Subject: @EXT: RE: United Nations report on Internet standards

From: "Marcolla, Sara Veronica" <[email-masked]>
Date: Fri, 27 Mar 2020 21:47:31 +0000

-----Original Message-----
From: ietf <[email-masked]> On Behalf Of Brian E Carpenter

<snip>

The singularity of the IETF is that there is no "representation"
since all participants contribute as individuals. This is something that I guarantee we have been trying to convey to government and international officials since 1994 to my personal knowledge and probably longer. While I was IAB chair (1995-2000) I spent quite a lot of time doing that, since liaisons are an IAB responsibility.

Such officials have genuine difficulty in understanding this concept, until they actually attend a few meetings.
 <snip>

The issue is, when government representative participate to IETF (or a RIR, or ICANN, or a NOG), they do so in their official capacity, thus representing to some extent their organisation. They (we) do understand the concept, however it is impossible to attend without this sort of "official" hat. So on one hand there is Joe-as-himself, and on the other hand there in Alice-as-a-whole-government-rep. How do we make this work better for everyone's benefit in IETF?

Kind regards,

Sara Marcolla

Europol - O3 European Cyber Crime Centre (EC3)
www.europol.europa.eu

*******************

DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it.
Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated.

*******************

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 28 Mar 2020 11:24:18 +1300

Hello Sara,
On 28-Mar-20 10:47, Marcolla, Sara Veronica wrote:
> The issue is, when government representative participate to IETF (or a RIR, or ICANN, or a NOG), they do so in their official capacity, thus representing to some extent their organisation. 

But that isn't so different from employees of companies. When I attended the IETF as a CERN (as an international civil servant), IBM, or University of Auckland employee, that's what it said on my badge and it was an official work trip following my employer's travel policy, expense rules, etc. But I knew that my contributions were treated only as personal contributions. We all live in the real world and know that a person's contributions are strongly influenced by their day job. And a perfectly valid contribution is to inform the community that Europol has issued policy statement X or that IBM has concluded that it won't implement RFC Y.

> They (we) do understand the concept, however it is impossible to attend without this sort of "official" hat. So on one hand there is Joe-as-himself, and on the other hand there in Alice-as-a-whole-government-rep. How do we make this work better for everyone's benefit in IETF?

Alice could say "The Elbonian government has mandated wire-tapping of all Internet traffic entering or leaving Elbonia." But that doesn't count more than Joe saying "Wire-tapping damages end to end security for the following reasons:..." Actually that's pretty much what happened before RFC 2804.

Footnote: When I was in the IAB, ISOC Board and IESG, I made sure that I had formal agreement from my employer that I was *not* formally representing them. In the limit, any official could take this approach even for general participation.

Stay well,
   Brian

---

From: Keith Moore <[email-masked]>
Date: Fri, 27 Mar 2020 18:30:16 -0400

> The issue is, when government representative participate to IETF (or a RIR, or ICANN, or a NOG), they do so in their official capacity, thus representing to some extent their organisation. They (we…

In all cases the burden is on the contributor to build rough consensus 
for their proposal and they do so not by wielding power but by making a 
sound case that their proposal benefits the Internet as a whole.   
Perhaps some people cannot help "wearing a hat".   But the hat isn't 
going to have much persuasive power and may be a liability.

Keith

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 27 Mar 2020 23:34:39 +0100

I think the problem is that many government employees are never authorized to speak at all, or to speak even if they state that's their personal view or only allowed to state the "official" position from their organization.

This is also tied to my experience in some other foras (not so much in IETF), for example when presenting policy proposals in the RIRs, where not all the participants can't understand situations like:

1) I may be presenting a proposal, clearly saying that I "personally" don't agree with that, however, I'm defending the proposal because is the right thing for the community.

2) A policy co-chair, staff, etc., which are also a members of the community, should be able to say "hat off" and the rest of the participants understand that and not misinterpret that as a "hat on" input and not being "influenced" by that.

Regards,
Jordi
@jordipalet

El 27/3/20 23:25, "ietf en nombre de Brian E Carpenter" <[email-masked] en nombre de [email-masked]> escribió:

    Hello Sara,

    

    Stay well,
       Brian

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

---

From: "John Levine" <[email-masked]>
Date: 28 Mar 2020 00:01:17 -0400

In article <[email-masked]> you write:
>The issue is, when government representative participate to IETF (or a RIR, or ICANN, or a NOG), they do
>so in their official capacity, thus representing to some extent their organisation. They (we) do
>understand the concept, however it is impossible to attend without this sort of "official" hat. So on one
>hand there is Joe-as-himself, and on the other hand there in Alice-as-a-whole-government-rep. How do we
>make this work better for everyone's benefit in IETF?

When Alice heads for the conference she may be a government rep, but
when she arrives and gets her badge, she's Alice who happens to work
for the Ministry of whatever.  Lots of people from governments come to
IETF meetings and work this way.  Just this afternoon we had a very
interesting discussion in the security displatch group in which
someone who works for the UK government presented a draft she had
co-written, people made comments and figured out how it could progress
in relation with other IETF work.

This is only a problem if you think it is.  We know it's not an inherent
problem since people from many governments have productively worked with
the IETF for a long time.

R's,
John

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 28 Mar 2020 11:10:55 +0100

On Fri, Mar 27, 2020 at 11:34:39PM +0100,
 JORDI PALET MARTINEZ <jordi.palet=[email-masked]> wrote 
 a message of 99 lines which said:

> I think the problem is that many government employees are never
> authorized to speak at all, or to speak even if they state that's
> their personal view or only allowed to state the "official" position
> from their organization.

Indeed, that's one of the points where the report is so
unrealistic. Government representatives have a script, they cannot
deviate from it, they have to get permission from several managers
above them just to give an opinion about the weather. This is
difficult to deal with.

---

From: "Marcolla, Sara Veronica" <[email-masked]>
Date: Mon, 30 Mar 2020 07:57:18 +0000

I do understand it. However, in many cases, when the one and only governmental representative on a list/working group etc agrees/disagrees on a position, paper or policy, he or she does not so in personal capacity. He or she is representing hundreds of stakeholders "behind", who entrusted this specific individual to follow up and engage on behalf - often - of entire governments. That is, hundreds of people, or even hundreds of governmental agencies. 

This vote, however, gets counted as one, as the one of any Joe or Alice. This is the big issue of participation,  with regards to government engagement in a multistakeholder environment. Often administrations do not find a good investment to make sure an individual is delegated to do so (with all internal coordination efforts, in some case at national level, in other even at international level), just to have one voice diluted so much.

Kind regards,

Sara Marcolla

-----Original Message-----
From: ietf <[email-masked]> On Behalf Of Keith Moore
Sent: 27 March 2020 23:30
To: [email-masked]
Subject: Re: @EXT: RE: United Nations report on Internet standards

> The issue is, when government representative participate to IETF (or a RIR, or ICANN, or a NOG), they do so in their official capacity, thus representing to some extent their organisation. They (we…

In all cases the burden is on the contributor to build rough consensus for their proposal and they do so not by wielding power but by making a sound case that their proposal benefits the Internet as a whole. Perhaps some people cannot help "wearing a hat".   But the hat isn't going to have much persuasive power and may be a liability.

Keith

*******************

*******************

---

From: Keith Moore <[email-masked]>
Date: Mon, 30 Mar 2020 04:13:13 -0400

> I do understand it. However, in many cases, when the one and only governmental representative on a list/working group etc agrees/disagrees on a position, paper or policy, he or she does not so in p…

But this is completely contrary to IETF expectations, which are that 
each individual participant represents his or her own best technical 
judgment.   IETF does not recognize "governmental representatives", (nor 
representatives of anyone else) and this is an explicit feature.   [*]

> This vote, however, gets counted as one, as the one of any Joe or Alice.

IETF doesn't vote; it attempts to build consensus.   So a good proposal 
which has a good justification, even if initially supported by only a 
single individual, can carry much more weight than one vote.   And 
ideally a proposal is judged on its merits; it shouldn't matter where 
that proposal comes from.   At the same time a proposal with poor 
justification and/or one which seems to be harmful, will hopefully fail 
no matter how big the organization or government that sponsors the 
individual who argues for it.

> This is the big issue of participation,  with regards to government engagement in a multistakeholder environment. Often administrations do not find a good investment to make sure an individual is delegated to do so (with all internal coordination efforts, in some case at national level, in other even at international level), just to have one voice diluted so much.

Having that one voice diluted so much is a feature, not a bug. If on the 
other hand, there really is justification for a proposal, a government 
is welcome to send one or more people to try to build consensus around it.

There are plenty of other organizations in which governments can try to 
use their political clout or other means to promote their ideas, for all 
the good it might do.

Keith

[*] And in many cases I personally doubt that this specific individual 
is really representing the stakeholders (or even the interests of the 
stakeholders) - who after all, are not the governments, or the 
governmental agencies, but the citizens of the world.

---

From: "Marcolla, Sara Veronica" <[email-masked]>
Date: Mon, 30 Mar 2020 08:33:14 +0000

-----Original Message-----
From: Keith Moore <[email-masked]> 
Sent: 30 March 2020 10:13
To: Marcolla, Sara Veronica <[email-masked]>; [email-masked]' <[email-masked]>
Subject: Re: @EXT: RE: United Nations report on Internet standards

<snip> 

> This vote, however, gets counted as one, as the one of any Joe or Alice.

IETF doesn't vote; it attempts to build consensus.   So a good proposal which has a good justification, even if initially supported by only a single individual, can carry much more weight than one vote.   And ideally a proposal is judged on its merits; it shouldn't matter where that proposal comes from.   At the same time a proposal with poor justification and/or one which seems to be harmful, will hopefully fail no matter how big the organization or government that sponsors the individual who argues for it.

Keith

<snip> 

I did indeed meant voice, not vote. 

On the other hand, I believe that a broad engagement such as IETF could encompass governments as well - the ISOC policy program was an excellent example of this, and if I have engaged with IETF (reading and digesting dozens of mailing lists and RFCs) is because I got educated in the ways of IETF. A more active participation would be indeed better, of course. Baby steps.

Kind regards,

Sara Marcolla

*******************

*******************

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 30 Mar 2020 15:45:06 +0200 (CEST)

> Il 27/03/2020 23:30 Keith Moore <[email-masked]> ha scritto:
> 

I think that one key problem of this discussion is that we are lumping together two very different things.

One thing is developing technical standards. In that case, there might be alternatives and even conflicting business interests, but it is still possible to come to an agreement on what "benefits the Internet as a whole". So the consensus method, among individuals that merge their brains to share ideas and make the best possible assessment, can work.

Another thing is choosing between different policies. In that case, there is conceptually no choice that "benefits the Internet as a whole"; almost always, there will only be choices that benefit some people and disadvantage others, or, if you prefer, that benefit the Internet according to some people's concept of what is best for the Internet, but damage the Internet according to some other people's concept. 

In that case, the consensus method will often fail, because there is no possible consensus to be reached. You can only define formal ways to let people express their views, promote a compromise if possible, but in the end pick one view over the other.

That's nothing new; that's how policy-making works, including in general government and politics. There are ~2500 years of philosophical and practical thought on how to deal with that, which led to modern democratic governments, which are based on formalized entities (parties) that represent a weighed set of citizens, and then to the critique of the effectiveness of democratic governments in making the best possible choice, which evolved towards an attempt to bridge the consensus method with the principle of representation - that is, the so-called multistakeholderism that many of us specified 15-20 years ago in Internet policy venues.

No one outside the IETF has problems with the IETF using its own traditional method to make technical choices. However, the concerns arise when the IETF makes policy choices that are de facto binding for the whole Internet. For example, privileging encryption over security is a policy choice. Designing technologies to circumvent national and personal content control points is a policy choice. IETF participants seem to oscillate between claiming that these are objectively good policy choices (as if an "objectively good" policy choice could ever exist) and claiming that these are in fact technical choices (but they are not).

Non-technical stakeholders react late to these choices, because they only realize they have been made when the Internet companies embed them in their ubiquitous products. Nonetheless, many of them - not just governments; see how many digital rights NGOs exist and deal with Internet issues - feel like these choices should be made according to common policy-making principles, not to common technical standardization principles.

Personally, I agree that there's a problem but I have no clear idea yet of how to deal with it. Of course I wouldn't want to have governments dictate what standards should do, but I don't think anyone is asking for that - not even governments, except maybe a few non-Western ones. But I also think that it is not fair that these choices are made almost only by first world engineers, mostly male, white, middle-aged and company-backed like me, without even listening to what others have to say, because there is not an established way to gather that input reliably and effectively. How to address this is IMHO a discussion worth having.

-- 
 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Keith Moore <[email-masked]>
Date: Mon, 30 Mar 2020 10:07:40 -0400

On 3/30/20 9:45 AM, Vittorio Bertola wrote:

> For example, privileging encryption over security is a policy choice.

That's a false dichotomy.   Security is not enhanced, but weakened, by 
giving governments back-door access, and there is plenty of technical 
justification for that.

Keith

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 30 Mar 2020 15:15:32 +0100

On 30/03/2020 15:07, Keith Moore wrote:
> That's a false dichotomy.

It's worse IMO - it's simply incorrect.

Over-simplifying complex things in ways that are
that inaccurate is not part of a useful discussion.

S.

> Â Â  Security is not enhanced, but weakened, by

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Mon, 30 Mar 2020 16:29:48 +0200

Hi Vittorio,

I'm not sure if you participate in the RIRs policy making process. I'm author of about 100 (just a guess, but probably not too much wrong) policy proposals among all the 5 RIRs. I never did the stats, but probably 85-95% of them reached consensus. It takes time, it means conceding a lot, even sometimes acting against your own personal views, just to make sure that the proposal reaches a point that is the best for all. Sometimes, this means having a policy that is only half way of what it is the best, and after some time doing some changes again.

It works! the same as in IETF.

Democracy *today* is a crap, of course, better than dictatorial regimes. However, in today's Internet world it should be possible that we have a more active participation in most of the government's decisions, but of course, this is not good for the powerful. I wish all the governments and politicians can learn about the consensus making process that we have in RIRs and IETF.

Regards,
Jordi
@jordipalet

El 30/3/20 15:46, "ietf en nombre de Vittorio Bertola" <[email-masked] en nombre de vittorio.bertola=[email-masked]> escribió:

    > > The issue is, when government representative participate to IETF (or a RIR, or ICANN, or a NOG), they do so in their official capacity, thus representing to some extent their organisation. They (we) do understand the concept, however it is impossible to attend without this sort of "official" hat.. So on one hand there is Joe-as-himself, and on the other hand there in Alice-as-a-whole-government-rep. How do we make this work better for everyone's benefit in IETF?
    > 

    

    

    
    --

---

From: Michael Richardson <[email-masked]>
Date: Mon, 30 Mar 2020 11:48:36 -0400

Marcolla, Sara Veronica <[email-masked]> wrote:
    > I do understand it. However, in many cases, when the one and only
    > governmental representative on a list/working group etc
    > agrees/disagrees on a position, paper or policy, he or she does not so
    > in personal capacity. He or she is representing hundreds of
    > stakeholders "behind", who entrusted this specific individual to follow
    > up and engage on behalf - often - of entire governments. That is,
    > hundreds of people, or even hundreds of governmental agencies.

    > This vote, however, gets counted as one, as the one of any Joe or
    > Alice. This is the big issue of participation,  with regards to
    > government engagement in a multistakeholder environment. Often
    > administrations do not find a good investment to make sure an
    > individual is delegated to do so (with all internal coordination
    > efforts, in some case at national level, in other even at international
    > level), just to have one voice diluted so much.

It seems that this calls for a liason statement, then.

---

Meanwhile, "Alice" might be a world-renown cryptographer, and "Joe" might
operate the world largest ISP (for some definition of "largest").

While none of the expertise of those "stakeholders" may even be relevant,
or they could be nobel laureates. But to the point, we didn't get a chance to
find out, and rather like the "First-Past-The-Point" electoral systems,
are you also delivering a minority report from the stakeholders?

Given that email participation is free, and remote attendance is also free,
my advice is simple:
   Stack the meeting.  Please.
   Send 100 review comments.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: "tom petch" <[email-masked]>
Date: Mon, 30 Mar 2020 17:34:59 +0100

----- Original Message -----
From: Michael Richardson [email-masked]
Sent: 30/03/2020 16:48:36
Subject: Re: @EXT: RE: United Nations report on Internet standards

<tp>
Yes, just what I was about to say.  The ICAO want an RFC, they have got it written and have sent a liaison asking that it be progressed.  I can clearly see that this I-D is not just an individual effort, that there is the ICAO behind it and that will colour my thinking as I review it and I do not see that as a compromise of the IETF processes.

The IETF gets liaisons from many organisations and I think that the process works well.

Tom Petch

---
New Outlook Express and Windows Live Mail replacement - get it here:
https://www.oeclassic.com/

---

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 31 Mar 2020 09:05:09 +1300

> giving governments back-door access, and there is plenty of technical 

And that is indeed the *technical* point made by RFC1984 and RFC2804.

It's a technical point that has policy implications, and the flow of
information is *from* the technical community *to* civil society and then
on *to* policy makers.

None of this has changed since the original key escrow & wiretap debates,
except that now we have massive scale surveillance and data mining by
both companies and governments to worry about, which of course strengtghens
the civil society case for widespread access to crypto.

Vittorio is 100% right:

> One thing is developing technical standards... 
> Another thing is choosing between different policies. 

The IETF doesn't do policies. Of course, what we do is not always
policy-neutral, but (again) the fact that key escrow intrinsically
reduces security is not a matter of policy. The fact that that social
distancing intrinsically reduces coronavirus transmission is not a
matter of policy. What society and government does with those facts
is another matter entirely.

    Brian

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 31 Mar 2020 10:00:54 +0200 (CEST)

> Il 30/03/2020 16:07 Keith Moore <[email-masked]> ha scritto:
> 
>  

That is your opinion, and incidentally it is also mine, but it is not the opinion of a whole lot of non-technical professionals and experts in the law enforcement field, and even of some technical experts, otherwise "eTLS" would not exist and would not have been approved as a technical standard at another well respected standards organization. Those people are not incompetent, those people prefer a different tradeoff between multiple policy objectives.

In any case, my discourse was much more general, so apologies for mentioning that specific case, it was just meant as an example, not to reopen a discussion from the past.

--

---

From: John C Klensin <[email-masked]>
Date: Tue, 31 Mar 2020 11:50:13 -0400

--On Tuesday, March 31, 2020 10:00 +0200 Vittorio Bertola
<vittorio.bertola=[email-masked]> wrote:

>> That's a false dichotomy.   Security is not enhanced, but
>> weakened, by  giving governments back-door access, and there
>> is plenty of technical  justification for that.
> 
> That is your opinion, and incidentally it is also mine, but it
> is not the opinion of a whole lot of non-technical
> professionals and experts in the law enforcement field, and
> even of some technical experts, otherwise "eTLS" would not
> exist and would not have been approved as a technical standard
> at another well respected standards organization. Those people
> are not incompetent, those people prefer a different tradeoff
> between multiple policy objectives.
> 
> In any case, my discourse was much more general, so apologies
> for mentioning that specific case, it was just meant as an
> example, not to reopen a discussion from the past.

I think it is another discussion for another time, but wonder
how the two of you feel about privileging encryption over
privacy and/or network robustness and resiliency in the cases in
which those are real tradeoffs.

   john