< draft-irtf-hrpc-guidelines-01.txt   draft-irtf-hrpc-guidelines-02.txt >
Human Rights Protocol Considerations Research GroupN. ten Oever (editor) Human Rights Protocol Considerations Research GroupN. ten Oever (editor)
Internet-Draft University of Amsterdam Internet-Draft University of Amsterdam
Intended status: Informational September 07, 2018 Intended status: Informational G. Grover (editor)
Expires: March 11, 2019 Expires: September 12, 2019 Centre for Internet and Society
March 11, 2019
Guidelines for Human Rights Protocol Considerations Guidelines for Human Rights Protocol and Architecture Considerations
draft-irtf-hrpc-guidelines-01 draft-irtf-hrpc-guidelines-02
Abstract Abstract
This document sets guidelines for human rights considerations in This document sets guidelines for human rights considerations in
networking protocols, similar to the work done on the guidelines for networking protocols, similar to the work done on the guidelines for
privacy considerations [RFC6973]. This is an updated version of the privacy considerations [RFC6973]. This is an updated version of the
guidelines for human rights considerations in [RFC8280]. guidelines for human rights considerations in [RFC8280].
Status of This Memo Status of This Memo
skipping to change at page 1, line 33 skipping to change at page 1, line 34
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on March 11, 2019. This Internet-Draft will expire on September 12, 2019.
Copyright Notice Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Vocabulary used . . . . . . . . . . . . . . . . . . . . . . . 3 2. Vocabulary used . . . . . . . . . . . . . . . . . . . . . . . 3
3. Model for developing human rights protocol considerations . . 3 3. Guidelines for developing human rights protocol
considerations . . . . . . . . . . . . . . . . . . . . . . . 3
3.1. Human rights threats . . . . . . . . . . . . . . . . . . 3 3.1. Human rights threats . . . . . . . . . . . . . . . . . . 3
3.2. Conducting human rights reviews . . . . . . . . . . . . . 4 3.2. Conducting human rights reviews . . . . . . . . . . . . . 4
3.2.1. Analyzing drafts based on guidelines for human rights 3.2.1. Analyzing drafts based on guidelines for human rights
considerations model . . . . . . . . . . . . . . . . 5 considerations model . . . . . . . . . . . . . . . . 5
3.2.2. Analyzing drafts based on their perceived or 3.2.2. Analyzing drafts based on their perceived or
speculated impact . . . . . . . . . . . . . . . . . . 5 speculated impact . . . . . . . . . . . . . . . . . . 5
3.2.3. Expert interviews . . . . . . . . . . . . . . . . . . 5 3.2.3. Expert interviews . . . . . . . . . . . . . . . . . . 5
3.2.4. Interviews with impacted persons and communities . . 5 3.2.4. Interviews with impacted persons and communities . . 5
3.2.5. Tracing impacts of implementations . . . . . . . . . 6 3.2.5. Tracing impacts of implementations . . . . . . . . . 6
3.3. Guidelines for human rights considerations . . . . . . . 6 3.3. Guidelines for human rights considerations . . . . . . . 6
skipping to change at page 2, line 44 skipping to change at page 2, line 45
3.3.15. Integrity . . . . . . . . . . . . . . . . . . . . . . 18 3.3.15. Integrity . . . . . . . . . . . . . . . . . . . . . . 18
3.3.16. Authenticity . . . . . . . . . . . . . . . . . . . . 19 3.3.16. Authenticity . . . . . . . . . . . . . . . . . . . . 19
3.3.17. Adaptability . . . . . . . . . . . . . . . . . . . . 20 3.3.17. Adaptability . . . . . . . . . . . . . . . . . . . . 20
3.3.18. Outcome Transparency . . . . . . . . . . . . . . . . 20 3.3.18. Outcome Transparency . . . . . . . . . . . . . . . . 20
3.3.19. Anonymity . . . . . . . . . . . . . . . . . . . . . . 21 3.3.19. Anonymity . . . . . . . . . . . . . . . . . . . . . . 21
4. Document Status . . . . . . . . . . . . . . . . . . . . . . . 22 4. Document Status . . . . . . . . . . . . . . . . . . . . . . . 22
5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 22 5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 22
6. Security Considerations . . . . . . . . . . . . . . . . . . . 22 6. Security Considerations . . . . . . . . . . . . . . . . . . . 22
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22
8. Research Group Information . . . . . . . . . . . . . . . . . 22 8. Research Group Information . . . . . . . . . . . . . . . . . 22
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 23 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 22
9.1. Informative References . . . . . . . . . . . . . . . . . 23 9.1. Informative References . . . . . . . . . . . . . . . . . 22
9.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 27 9.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 27 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27
1. Introduction 1. Introduction
2. Vocabulary used This document outlines a set of human rights protocol considerations
3. Model for developing human rights protocol considerations
This section outlines a set of human rights protocol considerations
for protocol developers. It provides questions engineers should ask for protocol developers. It provides questions engineers should ask
themselves when developing or improving protocols if they want to themselves when developing or improving protocols if they want to
understand their human rights impact. It should however be noted understand their potential human rights impact. It should however be
that the impact of a protocol cannot solely be deduced from its noted that the impact of a protocol cannot solely be deduced from its
design, but its usage and implementation should also be studied to design, but its usage and implementation should also be studied to
form a full protocol human rights impact assessment. form a full protocol human rights impact assessment.
The questions are based on the research performed by the hrpc The questions are based on the research performed by the hrpc
research group which has been documented before these considerations. research group which has been documented before these considerations.
The research establishes that human rights relate to standards and The research establishes that human rights relate to standards and
protocols and offers a common vocabulary of technical concepts that protocols, and offers a common vocabulary of technical concepts that
impact human rights and how these technical concept can be combined impact human rights and how these technical concepts can be combined
to ensure that the Internet remains an enabling environment for human to ensure that the Internet remains an enabling environment for human
rights. With this the contours of a model for developing human rights. With this the contours of a model for developing human
rights protocol considerations has taken shape. rights protocol considerations has taken shape.
This document is a further iteration of the guidelines that can be
found in [RFC8280].
2. Vocabulary used
3. Guidelines for developing human rights protocol considerations
3.1. Human rights threats 3.1. Human rights threats
Human rights threats on the Internet come in a myriad of forms. Human rights threats on the Internet come in a myriad of forms.
Protocols and standards can harm or enable the right to freedom of Protocols and standards can harm or enable the right to freedom of
expression, right to non-discrimination, right to equal protection, expression, right to non-discrimination, right to equal protection,
right to participate in cultural life, arts and science, right to right to participate in cultural life, arts and science, right to
freedom of assembly and association, and the right to security. An freedom of assembly and association, and the right to security. An
end-user who is denied access to certain services, data or websites end-user who is denied access to certain services, data or websites
may be unable to disclose vital information about the malpractices of may be unable to disclose vital information about the malpractices of
a government or other authority. A person whose communications are a government or other authority. A person whose communications are
monitored may be prevented from exercising their right to freedom of monitored may be prevented from exercising their right to freedom of
association or participate in political processes [Penney]. In a association or participate in political processes [Penney]. In a
worst-case scenario, protocols that leak information can lead to worst-case scenario, protocols that leak information can lead to
physical danger. A realistic example to consider is when individuals physical danger. A realistic example to consider is when individuals
perceived as threats to the state are subjected to torture or perceived as threats to the state are subjected to torture or
extrajudicial killing or detention on the basis of information extrajudicial killing or detention on the basis of information
gathered by state agencies through information leakage in protocols. gathered by state agencies through information leakage in protocols.
This section details several 'common' threats to human rights, This document details several 'common' threats to human rights,
indicating how each of these can lead to human rights violations/ indicating how each of these can lead to human rights violations/
harms and present several examples of how these threats to human harms and present several examples of how these threats to human
rights materialize on the Internet. This threat modeling is inspired rights materialize on the Internet. This threat modeling is inspired
by [RFC6973] Privacy Considerations for Internet Protocols, which is by [RFC6973] Privacy Considerations for Internet Protocols, which is
based on the security threat analysis. This method is by no means a based on security threat analysis. This method is a work in progress
perfect solution for assessing human rights risks in Internet and by no means a perfect solution for assessing human rights risks
protocols and systems; it is however the best approach currently in Internet protocols and systems. Certain specific human rights
available. Certain specific human rights threats are indirectly threats are indirectly considered in Internet protocols as part of
considered in Internet protocols as part of the security the security considerations [BCP72], but privacy considerations
considerations [BCP72], but privacy guidelines [RFC6973] or reviews, [RFC6973] or reviews, let alone human rights impact assessments of
let alone human rights impact assessments of protocols are not protocols are not standardized or implemented.
standardized or implemented.
Many threats, enablers and risks are linked to different rights. Many threats, enablers and risks are linked to different rights.
This is not unsurprising if one takes into account that human rights This is not unsurprising if one takes into account that human rights
are interrelated, interdependent and indivisible. Here however we're are interrelated, interdependent and indivisible. Here however we're
not discussing all human rights because not all human rights are not discussing all human rights because not all human rights are
relevant to ICTs in general and protocols and standards in particular relevant to ICTs in general and protocols and standards in particular
[Bless]: "The main source of the values of human rights is the [Bless]: "The main source of the values of human rights is the
International Bill of Human Rights that is composed of the Universal International Bill of Human Rights that is composed of the Universal
Declaration of Human Rights [UDHR] along with the International Declaration of Human Rights [UDHR] along with the International
Covenant on Civil and Political Rights [ICCPR] and the International Covenant on Civil and Political Rights [ICCPR] and the International
skipping to change at page 4, line 47 skipping to change at page 4, line 49
Information and Communications technologies, including economic Information and Communications technologies, including economic
rights, can be found in [Hill2014]. rights, can be found in [Hill2014].
This is by no means an attempt to exclude specific rights or This is by no means an attempt to exclude specific rights or
prioritize some rights over others. If other rights seem relevant, prioritize some rights over others. If other rights seem relevant,
please contact the authors. please contact the authors.
3.2. Conducting human rights reviews 3.2. Conducting human rights reviews
Human rights reviews can take place in different parts of the Human rights reviews can take place in different parts of the
development process of an Internet Draft. However generally speaking development process of an Internet Draft. However, generally
it is easier to influence the development of a technology at earlier speaking, it is easier to influence the development of a technology
stages than at later stages. This does not mean that reviews at at earlier stages than at later stages. This does not mean that
last-call are not relevant, but they are less likely to result in reviews at last-call are not relevant, but they are less likely to
significant changes in the reviewed document. result in significant changes in the reviewed document.
Methods for analyzing technology for specific human rights impacts Methods for analyzing technology for specific human rights impacts
are still quite nascent. Currently three five methods have been are still quite nascent. Currently three five methods have been
explored by the Human Rights Review Team, often in conjunction with explored by the Human Rights Review Team, often in conjunction with
each other: each other:
3.2.1. Analyzing drafts based on guidelines for human rights 3.2.1. Analyzing drafts based on guidelines for human rights
considerations model considerations model
This analysis of Internet-Drafts uses the model as described below. This analysis of Internet-Drafts uses the model as described below.
The outlined categories and questions are used to review an Internet The outlined categories and questions are used to review an Internet
Draft an generally the review is also presented in that order. The Draft an generally the review is also presented in that order. The
advatange of this is that it provides a known overview, and document advantage of this is that it provides a known overview, and document
authors can go back to this document as well as [RFC8280] to authors can go back to this document as well as [RFC8280] to
understand the background and the context. understand the background and the context.
3.2.2. Analyzing drafts based on their perceived or speculated impact 3.2.2. Analyzing drafts based on their perceived or speculated impact
When reviewing an Internet-Draft specific human rights impacts might When reviewing an Internet-Draft specific human rights impacts might
become apparent by doing a close reading of the draft and seeking to become apparent by doing a close reading of the draft and seeking to
understand how it might provide a different ordering of the network understand how it might provide a different ordering of the network
or society. While less structured than the straight use of the human or society. While less structured than the straight use of the human
rights considerations model, this analysis might lead to new rights considerations model, this analysis might lead to new
speculative understandings between human rights and protocols. speculative understandings between human rights and protocols.
3.2.3. Expert interviews 3.2.3. Expert interviews
Interviews with document authors, active members of the Working Interviews with document authors, active members of the Working
Group, or experts in the field can help explore the characteristics Group, or experts in the field can help explore the characteristics
of the protocol and their effects. There are two main advtanges to of the protocol and their effects. There are two main advantages to
this approach; one the one hand it allows the reviewer to gain a this approach: one the one hand, it allows the reviewer to gain a
deeper understanding of the (intended) workings of the protocol, on deeper understanding of the (intended) workings of the protocol; on
the other hand it also allows for the reviewer to start a discussion the other hand, it also allows for the reviewer to start a discussion
with an expert or even document author about certain aspects, which with experts or even document authors about certain aspects, which
might help gain the review gain traction when it is published. might help gain the review gain traction when it is published.
3.2.4. Interviews with impacted persons and communities 3.2.4. Interviews with impacted persons and communities
Protcols impact users of the Internet. There it might help the Protocols impact users of the Internet. There it might help the
review to understand how it impacts the people that use the protocol, review to understand how it impacts the people that use the protocol,
and the people whose lives are impacted by the protocol. Since human and the people whose lives are impacted by the protocol. Since human
rights should always be understood from the rightsholder, this rights should always be understood from the rightsholder, this
approach will improve the understanding of the real world effects of approach will improve the understanding of the real world effects of
the technology. At the same time it can be hard to attribute the technology. At the same time, it can be hard to attribute
specific changes to a particular protocol, this is of course even specific changes to a particular protocol, this is of course even
harder when a protocol has not been (widely) deployed. harder when a protocol has not been (widely) deployed.
3.2.5. Tracing impacts of implementations 3.2.5. Tracing impacts of implementations
When an Internet Draft is describing running code thas has already When an Internet Draft is describing running code that has already
been implemented, the code could be analyzed either in an been implemented, the code could be analyzed either in an
expirimental setting or on the Internet where its impact can be experimental setting or on the Internet where its impact can be
observed. Other than reviewing a draft, this allows the reviewer to observed. Other than reviewing a draft, this allows the reviewer to
understand how the document works in practice and potentially also understand how the document works in practice and potentially also
what unknown or unexpected effects the technology might have. what unknown or unexpected effects the technology might have.
3.3. Guidelines for human rights considerations 3.3. Guidelines for human rights considerations
This section provides guidance for document authors in the form of a This section provides guidance for document authors in the form of a
questionnaire about protocols and their (potential) impact. The questionnaire about protocols and their (potential) impact. The
questionnaire may be useful at any point in the design process, questionnaire may be useful at any point in the design process,
particularly after document authors have developed a high-level particularly after document authors have developed a high-level
skipping to change at page 6, line 40 skipping to change at page 6, line 40
Note that the guidance provided in this section does not recommend Note that the guidance provided in this section does not recommend
specific practices. The range of protocols developed in the IETF is specific practices. The range of protocols developed in the IETF is
too broad to make recommendations about particular uses of data or too broad to make recommendations about particular uses of data or
how human rights might be balanced against other design goals. how human rights might be balanced against other design goals.
However, by carefully considering the answers to the following However, by carefully considering the answers to the following
questions, document authors should be able to produce a comprehensive questions, document authors should be able to produce a comprehensive
analysis that can serve as the basis for discussion on whether the analysis that can serve as the basis for discussion on whether the
protocol adequately takes specific human rights threats into account. protocol adequately takes specific human rights threats into account.
This guidance is meant to help the thought process of a human rights This guidance is meant to help the thought process of a human rights
analysis; it does not provide specific directions for how to write a analysis; it does not provide specific directions for how to write a
human rights protocol considerations section (following the example human rights considerations section (following the example set in
set in [RFC6973]), and the addition of a human rights protocol [RFC6973]), and the addition of a human rights considerations section
considerations section has also not yet been proposed. In has also not yet been proposed.
considering these questions, authors will need to be aware of the
In considering these questions, authors will need to be aware of the
potential of technical advances or the passage of time to undermine potential of technical advances or the passage of time to undermine
protections. In general, considerations of rights are likely to be protections. In general, considerations of rights are likely to be
more effective if they are considered given a purpose and specific more effective if they are considered given a purpose and specific
use cases, rather than as abstract absolute goals. use cases, rather than as abstract absolute goals.
3.3.1. Connectivity 3.3.1. Connectivity
Question(s): Does your protocol add application-specific functions to Question(s): Does your protocol add application-specific functions to
intermediary nodes? Could this functionality be added to end nodes intermediary nodes? Could this functionality be added to end nodes
instead of intermediary nodes? Is your protocol optimized for low instead of intermediary nodes? Is your protocol optimized for low
bandwidth and high latency connections? Could your protocol also be bandwidth and high latency connections? Could your protocol also be
developed in a stateless manner? developed in a stateless manner?
Explanation: The end-to-end principle [Saltzer] holds that 'the Explanation: The end-to-end principle [Saltzer] holds that 'the
intelligence is end to end rather than hidden in the network' intelligence is end to end rather than hidden in the network'
[RFC1958]. The end-to-end principle is important for the robustness [RFC1958]. The end-to-end principle is important for the robustness
of the network and innovation. Such robustness of the network is of the network and innovation. Such robustness of the network is
crucial to enabling human rights like freedom of expression. crucial to enabling human rights like freedom of expression.
Example: Middleboxes (which can be Content Delivery Networks, Example: Middleboxes (which can be Content Delivery Networks,
Firewalls, NATs or other intermediary nodes that provide other Firewalls, NATs or other intermediary nodes that provide 'services'
'services' than routing) serve many legitimate purposes. But the besides routing) serve many legitimate purposes. However, protocols
protocols guiding them, can influence individuals' ability to relying on middleboxes can create potential for abuse, and
communicate online freely and privately. The potential for abuse and intentional and unintentional censoring, thereby influencing
intentional and unintentional censoring and limiting permissionless individuals' ability to communicate online freely and privately.
innovation, and thus ultimately the impact of middleboxes on the
Internet as a place of unfiltered, unmonitored freedom of speech, is
real.
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to freedom of assembly and association - Right to freedom of assembly and association
3.3.2. Privacy 3.3.2. Privacy
Question(s): Did you have a look at the Guidelines in the Privacy Question(s): Did you have a look at the Guidelines in the Privacy
Considerations for Internet Protocols [RFC6973] section 7? Could Considerations for Internet Protocols [RFC6973] section 7? Does your
your protocol in any way impact the confidentiality of protocol protocol maintain the confidentiality of metadata? Could your
metadata? Could your protocol counter traffic analysis? Could your protocol counter traffic analysis? Does your protocol adhere to data
protocol improve data minimization? Does your document identify minimization principles? Does your document identify potentially
potentially sensitive logged data by your protocol and/or for how sensitive data logged by your protocol and/or for how long that needs
long that needs to be retained for technical reasons? to be retained for technical reasons?
Explanation: Privacy refers to the right of an entity (normally a Explanation: Privacy refers to the right of an entity (normally a
person), acting in its own behalf, to determine the degree to which person), acting in its own behalf, to determine the degree to which
it will interact with its environment, including the degree to which it will interact with its environment, including the degree to which
the entity is willing to share its personal information with others. the entity is willing to share its personal information with others.
[RFC4949]. If a protocol provides insufficient privacy protection it [RFC4949]. If a protocol provides insufficient privacy protection it
may have a negative impact on freedom of expression as users self- may have a negative impact on freedom of expression as users self-
censor for fear of surveillance, or find themselves unable to express censor for fear of surveillance, or find themselves unable to express
themselves freely. themselves freely.
skipping to change at page 8, line 19 skipping to change at page 8, line 16
- Right to freedom of expression - Right to freedom of expression
- Right to non-discrimination - Right to non-discrimination
3.3.3. Content agnosticism 3.3.3. Content agnosticism
Question(s): If your protocol impacts packet handling, does it use Question(s): If your protocol impacts packet handling, does it use
user data (packet data that is not included in the header)? Is it user data (packet data that is not included in the header)? Is it
making decisions based on the payload of the packet? Does your making decisions based on the payload of the packet? Does your
protocol prioritize certain content or services over others in the protocol prioritize certain content or services over others in the
routing process ? Is the protocol transparent about the routing process? Is the protocol transparent about the
prioritization that is made (if any)? prioritization that is made (if any)?
Explanation: Content agnosticism refers to the notion that network Explanation: Content agnosticism refers to the notion that network
traffic is treated identically regardless of payload, with some traffic is treated identically regardless of payload, with some
exception where it comes to effective traffic handling, for instance exception where it comes to effective traffic handling, for instance
where it comes to delay tolerant or delay sensitive packets, based on where it comes to delay tolerant or delay sensitive packets, based on
the header. the header.
Example: Content agnosticism prevents payload-based discrimination Example: Content agnosticism prevents payload-based discrimination
against packets. This is important because changes to this principle against packets. This is important because changes to this principle
skipping to change at page 8, line 46 skipping to change at page 8, line 43
- Right to freedom of expression - Right to freedom of expression
- Right to non-discrimination - Right to non-discrimination
- Right to equal protection - Right to equal protection
3.3.4. Security 3.3.4. Security
Question(s): Did you have a look at Guidelines for Writing RFC Text Question(s): Did you have a look at Guidelines for Writing RFC Text
on Security Considerations [BCP72]? Have you found any "attacks that on Security Considerations [BCP72]? Have you found any attacks that
are somewhat related to your protocol yet considered out of scope of are somewhat related to your protocol yet considered out of scope of
your document? Would these attacks be pertinent to the human rights your document? Would these attacks be pertinent to the human rights
enabling features of the Internet (as described throughout this enabling features of the Internet (as described throughout this
document)? document)?
Explanation: Most people speak of security as if it were a single
monolithic property of a protocol or system, however, upon reflection Explanation: Security is not a single monolithic property of a
one realizes that it is clearly not true. Rather, security is a protocol or system, but rather a series of related but somewhat
series of related but somewhat independent properties. Not all of independent properties. Not all of these properties are required for
these properties are required for every application. Since every application. Since communications are carried out by systems
communications are carried out by systems and access to systems is and access to systems is through communications channels, security
through communications channels, these goals obviously interlock, but goals obviously interlock, but they can also be independently
they can also be independently provided [BCP72]. provided. [BCP72].
Example: See [BCP72]. Example: See [BCP72].
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to freedom of assembly and association - Right to freedom of assembly and association
- Right to non-discrimination - Right to non-discrimination
skipping to change at page 9, line 48 skipping to change at page 9, line 44
ASCII text in a protocol. [RFC6365] A different perspective, more ASCII text in a protocol. [RFC6365] A different perspective, more
appropriate to protocols that are designed for global use from the appropriate to protocols that are designed for global use from the
beginning, is the definition used by W3C: beginning, is the definition used by W3C:
"Internationalization is the design and development of a "Internationalization is the design and development of a
product, application or document content that enables easy product, application or document content that enables easy
localization for target audiences that vary in culture, region, localization for target audiences that vary in culture, region,
or language." {{W3Ci18nDef}} or language." {{W3Ci18nDef}}
Many protocols that handle text only handle one charset (US-ASCII), Many protocols that handle text only handle one charset (US-ASCII),
or leave the question of what CCS and encoding are used up to local or leave the question of what coded character set and encoding are
guesswork (which leads, of course, to interoperability problems). If used up to local guesswork (which leads, of course, to
multiple charsets are permitted, they must be explicitly identified interoperability problems). If multiple charsets are permitted, they
[RFC2277]. Adding non-ASCII text to a protocol allows the protocol must be explicitly identified [RFC2277]. Adding non-ASCII text to a
to handle more scripts, hopefully representing users across the protocol allows the protocol to handle more scripts, hopefully
world. In today's world, that is normally best accomplished by representing users across the world. In today's world, that is
allowing Unicode encoded in UTF-8 only. normally best accomplished by allowing Unicode encoded in UTF-8 only.
In the current IETF policy [RFC2277], internationalization is aimed In the current IETF policy [RFC2277], internationalization is aimed
at user-facing strings, not protocol elements, such as the verbs used at user-facing strings, not protocol elements, such as the verbs used
by some text-based protocols. (Do note that some strings are both by some text-based protocols. (Do note that some strings are both
content and protocol elements, such as the identifiers.) If the content and protocol elements, such as the identifiers.) If the
Internet wants to be a global network of networks, the protocols Internet wants to be a global network of networks, the protocols
should work with other languages than English and other character should work with languages apart from English and character sets
sets than latin characters. It is therefore crucial that at least apart from Latin characters. It is therefore crucial that at least
the content carried by the protocol can be in any script, and that the content carried by the protocol can be in any script, and that
all scripts are treated equally. all scripts are treated equally.
Example: See localization Example: See localization
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to political participation - Right to political participation
- Right to participate in cultural life, arts and science - Right to participate in cultural life, arts and science
3.3.6. Censorship resistance 3.3.6. Censorship resistance
Question(s): Does this protocol introduce new identifiers or reuse Question(s): Does your protocol introduce new identifiers or reuse
existing identifiers (e.g. MAC addresses) that might be associated existing identifiers (e.g. MAC addresses) that might be associated
with persons or content? Does your protocol make it apparent or with persons or content? Does your protocol make it apparent or
transparent when access to a resource it restricted? Can your transparent when access to a resource it restricted? Can your
protocol contribute to filtering in a way it could be implemented to protocol contribute to filtering in a way it could be implemented to
censor data or services? Could this be designed to ensure this censor data or services? Could this be designed to ensure this
doesn't happen? doesn't happen?
Explanation: Censorship resistance refers to the methods and measures Explanation: Censorship resistance refers to the methods and measures
to prevent Internet censorship. to prevent Internet censorship.
Example: In the development of the IPv6 protocol it was discussed to Example: In the development of the IPv6 protocol, it was discussed to
embed a Media Access Control (MAC) address into unique IP addresses. embed a Media Access Control (MAC) address into unique IP addresses.
This would make it possible for 'eavesdroppers and other information This would make it possible for 'eavesdroppers and other information
collectors to identify when different addresses used in different collectors to identify when different addresses used in different
transactions actually correspond to the same node. [RFC4941] This is transactions actually correspond to the same node. [RFC4941] This is
why Privacy Extensions for Stateless Address Autoconfiguration in why Privacy Extensions for Stateless Address Autoconfiguration in
IPv6 have been introduced. [RFC4941] IPv6 have been introduced. [RFC4941]
Identifiers of content exposed within a protocol might be used to Identifiers of content exposed within a protocol might be used to
facilitate censorship, as in the case of Application Layer based facilitate censorship, as in the case of Application Layer based
censorship, which affects protocols like HTTP. Denial or restriction censorship, which affects protocols like HTTP. In HTTP, denial or
of access can be made apparent by the use of status code 451 - which restriction of access can be made apparent by the use of status code
allows server operators to operate with greater transparency in 451, which allows server operators to operate with greater
circumstances where issues of law or public policy affect their transparency in circumstances where issues of law or public policy
operation [RFC7725]. affect their operation [RFC7725].
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to political participation - Right to political participation
- Right to participate in cultural life, arts and science - Right to participate in cultural life, arts and science
- Right to freedom of assembly and association - Right to freedom of assembly and association
3.3.7. Open Standards 3.3.7. Open Standards
Question(s): Is your protocol fully documented in a way that it could Question(s): Is your protocol fully documented in a way that it could
be easily implemented, improved, built upon and/or further developed? be easily implemented, improved, built upon and/or further developed?
Do you depend on proprietary code for the implementation, running or Do you depend on proprietary code for the implementation, running or
further development of your protocol? Does your protocol favor a further development of your protocol? Does your protocol favor a
particular proprietary specification over technically equivalent and particular proprietary specification over technically-equivalent
competing specification(s), for instance by making any incorporated competing specification(s), for instance by making any incorporated
vendor specification "required" or "recommended" [RFC2026]? Do you vendor specification "required" or "recommended" [RFC2026]? Do you
normatively reference another standard that is not available without normatively reference another standard that is not available without
cost (and could it possible be done without)? Are you aware of any cost (and could you do without it)? Are you aware of any patents
patents that would prevent your standard from being fully implemented that would prevent your standard from being fully implemented
[RFC3979] [RFC6701]? [RFC3979] [RFC6701]?
Explanation: The Internet was able to be developed into the global Explanation: The Internet was able to be developed into the global
network of networks because of the existence of open, non-proprietary network of networks because of the existence of open, non-proprietary
standards [Zittrain]. They are crucial for enabling standards [Zittrain]. They are crucial for enabling
interoperability. Yet, open standards are not explicitly defined interoperability. Yet, open standards are not explicitly defined
within the IETF. On the subject, [RFC2026] states: Various national within the IETF. On the subject, [RFC2026] states: "Various national
and international standards bodies, such as ANSI, ISO, IEEE, and ITU- and international standards bodies, such as ANSI, ISO, IEEE, and ITU-
T, develop a variety of protocol and service specifications that are T, develop a variety of protocol and service specifications that are
similar to Technical Specifications defined at the IETF. National similar to Technical Specifications defined at the IETF. National
and international groups also publish "implementors' agreements" that and international groups also publish "implementors' agreements" that
are analogous to Applicability Statements, capturing a body of are analogous to Applicability Statements, capturing a body of
implementation-specific detail concerned with the practical implementation-specific detail concerned with the practical
application of their standards. All of these are considered to be application of their standards. All of these are considered to be
"open external standards" for the purposes of the Internet Standards "open external standards" for the purposes of the Internet Standards
Process. Similarly, [RFC3935] does not define open standards but Process." Similarly, [RFC3935] does not define open standards but
does emphasize the importance of 'open process': any interested does emphasize the importance of an "open process", i.e. "any
person can participate in the work, know what is being decided, and interested person can participate in the work, know what is being
make his or her voice heard on the issue. Part of this principle is decided, and make his or her voice heard on the issue."
the IETF's commitment to making its documents, WG mailing lists,
attendance lists, and meeting minutes publicly available on the
Internet.
Open standards are important as they allow for permissionless Open standards are important as they allow for permissionless
innovation, which is important to maintain the freedom and ability to innovation, which is important to maintain the freedom and ability to
freely create and deploy new protocols on top of the communications freely create and deploy new protocols on top of the communications
constructs that currently exist. It is at the heart of the Internet constructs that currently exist. It is at the heart of the Internet
as we know it, and to maintain its fundamentally open nature, we need as we know it, and to maintain its fundamentally open nature, we need
to be mindful of the need for developing open standards. to be mindful of the need for developing open standards.
All standards that need to be normatively implemented should be All standards that need to be normatively implemented should be
freely available and with reasonable protection for patent freely available and with reasonable protection for patent
infringement claims, so it can also be implemented in open source or infringement claims, so it can also be implemented in open source or
free software. Patents have often held back open standardization or free software. Patents have often held back open standardization or
been used against those deploying open standards, particularly in the been used against those deploying open standards, particularly in the
domain of cryptography [newegg]. An exemption of this is sometimes domain of cryptography [newegg]. An exemption of this is sometimes
made when a protocol is standardized that normatively relies on made when a protocol is standardized that normatively relies on
speficiations produced by others SDOs that are not freely available. specifications produced by others SDOs that are not freely available.
Patents in open standards or in normative references to other Patents in open standards or in normative references to other
standards should have a patent disclosure [notewell], royalty-free standards should have a patent disclosure [notewell], royalty-free
licensing [patentpolicy], or some other form of reasonable licensing [patentpolicy], or some other form of fair, reasonable and
protection. Reasonable patent protection should include but is not non-discriminatory terms.
limited to cryptographic primitives.
Example: [RFC6108] describes a system for providing critical end-user Example: [RFC6108] describes a system for providing critical end-user
notifications to web browsers, which has been deployed by Comcast, an notifications to web browsers, which has been deployed by Comcast, an
Internet Service Provider (ISP). Such a notification system is being Internet Service Provider (ISP). Such a notification system is being
used to provide near-immediate notifications to customers, such as to used to provide near-immediate notifications to customers, such as to
warn them that their traffic exhibits patterns that are indicative of warn them that their traffic exhibits patterns that are indicative of
malware or virus infection. There are other proprietary systems that malware or virus infection. There are other proprietary systems that
can perform such notifications, but those systems utilize Deep Packet can perform such notifications, but those systems utilize Deep Packet
Inspection (DPI) technology. In contrast to DPI, this document Inspection (DPI) technology. In contrast, that document describes a
describes a system that does not rely upon DPI, and is instead based system that does not rely upon DPI, and is instead based on open IETF
in open IETF standards and open source applications. standards and open source applications.
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to participate in cultural life, arts and science - Right to participate in cultural life, arts and science
3.3.8. Heterogeneity Support 3.3.8. Heterogeneity Support
Question(s): Does your protocol support heterogeneity by design? Question(s): Does your protocol support heterogeneity by design?
skipping to change at page 13, line 33 skipping to change at page 13, line 22
various computer word lengths, and hosts ranging from memory-starved various computer word lengths, and hosts ranging from memory-starved
microprocessors up to massively parallel supercomputers. Multiple microprocessors up to massively parallel supercomputers. Multiple
types of application protocol must be allowed for, ranging from the types of application protocol must be allowed for, ranging from the
simplest such as remote login up to the most complex such as simplest such as remote login up to the most complex such as
distributed databases [RFC1958]. distributed databases [RFC1958].
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to political participtation - Right to political participation
3.3.9. Pseudonymity 3.3.9. Pseudonymity
Question(s): Have you considered the Privacy Considerations for Question(s): Have you considered the Privacy Considerations for
Internet Protocols [RFC6973], especially section 6.1.2 ? Does the Internet Protocols [RFC6973], especially section 6.1.2 ? Does the
protocol collect personally derived data? Does the protocol generate protocol collect personally derived data? Does the protocol generate
or process anything that can be, or be tightly correlated with, or process anything that can be, or be tightly correlated with,
personally identifiable information? Does the protocol utilize data personally identifiable information? Does the protocol utilize data
that is personally-derived, i.e. derived from the interaction of a that is personally-derived, i.e. derived from the interaction of a
single person, or their device or address? Does this protocol single person, or their device or address? Does this protocol
generate personally derived data, and if so how will that data be generate personally derived data, and if so how will that data be
handled? handled?
Explanation: Pseudonymity - the ability to use a persistent Explanation: Pseudonymity - the ability to use a persistent
identifier not linked to one's offline identity" straight away - is identifier not linked to one's offline identity - is an important
an important feature for many end-users, as it allows them different feature for many end-users, as it allows them different degrees of
degrees of disguised identity and privacy online. disguised identity and privacy online.
Example: Designing a standard that exposes personal data, it is Example: While designing a standard that exposes personal data, it is
important to consider ways to mitigate the obvious impacts. While important to consider ways to mitigate the obvious impacts. While
pseudonyms cannot be simply reverse engineered - some early pseudonyms cannot be simply reverse engineered - some early
approaches simply took approaches such as simple hashing of IP approaches simply took approaches such as simple hashing of IP
addresses, these could then be simply reversed by generating a hash addresses, these could then be simply reversed by generating a hash
for each potential IP address and comparing it to the pseudonym - for each potential IP address and comparing it to the pseudonym -
limiting the exposure of personal data remains important. limiting the exposure of personal data remains important.
Pseudonymity means using a pseudonym instead of one's "real" name. Pseudonymity means using a pseudonym instead of one's "real" name.
There are many reasons for users to use pseudoyms, for instance to: There are many reasons for users to use pseudonyms, for instance to:
hide their gender, protect themselves against harassment, protect hide their gender, protect themselves against harassment, protect
their families' privacy, frankly discuss sexuality, or develop a their families' privacy, frankly discuss sexuality, or develop a
artistic or journalistic persona without retribution from an artistic or journalistic persona without repercussions from an
employer, (potential) customers, or social surrounding. employer, (potential) customers, or social surrounding.
[geekfeminism] The difference between anonymity and pseudonymity is [geekfeminism] The difference between anonymity and pseudonymity is
that a pseudonym often is persistent. "Pseudonymity is strengthened that a pseudonym often is persistent. "Pseudonymity is strengthened
when less personal data can be linked to the pseudonym; when the same when less personal data can be linked to the pseudonym; when the same
pseudonym is used less often and across fewer contexts; and when pseudonym is used less often and across fewer contexts; and when
independently chosen pseudonyms are more frequently used for new independently chosen pseudonyms are more frequently used for new
actions (making them, from an observer's or attacker's perspective, actions (making them, from an observer's or attacker's perspective,
unlinkable)." [RFC6973] unlinkable)." [RFC6973]
Impacts: Impacts:
skipping to change at page 15, line 18 skipping to change at page 15, line 8
- Right to freedom of assembly and association - Right to freedom of assembly and association
- Right to education - Right to education
- Right to political participation - Right to political participation
3.3.11. Localization 3.3.11. Localization
Question(s): Does your protocol uphold the standards of Question(s): Does your protocol uphold the standards of
internationalization? Have made any concrete steps towards internationalization? Have you made any concrete steps towards
localizing your protocol for relevant audiences? localizing your protocol for relevant audiences?
Explanation: Localization refers to the adaptation of a product, Explanation: Localization refers to the adaptation of a product,
application or document content to meet the language, cultural and application or document content to meet the language, cultural and
other requirements of a specific target market (a locale) other requirements of a specific target market (a locale)
[W3Ci18nDef]. It is also described as the practice of translating an [W3Ci18nDef]. It is also described as the practice of translating an
implementation to make it functional in a specific language or for implementation to make it functional in a specific language or for
users in a specific locale (see Internationalization). users in a specific locale (see Internationalization).
Example: The Internet is a global medium, but many of its protocols Example: The Internet is a global medium, but many of its protocols
skipping to change at page 15, line 50 skipping to change at page 15, line 40
Impacts: Impacts:
- Right to non-discrimination - Right to non-discrimination
- Right to participate in cultural life, arts and science - Right to participate in cultural life, arts and science
- Right to freedom of expression - Right to freedom of expression
3.3.12. Decentralization 3.3.12. Decentralization
Question(s): Can your protocol be implemented without one single Question(s): Can your protocol be implemented without a single point
point of control? If applicable, can your protocol be deployed in a of control? If applicable, can your protocol be deployed in a
federated manner? What is the potential for discrimination against federated manner? What is the potential for discrimination against
users of your protocol? How can the use of your protocol be used to users of your protocol? How can your protocol be used to implicate
implicate users? Does your protocol create additional centralized users? Does your protocol create additional centralized points of
points of control? control?
Explanation: Decentralization is one of the central technical Explanation: Decentralization is one of the central technical
concepts of the architecture of the networks, and embraced as such by concepts of the architecture of the networks, and embraced as such by
the IETF [RFC3935]. It refers to the absence or minimization of the IETF [RFC3935]. It refers to the absence or minimization of
centralized points of control; a feature that is assumed to make it centralized points of control, a feature that is assumed to make it
easy for new users to join and new uses to unfold [Brown]. It also easy for new users to join and new uses to unfold [Brown]. It also
reduces issues surrounding single points of failure, and distributes reduces issues surrounding single points of failure, and distributes
the network such that it continues to function if one or several the network such that it continues to function even if one or several
nodes are disabled. With the commercialization of the Internet in nodes are disabled. With the commercialization of the Internet in
the early 1990's there has been a slow move to move away from the early 1990s, there has been a slow move away from
decentralization, to the detriment of the technical benefits of decentralization, to the detriment of the technical benefits of
having a decentralized Internet. having a decentralized Internet.
Example: The bits traveling the Internet are increasingly susceptible Example: The bits traveling the Internet are increasingly susceptible
to monitoring and censorship, from both governments and Internet to monitoring and censorship, from both governments and Internet
service providers, as well as third (malicious) parties. The ability service providers, as well as third (malicious) parties. The ability
to monitor and censor is further enabled by the increased to monitor and censor is further enabled by the increased
centralization of the network that creates central infrastructure centralization of the network that creates central infrastructure
points that can be tapped in to. The creation of peer-to-peer points that can be tapped in to. The creation of peer-to-peer
networks and the development of voice-over-IP protocols using peer- networks and the development of voice-over-IP protocols using peer-
skipping to change at page 16, line 39 skipping to change at page 16, line 29
decentralization [Pouwelse]. decentralization [Pouwelse].
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to freedom of assembly and association - Right to freedom of assembly and association
3.3.13. Reliability 3.3.13. Reliability
Question(s): Is your protocol fault tolerant? Does it degrade Question(s): Is your protocol fault tolerant? Does it downgrade
gracefully? Can your protocol resist malicious degradation attempts? gracefully? Can your protocol resist malicious degradation attempts?
Do you have a documented way to announce degradation? Do you have Do you have a documented way to announce degradation? Do you have
measures in place for recovery or partial healing from failure? Can measures in place for recovery or partial healing from failure? Can
your protocol maintain dependability and performance in the face of your protocol maintain dependability and performance in the face of
unanticipated changes or circumstances? unanticipated changes or circumstances?
Explanation: Reliability ensures that a protocol will execute its Explanation: Reliability ensures that a protocol will execute its
function consistently and error resistant as described, and function function consistently and error resistant as described, and function
without unexpected result. A system that is reliable degenerates without unexpected result. A system that is reliable degenerates
gracefully and will have a documented way to announce degradation. gracefully and will have a documented way to announce degradation.
It also has mechanisms to recover from failure gracefully, and if It also has mechanisms to recover from failure gracefully, and if
applicable, allow for partial healing. It is important here to draw applicable, allow for partial healing. It is important here to draw
a distinction between random degradation and malicious degradation. a distinction between random degradation and malicious degradation.
Many current attacks against TLS, for example, exploit TLS's ability Many current attacks against TLS, for example, exploit TLS' ability
to gracefully degrade to older cipher suites - from a functional to gracefully downgrade to older cipher suites - from a functional
perspective, this is good. From a security perspective, this can be perspective, this is good; from a security perspective, this can be
very bad. As with confidentiality, the growth of the Internet and very bad. As with confidentiality, the growth of the Internet and
fostering innovation in services depends on users having confidence fostering innovation in services depends on users having confidence
and trust [RFC3724] in the network. For reliability it is necessary and trust [RFC3724] in the network. For reliability, it is necessary
that services notify the users if a delivery fails. In the case of that services notify the users if a delivery fails. In the case of
real-time systems in addition to the reliable delivery the protocol real-time systems in addition to the reliable delivery the protocol
needs to safeguard timeliness. needs to safeguard timeliness.
Example: In the modern IP stack structure, a reliable transport layer Example: In the modern IP stack structure, a reliable transport layer
requires an indication that transport processing has successfully requires an indication that transport processing has successfully
completed, such as given by TCP's ACK message [RFC0793], and not completed, such as given by TCP's ACK message [RFC0793], and not
simply an indication from the IP layer that the packet arrived. simply an indication from the IP layer that the packet arrived.
Similarly, an application layer protocol may require an application- Similarly, an application layer protocol may require an application-
specific acknowledgement that contains, among other things, a status specific acknowledgment that contains, among other things, a status
code indicating the disposition of the request (See [RFC3724]). code indicating the disposition of the request (See [RFC3724]).
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to security - Right to security
3.3.14. Confidentiality 3.3.14. Confidentiality
skipping to change at page 18, line 21 skipping to change at page 18, line 11
unintended listeners [BCP72]. The growth of the Internet depends on unintended listeners [BCP72]. The growth of the Internet depends on
users having confidence that the network protects their personal data users having confidence that the network protects their personal data
[RFC1984]. [RFC1984].
Example: Protocols that do not encrypt their payload make the entire Example: Protocols that do not encrypt their payload make the entire
content of the communication available to the idealized attacker content of the communication available to the idealized attacker
along their path. Following the advice in [RFC3365], most such along their path. Following the advice in [RFC3365], most such
protocols have a secure variant that encrypts the payload for protocols have a secure variant that encrypts the payload for
confidentiality, and these secure variants are seeing ever-wider confidentiality, and these secure variants are seeing ever-wider
deployment. A noteworthy exception is DNS [RFC1035], as DNSSEC deployment. A noteworthy exception is DNS [RFC1035], as DNSSEC
[RFC4033]does not have confidentiality as a requirement. This [RFC4033] does not have confidentiality as a requirement. This
implies that, in the absence of changes to the protocol as presently implies that, in the absence of the use of more recent standards like
under development in the IETF's DNS Private Exchange (DPRIVE) working DNS over TLS [RFC7858] or DNS over HTTPS [RFC8484], all DNS queries
group, all DNS queries and answers generated by the activities of any and answers generated by the activities of any protocol are available
protocol are available to the attacker. When store-and-forward to the attacker. When store-and-forward protocols are used (e.g.,
protocols are used (e.g., SMTP [RFC5321]), intermediaries leave this SMTP [RFC5321]), intermediaries leave this data subject to
data subject to observation by an attacker that has compromised these observation by an attacker that has compromised these intermediaries,
intermediaries, unless the data is encrypted end-to-end by the unless the data is encrypted end-to-end by the application-layer
application-layer protocol or the implementation uses an encrypted protocol or the implementation uses an encrypted store for this data
store for this data [RFC7624]. [RFC7624].
Impacts: Impacts:
- Right to privacy - Right to privacy
- Right to security - Right to security
3.3.15. Integrity 3.3.15. Integrity
Question(s): Does your protocol maintain, assure and/or verify the Question(s): Does your protocol maintain, assure and/or verify the
skipping to change at page 19, line 9 skipping to change at page 18, line 47
(intentionally or unintentionally) altered. (intentionally or unintentionally) altered.
Example: Integrity verification of data is important to prevent Example: Integrity verification of data is important to prevent
vulnerabilities and attacks, like man-in-the-middle-attacks. These vulnerabilities and attacks, like man-in-the-middle-attacks. These
attacks happen when a third party (often for malicious reasons) attacks happen when a third party (often for malicious reasons)
intercepts a communication between two parties, inserting themselves intercepts a communication between two parties, inserting themselves
in the middle changing the content of the data. In practice this in the middle changing the content of the data. In practice this
looks as follows: looks as follows:
Alice wants to communicate with Bob. Alice wants to communicate with Bob.
Corinne forges and sends a message to Bob, impersonating Alice. Bob Corinne forges and sends a message to Bob, impersonating Alice.
cannot see the data from Alice was altered by Corinne. Bob cannot see the data from Alice was altered by Corinne.
Corinne intercepts and alters the communication as it is sent between Corinne intercepts and alters the communication as it is sent between
Alice and Bob. Alice and Bob.
Corinne is able to control the communication content. Corinne is able to control the communication content.
Impacts: Impacts:
- Right to freedom of expression - Right to freedom of expression
- Right to security - Right to security
3.3.16. Authenticity 3.3.16. Authenticity
Question(s): Do you have sufficient measures to confirm the truth of Question(s): Do you have sufficient measures to confirm the truth of
an attribute of a single piece of data or entity? Can the attributes an attribute of a single piece of data or entity? Can the attributes
get garbled along the way (see security)? If relevant have you get garbled along the way (see security)? If relevant, have you
implemented IPsec, DNSsec, HTTPS and other Standard Security Best implemented IPsec, DNSsec, HTTPS and other Standard Security Best
Practices? Practices?
Explanation: Authenticity ensures that data does indeed come from the Explanation: Authenticity ensures that data does indeed come from the
source it claims to come from. This is important to prevent certain source it claims to come from. This is important to prevent certain
attacks or unauthorized access and use of data. attacks or unauthorized access and use of data.
Example: Authentication of data is important to prevent Example: Authentication of data is important to prevent
vulnerabilities and attacks, like man-in-the-middle-attacks. These vulnerabilities and attacks, like man-in-the-middle-attacks. These
attacks happen when a third party (often for malicious reasons) attacks happen when a third party (often for malicious reasons)
skipping to change at page 20, line 19 skipping to change at page 20, line 9
- Right to privacy - Right to privacy
- Right to freedom of expression - Right to freedom of expression
- Right to security - Right to security
3.3.17. Adaptability 3.3.17. Adaptability
Question(s): Is your protocol written in such a way that is would be Question(s): Is your protocol written in such a way that is would be
easy for other protocols to be developed on top of it, or to interact easy for other protocols to be developed on top of it, or to interact
with it? Does your protocol impact permissionless innovation? See with it? Does your protocol impact permissionless innovation? (See
'Connectivity' above. Connectivity)
Explanation: Adaptability is closely interrelated with permissionless Explanation: Adaptability is closely interrelated with permissionless
innovation, both maintain the freedom and ability to freely create innovation: both maintain the freedom and ability to freely create
and deploy new protocols on top of the communications constructs that and deploy new protocols on top of the communications constructs that
currently exist. It is at the heart of the Internet as we know it, currently exist. It is at the heart of the Internet as we know it,
and to maintain its fundamentally open nature, we need to be mindful and to maintain its fundamentally open nature, we need to be mindful
of the impact of protocols on maintaining or reducing permissionless of the impact of protocols on maintaining or reducing permissionless
innovation to ensure the Internet can continue to develop. innovation to ensure the Internet can continue to develop.
Example: WebRTC generates audio and/or video data. In order to Example: WebRTC generates audio and/or video data. In order to
ensure that WebRTC can be used in different locations by different ensure that WebRTC can be used in different locations by different
parties it is important that standard Javascript APIs are developed parties, it is important that standard Javascript APIs are developed
to support applications from different voice service providers. to support applications from different voice service providers.
Multiple parties will have similar capabilities, in order to ensure Multiple parties will have similar capabilities, in order to ensure
that all parties can build upon existing standards these need to be that all parties can build upon existing standards these need to be
adaptable, and allow for permissionless innovation. adaptable, and allow for permissionless innovation.
Impacts: Impacts:
- Right to education - Right to education
- Freedom of expression - Freedom of expression
- Freedom of assembly and association - Freedom of assembly and association
3.3.18. Outcome Transparency 3.3.18. Outcome Transparency
Question(s): Are the effects of your protocol fully and easily Question(s): Are the effects of your protocol fully and easily
comprehensible, including with respect to unintended consequences of comprehensible, including with respect to unintended consequences of
protocol choices? protocol choices?
Explanation: certain technical choice may have unintended
Explanation: Certain technical choices may have unintended
consequences. consequences.
Example: lack of authenticity may lead to lack of integrity and Example: Lack of authenticity may lead to lack of integrity and
negative externalities, of which spam is an example. Lack of data negative externalities, of which spam is an example. Lack of data
that could be used for billing and accounting can lead to so-called that could be used for billing and accounting can lead to so-called
"free" arrangements which obscure the actual costs and distribution "free" arrangements which obscure the actual costs and distribution
of the costs, for example the barter arrangements that are commonly of the costs, for example the barter arrangements that are commonly
used for Internet interconnection; and the commercial exploitation of used for Internet interconnection; and the commercial exploitation of
personal data for targeted advertising which is the most common personal data for targeted advertising which is the most common
funding model for the so-called "free" services such as search funding model for the so-called "free" services such as search
engines and social networks. engines and social networks. Other unexpected outcomes might not be
technical, but rather architectural, social or economical.
Impacts: - Freedom of expression - Privacy - Freedom of assembly and Impacts: - Freedom of expression - Privacy - Freedom of assembly and
association - Access to information association - Access to information
3.3.19. Anonymity 3.3.19. Anonymity
Example: Often protocols expose personal data, it is important to
consider ways to mitigate the obvious privacy impacts. A protocol
that uses data that could help identify a sender (items of interest)
should be protected from third parties. For instance if one wants to
hide the source/destination IP addresses of a packet, the use of
IPsec in tunneling mode (e.g., inside a virtual private network) can
be helpful to protect from third parties likely to eavesdrop packets
exchanged between the tunnel endpoints.
Question(s): Does you protocol make use of persistent identifiers? Question(s): Does you protocol make use of persistent identifiers?
Can it be done without them? If your protocol collects data and Can it be done without them? Did you have a look at the Privacy
distributes it (see [RFC6235]), you should anonymize the data, but Considerations for Internet Protocols [RFC6973], especially section
keep in mind that "anonymizing" data is notoriously hard. Do not 6.1.1 of that document?
think that just dropping the last byte of an IP address "anonymizes"
data. If your protocol allows for identity management, there should
be a clear barrier between the identities to ensure that they cannot
(easily) be associated with each other. Did you have a look at the
Privacy Considerations for Internet Protocols [RFC6973], especially
section 6.1.1 ?
Explanation: Anonymity refers to the condition of an identity being Explanation: Anonymity refers to the condition of an identity being
unknown or concealed [RFC4949]. Even though full anonymity is hard unknown or concealed [RFC4949]. Even though full anonymity is hard
to achieve, it is a non-binary concept. Making pervasive monitoring to achieve, it is a non-binary concept. Making pervasive monitoring
and tracking harder is important for many users as well as for the and tracking harder is important for many users as well as for the
IETF [RFC7258]. Achieving a higher level of anonymity is an IETF [RFC7258]. Achieving a higher level of anonymity is an
important feature for many end-users, as it allows them different important feature for many end-users, as it allows them different
degrees of privacy online. Anonymity is an inherent part of the degrees of privacy online. Anonymity is an inherent part of the
right to freedom of opinion and expression and the right to privacy. right to freedom of opinion and expression and the right to privacy.
Avoid adding identifiers, options or configurations that create or Avoid adding identifiers, options or configurations that create or
might lead to patterns or regularities that are not explicitely might lead to patterns or regularities that are not explicitly
required by the protocol. required by the protocol.
If your protocol collects data and distributes it (see [RFC6235]),
you should anonymize the data, but keep in mind that "anonymizing"
data is notoriously hard. Do not think that just dropping the last
byte of an IP address "anonymizes" data. If your protocol allows for
identity management, there should be a clear barrier between the
identities to ensure that they cannot (easily) be associated with
each other.
Often protocols expose personal data, it is important to consider
ways to mitigate the obvious privacy impacts. A protocol that uses
data that could help identify a sender (items of interest) should be
protected from third parties. For instance, if one wants to hide the
source/destination IP addresses of a packet, the use of IPsec in
tunneling mode (e.g., inside a virtual private network) can be
helpful to protect from third parties likely to eavesdrop packets
exchanged between the tunnel endpoints.
Example: An example is DHCP where sending a persistent identifier as Example: An example is DHCP where sending a persistent identifier as
the client name was not mandatory but, in practice, done by many the client name was not mandatory but, in practice, done by many
implementations, before [RFC7844]. implementations, before [RFC7844].
Impacts: Impacts:
- Right to non-discrimination - Right to non-discrimination
- Right to political participation - Right to political participation
skipping to change at page 26, line 50 skipping to change at page 26, line 31
[RFC7725] Bray, T., "An HTTP Status Code to Report Legal Obstacles", [RFC7725] Bray, T., "An HTTP Status Code to Report Legal Obstacles",
RFC 7725, DOI 10.17487/RFC7725, February 2016, RFC 7725, DOI 10.17487/RFC7725, February 2016,
<https://www.rfc-editor.org/info/rfc7725>. <https://www.rfc-editor.org/info/rfc7725>.
[RFC7844] Huitema, C., Mrugalski, T., and S. Krishnan, "Anonymity [RFC7844] Huitema, C., Mrugalski, T., and S. Krishnan, "Anonymity
Profiles for DHCP Clients", RFC 7844, Profiles for DHCP Clients", RFC 7844,
DOI 10.17487/RFC7844, May 2016, DOI 10.17487/RFC7844, May 2016,
<https://www.rfc-editor.org/info/rfc7844>. <https://www.rfc-editor.org/info/rfc7844>.
[RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D.,
and P. Hoffman, "Specification for DNS over Transport
Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May
2016, <https://www.rfc-editor.org/info/rfc7858>.
[RFC8280] ten Oever, N. and C. Cath, "Research into Human Rights [RFC8280] ten Oever, N. and C. Cath, "Research into Human Rights
Protocol Considerations", RFC 8280, DOI 10.17487/RFC8280, Protocol Considerations", RFC 8280, DOI 10.17487/RFC8280,
October 2017, <https://www.rfc-editor.org/info/rfc8280>. October 2017, <https://www.rfc-editor.org/info/rfc8280>.
[RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS
(DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018,
<https://www.rfc-editor.org/info/rfc8484>.
[Saltzer] Saltzer, J., Reed, D., and D. Clark, "End-to-End Arguments [Saltzer] Saltzer, J., Reed, D., and D. Clark, "End-to-End Arguments
in System Design", ACM TOCS, Vol 2, Number 4, November in System Design", ACM TOCS, Vol 2, Number 4, November
1984, pp 277-288. , 1984. 1984, pp 277-288. , 1984.
[UDHR] United Nations General Assembly, "The Universal [UDHR] United Nations General Assembly, "The Universal
Declaration of Human Rights", 1948, Declaration of Human Rights", 1948,
<http://www.un.org/en/documents/udhr/>. <http://www.un.org/en/documents/udhr/>.
[UNHRC2016] [UNHRC2016]
United Nations Human Rights Council, "UN Human Rights United Nations Human Rights Council, "UN Human Rights
skipping to change at page 27, line 43 skipping to change at page 27, line 35
Zittrain_Future%20of%20the%20Internet.pdf?sequence=1>. Zittrain_Future%20of%20the%20Internet.pdf?sequence=1>.
9.2. URIs 9.2. URIs
[1] mailto:hrpc@ietf.org [1] mailto:hrpc@ietf.org
[2] https://www.irtf.org/mailman/listinfo/hrpc [2] https://www.irtf.org/mailman/listinfo/hrpc
[3] https://www.irtf.org/mail-archive/web/hrpc/current/index.html [3] https://www.irtf.org/mail-archive/web/hrpc/current/index.html
Author's Address Authors' Addresses
Niels ten Oever Niels ten Oever
University of Amsterdam University of Amsterdam
EMail: mail@nielstenoever.net EMail: mail@nielstenoever.net
Gurshabad Grover
Centre for Internet and Society
EMail: gurshabad@cis-india.org
 End of changes. 70 change blocks. 
167 lines changed or deleted 178 lines changed or added

This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/