[00:01.240 --> 00:01.760]  Okay.
[00:01.760 --> 00:03.800]  Yeah, just quickly, we'll introduce ourselves.
[00:04.120 --> 00:18.360]  We are members of a multi-stakeholder working group, which means governments, private sector, and academics, and civil society groups working on... A working group is called an Internet Free and Secure.
[00:18.460 --> 00:27.160]  It's a working group of the Freedom Online Coalition, which, if people remember, is an initiative started by Hillary Clinton when she was Secretary of State in 2011.
[00:27.300 --> 00:29.980]  And we'll get into all of that, but just to tell you why we're here.
[00:30.000 --> 00:31.600]  And I'm Mallory Knodel.
[00:31.700 --> 00:34.300]  I'm with the Association for Progressive Communications.
[00:36.180 --> 00:37.720]  I'm Camille Francoise.
[00:38.160 --> 00:39.520]  I'm academic.
[00:42.160 --> 00:43.800]  So, I'm Sacha van Geffen.
[00:44.040 --> 00:50.900]  I am the managing director of Greenhost, a hosting provider based in the Netherlands and Amsterdam.
[00:52.460 --> 00:59.000]  So, we're going to start off with a quick video that gives an insight into, you know, why...
[00:59.000 --> 01:11.320]  why we feel... why we're here, reaching out to technologists, community, and especially on this topic of human rights and the Internet and what that means.
[01:11.420 --> 01:12.760]  This was done by Article 19.
[01:14.500 --> 01:17.080]  It's mostly focused on policy at the IETF.
[01:18.120 --> 01:25.260]  Internet Protocols and the most common response was, well, it's obvious there is no relationship between human rights and Internet Protocols.
[01:25.380 --> 01:27.100]  It's completely different things.
[01:27.280 --> 01:29.240]  How can it be any connection?
[01:29.560 --> 01:36.440]  The IETF has made a big thing of not being a political organization, being an engineering organization.
[01:36.440 --> 01:40.400]  There are quite a few people in the IETF who would prefer not to get into politics.
[01:40.680 --> 01:45.760]  The Internet started as a military and academic network with a limited number of users.
[01:46.240 --> 01:51.320]  Therefore, it was implicit that users could trust each other and that they shared the same objectives.
[01:51.740 --> 01:53.240]  This was its foundation.
[01:53.940 --> 02:03.120]  The underlying protocols of the Internet, you know, IP, TCP, HTTP, DNS, all of these protocols are enabling protocols that allow you to do whatever you want.
[02:03.200 --> 02:07.800]  And so you see this wonderful flowering of innovation, of new ways of communicating.
[02:07.800 --> 02:11.540]  The functioning of the Internet is dependent upon standards.
[02:11.760 --> 02:19.220]  To build the first connection between computers and have them talk to each other, the Network Control Protocol, NCP, was developed.
[02:19.540 --> 02:26.980]  It was later on replaced by the more efficient Transmission Control Protocol, TCP, which confirms that sent messages are received.
[02:27.580 --> 02:34.060]  On top of that, files are cut into little parts, packets, which allows for more efficient traffic handling.
[02:34.060 --> 02:39.780]  With these two innovations, packet switching and TCP, the modern Internet, was born.
[02:41.060 --> 02:49.920]  Since the Internet is a network made up of other networks, the biggest challenge has been defining open standards that allow these networks to communicate with each other.
[02:51.500 --> 02:56.800]  A vibrant city needs well-engineered infrastructure to keep it growing and running smoothly.
[02:56.800 --> 03:07.940]  That's why we need the Internet Engineering Task Force, a global organization of volunteers collaborating to design standards that provide the infrastructure for innovation on the Internet.
[03:08.180 --> 03:10.680]  It's critically important to have global standards.
[03:11.020 --> 03:19.120]  And one of the reasons the IETF and organizations like the IETF are important, where it's voluntary expert-based.
[03:19.120 --> 03:21.340]  The IETF is open.
[03:21.620 --> 03:25.740]  Open participation, open processes, and open standards.
[03:25.960 --> 03:33.580]  It's interesting because the IETF community is very heavily biased towards, you know, white, male, middle-class American engineers.
[03:34.480 --> 03:35.200]  Oops.
[03:35.400 --> 03:43.320]  The people who work on these standards are sincerely striving for doing the right thing technically.
[03:43.900 --> 03:48.360]  And in a sense, they have to do that because if they do the wrong thing technically, it won't work.
[03:48.880 --> 03:55.320]  And so, for the most part, issues of human rights or ethics in general are a distraction to them.
[03:55.460 --> 03:56.940]  IETF is not the protocol police.
[03:57.080 --> 04:00.340]  We cannot always control what happens in the world.
[04:01.460 --> 04:11.480]  I remember, I've been in this space dealing with data brokers and third-party surveillers of consumers for so many years.
[04:11.480 --> 04:18.840]  Um, like, 20 years ago, we brought together a group of data brokers to find out what they're doing and how much they know about consumers.
[04:19.060 --> 04:22.380]  And I remember so well that one of their representatives said...
[04:25.010 --> 04:33.270]  Lawrence Lessig said, code is law, you know, and the code that people write for the Internet is determined in large part by what we do in the IETF.
[04:36.920 --> 04:43.260]  Twenty years ago, we brought together a group of data brokers to find out what they're doing and how much they know about consumers.
[04:43.440 --> 04:52.960]  And I remember so well that one of their representatives said, you know, the secret to our business is not so much how much we know, but just making sure that consumers don't know about it.
[04:53.100 --> 04:55.940]  Just making sure that consumers don't know about it.
[05:04.480 --> 05:08.340]  It soon became clear that the Internet was no longer a trusted space.
[05:08.540 --> 05:13.580]  The insecurities inherent in a network based on trust were being increasingly exploited.
[05:19.580 --> 05:29.880]  The Internet works because we have machinery that's designed that implements particular ideas, particular protocols, particular rules about how communications work.
[05:29.880 --> 05:34.100]  And if you do something that violates those rules, your communication won't work.
[05:34.380 --> 05:40.700]  We now need to think what the future Internet should look like, what we want to keep, and what we want to leave behind.
[05:50.770 --> 05:56.190]  Technologists, particularly the IETF, you guys are the ones...
[06:01.520 --> 06:03.720]  You can go on, you can find it online.
[06:03.960 --> 06:04.920]  It's called Net of Rights.
[06:04.920 --> 06:16.880]  We wanted to show an example of the kind of bridges that are being built between policy and human rights and technologists, which is also something that we're doing.
[06:17.100 --> 06:18.300]  So it's an example of the kind of stuff.
[06:18.460 --> 06:26.000]  And you can see this is obviously aimed at the policymakers, because, you know, it's got a lot of technical knowledge that was obviously you all understand.
[06:27.140 --> 06:28.740]  So we're here.
[06:28.960 --> 06:31.340]  Let me explain some more context that I started at the beginning.
[06:31.940 --> 06:42.220]  We're here on a mandate for this working group to promote a human-centric notion of cyber security.
[06:42.660 --> 06:49.900]  If you look at sort of the North American model of cyber security, it's all very related to...
[06:50.900 --> 06:51.780]  It's securitization.
[06:51.960 --> 06:53.640]  It's sort of building off of the PATRIOT Act.
[06:53.840 --> 06:56.340]  It's kind of war, cyber-war, cyber-terrorism.
[06:56.460 --> 07:02.900]  If you look at Europe, it's a lot more about markets and why the Internet needs to be secure.
[07:03.100 --> 07:07.200]  And everywhere around the world, we're missing this human element.
[07:07.460 --> 07:13.760]  So, like, presumably, we want infrastructure to be safe, because at the end of the day, so humans are safe.
[07:13.760 --> 07:20.700]  We want markets to be sound, because that promotes prosperity for citizens.
[07:21.080 --> 07:24.300]  But this is not an explicit goal of cyber security.
[07:24.580 --> 07:30.140]  And so we're really... we're raising these questions in all sorts of places.
[07:30.740 --> 07:34.020]  We've had... like, our working group is bigger than us, of course.
[07:34.320 --> 07:39.480]  We've had events at Eurodig, at RightsCon, at several different places.
[07:39.480 --> 07:41.260]  This is just one of the stops along the way.
[07:41.260 --> 07:47.580]  And particularly, we're here because as members of that working group, this is sort of more our audience.
[07:48.380 --> 07:52.160]  We're technologists, academics, studying technology.
[07:52.880 --> 08:13.820]  And so we, as a part of this, we actually want to have more discussion than to actually present anything, because as part of our mandate, we actually want to improve the work that we're doing to make sure that it's useful to you all, actually, to hackers that are already kind of interested in human rights anyway.
[08:14.560 --> 08:21.940]  So I'm not going to say much more, other than you can find outputs from our working group that has been going on now, what, two years?
[08:22.200 --> 08:22.900]  More than two years.
[08:23.580 --> 08:25.960]  So we've done, we kind of, we defined cybersecurity.
[08:26.020 --> 08:39.620]  So the definition that we created, that defined cybersecurity in just a couple sentences, put humans at the center, and that we've been promoting, and it's been picked up by a couple of different places, saying this is a good example of how we would define cybersecurity.
[08:39.620 --> 08:51.620]  The other things we've done is write, you know, a series of articles and analysis that connect this work in other spaces, like the ITF, like the UN, you know, various places.
[08:51.840 --> 09:05.960]  And then we have a set of policy recommendations that we are shopping around to policymakers actually writing cybersecurity-related legislation to give them an idea of the best practice.
[09:05.960 --> 09:09.980]  You know, do ask lots of people what they think and involve lots of people.
[09:10.420 --> 09:13.580]  You know, don't sort of frame this as humans are threats.
[09:13.700 --> 09:16.040]  You know, that sort of thing, it's like a whole set of them.
[09:16.380 --> 09:19.460]  So you can find those things on the Freedom Online Coalition website.
[09:20.120 --> 09:28.540]  I'm going to turn it over now to Sasha here, who's going to talk a lot more about the connection between technologists and the work that we're doing.
[09:32.700 --> 09:38.320]  Yeah, so first of all, I think you've heard the word cyber more than you would ever hear in any kind of conference.
[09:38.420 --> 09:40.760]  that deals with actual cyber stuff.
[09:42.320 --> 09:54.580]  Of course, we, at least as academics and technologists, don't really like that term, except for if we are describing some fiction from the 80s and 90s.
[09:55.660 --> 10:11.320]  But on the other hand, cybersecurity and all the terms that are prefixed with cyber are the terms used in the political debate, and that's the debate that makes the rules on what we can do, what will be filtered, tapped and stored for the next generations.
[10:11.680 --> 10:23.500]  And so if we don't use those words, the people that we want to change their opinions of will not really relate to it.
[10:23.500 --> 10:30.340]  So that's to explain why we've been burdening you with this terrible cyber thing.
[10:31.000 --> 10:34.260]  So the rest of the day...
[10:34.740 --> 10:36.880]  So during this talk, you will hear it more and more.
[10:37.000 --> 10:43.560]  After that, we will probably only talk cyber in the way of cyber, cyber, cyber, cyber, cyber, cyber, cyber, cyber, cyber.
[10:43.560 --> 11:06.460]  So one of the things that we actually really want to achieve as a working group and that I firmly believe in is to get the notion to technologists as well as cyber policy makers that the end user or the end point in computer security is actually the most important point to protect.
[11:06.460 --> 11:13.720]  And that actually directly makes it a way of protecting human rights as well.
[11:14.380 --> 11:23.680]  So this means that protocols should not be... and techniques should not be insecure in the way they're built.
[11:24.320 --> 11:27.000]  End-to-end encryption should not be forbidden in law.
[11:27.000 --> 11:44.280]  It has all these kind of very deep implications based on a very simple premise of this cyber security to protect the end user and not only to protect the interests of large corporations or governments.
[11:44.980 --> 11:59.380]  Actually, it changes the narrative in a way that we can now say, actually you, governments and corporations, you're not doing enough in terms of Internet and cyber security.
[11:59.640 --> 12:03.260]  You're doing far too little because you're not protecting the end users.
[12:03.460 --> 12:05.460]  You're only protecting some of your systems.
[12:05.640 --> 12:15.080]  But in the end, your CEO or your finance department is still going to use computers and they are going to get owned by the back doors that our governments want to have.
[12:15.080 --> 12:18.900]  And so that back doors can also be used by others.
[12:19.180 --> 12:28.080]  So what we basically want to achieve is shifting the debate from what is a cyber offense debate.
[12:28.080 --> 12:36.860]  So what are our technical capacities to attack other people or to attack individuals to a cyber defense debate?
[12:36.980 --> 12:43.340]  How can we make sure that all the end users, that all the citizens are protected against all these potential threats?
[12:43.340 --> 12:50.500]  And that's by actually trying to enforce and push forward new encryption techniques and more secure computing.
[12:53.670 --> 13:02.670]  So I think it was in our last... we did a round of discussions about this subject with other groups like policy and technology groups.
[13:02.670 --> 13:08.830]  And in one of those groups, I remember Bruce Snyder being around.
[13:09.170 --> 13:16.030]  And he perfectly, I think, summarized what we are trying to do.
[13:16.230 --> 13:23.210]  But saying it's actually... so it's not security versus like human rights or like freedom.
[13:23.590 --> 13:25.310]  It's basically all security.
[13:25.530 --> 13:31.310]  It's the security of the end user versus this... and other levels of security.
[13:31.310 --> 13:38.030]  So, and as he phrased it, he said, if I remember correctly, it's all about security, stupid.
[13:38.950 --> 13:48.510]  So with that, I will hand over to Camille, who will get back, I think, a bit more into the whole cyber narrative.
[13:49.310 --> 13:49.930]  Oh, no.
[13:50.170 --> 13:51.070]  Don't do this to me, Sasha.
[13:51.190 --> 13:51.710]  It's not nice.
[13:52.250 --> 14:02.550]  Okay, so we were... I think we were trying to have a workshop-y conversation, kind of like more participative debate, which is hard because of the configuration of the room and because I can't see any of you.
[14:05.030 --> 14:11.370]  So, to do what you're asking me to do, Sasha, it's true that the fun part about the cyber debate is...
[14:11.370 --> 14:13.990]  there's basically two approaches, right?
[14:14.130 --> 14:17.510]  The usual one that we're used to is the only way we use cyber.
[14:17.670 --> 14:19.770]  It's like the cyber libertarian approach, right?
[14:19.830 --> 14:26.910]  It's this idea that... it's very John Pariballo idea that in cyberspace, Internet sovereignty doesn't apply.
[14:26.910 --> 14:33.030]  Like the government can try to catch up with what people are doing in cyberspace, but this is really a space of freedom.
[14:33.330 --> 14:36.050]  It's a space in which people are allowed to tinker.
[14:36.250 --> 14:39.350]  It's a space in which people will create and attempt new things.
[14:39.530 --> 14:41.050]  And that's like one paradigm.
[14:41.490 --> 14:45.150]  And we were kind of like living in this bubble world and it was kind of cool and everything.
[14:45.330 --> 14:49.150]  And then we, you know, sort of realized that not everyone was thinking about it like this.
[14:49.150 --> 15:02.130]  And it became apparent and very clear that there was another paradigm, which was the exact opposite, which is, you know, what I call the cyber warfare paradigm, which is, well, actually the entire domain of cyberspace is a fifth domain of war.
[15:02.290 --> 15:08.510]  And it's all a legitimate area for securitization, for militaristic intervention.
[15:08.950 --> 15:12.430]  And at this stage, it's like, okay, well, those two are obviously not compatible.
[15:12.770 --> 15:15.270]  We've obviously seen that you do this.
[15:15.390 --> 15:17.570]  Well, we think that and we have a problem, right?
[15:18.190 --> 15:27.130]  And so at this stage, people say, well, you know, there must be some in between in which we discuss what's the appropriate rules of engagement for governments in cyberspace.
[15:27.650 --> 15:38.350]  And what's kind of, you know, the area in which we believe that they can be security, they can be military intervention if needed, but in a way that doesn't trample human rights and our freedom.
[15:38.790 --> 15:45.770]  And this is sort of like, you know, a beginning for this working group that says, okay, you guys are going to think about human rights and cybersecurity.
[15:46.530 --> 15:52.290]  And so around the room is, you know, people in, as you said, you know, government, not all the governments.
[15:52.550 --> 15:54.570]  There was a, it was shared by the Dutch government.
[15:54.930 --> 15:56.290]  There was a Canadians were there.
[15:56.810 --> 15:58.490]  The French were not there.
[15:59.650 --> 16:05.410]  The, I'm French, so I'm allowed to, I'm allowed to, I mean, everyone's allowed to poke holes at France, but I feel entitled to.
[16:06.570 --> 16:07.330]  The U.S.
[16:07.390 --> 16:08.090]  was there.
[16:08.290 --> 16:14.610]  And we had a couple of people where activists, academia, businesses were there, big NGO, digital rights NGOs were there.
[16:14.970 --> 16:18.210]  And so at first we say, okay, what's the relationship between human rights and cybersecurity?
[16:18.930 --> 16:26.250]  And, you know, some who will remain inside it were like, well, it's, you know, obvious storage is, you know, we have human rights.
[16:26.250 --> 16:30.850]  And then when we need cybersecurity, sadly, we make decisions.
[16:31.410 --> 16:33.230]  They have a bad impact on human rights.
[16:33.430 --> 16:34.010]  That's okay.
[16:34.030 --> 16:38.170]  Cause sometimes it's war or terrorism and it's needed.
[16:38.170 --> 16:38.390]  Right.
[16:38.590 --> 16:42.210]  And so that was like first, first stop on the road saying, okay, you know, it's true.
[16:42.290 --> 16:43.190]  There are people who think like that.
[16:43.310 --> 16:44.390]  We don't think it makes any sense.
[16:44.390 --> 16:50.390]  We want to shift this paradigm and we want to say, you know, human rights and cybersecurity are really like mutually reinforcing.
[16:50.910 --> 16:53.790]  It's not, you know, it's not, you drop one, you get the other up.
[16:53.950 --> 17:01.590]  It's really, you can't have human rights if you don't have cybersecurity in this world, because, you know, if you don't have a secure connection, you use a right to freedom of expression.
[17:01.970 --> 17:04.930]  And generally we should think of them too as mutually reinforcing.
[17:04.930 --> 17:06.170]  So that was our first stop.
[17:06.290 --> 17:07.250]  And it wasn't so easy.
[17:07.370 --> 17:18.130]  Like it sounds obvious for where we are, but, you know, it was, it was a big conversation saying, okay, Okay, why don't we put off the table this idea that there is security versus privacy tension?
[17:18.510 --> 17:21.610]  Why don't we just admit that this is a continuum and want to build on that?
[17:22.230 --> 17:39.010]  Then the rethinking of the definition was kind of fun because ultimately, the people that these recommendations go to are people who sit in government, and their question is like, okay, I'm in charge of cybersecurity, or I sit within the army unit that is in charge of secretizing,
[17:39.090 --> 17:45.410]  you know, cyberspace, as a cyber warrior unit, you know, what should I think about human rights?
[17:45.530 --> 17:46.850]  How should I start thinking about this?
[17:46.910 --> 17:48.350]  How does it impact my business?
[17:48.570 --> 17:51.290]  Like, what are the questions that you guys want me to run through?
[17:51.470 --> 17:53.690]  And so we became this question about norms, right?
[17:53.810 --> 18:04.930]  Like, what is it that we want to put on their desk as like, we're going to build in these reflexes that everything you do has an impact on human rights, and this is where we want you to start.
[18:04.930 --> 18:12.470]  And so, same thing, I think we think here, like today in this room in 2016, we're like, yeah, this is very obvious.
[18:12.670 --> 18:15.370]  But it wasn't, and it's a process that took forever, right?
[18:15.510 --> 18:34.350]  When you think about when people started working on, like, you know, the beginning, for instance, of the big industry that sells spyware to governments to spy on human rights activists, the beginning of all the cyber warfare paradigms, you know, the creation of all these cyber warrior units.
[18:34.610 --> 18:37.350]  I mean, I do cyber warfare, so I'm a bit heavily on...
[18:37.350 --> 18:41.430]  Not as in I conduct, but this is an area of interest for me.
[18:41.530 --> 18:43.830]  So I'm a little bit heavy on the military side of things.
[18:43.950 --> 18:51.330]  But, you know, when you think about everything that has happened in the securitization and the militarization of cyberspace, it really started in the 70s.
[18:51.330 --> 18:59.830]  And it took up until 2013 for people at the UN to say, hey, human rights applied to cyberspace.
[19:00.770 --> 19:02.110]  Like, 2013, right?
[19:02.190 --> 19:03.110]  So we're building on that.
[19:03.250 --> 19:06.310]  And even when we started doing this, people say, okay, human rights applied to cyberspace.
[19:06.370 --> 19:06.630]  Okay.
[19:06.830 --> 19:07.150]  Okay.
[19:07.970 --> 19:08.370]  Okay.
[19:08.690 --> 19:09.010]  How?
[19:09.510 --> 19:13.010]  And the okay how is kind of the question that we wanted to discuss and unpack.
[19:13.430 --> 19:15.310]  What are the points that we need to hit?
[19:15.570 --> 19:17.830]  You know, where should we focus at?
[19:17.830 --> 19:21.870]  What do we want to make a norm?
[19:22.110 --> 19:28.710]  As in what are the things that we want to ensure that everyone who operates in that space prioritizes and think about?
[19:30.710 --> 19:33.510]  Now, I don't know how we make a debate in that room, but Sasha, you're good at this.
[19:33.830 --> 19:36.110]  So back to you.
[19:36.270 --> 19:37.110]  Should I give some questions?
[19:37.570 --> 19:37.710]  Yeah.
[19:37.970 --> 19:38.130]  Yeah.
[19:38.350 --> 19:49.170]  So if we can get the lights up, maybe we can use the rest of the time to actually talk about what other people want to know about and have questions about, and some things that could help.
[19:49.610 --> 19:51.390]  We can start with a couple questions.
[19:51.610 --> 19:58.390]  Like, you can tell us just why you came, why you thought it was interesting, because you had the wrong room and the schedule was wrong.
[19:58.930 --> 19:59.770]  You can say that.
[20:00.270 --> 20:09.930]  You can also maybe talk about, like, outputs from a working group such as ours that you would find to be useful in the world, and your perspective on that.
[20:10.150 --> 20:11.770]  I think that we would maybe get a lot out of that.
[20:11.870 --> 20:13.830]  And we'll take it back to our working group.
[20:13.970 --> 20:16.770]  So I saw a hand in the back and then a hand here.
[20:17.790 --> 20:19.510]  Is there a microphone for the audience?
[20:23.270 --> 20:29.550]  Can you just recognise the problem with the other human rights and the greater arguments about that?
[20:29.730 --> 20:43.830]  So, each as a problem with the freedom of expression or privacy or the cultural rights, if there are any insults, which is something that, I believe, is part two of the idea that speaks of cultural rights.
[20:56.870 --> 20:57.270]  Absolutely.
[20:57.550 --> 21:04.910]  So the question was, can we just frame the Internet as a conduit for human rights and why are we trying to... I think that is actually what we're doing.
[21:05.070 --> 21:07.830]  So we're not trying to say that the Internet is a human right.
[21:08.050 --> 21:20.550]  We're actually... and I think it goes beyond that because I think, as Camille was saying, it's understood now in this sort of policy world that human rights apply online as a sort of space.
[21:20.830 --> 21:35.570]  There's still... because there's a lot of sectors involved and there's still not sort of wide recognition or... that there is really not a whole lot of separation between the Internet and our real lives.
[21:35.710 --> 21:36.670]  Like that's sort of eroding.
[21:36.910 --> 21:37.350]  But anyway.
[21:37.790 --> 21:45.170]  So I think that more... what we're fighting against is this notion... it's actually... you can see it outside of the Internet.
[21:45.170 --> 21:45.590]  for a second.
[21:45.790 --> 21:46.430]  So the PATRIOT Act.
[21:46.590 --> 21:52.890]  It's like we're inundated with this notion that if we all want to be secure, we need to give up our rights from time to time.
[21:53.090 --> 21:54.850]  It's mostly about the right to privacy.
[21:55.030 --> 22:00.550]  So like we should be okay with surveillance because it helps catch people who would make us insecure.
[22:00.750 --> 22:03.530]  So we're fighting that on in this sort of Internet context.
[22:04.130 --> 22:06.810]  So we see this a lot.
[22:06.970 --> 22:26.110]  And so we're going to policymakers and we're saying, you know, if you want your cybersecurity policy to be rights respecting, you can't just, as the EU just did, what, two weeks ago or released its cybersecurity strategy has like, you know, I think 16 points about mostly markets.
[22:26.210 --> 22:34.010]  And then the last point, which I think they might put on every single thing they do, which is about this, everything that we do in this context needs to respect human rights, right?
[22:34.050 --> 22:37.750]  Or the universal declaration of human rights.
[22:37.890 --> 22:40.770]  But without giving it like deep thought, right?
[22:40.850 --> 22:46.550]  Without thinking that, oh, maybe the reason why we want to have a secure Internet is so that people can enjoy their human rights.
[22:46.730 --> 22:53.130]  So we're trying to re-center humans in this entire debate from the ground up, which is quite the struggle.
[22:53.330 --> 22:53.550]  Go ahead.
[22:53.870 --> 22:53.930]  Yes.
[22:54.530 --> 22:54.730]  Yeah.
[22:54.870 --> 22:56.550]  And to give like a first step context.
[22:56.750 --> 22:57.990]  The first one was like, okay.
[22:58.190 --> 23:00.150]  You know, they think that no rights supply at all.
[23:00.530 --> 23:00.810]  Okay.
[23:00.990 --> 23:01.550]  We're over that.
[23:01.690 --> 23:04.830]  Then they were like, okay, maybe we can craft like Internet special rights.
[23:05.050 --> 23:08.730]  You know, like, okay, you got you got rights, but we, you know, we're gonna make it special for the Internet.
[23:09.070 --> 23:09.230]  And.
[23:09.310 --> 23:11.710]  Then we're like, no, no, there's a thing called a human rights.
[23:11.870 --> 23:13.650]  Like it was, it was hard enough to to get out the door.
[23:13.810 --> 23:14.870]  There are people agreeing on it.
[23:14.990 --> 23:16.370]  It's a legal framework.
[23:16.590 --> 23:17.470]  It's pretty good.
[23:17.930 --> 23:20.150]  Now let's use that and apply it to Internet.
[23:20.530 --> 23:23.950]  So we're like, okay, human rights apply online as well as offline.
[23:24.110 --> 23:24.530]  Big win.
[23:24.710 --> 23:26.070]  But now what does it actually mean?
[23:26.070 --> 23:28.230]  It's really hard to get to the details, right?
[23:28.330 --> 23:37.710]  So once you've said that, and you have people who agree with that, but then they're like, even though that is the case, massive Internet shut down when we think there's a little bit of unrest in the country.
[23:37.930 --> 23:38.790]  It's totally right, right?
[23:39.030 --> 23:41.630]  Like there's no overlap with freedom of expression or anything.
[23:42.010 --> 23:52.270]  And you're like, you know, just like the bringing it down to a level of detail when it becomes helpful and when it becomes applicable to specific situations, maybe it's massive Internet shut down.
[23:52.490 --> 23:59.930]  Again, maybe it's the export of spyware that governments buy to spy on and, you know, and hack onto human rights activists.
[24:00.190 --> 24:09.090]  The bringing it down to where it matters and making norms applicable to the reality of situations that people face is really like the last leg of the effort.
[24:09.170 --> 24:09.170]  Right.
[24:11.570 --> 24:15.950]  Just to very shortly add to this, I think...
[24:15.950 --> 24:17.530]  Do you call yourself a cyber warrior?
[24:18.150 --> 24:18.490]  No.
[24:18.770 --> 24:31.090]  Well, where is the... no mention is the name of the man who supposedly betrayed our country and is not allowed back in the country?
[24:31.890 --> 24:34.050]  We could... yeah.
[24:34.330 --> 24:35.430]  And maybe after... yeah.
[24:35.570 --> 24:37.550]  We do have a stack.
[24:37.750 --> 24:38.910]  So there's a guy with a...
[24:38.910 --> 24:42.950]  awesome LED or... anyway, and you want to respond?
[24:43.410 --> 24:46.530]  Yeah, what I wanted to respond to actually touches upon this.
[24:46.790 --> 25:00.890]  I think actually there's a lot of people in this room that might be next... tomorrow's threat, at least to like upcoming administrations, to upcoming threats to national security.
[25:01.150 --> 25:08.890]  And of course, every law will, will like fit to the human rights model because we all want to uphold it.
[25:08.890 --> 25:16.370]  But then, of course, there will be national security exceptions and then everything becomes a national security exception.
[25:16.950 --> 25:33.110]  And then, like finding some information that actually are blatant human rights violations and posting those online is a threat, of course, to national security of one or many countries.
[25:33.110 --> 25:37.630]  So, you here in a room are technologists.
[25:37.830 --> 25:41.130]  You're not so very well understood, especially not by policy makers.
[25:41.330 --> 25:49.090]  That is why videos like this explaining the Internet is necessary, even to people who are policy making on cyber.
[25:49.090 --> 25:54.170]  So, and... But the other thing is also true.
[25:54.330 --> 26:03.310]  We have always, for a long time, have turned our back to all those people talking about cyber this and cyber that because, you know, it's not so cyber, what we're doing.
[26:04.550 --> 26:16.690]  But at the same time, we are also in a position where we might become like the next group of people that is going to be, like, watched upon.
[26:16.950 --> 26:20.030]  Because, you know, we know the stuff that actually make the world run.
[26:20.170 --> 26:25.530]  Because when we made that stuff, people suddenly decided that it would be a good idea to run the world on it.
[26:26.590 --> 26:29.830]  So... And this is not something that I'm just making up.
[26:30.050 --> 26:51.290]  I mean, it's something that you can see in the way hacking is depicted, in the way people are like lawmakers, but also law enforcement is responding to people tinkering and hacking and even not even doing things that are close to anything that should be illegal.
[26:52.030 --> 26:56.090]  And this is something that is going to go on and on.
[26:56.290 --> 26:57.490]  Because people are...
[26:57.490 --> 27:06.830]  like some people among us and some people being technologists will hack into other systems and maybe do bad things.
[27:07.510 --> 27:09.450]  And that will be taken to all of us.
[27:10.250 --> 27:28.170]  And if we do not intervene in these policy debates and do not, like, try to steer, help steer them in the right directions or educate policy makers and what this technology actually means, then in a few years we're all f*cked.
[27:28.950 --> 27:29.710]  Oh, sorry.
[27:29.790 --> 27:30.310]  We're in the U.S.
[27:30.310 --> 27:31.390]  We're all screwed.
[27:31.630 --> 27:32.550]  There's a question here.
[27:33.650 --> 27:33.930]  Yeah.
[27:34.130 --> 27:39.570]  So you started out by batching the IETF and the IEEE for setting standards.
[27:39.850 --> 27:48.190]  What specific technical changes do you want to make that are not currently supported and in fact being blocked, as you assume, by the IETF?
[27:48.630 --> 27:50.010]  Oh, that was a misunderstanding.
[27:50.230 --> 27:51.370]  I don't...
[27:51.370 --> 27:53.510]  Anybody else disagree with that statement from that video?
[27:53.890 --> 27:55.270]  What statement are you talking about?
[27:55.410 --> 27:58.590]  Like, that video started out by bashing IETF for being...
[27:58.590 --> 28:00.630]  But these were all people that go to the IETF.
[28:00.870 --> 28:00.890]  Right.
[28:00.890 --> 28:02.370]  This was an interview of technologists...
[28:03.270 --> 28:03.410]  Right, I did that.
[28:03.410 --> 28:04.810]  But what technically do you want to change?
[28:05.210 --> 28:05.290]  Right.
[28:06.530 --> 28:09.190]  So regardless of the bashing or not, what would you like to change?
[28:09.270 --> 28:09.330]  Okay.
[28:09.330 --> 28:09.470]  Sure.
[28:09.810 --> 28:10.290]  Yeah, go ahead.
[28:11.010 --> 28:11.450]  You want to go?
[28:11.910 --> 28:12.310]  I...
[28:12.310 --> 28:12.990]  I actually...
[28:14.050 --> 28:18.030]  I have maybe a differently phrased question.
[28:18.030 --> 28:29.570]  I'm working with a commissioner who's been appointed with writing a report for the White House on enhancing national cybersecurity while protecting our privacy.
[28:29.570 --> 28:43.670]  And I would be very interested in knowing, instead of cataloging problems and dealing with symptoms, it's very tempting to just address symptoms, how can we address underlying issues?
[28:43.670 --> 28:44.470]  What are...
[28:44.470 --> 28:54.070]  What may be a direct recommendation that you would make, if you could, to the White House in terms of enhancing national cybersecurity while protecting privacy?
[28:54.490 --> 28:59.230]  Or just advice that you would give to the commission members who are tasked with writing this report?
[28:59.390 --> 28:59.570]  Right.
[28:59.710 --> 29:01.230]  We can take them as separate questions.
[29:01.470 --> 29:03.450]  I see some overlap, but not total.
[29:03.630 --> 29:03.970]  So, yeah.
[29:04.490 --> 29:07.430]  Yeah, I want to take the IETF question, because I agree with you.
[29:07.590 --> 29:09.010]  It's actually unclear.
[29:09.410 --> 29:11.770]  This video was made, I think, by them, right?
[29:12.130 --> 29:13.270]  That's what I was trying to explain.
[29:13.270 --> 29:16.970]  Yeah, it's an IETF video, and I don't know why they started with that quote.
[29:17.150 --> 29:26.370]  I think that, you know, it suggests that human rights is a sort of, like, additional concern that they sometimes get to when they have time.
[29:27.370 --> 29:29.010]  And that's back of their mind.
[29:29.290 --> 29:32.010]  It's not my experience working with people in this community.
[29:32.310 --> 29:38.970]  I know a lot of people who think that protocols are going to change the world and are going to make us stronger in terms of human rights.
[29:38.970 --> 29:48.470]  I can think of a series of actual changes that have happened at the IETF that create a stronger, you know, more secure, more free Internet.
[29:48.730 --> 29:51.750]  And I think this is our, like, number one protection.
[29:52.090 --> 29:55.210]  Like, protection by protocol, human rights embedded in the protocols.
[29:55.210 --> 29:57.250]  I think it's something we all believe in.
[29:57.410 --> 29:58.430]  I just wanted to clarify.
[29:58.710 --> 30:03.270]  I don't know why the statement was put in this video by the IETF.
[30:03.710 --> 30:07.290]  I think it's for them to say, like, oh, you might think we think like that, but we don't.
[30:07.290 --> 30:11.690]  And I think we all agree that, you know, protocols is our first line of defense.
[30:13.370 --> 30:21.670]  Now, where we get to is, like, people who don't speak protocols and people who, you know, like, whose action break protocols.
[30:22.050 --> 30:23.710]  What is it that we get in front of them?
[30:23.970 --> 30:26.970]  And they are the audience for that work, right?
[30:27.110 --> 30:34.310]  So the norms, they don't go to people who do fantastic technical work because, A, I think they're already thinking about this a lot.
[30:34.310 --> 30:38.850]  B, I think that they are the first line of defense and they don't need to be lectured about human rights.
[30:39.030 --> 30:44.090]  It's more like the rest, you know, the rest of the people who say they care about cybersecurity.
[30:44.530 --> 30:48.750]  As you said, you know, like people who are in charge of making cybersecurity policy.
[30:49.090 --> 30:51.890]  People who are, you know, if we talk about U.S.
[30:52.170 --> 30:58.410]  institutions sitting in all the security institutions from DHS to U.S.
[30:58.610 --> 31:03.990]  Cybercom, you know, including, you know, everything that's in between the NSA and all of that.
[31:03.990 --> 31:08.190]  Those people, what is it that they should know about or think about in terms of human rights?
[31:08.330 --> 31:11.250]  So just wanted to clarify that in case, like, I agree with you, it was confusing.
[31:11.470 --> 31:13.150]  I watched it and was like, yeah.
[31:14.450 --> 31:17.250]  Yeah, as well, it's interesting to look at it from that perspective.
[31:17.250 --> 31:20.550]  I think it was sort of trying to play to the controversy for the movie.
[31:20.570 --> 31:24.870]  But, I mean, I'm on a working group in the IETF that's focused on human rights and protocols.
[31:24.870 --> 31:28.830]  It's new and we're doing, so we're going both ways.
[31:29.050 --> 31:43.950]  We're trying to, as policy people, I'm a technologist, but showing up to the IETF and talking about human rights and getting technologists to see that sort of the open standards and the things that people are committed to in an altruistic way actually have a great deal of overlap with human rights.
[31:44.650 --> 31:50.170]  The way it's phrased and the universal declaration on human rights and human rights law.
[31:50.630 --> 31:52.250]  So, and then the other way, right?
[31:52.410 --> 31:55.030]  And so we want more technologists involved in policy making.
[31:55.230 --> 31:57.950]  So we're trying to build that bridge and it's really, really important.
[31:58.170 --> 32:03.590]  I think, so I wrote a blog post on this for this working group about why the IETF matters for privacy.
[32:03.950 --> 32:07.550]  And it actually laid out a lot of the issues that the IETF is working out now.
[32:07.770 --> 32:12.190]  I mean, metadata, for example, is like a really hard problem from a technical perspective.
[32:12.190 --> 32:16.630]  And if you don't solve it, you have a leak in privacy, right?
[32:16.730 --> 32:19.270]  And that's like, you know, that's not a policy issue.
[32:19.430 --> 32:20.730]  That's, that's a technical issue.
[32:21.150 --> 32:24.490]  There are lots of these things like OSCP stapling, like we can go on.
[32:24.570 --> 32:35.190]  And actually two years ago, Daniel Kahn-Gilmore, who was on that screen, had an excellent talk here that talked through some of those, some of those IETF related things.
[32:36.110 --> 32:40.230]  I would just like to really quickly answer your question about what are some concrete things.
[32:40.230 --> 32:43.190]  So, so the recommendations you should definitely download.
[32:43.490 --> 32:50.110]  It's a point-by-point, they're point-by-point recommendations for people who are writing policy.
[32:50.570 --> 32:54.650]  And in their concrete, and you can check them off the list.
[32:54.670 --> 32:56.350]  You can say, yes, we have done that.
[32:56.430 --> 33:00.450]  We have included a multi-stakeholder advisory group in drafting this policy.
[33:00.450 --> 33:10.630]  We have, you know, made sure that the only mention of humans is not to treat them as threats, but as to actually center them at the point of this legislation.
[33:10.970 --> 33:12.250]  Which is actually what you see.
[33:12.370 --> 33:20.130]  I think if you would go through and look at most cybersecurity law, if humans, if like people are mentioned at all, they're mentioned as a threat, right?
[33:20.190 --> 33:21.410]  Like a hacker or something.
[33:21.550 --> 33:22.290]  They're a potential threat.
[33:22.290 --> 33:26.690]  They're not seen as the subjects who benefit from cybersecurity law.
[33:26.970 --> 33:29.670]  So that, anyway, I think that would answer your question.
[33:30.290 --> 33:30.810]  Yeah.
[33:30.950 --> 33:31.430]  Sure.
[33:31.690 --> 33:31.830]  Yeah.
[33:31.970 --> 33:39.550]  Maybe I have just for the room a few concrete additions, because I saw some nodding when there was an ask for like concrete stuff.
[33:40.330 --> 33:51.410]  I think concrete stuff that I can think of is a push towards using all secure protocols on all levels.
[33:52.410 --> 33:57.970]  Fixing problems with the security of Internet routing, BGP.
[33:58.470 --> 34:08.030]  Fixing problems with the security of other systems that make the Internet work, but at the same time also can be misused like DNS.
[34:10.270 --> 34:19.650]  So, and then there's a lot of other old standards that have some great additions that sometimes have already been published and should be implemented.
[34:22.110 --> 34:32.750]  And sometimes there are policies or there are even standards that still need to be pushed or standardized in this part of the process.
[34:32.750 --> 34:57.410]  I think if it comes to policy, if you want to protect citizens, then the basic point to start is protecting the citizens and not necessarily protecting the institutions that were made in the first place to protect the citizens.
[34:57.410 --> 35:07.110]  Because what is happening a lot of times is that the protection of those institutions becomes more important than the protection of the citizens.
[35:07.370 --> 35:16.890]  And I think the whole narrative about national security exceptions is the kind of thing that epitomizes that narrative.
[35:16.890 --> 35:20.390]  And I think that narrative is in essence completely wrong.
[35:20.630 --> 35:28.270]  I think every law should be able to cope with any kind of thing it tries to defend.
[35:28.630 --> 35:35.270]  And there shouldn't be a kind of like specific exception that you can invoke almost every time.
[35:35.270 --> 35:40.550]  Because we are not talking about something that happens like once every hundred years.
[35:41.190 --> 35:47.650]  We are talking about a lot of the things that are called national security exceptions are happening all of the time.
[35:48.190 --> 35:50.330]  And then you can say, yeah, but the world has changed.
[35:50.510 --> 35:58.910]  Yeah, well, we have seen like, I mean, we saw a lot more deaths even by terrorism in the 80s than we are seeing right now.
[35:58.910 --> 36:09.390]  And I'm not saying that the world is a fun place and that we should not, that we should build our systems to, like, aid everyone in doing everything.
[36:09.470 --> 36:29.070]  But I think also as citizens, we should allow for, let's say, security forces, if they want to actually find actual criminals and not civilians, to have proper methods to do that in the actual world.
[36:29.330 --> 36:33.390]  And that's probably, it's going to be more expensive, but it's probably also going to work better.
[36:33.930 --> 36:42.990]  All of the last, like, few attempts and succeeded and failed attempts at terrorist attacks already had a lot of data.
[36:43.190 --> 36:49.010]  But it was just not that people collected from metadata that they could construct with hindsight.
[36:50.070 --> 36:50.950]  Sorry, yeah.
[36:50.950 --> 36:56.570]  I have a question about how, related to this, there are two states of emergency right now.
[36:56.690 --> 37:00.170]  There's one in Turkey and then one in France for, like, six months.
[37:01.310 --> 37:06.610]  Both had attacks, violent attacks, and people dying.
[37:07.290 --> 37:09.890]  The coup in Turkey and terrorist attacks in France.
[37:10.790 --> 37:15.270]  How do you see that impacting the conversations that you're talking about, the recommendations that you have?
[37:15.270 --> 37:19.610]  Because if you have an emergency, basically, the rule of law goes out the window.
[37:19.830 --> 37:21.230]  Government does what it wants to do.
[37:24.070 --> 37:30.130]  I want to take these questions about government, because I think, to be really honest, I think somehow they're a little bit unfair for us to address.
[37:30.270 --> 37:33.590]  Because we sit in a working group with governments, right?
[37:33.710 --> 37:35.790]  And we are the ones having to talk about this.
[37:35.950 --> 37:39.390]  And so, when you say, you know, like, hey, can we get something concrete?
[37:39.390 --> 37:40.290]  I agree with that.
[37:40.490 --> 37:42.550]  Like, our recommendations are super vague.
[37:42.730 --> 37:43.170]  You know why?
[37:43.510 --> 37:50.950]  Because they have to go through an interagency approval process, and they're signed and endorsed by the governmental members of this working group.
[37:51.090 --> 37:53.270]  France is a part of the Freedom Online Coalition.
[37:53.630 --> 37:55.850]  We had a fantastic meeting in Mongolia last year.
[37:56.050 --> 37:57.490]  They were nowhere to be seen, right?
[37:57.650 --> 38:03.710]  So, I'm not saying activists and academic and NGO people can't produce great, super specific recommendations.
[38:03.850 --> 38:06.050]  I can cite you, like, a list of them, right?
[38:06.610 --> 38:20.990]  The necessary and proportionate principles are fantastic work done by NGOs to actually get more clarity and be very specific on how the overlap, you know, between surveillance and, you know, legitimate access and privacy works.
[38:21.210 --> 38:25.330]  Now, what happens is that when you put government in the room and say, okay, now let's work on this together.
[38:25.330 --> 38:33.630]  And at the end of the day, you're going to have to do something and, you know, you're going to have to look at it, you put it through the interagency agreement process, but then you sign it and then you live up to it.
[38:33.630 --> 38:36.470]  And this is kind of where the conversation gets more complicated.
[38:36.690 --> 38:38.790]  Now, we can talk a little bit about, you know, why.
[38:39.170 --> 38:46.790]  The State Department people who've been, at least, you know, for the people who, the government people who we interacted with have been really, really great.
[38:46.950 --> 38:57.930]  They've actually pushed stuff forward, but it's complicated because governments have, you know, multiple people involved in this decision and there's always a way to say, well, you know, like, we totally agree with that.
[38:57.930 --> 39:05.670]  But then those people who are on the, you know, state of emergency side of things, they have a completely different discussion and, you know, this is in their backyard.
[39:05.870 --> 39:08.650]  So when you say, like, yeah, why can't we be more concrete?
[39:08.650 --> 39:23.870]  It's because when you say, okay, let's talk about, for instance, the vulnerability equities process and how it pertains to human rights, people say, hmm, we can't talk about that or don't have the mandate or this won't go through the interagency approval process or the right person's not in the room.
[39:24.550 --> 39:24.550]  Right.
[39:25.210 --> 39:26.930]  So the hard part about...
[39:26.930 --> 39:28.510]  The Internet doesn't belong to government.
[39:29.310 --> 39:48.770]  Yeah, so I think it's a really good question because, you know, like, let's bridge the gap between what great, fantastic activists, NGOs, academic and well-intentioned people, including the State Department, including very well-intentioned government people can do when they sit and agree together and what becomes an actual norm that they're willing to endorse and follow.
[39:48.770 --> 40:02.730]  Now, if anyone can help us, like, illuminate what happens in that gap and how do we manage to have, like, you know, great conversations, great guidance and then nothing but vague norms and then we're left saying, like, yeah, yeah, we do want to shift the paradigms and,
[40:02.850 --> 40:08.750]  you know, help us, you know, help us understand, like, how we can better plug this to ends of the spectrum.
[40:09.430 --> 40:10.630]  There was a question over here.
[40:10.710 --> 40:10.830]  Yeah?
[40:12.210 --> 40:12.610]  Yeah.
[40:12.610 --> 40:17.530]  So being in the United States, we haven't signed the conventions.
[40:18.750 --> 40:26.150]  related to disability discrimination against women or a convention on, like, protecting the children.
[40:27.630 --> 40:39.690]  Is there some sense that the United States not being a part of this is holding back the implementation of those human rights conventions internationally?
[40:40.250 --> 40:42.790]  And if so, what's the impact on the Internet?
[40:43.290 --> 40:51.390]  So I can think for ADA compliance on websites, very few websites are available in 2021, you know, being an example.
[40:51.810 --> 40:52.270]  Absolutely.
[40:52.510 --> 40:58.650]  I mean, just I'll speak more generally about this issue of signing things and then follow up.
[40:58.870 --> 41:01.670]  So that is absolutely a consideration.
[41:01.750 --> 41:03.050]  What if they don't sign?
[41:03.230 --> 41:06.270]  I'm actually going to talk about what if they do sign and then what?
[41:06.270 --> 41:09.250]  Because this is a very... this happens, right?
[41:09.370 --> 41:17.830]  So the Freedom Online Coalition, I told you, was set up as an initiative of a few countries, the United States being the major one in 2011.
[41:18.110 --> 41:21.190]  And so it's a member... so you have to be a state.
[41:21.370 --> 41:24.550]  So it's a member state organization... yeah, coalition.
[41:24.550 --> 41:25.910]  There are 23 members.
[41:26.970 --> 41:35.390]  And then they sort of invite civil society academics and technical people, you know, randomly to come and do things like a working group.
[41:36.990 --> 41:42.130]  There was something... a really great moment when they had the Freedom Online Coalition in Tallinn.
[41:42.270 --> 41:43.750]  They had a Tallinn agreement come out.
[41:43.870 --> 41:45.050]  And if you read it, it's quite good.
[41:45.190 --> 41:46.070]  This is pre-Snowden.
[41:46.230 --> 41:47.530]  There's stuff in there about surveillance.
[41:47.830 --> 41:48.770]  Like, it's really solid.
[41:49.430 --> 41:52.430]  There's been zero... and all the member states signed it.
[41:52.850 --> 41:55.090]  U.S., Canada, Australia.
[41:55.410 --> 41:56.310]  Can we go through the five eyes?
[41:56.930 --> 41:58.410]  Yeah, they all signed it, right?
[41:58.670 --> 42:00.050]  But there's been no follow-up.
[42:00.150 --> 42:05.090]  There's been no revocation of membership because of, like, shady practices.
[42:05.350 --> 42:06.510]  I mean, Tunisia's on there.
[42:06.790 --> 42:07.790]  Like, all kinds of things, right?
[42:07.930 --> 42:09.370]  So no real accountability.
[42:10.330 --> 42:17.150]  We're so far back in our working group that we can't even get our recommendations to be signed by the 23 member states.
[42:17.150 --> 42:24.070]  We're still just sort of, like, as a working group, which, to our credit, has been a collaboration with Canada and the U.S.
[42:24.170 --> 42:30.090]  We have also the Netherlands, who are, like, shining stars, comparatively, and have really greased the wheels.
[42:30.370 --> 42:30.830]  Oh, my God.
[42:31.870 --> 42:36.990]  You know, some of the other working groups have, like, Britain, which I hear on another working group is even worse than working with the U.S.
[42:36.990 --> 42:41.430]  I mean, they really stonewall some things, like, about trying to get... like, we couldn't mention surveillance.
[42:41.430 --> 42:46.910]  How do you have cybersecurity focused on human rights and you can't say the word surveillance?
[42:47.070 --> 42:49.810]  That actually made one of the co-founders of the working group leave.
[42:50.130 --> 42:53.570]  So there was a controversy about that around at the Mongolian meeting.
[42:53.730 --> 43:02.370]  But anyway, so, I mean, just to your point, like, I think sometimes we are really focused on these sort of things where people sign on and they accept and so on.
[43:02.370 --> 43:08.850]  But I found just generally in the policy world that even then, like, there's just so little accountability and follow-up that...
[43:08.850 --> 43:18.630]  That's, I think, why we're, like, we're desperate for some more concrete goals we can get out besides these sort of recommendations that people sign on to but then don't actually follow up with.
[43:18.730 --> 43:24.070]  So, like, ranking digital rights is a really good initiative that tries to score people.
[43:24.230 --> 43:27.270]  You've also seen the EFF, like, they score people for various things.
[43:27.270 --> 43:33.750]  I mean, like, that kind of stuff seems to be a bit more effective because you're actually getting the output, not just, like, the promise, right?
[43:34.770 --> 43:40.750]  So if people want to take our norms and then create a scoring card and then run the country through this, well, this is a great idea.
[43:40.990 --> 43:49.490]  But I just want to, you know, I just want to highlight, though, that, you know, to Canada and the U.S.'s credit, they showed up.
[43:49.750 --> 43:54.450]  Like, there are a lot of countries who are part of this coalition who never showed up.
[43:54.990 --> 43:55.690]  That's... yeah.
[43:55.690 --> 43:55.750]  Yeah.
[43:56.810 --> 43:59.510]  So I think there are some more questions.
[44:12.130 --> 44:12.630]  So...
[44:17.790 --> 44:20.250]  Is the question why is French not showing up?
[44:22.010 --> 44:22.510]  Well...
[44:23.730 --> 44:26.190]  Do I get to answer that because I'm French?
[44:28.250 --> 44:30.390]  You know, I have no idea.
[44:34.650 --> 44:35.150]  Um...
[44:35.150 --> 44:35.790]  I...
[44:38.870 --> 44:40.410]  You know, it's...
[44:40.410 --> 44:43.070]  Who has shamed them into not showing up?
[44:43.150 --> 44:44.390]  Not many people either, right?
[44:45.170 --> 44:45.670]  Like...
[44:46.510 --> 44:46.950]  Um...
[44:46.950 --> 44:47.150]  Yeah.
[44:47.630 --> 44:48.330]  Tweeted about it.
[44:48.490 --> 44:49.870]  No, we tweeted about it.
[44:49.990 --> 44:50.710]  But, you know...
[44:50.710 --> 44:55.850]  Yeah, I mean, I don't think anyone's on the hook for showing up and for making anything, like, happen.
[44:55.850 --> 44:56.670]  That's...
[44:56.670 --> 44:57.170]  Yeah.
[44:57.610 --> 44:58.050]  That's it?
[44:59.650 --> 45:00.010]  Yeah.
[45:00.850 --> 45:00.970]  Yeah.
[45:00.970 --> 45:01.090]  Mm-hmm.
[45:02.130 --> 45:02.350]  Yeah.
[45:02.570 --> 45:22.010]  Beyond recognition, what are your proposals and strategy for enforcement given that human rights law is often limited to only applying to state actors and humanitarian law, international and it takes place in terms of conflict, cyber conflict is so hard to discern and so much of it is covert.
[45:22.530 --> 45:23.770]  How do you bring that up?
[45:25.090 --> 45:47.530]  So, I think, for me, but that's mostly, I think, from my standpoint as a technologist, is what I try to achieve, at least, is that if we now develop sound encryption for end users or for either data in rest or data in transit, that those are not going to be forbidden in five years.
[45:47.750 --> 45:54.150]  That, to me, would already be, like, a major thing to achieve.
[45:54.350 --> 45:58.910]  I think we're at that point where we can't just... and that's what I was trying to say.
[45:58.930 --> 46:01.870]  I don't think that policy is going to save the world.
[46:02.050 --> 46:02.990]  But it's also not...
[46:02.990 --> 46:05.150]  I'm sorry for your Silicon Valley folks.
[46:05.250 --> 46:07.490]  It's also not technology that's going to save the world.
[46:07.490 --> 46:10.430]  And it's also not law or anything else.
[46:11.450 --> 46:20.990]  So, if we want to, like, keep the world a bit sane and or improve on it, then we should work on all the fields.
[46:21.210 --> 46:25.890]  And I think what we are trying to do here is at least make sure that things...
[46:25.890 --> 46:28.650]  I mean, things are always shifting in one way, right?
[46:28.770 --> 46:37.090]  It's always, like, intelligence agencies, police, military getting more power and not necessarily getting less, right?
[46:37.090 --> 46:40.990]  It's very hard to shift things back from that perspective.
[46:41.450 --> 46:45.910]  So, trying to change this narrative and talking about we should protect the end user.
[46:46.070 --> 46:49.090]  And that should also be a goal of policymakers.
[46:49.850 --> 46:56.090]  So, that might even be saying, well, if you're handling any kind of private data, then all the connections should be encrypted.
[46:56.310 --> 47:00.530]  And that is something that the companies that are handling the data should do, etc., etc.
[47:00.530 --> 47:11.830]  So, it's this kind of things, I think, that could help getting a better defense on the, like, very outskirts of what the Internet is.
[47:11.930 --> 47:13.150]  Like, the end user.
[47:13.410 --> 47:21.470]  And if the end user is better defended because we have a more secure Internet and a more secure computing system.
[47:21.470 --> 47:25.010]  And even talking beyond that with the kind of Internet of things.
[47:25.470 --> 47:30.150]  Also, more secure fridges and any kind of instrument that can be used to kill people.
[47:30.770 --> 47:40.510]  That you just have in your home with an Internet connection on IPv6 without any, like, way of protecting it from others.
[47:40.510 --> 47:46.190]  Like, turning it a bit down so your food goes to waste or worse.
[47:48.950 --> 47:51.410]  I also believe in the small step strategy.
[47:51.770 --> 47:54.210]  If you get them to say, okay, I signed this document.
[47:54.230 --> 47:57.750]  I made it as ex-government in collaboration with people.
[47:57.930 --> 47:59.410]  And that's going to be my norm.
[47:59.750 --> 48:04.930]  Then the next best thing is like, okay, what's another document that outlines norms for you?
[48:05.010 --> 48:09.370]  That actually serves as a guiding blueprint for an organization that's concerned?
[48:09.370 --> 48:12.050]  A good one is a national cybersecurity strategy.
[48:12.390 --> 48:16.770]  All these countries have national cybersecurity strategies that they publish.
[48:16.970 --> 48:17.630]  They share.
[48:17.770 --> 48:19.190]  It's best practices for them.
[48:19.630 --> 48:25.330]  And their cybersecurity agencies actually are in charge of abiding by this role, right?
[48:25.490 --> 48:28.490]  So if you get them to the norm and then you look at the national cybersecurity strategies.
[48:29.130 --> 48:30.250]  The U.S. one's actually pretty good.
[48:30.330 --> 48:32.870]  But if you look at the French one, there's no mention of privacy.
[48:33.130 --> 48:34.590]  No mention of freedom of expression.
[48:34.850 --> 48:36.210]  No mention of human rights whatsoever.
[48:36.210 --> 48:50.110]  And so if you're someone who works in the cyber security agency, you legitimately can say I'm sorry, I've never heard about human rights and it's true because none of the documents that actually set out a blueprint for the job you're gonna do mention any of that,
[48:50.210 --> 48:50.290]  right?
[48:50.490 --> 49:00.430]  So if you get to the norm, we can look at like what's the next best thing that's actually going to be used by the practitioners on the government side that is supposed to determine their strategy.
[49:00.730 --> 49:05.070]  I think, I'm not saying it's gonna save the world, but I think it would be like a good first step.
[49:06.230 --> 49:09.670]  I'm definitely not saying the national cyber security stages will save the world.
[49:13.780 --> 49:29.980]  So I think one practical step we can take towards this, and this is never going to happen, but bring with me for a moment, is if governments would start publishing specs on their actual network infrastructures and things like that.
[49:29.980 --> 49:38.880]  I think most of us here are in the opinion that if your system can't undergo scrutiny, then it's not secure.
[49:39.040 --> 49:41.340]  If that breaks it, that's a pretty weak system.
[49:41.340 --> 49:53.380]  So I think, like, we would never see an RFC for prison, but it would not get very far if they would have to have write Britain, you know what I'm saying?
[49:53.580 --> 49:53.980]  That's right.
[49:54.200 --> 50:08.960]  So I think if we can kind of enforce some sort of documentation of how they're interacting with the nation's information systems, I think that would go a long way towards abuse of that system.
[50:08.960 --> 50:11.760]  Yeah, and I think that's a really good idea.
[50:12.740 --> 50:24.040]  And something that, just sort of in my experience with Internet policy generally, that sort of less developed countries would be way more open to.
[50:24.040 --> 50:28.620]  I mean, I think you see a lot of, like, open legislation initiatives, like in Latin America.
[50:29.640 --> 50:31.560]  It's happened a bit in Europe, I guess.
[50:31.760 --> 50:46.340]  But, you know, like, I think a lot of where this sort of pretty weak feeling like policy work is actually quite impactful is in countries that don't really have cyber security policy yet.
[50:46.340 --> 51:01.520]  And I think those kinds of new ideas or something, like going out of a limb, like really looking at this from, like an RFC, like putting it in that way is actually quite a great idea, would maybe be something that people would consider.
[51:01.700 --> 51:07.180]  I mean, I think, you know, the thing is, openness is really useful.
[51:07.260 --> 51:11.980]  But again, like there's this perception that the people are threats.
[51:11.980 --> 51:14.120]  They're not going to help, right?
[51:14.120 --> 51:28.560]  You know, technologists are at the table, but these are technologists that have gone to Ivy League institutions, that have spent time in government, that maybe they don't even have even really decent technical expertise, but they are again and again and again,
[51:28.700 --> 51:31.220]  sort of, you know, expert technocrats, really.
[51:31.840 --> 51:45.420]  And so I think, you know, when, if you, if you think that like, okay, opening up your, your infrastructure as a way of like getting a lot of eyes on it and making sure that it's, it's quite solid, you know, that there's, the impulse is not to say, oh,
[51:45.520 --> 51:47.820]  because there are a lot of really brilliant people out there that could help us.
[51:47.940 --> 51:53.540]  The impulse is, there are a lot of, you know, evilly genius people that could like attack us, right?
[51:53.640 --> 51:56.260]  Like that's the, and that's what we're trying to shift, right?
[51:56.440 --> 51:56.800]  That's...
[51:58.600 --> 52:00.620]  Okay, um, yes, you may.
[52:00.740 --> 52:09.760]  Yeah, one, I think, I think you're getting to a core, core piece of the puzzle we're trying to solve, is that all these things are absolutely, horribly overclassified.
[52:10.120 --> 52:14.360]  And more often than not, governments show up being like, yeah, we need to have a real debate about that.
[52:14.580 --> 52:17.180]  But I'm sorry, we can't tell you anything that's going on, right?
[52:17.420 --> 52:26.700]  And so General Hayden, for instance, who's a former director of both the CIA and the NSA, was asked about cyber operations, it was like, yeah, that's, you know, definitely something we need to talk about.
[52:26.700 --> 52:31.400]  And he admitted that that thing was hideously overclassified.
[52:31.600 --> 52:33.960]  He said, hideously overclassified.
[52:34.180 --> 52:45.440]  I think we have a real transparency problem, and the root of the transparency problem is how governments decide to classify things pertaining to cybersecurity, and how that hurts the human rights debate that needs to happen in that space.
[52:47.180 --> 52:48.640]  That's a very good way back.
[52:49.660 --> 52:51.480]  Oh, that's our exit statement?
[52:51.720 --> 52:52.580]  I think so.
[52:52.820 --> 52:53.660]  Working group out.
[52:55.060 --> 52:55.820]  Thank you.
[52:55.820 --> 52:56.860]  Thanks.
[52:56.860 --> 52:57.140]  Thank you.