=E2=80=9D >>> How much would having more diverse stakeholders around the table help, >>> when ultimately Google decides whether and how a standard will be >>> implemented, or founds a =E2=80=98more effective=E2=80=99 standardisati= on body instead? >> >> >> Our work over the next few months is unbelievably important, >> >> - Adrian >> > --00000000000021476205d4d72abc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Bob's are=C2=A0important questions in the context= of our specific protocol work. I do not mean to scope this thread to gener= al W3C or IETF groups or their governance. Bold is used below to lin= k to Bob's specific questions.

I might also ar= gue to limit the scope to protocols and not VC, DID, biometric templates, o= r other data models even though effective standards for these drive quantit= ative and possibly qualitative improvements in the efficiency of surveillan= ce because a common language seems essential to discussing protocols. Adver= se consequences=C2=A0of the efficiency of common interoperable language can= be mitigated at the protocol level.

I'm respo= nding in personal terms to Bob's questions. I urge all of us engaged= in the protocol engineering effort to bring their own perspective on "= ;Human Rights" and to advocate for specific technical solutions in spe= cific workgroups. For example, I have chosen to focus attention on auth= orization for verifiable credential issue. I hope others will prioritize hu= man rights impact of authentication=C2=A0protocols especially where biometr= ics could be involved.

The specific aspects of = our protocol work that give rise to human rights issues relate to the effic= iency of standardized=C2=A0digital credentials to human persons.=C2=A0W= hat works for drugs in a supply chain or cattle on a farm can and usually w= ill be misused on people. Also, transferring responsibility from an issuer = to a subject of a VC is a burden that needs to be recognized and mitigated.= With respect to the UDHRs, I would point to 12 (privacy and confidentialit= y), 13 (anonymity), 14 (limit the reach of DHS and other state actors), 17 = (the right to associate with and delegate to others), 18 (associate with an= d delegate to communities one chooses), 20 (association, again), 21 (secret= elections), 22 (anonymity), 23 (trade unions as delegates), 24 (burden of = managing decisions in an asymmetric power relationship with the state or wi= th dominant private=C2=A0platforms), 29 (duties to and scope of the communi= ty).

I'm suggesting that we formally addres= s the issue of human rights as applied to the VC-API standardization proces= s.=C2=A0I'm also suggesting that we use a process in VC-API that fo= rmally harmonizes our work with IETF GNAP.

Adrian<= /div>
O= n Tue, Jan 4, 2022 at 11:45 PM Bob Wyman <bob@wyman.us> wrote:
=
Adrian,
Given that you're starting a new thread, I would appre= ciate it if you could do some context setting and clarifying:
  • What do you mean by "Human Rights?&q= uot; Hopefully, you won't consider that a foolish question. The iss= ue is, of course, that since Internet standards are developed in a multicul= tural, multinational context, it isn't obvious, without reference to so= me external authority, what a standards=C2=A0group should classify as a hum= an right. Different cultures and governments tend to differ on this subject= ... As far as I know, the "best" source of what might be consider= ed a broad consensus definition of human rights is found in the UN's 19= 48=C2=A0Universal Declaration of Human Rights= =C2=A0(UDHR).=C2=A0
    • Does the UDHR contain the full set of right= s that you think should be addressed by standards groups? If not, are there= additional rights that you think should be considered?=C2=A0
    • In hi= s document, Human Rights Are Not a Bug, Niels ten Oeve= r refers to the=C2=A0UN Guiding Principl= es for Business and Human Rights, which adds to the rights enumerated i= n the UDHR a number of additional rights described in the International Lab= our Organization=E2=80=99s Declaration on Fundamental Principles and = Rights at Work. Given that you appear to endorse ten Oever's=C2=A0r= eport, do you also propose the=C2=A0same combined set of rights? (ie. UDHR= =C2=A0+ ILO DFPRW?)
    • Some have argued that the Internet introduces a= need to recognize rights that have not yet been enumerated either in the U= DHR or in any other broadly accepted documents. If this is the case, how is= a standards group to determine what=C2=A0set of rights they must respect?<= /li>
  • What specific aspects of the issues being addressed by this= community group give rise to human rights issues?=C2=A0Also, if you ac= cept that one or some number of documents contain a useful list of such rig= hts, can you identify which specific, enumerated rights are at risk? (e.g. = if the UDHR is the foundation text, then I assume privacy issues would prob= ably be considered in the context of the UDHR's=C2=A0Article 12.)<= /li>
  • Are you suggesting that this group should formally address the i= ssue of rights, with some sort of process, or just that we should be aw= are of the issues?
    • ten Oever suggests that "Those who desi= gn, standardize, and maintain the infrastructure on which we run our inform= ation societies, should assess their actions, processes, and technologies o= n their societal impact." You apparently agree. Can you say how this s= hould be done?
    • The UN Guiding Principles for Business and Human Rig= hts describe a number of procedural steps that should be taken by either go= vernments or corporations. Are you aware of a similar procedural descriptio= n that would apply to standards groups?
    • I think it was in the video= that it was suggested that, in Internet=C2=A0standards=C2=A0documents, &qu= ot;a section on human rights considerations should become as normal as one = on security considerations." Do you agree? If so, can you suggest how = such a section would be written?
bob wyman

On Tue, Jan 4, 2022 at 9:05 PM Adrian Gropper <agropper@healthurl.com&= gt; wrote:
This is a new th= read for a new year to inspire deeper cooperation between W3C and IETF. Thi= s is relevant to our formal objection issues in W3C DID as well as the harm= onization of IETF SECEVENT DIDs and GNAP with ongoing protocol work in W3C = and DIF.

The Ford Foundation paper attached provid= es the references. However, this thread should not be about governance phil= osophy but rather a focus on human rights as a design principle as we all w= ork on protocols that will drive adoption of W3C VCs and DIDs at Internet s= cale.

https://redecentralize.org/redigest/2021/08/ = says:

Human rights are not a bug=
Decisions made by engineers in internet standards bodies (such as=C2=A0IETF=C2=A0and=C2=A0W3C) have a large i= nfluence on internet technology, which in turn influences people=E2=80=99s = lives =E2=80=94 people whose needs may or may not have been taken into acco= unt. In the report=C2=A0Human Rights Are Not a= Bug=C2=A0(see also its=C2=A0launch event), Niels= ten Oever asks=C2=A0=E2= =80=9Chow internet governance processes could be updated to deeply embed th= e public interest in governance decisions and in decision-making culture=E2= =80=9D.
=E2=80=9CInternet governance organizations maintain a disti= nct governance philosophy: to be consensus-driven and resistant to centrali= zed institutional authority over the internet. But these fundamental values= have limitations that leave the public interest dangerously neglected in g= overnance processes. In this consensus culture, the lack of institutional a= uthority grants disproportionate power to the dominant corporate participan= ts. While the governance bodies are open to non-industry members, they are = essentially forums for voluntary industry self-regulation. Voices advocatin= g for the public interest are at best limited and at worst absent.=E2=80=9D=
The report describes how standards bodies, IETF in particular, focus na= rrowly on facilitating interconnection between systems, so that=C2=A0= =E2=80=9Cmany rights-related top= ics such as privacy, free expression or exclusion are deemed =E2=80=9Ctoo p= olitical=E2=80=9D=E2=80=9D; this came hand in hand with the culture of= techno-optimism:
=E2=80=9CThere was a deeply entrenched assumption that= the internet is an engine for good=E2=80=94that interconnection and rough = consensus naturally promote democratization and that the open, distributed = design of the network can by itself limit the concentration of power into o= ligopolies.
This has not proved to be the case.=E2=80=9D
To improve i= nternet governance, the report recommends involving all stakeholders in dec= ision procedures, and adopting human rights impact assessments (a section o= n=C2=A0human rights consid= erations=C2=A0should become as normal as one on=C2= =A0security considerations)= .
The report only briefly touches what seems an important point: that ex= isting governance bodies may become altogether irrelevant as both tech gian= ts and governments move on without them:
=E2=80=9CTransnational corporat= ions and governments have the power to drive internet infrastructure withou= t the existing governance bodies, through new technologies that set de fact= o standards and laws that govern =E2=80=9Cat=E2=80=9D the internet not =E2= =80=9Cwith=E2=80=9D it.=E2=80=9D
How much would having more diverse stak= eholders around the table help, when ultimately Google decides whether and = how a standard will be implemented, or founds a =E2=80=98more effective=E2= =80=99 standardisation body instead?


Our work over the next few months is unbel= ievably important,

- Adrian

--00000000000021476205d4d72abc--