[gnso-rds-pdp-wg] Principle on Proportionality for "Thin Data"access
Stephanie Perrin
stephanie.perrin at mail.utoronto.ca
Thu Jun 1 14:23:47 UTC 2017
This is not a personal "demand", it is a request that we maintain more
civility in this discourse. The allegation that those of us who are
trying to explain the privacy perspective on this matter do not
understand your work is simply untrue. Some of us have worked on the
issues for years. Please, all I am asking for is that we tone the
rhetoric down and treat each other with respect, as is required by ICANN
standards of behaviour on working groups.
With respect to your other comments, I have been clarifying in all the
calls that I attend, that when I raise an objection it is often on
principle because we need caveats or derogations on some of the
agreements we reach. I have clarified several times my position on the
technical definition of personal information, and the fact that this in
no way means that because information is personal, it cannot be
disclosed (eg thin data). I believe my response to Andrew's latest
excellent summary yesterday pretty well encapsulates that so I am not
going to respond point by point to what you have said below.
Thanks.
Stephanie Perrin
On 2017-05-31 19:04, allison nixon wrote:
> Your e-mail stated:
> >>Data that is gleaned from a file related to an individual, ie in
> this case their registration data, even if it is nameservers and the
> like, is their personal data.
>
> And it was stated in support of restricting public access to this
> information.
>
> Eliminating the other data elements may make troubleshooting harder,
> but eliminating nameservers on the basis of privacy means the
> registrars won't be able to disseminate it at all, and it will
> literally break the Internet. Were you thinking of the absurd
> possibilities when you wrote it?
>
> Your references don't change the fact of how DNS resolution works. If
> you're going to object to that characterization, then I formally
> object to this one, which is similar to the sentiment that has
> underpinned this group since the beginning:
>
> >>At a time when increasing imbalance in ‘informational power’, when
> governments and business organizations alike amass hitherto
> unprecedented amounts of data about individuals, and are increasingly
> in the position to compile detailed profiles that will predict their
> behavior (reinforcing informational imbalance and reducing their
> autonomy), it is ever more important to ensure that the interests of
> the individuals to preserve their privacy and autonomy be protected.
>
> In the context of WHOIS, it's ridiculous borderline conspiracy theory.
> A tiny percent of the population owns any domains, and an even smaller
> percent disclose anything in the WHOIS. This isn't intrusive like ad
> tracking or companies selling health data. This is information that
> people enter when they stake a claim in a public space. Blinding
> defenders from being able to judge if we want to interact with inbound
> traffic reduces our autonomy and only empowers the massive problem of
> abuse. Mischaracterizing public WHOIS info, which has been public for
> decades, as some sort of scandalous leak of data is ridiculous. It
> also falsely shades the motivations of the people who are asking for
> it to remain open. The truth is that this data is useless for what is
> insinuated, and we aren't asking to keep the data open so we can snoop
> on some dissident by knowing what their junk email and domain creation
> date is.
>
> And just because someone in the world is(and they certainly are), it
> doesn't mean we must shut down the whole system.
>
> On top of that, no one is forced to disclose damaging info. If you
> want to use an ICANN domain, fill out the form. If you don't want to,
> get an .onion, get a dynamic domain, go somewhere else. Or use WHOIS
> privacy. Or use junk info.
>
> You can demand respect, but many arguments in this group do not
> inspire respect.
>
> * When people claim to be concerned about spam as a motivation for
> eliminating WHOIS, and then don't listen when actual anti-spam
> people tell them it will destroy a major tool in the fight against
> spam, that does not inspire respect.
> * When people propose to put basic functionality on the chopping
> block, that does not inspire respect.
> * When theoretical edge cases are dreamed up as rebuttals to real
> and frequent issues, that does not inspire respect.
> * When anti-abuse is judged as anathema to privacy and are
> disrespected, that does not inspire respect.
>
> I along with many other security professionals here are not opposed to
> following the law. Collectively much of our work involves ensuring
> compliance with the law, including privacy laws, HIPAA, data breach
> laws, et cetera. Despite frequently being mischaracterized as wannabe
> cops by list members, we are not cops. We actually implement the
> protection of privacy, including the need to prevent data breaches-
> which can incur massive fines thanks to some privacy laws. Yet here we
> are, butting heads with "privacy experts", who by and large don't want
> to hear about operational issues or the wider impact of their narrow
> agenda.
>
> This observation isn't solely about you personally, and your work
> history is irrelevant here. It is an observation about the group as a
> whole since I became active. This isn't privacy versus security. This
> is quite literally, privacy versus privacy. And one side of the
> argument has operational experience. Security in the Internet sense
> involves- confidentiality, integrity, and availability. And most
> efforts are focused on the first item. We are not the NSA hunting
> terrorists or tapping phones or whatever youall imagine we are. We are
> trying to prevent data breaches and identity theft and phishing and
> quite literally everything that privacy laws are written to address.
> That's why these arguments are so ridiculous.
>
>
> On Wed, May 31, 2017 at 3:42 PM, Stephanie Perrin
> <stephanie.perrin at mail.utoronto.ca
> <mailto:stephanie.perrin at mail.utoronto.ca>> wrote:
>
> I would like to formally object to this kind of characterization
> of the people who are working in good faith on this working
> group: "self-proclaimed privacy advocates". I can only speak for
> myself, so I will do only that.....I am not a self-proclaimed
> privacy advocate. I have been working as a privacy professional
> since 1984, when I became one of the first privacy coordinators
> for the Department of Communications of Canada. I was the first
> president in 1986 of CAPA, the privacy professionals association
> which we formed and which collaborated for many years with ASAP,
> the US equivalent. I could go on and on and if you require
> references as to whether or not our views should be accepted as
> having merit, regardless of whether you agree with them or not, I
> am happy to provide them. But please, let us treat one another
> with a bit more respect.
>
> Stephanie Perrin
>
>
> On 2017-05-31 13:39, allison nixon wrote:
>> Good faith does not excuse ignorance. Such a mistake reveals the
>> extreme tunnel vision by many self proclaimed privacy advocates
>> here. It shows why they butt heads with people who work every day
>> in the trenches to actually protect privacy of real- not
>> theoretical- victims.
>>
>> On Wed, May 31, 2017 at 1:30 PM, Jeremy Malcolm <jmalcolm at eff.org
>> <mailto:jmalcolm at eff.org>> wrote:
>>
>> Again, I really think we need to dial down the level of
>> sarcasm here. The proportionality proposal was made in good
>> faith.
>>
>> However, I'm from a privacy advocacy organization and even I
>> have agreed that there are operational problems with any
>> proposal to limit unauthenticated access to thin WHOIS data.
>> I agree that while privacy is an absolutely key principle to
>> be upheld, so is the generativity of the Internet, and that
>> unauthenticated access to thin WHOIS data, much of which just
>> replicates the information that end users make available
>> through their own nameservers, is part of the permissionless
>> innovation that underpins many real world Internet applications.
>>
>>
>> On 31/5/17 10:14 am, allison nixon wrote:
>>> Which includes nameservers, which are collected and
>>> propagated by the registrars. If this is deemed sensitive
>>> information, then the registrars should be careful sharing
>>> that data via other outlets without tight restrictions!
>>>
>>> On Wed, May 31, 2017 at 1:09 PM, Michael Peddemors
>>> <michael at linuxmagic.com <mailto:michael at linuxmagic.com>> wrote:
>>>
>>> On 17-05-31 10:07 AM, allison nixon wrote:
>>>
>>> the rest of it can't be. You can't put a DNS query
>>> behind a EULA. We
>>> can't pretend there are restrictions on this data.
>>>
>>>
>>> We aren't discussing DNS or any other places that data
>>> is available as part of this working group. Only the
>>> informed consent of data held in whois thin data.
>>>
>>>
>>>
>>> --
>>> "Catch the Magic of Linux..."
>>> ------------------------------------------------------------------------
>>> Michael Peddemors, President/CEO LinuxMagic Inc.
>>> Visit us at http://www.linuxmagic.com @linuxmagic
>>> ------------------------------------------------------------------------
>>> A Wizard IT Company - For More Info http://www.wizard.ca
>>> "LinuxMagic" a Registered TradeMark of Wizard Tower
>>> TechnoServices Ltd.
>>> ------------------------------------------------------------------------
>>> 604-682-0300 <tel:604-682-0300> Beautiful British
>>> Columbia, Canada
>>>
>>> This email and any electronic data contained are
>>> confidential and intended
>>> solely for the use of the individual or entity to which
>>> they are addressed.
>>> Please note that any views or opinions presented in this
>>> email are solely
>>> those of the author and are not intended to represent
>>> those of the company.
>>>
>>>
>>>
>>>
>>> --
>>> _________________________________
>>> Note to self: Pillage BEFORE burning.
>>>
>>>
>>> _______________________________________________
>>> gnso-rds-pdp-wg mailing list
>>> gnso-rds-pdp-wg at icann.org <mailto:gnso-rds-pdp-wg at icann.org>
>>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
>>> <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
>>
>> --
>> Jeremy Malcolm
>> Senior Global Policy Analyst
>> Electronic Frontier Foundation
>> https://eff.org
>> jmalcolm at eff.org <mailto:jmalcolm at eff.org>
>>
>> Tel:415.436.9333 ext 161 <tel:%28415%29%20436-9333>
>>
>> :: Defending Your Rights in the Digital World ::
>>
>> Public key:https://www.eff.org/files/2016/11/27/key_jmalcolm.txt
>> <https://www.eff.org/files/2016/11/27/key_jmalcolm.txt>
>> PGP fingerprint: 75D2 4C0D 35EA EA2F 8CA8 8F79 4911 EC4A EDDF 1122
>>
>> _______________________________________________
>> gnso-rds-pdp-wg mailing list gnso-rds-pdp-wg at icann.org
>> <mailto:gnso-rds-pdp-wg at icann.org>
>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
>> <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
>>
>> --
>> _________________________________ Note to self: Pillage BEFORE
>> burning.
>>
>> _______________________________________________
>> gnso-rds-pdp-wg mailing list
>> gnso-rds-pdp-wg at icann.org <mailto:gnso-rds-pdp-wg at icann.org>
>> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
>> <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
> _______________________________________________ gnso-rds-pdp-wg
> mailing list gnso-rds-pdp-wg at icann.org
> <mailto:gnso-rds-pdp-wg at icann.org>
> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg
> <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg>
>
> --
> _________________________________ Note to self: Pillage BEFORE burning.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20170601/b1cb92fc/attachment-0001.html>
More information about the gnso-rds-pdp-wg
mailing list