authority. A person whose communications are monitored may be prevented from exercising their right to freedom of association or participation in political processes [Penney]. In a worst-case scenario, protocols that leak information can lead to physical danger. A realistic example to consider is when, based on information gathered by state agencies through information leakage in protocols, individuals perceived as threats to the state are subjected to torture, extrajudicial killings, or detention. This section details several "common" threats to human rights, indicating how each of these can lead to harm to, or violations of, human rights. It also presents several examples of how these threats to human rights materialize on the Internet. This threat modeling is inspired by [RFC6973] ("Privacy Considerations for Internet Protocols"), which is based on security threat analysis. This method is by no means a perfect solution for assessing human rights risks in Internet protocols and systems; it is, however, the best approach currently available. Certain specific human rights threats are indirectly considered in Internet protocols as part of their security considerations [BCP72], but privacy guidelines [RFC6973] or reviews, let alone the assessments of the impact of protocols on human rights, are not standardized or implemented. Many threats, enablers, and risks are linked to different rights. This is not surprising if one takes into account that human rights are interrelated, interdependent, and indivisible. Here, however, we're not discussing all human rights, because not all human rights are relevant to ICTs in general and to protocols and standards in particular [Bless1]: The main source of the values of human rights is the International Bill of Human Rights that is composed of the Universal Declaration of Human Rights [UDHR] along with the International Covenant on Civil and Political Rights [ICCPR] and the International Covenant on Economic, Social and Cultural Rights [ICESCR]. In the light of several cases of Internet censorship, the Human Rights Council Resolution 20/8 was adopted in 2012 [UNHRC2016], affirming "... that the same rights that people have offline must also be protected online ..." In 2015, the Charter of Human Rights and Principles for the Internet [IRP] was developed and released. According to these documents, some examples of human rights relevant for ICT systems are human dignity (Art. 1 UDHR), non-discrimination (Art. 2), rights to life, liberty and security (Art. 3), freedom of opinion and expression (Art. 19), freedom of assembly and association (Art. 20), rights to equal protection, legal remedy, fair trial, due process, presumed innocent (Art. 7-11), appropriate social and international order (Art. 28),
participation in public affairs (Art. 21), participation in cultural life, protection of intellectual property (Art. 27), and privacy (Art. 12). A partial catalog of human rights related to ICTs, including economic rights, can be found in [Hill2014]. This is by no means an attempt to exclude specific rights or prioritize some rights over others. If other rights seem relevant, please contact the authors of this document. RFC4101]. These guidelines do not seek to replace any existing referenced specifications; rather, they contribute to them and look at the design process from a human rights perspective. Protocols and Internet Standards might benefit from a documented discussion of potential human rights risks arising from potential misapplications of the protocol or technology described in the RFC in question. This might be coupled with an Applicability Statement for that RFC. Note that the guidance provided in this section does not recommend specific practices. The range of protocols developed in the IETF is too broad to make recommendations about particular uses of data or how human rights might be balanced against other design goals. However, by carefully considering the answers to the following questions, document authors should be able to produce a comprehensive analysis that can serve as the basis for discussion on whether the protocol adequately takes specific human rights threats into account. This guidance is meant to help the thought process of a human rights analysis; it does not provide specific directions for how to write a human rights protocol considerations section (following the example set in [RFC6973]), and the addition of a human rights protocol considerations section has also not yet been proposed. In considering these questions, authors will need to be aware of the potential of technical advances or the passage of time to undermine protections. In general, considerations of rights are likely to be more effective if they are considered given a purpose and specific use cases, rather than as abstract absolute goals.
Saltzer] holds that "the intelligence is end to end rather than hidden in the network" [RFC1958]. The end-to-end principle is important for the robustness of the network and innovation. Such robustness of the network is crucial to enabling human rights like freedom of expression. Example: Middleboxes (which can be content delivery networks, firewalls, NATs, or other intermediary nodes that provide "services" other than routing) serve many legitimate purposes. But the protocols guiding them can influence individuals' ability to communicate online freely and privately. The potential for abuse, intentional and unintentional censoring, and limiting permissionless innovation -- and thus, ultimately, the impact of middleboxes on the Internet as a place of unfiltered, unmonitored freedom of speech -- is real. Impacts: - Right to freedom of expression - Right to freedom of assembly and association Section 7 of [RFC6973] ("Privacy Considerations for Internet Protocols")? - Could your protocol in any way impact the confidentiality of protocol metadata?
- Could your protocol counter traffic analysis? - Could your protocol improve data minimization? - Does your document identify potentially sensitive data logged by your protocol and/or for how long that data needs to be retained for technical reasons? Explanation: "Privacy" refers to the right of an entity (normally a person), acting on its own behalf, to determine the degree to which it will interact with its environment, including the degree to which the entity is willing to share its personal information with others [RFC4949]. If a protocol provides insufficient privacy protection, it may have a negative impact on freedom of expression as users self-censor for fear of surveillance or find themselves unable to express themselves freely. Example: See [RFC6973]. Impacts: - Right to freedom of expression - Right to non-discrimination
Example: Content agnosticism prevents payload-based discrimination against packets. This is important because changes to this principle can lead to a two-tiered Internet, where certain packets are prioritized over others based on their content. Effectively, this would mean that although all users are entitled to receive their packets at a certain speed, some users become more equal than others. Impacts: - Right to freedom of expression - Right to non-discrimination - Right to equal protection BCP72] ("Guidelines for Writing RFC Text on Security Considerations")? - Have you found any attacks that are somewhat related to your protocol yet considered out of scope for your document? - Would these attacks be pertinent to the features of the Internet that enable human rights (as described throughout this document)? Explanation: Most people speak of security as if it were a single monolithic property of a protocol or system; however, upon reflection one realizes that it is clearly not true. Rather, security is a series of related but somewhat independent properties. Not all of these properties are required for every application. Since communications are carried out by systems and access to systems is through communications channels, these goals obviously interlock, but they can also be independently provided [BCP72]. Example: See [BCP72].
Impacts: - Right to freedom of expression - Right to freedom of assembly and association - Right to non-discrimination - Right to security RFC6365]? Explanation: "Internationalization" refers to the practice of making protocols, standards, and implementations usable in different languages and scripts (see Section 6.2.12 ("Localization")). "In the IETF, 'internationalization' means to add or improve the handling of non-ASCII text in a protocol" [RFC6365]. A different perspective, more appropriate to protocols that are designed for global use from the beginning, is the definition used by the W3C [W3Ci18nDef]: "Internationalization is the design and development of a product, application or document content that enables easy localization for target audiences that vary in culture, region, or language." Many protocols that handle text only handle one charset (US-ASCII), or they leave the question of what coded character set (CCS) and encoding are used up to local guesswork (which leads, of course, to interoperability problems) [RFC3536]. If multiple charsets are permitted, they must be explicitly identified [RFC2277]. Adding non-ASCII text to a protocol allows the protocol to handle more scripts, hopefully all scripts in use in the world. In today's world, that is normally best accomplished by allowing Unicode encoded in UTF-8 only.
In the current IETF policy [RFC2277], internationalization is aimed at user-facing strings, not protocol elements, such as the verbs used by some text-based protocols. (Do note that some strings, such as identifiers, are both content and protocol elements.) If the Internet wants to be a global network of networks, the protocols should work with languages other than English and character sets other than Latin characters. It is therefore crucial that at least the content carried by the protocol can be in any script and that all scripts are treated equally. Example: See Section 6.2.12 ("Localization"). Impacts: - Right to freedom of expression - Right to political participation - Right to participate in cultural life, arts, and science RFC4941], for "eavesdroppers and other information collectors to identify when different addresses used in different transactions actually correspond to the same node." This is why privacy extensions for stateless address autoconfiguration in IPv6 [RFC4941] have been introduced.
Identifiers of content exposed within a protocol might be used to facilitate censorship, as in the case of application-layer-based censorship, which affects protocols like HTTP. Denial or restriction of access can be made apparent by the use of status code 451, thereby allowing server operators to operate with greater transparency in circumstances where issues of law or public policy affect their operation [RFC7725]. Impacts: - Right to freedom of expression - Right to political participation - Right to participate in cultural life, arts, and science - Right to freedom of assembly and association RFC2026]? - Do you normatively reference another standard that is not available without cost (and could you possibly do without it)? - Are you aware of any patents that would prevent your standard from being fully implemented [RFC6701] [RFC8179]? Explanation: The Internet was able to be developed into the global network of networks because of the existence of open, non-proprietary standards [Zittrain]. They are crucial for enabling interoperability. Yet, open standards are not explicitly defined within the IETF. On the subject, [RFC2026] states the following: "Various national and international standards bodies, such as ANSI, ISO, IEEE, and ITU-T, develop a variety of protocol and service specifications that are similar to Technical
Specifications defined" at the IETF. "National and international groups also publish 'implementors' agreements' that are analogous to Applicability Statements, capturing a body of implementation- specific detail concerned with the practical application of their standards. All of these are considered to be 'open external standards' for the purposes of the Internet Standards Process." Similarly, [RFC3935] does not define open standards but does emphasize the importance of "open process": any interested person can participate in the work, know what is being decided, and make his or her voice heard on the issue. Part of this principle is the IETF's commitment to making its documents, WG mailing lists, attendance lists, and meeting minutes publicly available on the Internet. Open standards are important, as they allow for permissionless innovation, which in turn is important for maintaining the freedom and ability to freely create and deploy new protocols on top of the communications constructs that currently exist. It is at the heart of the Internet as we know it, and to maintain its fundamentally open nature, we need to be mindful of the need for developing open standards. All standards that need to be normatively implemented should be freely available and should provide reasonable protection against patent infringement claims, so that it can also be implemented in open-source or free software. Patents have often held back open standardization or have been used against those deploying open standards, particularly in the domain of cryptography [Newegg]. An exemption is sometimes made when a protocol that normatively relies on specifications produced by other SDOs that are not freely available is standardized. Patents in open standards or in normative references to other standards should have a patent disclosure [notewell], royalty-free licensing [patentpolicy], or some other form of reasonable protection. Reasonable patent protection should include, but is not limited to, cryptographic primitives. Example: [RFC6108] describes a system deployed by Comcast, an ISP, for providing critical end-user notifications to web browsers. Such a notification system is being used to provide almost-immediate notifications to customers, such as warning them that their traffic exhibits patterns that are indicative of malware or virus infection. There are other proprietary systems that can perform such notifications, but those systems utilize Deep Packet Inspection (DPI) technology. In contrast to DPI, [RFC6108] describes a system that does not rely upon DPI and is instead based on open IETF standards and open-source applications.
Impacts: - Right to freedom of expression - Right to participate in cultural life, arts, and science FIArch] notes the following: "The Internet is characterized by heterogeneity on many levels: devices and nodes, router scheduling algorithms and queue management mechanisms, routing protocols, levels of multiplexing, protocol versions and implementations, underlying link layers (e.g., point-to-point, multi-access links, wireless, FDDI, etc.), in the traffic mix and in the levels of congestion at different times and places. Moreover, as the Internet is composed of autonomous organizations and internet service providers, each with their own separate policy concerns, there is a large heterogeneity of administrative domains and pricing structures." As a result, as also noted in [FIArch], the heterogeneity principle proposed in [RFC1958] needs to be supported by design. Example: Heterogeneity is inevitable and needs to be supported by design. For example, multiple types of hardware must be allowed for transmission speeds differing by at least seven orders of magnitude, various computer word lengths, and hosts ranging from memory-starved microprocessors up to massively parallel supercomputers. As noted in [RFC1958], "Multiple types of application protocol must be allowed for, ranging from the simplest such as remote login up to the most complex such as distributed databases."
Impacts: - Right to freedom of expression - Right to political participation RFC6973] ("Privacy Considerations for Internet Protocols"), especially Section 6.1.1 of that document? Explanation: "Anonymity" refers to the condition of an identity being unknown or concealed [RFC4949]. Even though full anonymity is hard to achieve, it is a non-binary concept. Making pervasive monitoring and tracking harder is important for many users as well as for the IETF [RFC7258]. Achieving a higher level of anonymity is an important feature for many end users, as it allows them different degrees of privacy online. Example: Protocols often expose personal data; it is therefore important to consider ways to mitigate the obvious impacts on privacy. A protocol that uses data that could help identify a sender (items of interest) should be protected from third parties. For instance, if one wants to hide the source/destination IP addresses of a packet, the use of IPsec in tunneling mode (e.g., inside a VPN) can help protect against third parties likely to eavesdrop packets exchanged between the tunnel endpoints. Impacts: - Right to non-discrimination - Right to political participation - Right to freedom of assembly and association - Right to security RFC6973] ("Privacy Considerations for Internet Protocols"), especially Section 6.1.2 of that document? - Does the protocol collect personally derived data?
- Does the protocol generate or process anything that can be, or that can be tightly correlated with, personally identifiable information? - Does the protocol utilize data that is personally derived, i.e., derived from the interaction of a single person or from their device or address? - Does this protocol generate personally derived data? If so, how will that data be handled? Explanation: Pseudonymity -- the ability to use a persistent identifier that is not immediately linked to one's offline identity -- is an important feature for many end users, as it allows them different degrees of disguised identity and privacy online. Example: When designing a standard that exposes personal data, it is important to consider ways to mitigate the obvious impacts. While pseudonyms cannot easily be reverse-engineered -- for example, some early approaches used such techniques as simple hashing of IP addresses that could in turn be easily reversed by generating a hash for each potential IP address and comparing it to the pseudonym -- limiting the exposure of personal data remains important. "Pseudonymity" means using a pseudonym instead of one's "real" name. There are many reasons for users to use pseudonyms -- for instance, to hide their gender; protect themselves against harassment; protect their families' privacy; frankly discuss sexuality; or develop an artistic or journalistic persona without retribution from an employer, (potential) customers, or social surroundings [geekfeminism]. The difference between anonymity and pseudonymity is that a pseudonym is often persistent. "Pseudonymity is strengthened when less personal data can be linked to the pseudonym; when the same pseudonym is used less often and across fewer contexts; and when independently chosen pseudonyms are more frequently used for new actions (making them, from an observer's or attacker's perspective, unlinkable)." [RFC6973] Impacts: - Right to non-discrimination - Right to freedom of assembly and association
W3CAccessibility] for examples and guidance? Explanation: The Internet is fundamentally designed to work for all people, whatever their hardware, software, language, culture, location, or physical or mental ability. When the Internet meets this goal, it is accessible to people with a diverse range of hearing, movement, sight, and cognitive abilities [W3CAccessibility]. Sometimes, in the design of protocols, websites, web technologies, or web tools, barriers that exclude people from using the Web are created. Example: The HTML protocol as defined in [HTML5] specifically requires that (with a few exceptions) every image must have an "alt" attribute to ensure that images are accessible for people that cannot themselves decipher non-text content in web pages. Impacts: - Right to non-discrimination - Right to freedom of assembly and association - Right to education - Right to political participation W3Ci18nDef], "Localization refers to the adaptation of a product, application or document content to meet the language, cultural and other requirements of a specific target market (a 'locale')." It is also described as the practice of
translating an implementation to make it functional in a specific language or for users in a specific locale (see Section 6.2.5 ("Internationalization")). Example: The Internet is a global medium, but many of its protocols and products are developed with a certain audience in mind; this audience often shares particular characteristics like knowing how to read and write in ASCII and knowing English. This limits the ability of a large part of the world's online population to use the Internet in a way that is culturally and linguistically accessible. An example of a protocol that has taken into account the view that individuals like to have access to data in their native language can be found in [RFC5646]; such a protocol would label the information content with an identifier for the language in which it is written and would allow information to be presented in more than one language. Impacts: - Right to non-discrimination - Right to participate in cultural life, arts, and science - Right to freedom of expression RFC3935]. It refers to the absence or minimization of centralized points of control -- "a feature that is assumed to
make it easy for new users to join and new uses to unfold" [Brown]. It also reduces issues surrounding single points of failure and distributes the network such that it continues to function if one or several nodes are disabled. With the commercialization of the Internet in the early 1990s, there has been a slow trend toward moving away from decentralization, to the detriment of any technical benefits that having a decentralized Internet otherwise provides. Example: The bits traveling the Internet are increasingly susceptible to monitoring and censorship, from both governments and ISPs, as well as third (malicious) parties. The ability to monitor and censor is further enabled by increased centralization of the network, creating central infrastructure points that can be tapped into. The creation of P2P networks and the development of voice-over-IP protocols using P2P technology in combination with a distributed hash table (DHT) for scalability are examples of how protocols can preserve decentralization [Pouwelse]. Impacts: - Right to freedom of expression - Right to freedom of assembly and association
gracefully and, if applicable, to allow for partial healing. It is important here to draw a distinction between random degradation and malicious degradation. Many current attacks against TLS, for example, exploit TLS's ability to gracefully degrade to older cipher suites; from a functional perspective, this ability is good, but from a security perspective, it can be very bad. As with confidentiality, the growth of the Internet and fostering innovation in services depend on users having confidence and trust [RFC3724] in the network. For reliability, it is necessary that services notify users if packet delivery fails. In the case of real-time systems, the protocol needs to safeguard timeliness in addition to providing reliable delivery. Example: In the modern IP stack structure, a reliable transport layer requires an indication that transport processing has successfully completed, such as the indication given by TCP's ACK message [RFC793] and not simply an indication from the IP layer that the packet arrived. Similarly, an application-layer protocol may require an application-specific acknowledgement that contains, among other things, a status code indicating the disposition of the request (see [RFC3724]). Impacts: - Right to freedom of expression - Right to security RFC6973]? - What options exist for protocol implementers to choose to limit the information shared with each entity? - What operational controls are available to limit the information shared with each entity? - What controls or consent mechanisms does the protocol define or require before personal data or identifiers are shared or exposed via the protocol? If no such mechanisms or controls are specified, is it expected that control and consent will be handled outside of the protocol?
- Does the protocol provide ways for initiators to share different pieces of information with different recipients? If not, are there mechanisms that exist outside of the protocol to provide initiators with such control? - Does the protocol provide ways for initiators to limit which information is shared with intermediaries? If not, are there mechanisms that exist outside of the protocol to provide users with such control? - Is it expected that users will have relationships that govern the use of the information (contractual or otherwise) with those who operate these intermediaries? - Does the protocol prefer encryption over cleartext operation? - Does the protocol provide ways for initiators to express individuals' preferences to recipients or intermediaries with regard to the collection, use, or disclosure of their personal data? Explanation: "Confidentiality" refers to keeping a user's data secret from unintended listeners [BCP72]. The growth of the Internet depends on users having confidence that the network protects their personal data [RFC1984]. Example: Protocols that do not encrypt their payload make the entire content of the communication available to the idealized attacker along their path [RFC7624]. Following the advice in [RFC3365], most such protocols have a secure variant that encrypts the payload for confidentiality, and these secure variants are seeing ever-wider deployment. A noteworthy exception is DNS [RFC1035], as DNSSEC [RFC4033] does not have confidentiality as a requirement. This implies that, in the absence of changes to the protocol as presently under development in the IETF's DNS Private Exchange (DPRIVE) Working Group, all DNS queries and answers generated by the activities of any protocol are available to the attacker. When store-and-forward protocols are used (e.g., SMTP [RFC5321]), intermediaries leave this data subject to observation by an attacker that has compromised these intermediaries, unless the data is encrypted end to end by the application-layer protocol or the implementation uses an encrypted store for this data [RFC7624].
Impacts: - Right to privacy - Right to security
Section 6.2.4 ("Security"))? - If relevant, have you implemented IPsec, DNSSEC, HTTPS, and other standard security best practices? Explanation: Authenticity ensures that data does indeed come from the source it claims to come from. This is important for preventing (1) certain attacks or (2) unauthorized access to, and use of, data. Example: Authentication of data is important for preventing vulnerabilities and attacks such as man-in-the-middle attacks. These attacks happen when a third party (often for malicious reasons) intercepts a communication between two parties, inserting themselves in the middle and posing as both parties. In practice, this looks as follows: Alice wants to communicate with Bob. Alice sends data to Bob. Corinne intercepts the data sent to Bob. Corinne reads and alters the message to Bob. Bob cannot see that the data did not come from Alice but instead came from Corinne. When there is proper authentication, the scenario would be as follows: Alice wants to communicate with Bob. Alice sends data to Bob. Corinne intercepts the data sent to Bob. Corinne reads and alters the message to Bob. Bob can see that the data did not come from Alice but instead came from Corinne.