Subject: [perpass] politics and the ietf

From: Elijah Sparrow <[email-masked]>
Date: Wed, 04 Dec 2013 23:25:44 -0800

As an outsider to the IETF, and one-time sociologist, I found the 
repeated calls in Vancouver 88 and on this list for decisions to be made 
based solely on technical merit and not political argument to be 
extremely fascinating.

There was once a time when the design of a protocol or standard could be 
done in a manner that benefited nearly everyone who might be touched by 
it. These days are surely past. Nearly every single debate or question 
that has come up on this list is deeply political, if for no other 
reason than whatever decisions are made will create winners and losers, 
people who benefit from the choice and people who are harmed by the choice.

In the sweep of history, information capitalism has come to a moment of 
truth, where the material infrastructure that the IETF and technologists 
the world around have helped to create has now matured into both an 
economic engine and a state intelligence system based on mass 
surveillance. Perhaps the most distinguishing political debate of our 
time is how the power of the state and of business with respect to 
citizens and customers has been radically transformed under this new 
regime of ubiquitous surveillance. Obviously, I feel a particular way 
about this, but I am just stating the obvious: these issues are deeply 
political because the fragile balance of powers in liberal democracy and 
in our capitalist economies have been inexorably rocked by technological 
changes.

In this context, the question of "how much encryption" is a technical 
question that is also deeply intertwined with the major political 
debates of our day. One only has to note the major headlines around the 
world about the ietf calls for encryption in http 2.0. How often have 
ietf meetings garnered such global coverage?

Scientists and engineers are often forced into political arenas without 
their desire or foresight. Take, for example, the history of genomics, 
climate change, or nuclear physics. Historically, the scientists and 
engineers have clung desperately to the cloak of objective science, even 
as their work took on increasingly obvious political ramifications. My 
hope for the internet is that we could perhaps bypass such silliness and 
embrace the obvious political nature of our work. Being honest with 
ourselves does not push anyone toward any particular technical or 
political stance, except that perhaps we can be more transparent in our 
justifications.

In the immortal words of Voltaire, and Spiderman, with great power comes 
great responsibility.

-elijah

--
I prefer encrypted email - https://bitmask.net/key/elijah.

---

From: SM <[email-masked]>
Date: Thu, 05 Dec 2013 00:21:36 -0800

Hi Elijah,
At 23:25 04-12-2013, Elijah Sparrow wrote:
>There was once a time when the design of a protocol or standard 
>could be done in a manner that benefited nearly everyone who might 
>be touched by it. These days are surely past. Nearly every single 
>debate or question that has come up on this list is deeply 
>political, if for no other reason than whatever decisions are made 
>will create winners and losers, people who benefit from the choice 
>and people who are harmed by the choice.

Yes.

>In this context, the question of "how much encryption" is a 
>technical question that is also deeply intertwined with the major 
>political debates of our day. One only has to note the major 
>headlines around the world about the ietf calls for encryption in 
>http 2.0. How often have ietf meetings garnered such global coverage?

My guess is that it was the first time.  The coverage wasn't that 
global.  The approach would likely be more nuanced than what has been reported.

Regards,
-sm

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 5 Dec 2013 10:14:20 +0100

On Wed, Dec 04, 2013 at 11:25:44PM -0800,
 Elijah Sparrow <[email-masked]> wrote 
 a message of 95 lines which said:

> As an outsider to the IETF, and one-time sociologist [...] whatever
> decisions are made will create winners and losers, people who
> benefit from the choice and people who are harmed by the choice.

I fully agree and, for the benefit of my fellow engineers, the best
paper to read about this issue is still "Tussle in Cyberspace:
Defining Tomorrow's Internet"
<http://groups.csail.mit.edu/ana/Publications/PubPDFs/Tussle2002.pdf>
which claims that we should admit there are tussles (different
interests and no hope of making everyone happy).

---

From: Robin Wilton <[email-masked]>
Date: Thu, 5 Dec 2013 09:55:16 +0000

Thanks Elijah, this is a very useful perspective on the whole question of technologists' role - especially when the technology in question is so woven into our political, economic and personal lives.

As you say, much of the work of the IETF has an inescapably political dimension - whether we choose to acknowledge that ourselves, or have it thrust upon us (Dual_EC_DRBG being a case in point). 

I apologise for re-using a well-worn phrase, but I think this reinforces the argument in favour of an open, multi-stakeholder process. That doesn't mean forcing economists and policymakers into the drafting sessions for RFCs, but it does mean creating a process that can take their (and others') input into account - and being able to articulate what we do in terms that make sense to other stakeholders.

That approach isn't a guarantee against 'bad actors' exploiting the open nature of the process for their own ends, but compared to alternative ways of architecting and governing the Internet, it offers the best prospects of detecting and mitigating that kind of harm.

Best wishes,

Robin

Robin Wilton

Technical Outreach Director - Identity and Privacy

On 5 Dec 2013, at 07:25, Elijah Sparrow <[email-masked]> wrote:

> As an outsider to the IETF, and one-time sociologist, I found the repeated calls in Vancouver 88 and on this list for decisions to be made based solely on technical merit and not political argument to be extremely fascinating.
> 
> There was once a time when the design of a protocol or standard could be done in a manner that benefited nearly everyone who might be touched by it. These days are surely past. Nearly every single debate or question that has come up on this list is deeply political, if for no other reason than whatever decisions are made will create winners and losers, people who benefit from the choice and people who are harmed by the choice.
> 
> In the sweep of history, information capitalism has come to a moment of truth, where the material infrastructure that the IETF and technologists the world around have helped to create has now matured into both an economic engine and a state intelligence system based on mass surveillance. Perhaps the most distinguishing political debate of our time is how the power of the state and of business with respect to citizens and customers has been radically transformed under this new regime of ubiquitous surveillance. Obviously, I feel a particular way about this, but I am just stating the obvious: these issues are deeply political because the fragile balance of powers in liberal democracy and in our capitalist economies have been inexorably rocked by technological changes.
> 
> In this context, the question of "how much encryption" is a technical question that is also deeply intertwined with the major political debates of our day. One only has to note the major headlines around the world about the ietf calls for encryption in http 2.0. How often have ietf meetings garnered such global coverage?
> 
> Scientists and engineers are often forced into political arenas without their desire or foresight. Take, for example, the history of genomics, climate change, or nuclear physics. Historically, the scientists and engineers have clung desperately to the cloak of objective science, even as their work took on increasingly obvious political ramifications. My hope for the internet is that we could perhaps bypass such silliness and embrace the obvious political nature of our work. Being honest with ourselves does not push anyone toward any particular technical or political stance, except that perhaps we can be more transparent in our justifications.
> 
> In the immortal words of Voltaire, and Spiderman, with great power comes great responsibility.
> 
> -elijah
> 
> --
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 04 Dec 2013 20:24:52 +0000

Robin, Elijah,

I am always curious how one manages to make a clear distinction between
political decisions, technical decisions, economical decisions, and
other decisions.

The perception that "in the early days of the Internet" the decisions
were purely technical as too simplistic. If you look at specific
decisions of individuals in the IETF it is hard to put them into
specific categories. Even if you believe you see a purely technical
decision it may have economical implications, or at some time interfere
with other design goals. Take the HTTP state management work as an
example. The introduction of cookies was a technical mechanism to keep
state for the otherwise mostly stateless HTTP protocol. As we now know,
the way how cookies have been used later by various Web companies lead
to privacy concerns. This lead to the famous technical work on Do Not
Track, which has technical components, business implications, and raises
legal questions. 

I wouldn't call the discussions on the list necessarily as "political"
but rather non-actionable statements. Here is what I mean by that.

Some of us try to take specific actions and that requires that you
identify who needs to do what. There are things the IETF can do, but
there are other communities as well. I tried to explain a simplified
version of the Internet protocol development process in
http://www.ietf.org/id/draft-tschofenig-perpass-surveillance-01.txt. As
you can see different communities deal with different type of security
vulnerabilities. Security problems are not a new thing - just check the
OWASP top-10 security vulnerabilities of the last couple of years. These
vulnerabilities are obviously be exploited by various folks (state
actors, criminals, script kiddies, researchers, enterprise network
administrators, etc.). A software that is vulnerable to, let's say, an
SQL injection vulnerability is unfortunately not kind enough to take the
motives, the organization, the hair colour, etc. of the attacker into
account.

Of course it would be possible to could come up with suggestions for
other communities. But you have to start somewhere first. I don't see it
as my task, for example, to tell the European Commission, the European
Parliament, or the Council what they should be doing. I doubt that the
IETF community would be interested in producing such recommendations.

For everyone on the list who believes that regulators should take some
actions then they should just approach them. It is just lame to say that
others should do some work without even providing enough detail about
what they should be doing.

Ciao
Hannes

PS: I dislike the use of the term "politics", "policy makers", and
alike. It just hides what you are really trying to say. Use other, more
specific terms instead. For example, if you believe there is an action
required by regulators then say "regulator". If you mean that the job is
with enforcement agencies then say that.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 5 Dec 2013 07:27:09 -0500

Elijah, the IETF is well aware of politics, and has been for a long time.   Google "OSI layer 9" for a review.   But what we mean by politics is something very specific.   You might get quite a few answers from IETFers if you asked what "politics" is, but most of them would boil down to this: a political argument is one where a person or group of people bloviate loudly about some position they hold, but cannot or will not expose the rationale for that position to the light of public criticism.

And the IETF has a strong, and I think important, tradition of trying not to make decisions based on such bloviations.   When we do, we produce crap.   When we stick to arguments that can be openly stated and agreed upon, we produce goodness (at least often enough that people keep coming).

As for the question of great power and great responsibility, that's a lovely sentiment, but it can mean whatever you want it to mean.   We've heard at least one person say that we should be careful not to do too good a job, for fear of unstated but clearly bad consequences.   I personally think we should do a better job, because I know people who have been victimized by 419 scams that couldn't have been perpetrated if we had done a better job with SMTP.   I also know people who have been victimized and lost businesses because we didn't get security right in HTTP.

Bruce Schneier has a term that I really like, "movie plot threat," which I think applies here.   The reason the IETF insists on making decisions in the open, and not accepting peoples' word that something really bad might happen if we do X, but we can't say what it will be, is that  these arguments invariably boil down to "put these real people, with real problems, here in the real world, at risk so that we can avoid a movie plot threat scenario."

This is actually a classic example of what we mean by "politics."

---

From: Harry Halpin <[email-masked]>
Date: Thu, 05 Dec 2013 14:46:42 +0100

On 12/04/2013 09:24 PM, Hannes Tschofenig wrote:
> Robin, Elijah,
>
> I am always curious how one manages to make a clear distinction 
> between political decisions, technical decisions, economical 
> decisions, and other decisions.

Political decisions have to deal with sovereignty: Who makes binding 
decisions. I think what has escaped lots of folks in Internet governance 
is that now the Internet is at the centre of rather important political 
struggles over decision-making.

The problem is "who" is making these decisions. Right now, for standards 
it's an open multi-stakeholder process that at least we who are involved 
in places like the IETF believes make technical decisions, but these 
decisions only have binding force insofar as they provide enough 
economic advantage that vendors implement them uniformly.

However, we should never forget that the very process of making 
decisions means that standards bodies are *always* political in this 
large sense of making decisions. After all, it is very possible that 
some vendors and countries can go away and make their own decisions 
without the traditional Internet open and voluntary standards bodies, 
and bind their new technologies via the threat of coercive violence. 
While we have name-calling on IETF mailing lists, I'm not aware of 
coercive violence anywhere.

I'm hoping we can bear the responsibility of creating an Internet free 
of pervasive surveillance. And we should be aware that even if we are 
successful in this, other pre-Internet political bodies ranging from 
nation-states to vendors will try to strip out whatever safeguards we 
try to put in in order to continue the value they gain from 
surveillance. A conflict between different bodies, each with its own 
plans for the future and its own overlapping sphere of decision-making, 
is self-evidently a political struggle.

> decision it may have economical implications, or at some time 
> interfere with other design goals. Take the HTTP state management work 
> as an example. The introduction of cookies was a technical mechanism 
> to keep state for the otherwise mostly stateless HTTP protocol. As we 
> now know, the way how cookies have been used later by various Web 
> companies lead to privacy concerns. This lead to the famous technical 
> work on Do Not Track, which has technical components, business 
> implications, and raises legal questions.

In the "early days" of the Internet, to my knowlege, the Internet was 
more of a research project amongst co-operative researchers at places 
like MIT, SRI, and CERN with the Web so security and privacy concerns 
were minimal at best. I'm not sure what else can explain early RFCs :) 
Obviously this has changed, and now folks have to retro-fit these 
security on top the system.
> http://www.ietf.org/id/draft-tschofenig-perpass-surveillance-01.txt. 
> As you can see different communities deal with different type of 
> security vulnerabilities. Security problems are not a new thing - just 
> check the OWASP top-10 security vulnerabilities of the last couple of 
> years. These vulnerabilities are obviously be exploited by various 
> folks (state actors, criminals, script kiddies, researchers, 
> enterprise network administrators, etc.). A software that is 
> vulnerable to, let's say, an SQL injection vulnerability is 
> unfortunately not kind enough to take the motives, the organization, 
> the hair colour, etc. of the attacker into account.
>
> other communities. But you have to start somewhere first. I don't see 
> it as my task, for example, to tell the European Commission, the 
> European Parliament, or the Council what they should be doing. I doubt 
> that the IETF community would be interested in producing such 
> recommendations.

I think they'd want to create broad mandates based on policy decisions 
(hopefully made with consent or even involvement of general population) 
that then are respected by the details of technical standards bodies. Of 
course, that's not usually how it works in practice with governments, 
who tend to either overspecify technical details or do not actually 
represent the consent of their population in any meaningful sense of the 
term.

> actions then they should just approach them. It is just lame to say 
> that others should do some work without even providing enough detail 
> about what they should be doing.
>
> Ciao
> Hannes
>
> alike. It just hides what you are really trying to say. Use other, 
> more specific terms instead. For example, if you believe there is an 
> action required by regulators then say "regulator". If you mean that 
> the job is with enforcement agencies then say that.
In general, regulators are at the bequest of their government, who at 
the present moment is often in thrall of lobbies that prevent anything 
resembling effective regulation. There are political processes that do 
not have regulatory power per se but have the power to nonetheless 
mobilize actors (thinking ACTA/SOPA protests) that have the ability to 
change the decisions of sovereign bodies.

  So I don't think "politics" is the wrong word or empty word. Hopefully 
the IETF - with the help of ISOC of course - and others can continue to 
interface open, meritocratic political Internet processes with 
traditional per-Internet political actors.

  cheers,

            harry

>> On 5 Dec 2013, at 07:25, Elijah Sparrow<[email-masked]>  wrote:
>>
>>> I prefer encrypted email -https://bitmask.net/key/elijah.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 5 Dec 2013 10:23:38 -0500

Many people assume that technical people are unaware of the political
implications of their work. This is not true and has never been true.

In my case I contacted Jock Gill who was running the Clinton-Gore '92
campaign and told him about the Web and the political potential in 1992,
the day after I returned from the first public presentation at the CHEP'92
conference in France.

I discussed the potential of the Web with people who were working in
Sarajevo during the siege. They used a Web server there to coordinate
information, for example reporting positions of snipers.

I also had conversations with the intelligence services at the time. The
cold war had just ended and they were looking for a new role.

>From 1991 through 1998 there was an event that is generally known in the
field as the cryptowars which began as a fight between the NSA and the
Internet and ended with Louis Freeh the FBI backing the Republican party
attempt to impeach Bill Clinton in revenge for the administration reneging
on what Freeh believed was a commitment to back his surveillance ambitions.

Some of us have experience of national politics as well. I was a (full not
youth) delegate to a national party conference at 20. I gave up that
activity because building the net is far more consequential than most
cabinet level political careers.

More specifically, when I started work on the Web 95% of the UK newspaper
industry was controlled by three individuals, Rupert Murdoch, Conrad Black
and Robert Maxwell. Conrad Black has recently completed a prison sentence
for fraud, Maxwell committed suicide just before his massive fraud was
exposed and the senior management a Rupert Murdoch UK newspaper are
currently on trial. I really did not see why a conspicuously corrupt and
dishonest Austrialian newspaper magnate should get to choose the UK
government which is what Murdoch claimed in the wake of the '92 election.

It is hard to imagine that the Iraq war could have occurred without support
from Murdoch's global propaganda machine. He has the blood of a half
million people on his hands.

In the case of cryptography in particular and security in general, the
technology affects the balance of power and is always controversial. When
the IETF tried to do anti-spam work the efforts were initially sabotaged by
a large number of shills paid by the spammers themselves. Even though
99.99% of net users hate spam there are some parties that made their
livings from it and wanted to protect them.

DRM is contentious for the same reason. It affects the balance of power
between the producer of content and the consumer. Payment security
mechanisms are contentious because some net merchants have built their
reputations on being a safe place to buy from and they have little
incentive to make trust a commodity.

---

From: Edward Lopez <[email-masked]>
Date: Thu, 5 Dec 2013 16:15:09 +0000

Elijah,

I have a sociology background as well, and found resonance in your comments.

As a security technologist, I often tell people that security is not required for productivity.  A new protocol or application can be highly productive without being secure.  A significant challenge is in changing the mindset of participants to incorporate security as a goal of design.

But we have to consider the technical, political, and economic (cost) factors of what we do.  In the discussion of opportunistic encryption, we have to recognize that there is a significant barriers in all three areas.  Encryption everywhere is over-simplistic, and is biased on the idea that the math works.  But we have to remember that just like bad security is equivalent to no security, bad implementations of encryption generate costs and hassles without benefit.

I have heard comments regarding pervasive surveillance as an attack on the Internet, and am concerned about cycles lost in overreaction, analogous to how we perceive the Patriot Act, TSA, and Air Marshals as an overreaction to 9/11.

We applaud the concept of Google searches, but are repelled by the concept of data analytics, which is an inherent byproduct of search engines.  In a decade past we demanded 1Gbps wired to the desktop, but gave it up for 11Mbps of shared wireless, even if it was not secure and subject to surveillance. But the productivity gained by searches and wireless are not in question, and the side effects seen as a reasonable cost/risk at the time

The reality is with the NSA, we have an ultimate peer-review organization. One that is prepared to expend tremendous resources to find and exploit weaknesses in the protocols we design.  It's not that they are smarter (although as Bruce points out, likely a decade ahead in math), but they are more tenacious, and they play dirty.  

Collectively, we need to change our thinking.

Ed Lopez

Sent from my iPhone ... Sorry for any auto-correct errors

> On Dec 5, 2013, at 2:26 AM, "Elijah Sparrow" <[email-masked]> wrote:
> 

***  Please note that this message and any attachments may contain confidential 
and proprietary material and information and are intended only for the use of 
the intended recipient(s). If you are not the intended recipient, you are hereby 
notified that any review, use, disclosure, dissemination, distribution or copying 
of this message and any attachments is strictly prohibited. If you have received 
this email in error, please immediately notify the sender and destroy this e-mail 
and any attachments and all copies, whether electronic or printed.
Please also note that any views, opinions, conclusions or commitments expressed 
in this message are those of the individual sender and do not necessarily reflect 
the views of Fortinet, Inc., its affiliates, and emails are not binding on 
Fortinet and only a writing manually signed by Fortinet's General Counsel can be 
a binding commitment of Fortinet to Fortinet's customers or partners. Thank you. ***

---

From: Elijah Sparrow <[email-masked]>
Date: Fri, 06 Dec 2013 02:05:38 -0800

As it happens, the Guardian just posted a commentary on the very topic
of engineering ethics and surveillance:

http://www.theguardian.com/commentisfree/2013/dec/05/engineering-moral-effects-technology-impact

In brief:

> However, we are still essentially producing what industry requires:
> engineers able to carry out technically complex projects, rather than
> professionals with an in-depth understanding of the social complexity
> of technology

-elijah

---

From: Stephen Kent <[email-masked]>
Date: Fri, 06 Dec 2013 10:10:48 -0500

Harry,

> ...
As one who has been actively involved since "the early days" I have to 
disagree with your characterization. Internet R&D was funded primarily 
by the U.S. DoD, and thuis security was a consideration. Moreover, the 
sort of passive and active wiretapping attacks that we're discussing, 
ones that can be carried out by nation states, were a concern. The
technical approach to dealing with such attacks was to employ 
encryption, on an end-to-end basis, for realtime communication. Sound 
familiar?

BBN built a basic e-t-e encryption device (the PLI) in the mid-1970's, 
for use in the ARPANET. Later in the 70's we worked with ARPA (now 
DARPA) to develop a more sophisticated system, one that worked with 
TCP/IP, provided per-connection security associations, and which used a 
KDC. (This was a few years before the MIT Kerberos project began and 
long before public key crypto was considered practical.)

All of this was well before development of the Web, even before DNS, in 
a simpler
environment. My point is that technology was developed to provide protection
against passive and active wiretapping of Internet protocols. It was not 
developed for
the software implementations that we see in OSes, because the DoD 
understood the vulnerabilities that arise in a software-based 
implementation. The solutions focused on external, hardware crypto, 
inline between a computer (or a gateway) and the Internet. That made the 
solutions developed for the DoD environment unattractive for typical 
commercial, much less, residential users.

Steve