<?xml version='1.0' encoding='utf-8'?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" ipr="trust200902" docName="draft-farrell-tenyearsafter-05" number="9446" submissionType="independent" category="info" tocInclude="true" sortRefs="true" symRefs="true" updates="" obsoletes="" xml:lang="en" prepTime="2023-07-20T13:53:25" indexInclude="true" scripts="Common,Latin" tocDepth="3">
  <link href="https://datatracker.ietf.org/doc/draft-farrell-tenyearsafter-05" rel="prev"/>
  <link href="https://dx.doi.org/10.17487/rfc9446" rel="alternate"/>
  <link href="urn:issn:2070-1721" rel="alternate"/>
  <front>
    <title abbrev="Ten Years After">Reflections on Ten Years Past the Snowden Revelations</title>
    <seriesInfo name="RFC" value="9446" stream="independent"/>
    <author initials="S." surname="Farrell" fullname="Stephen Farrell">
      <organization showOnFrontPage="true">Trinity College, Dublin</organization>
      <address>
        <postal>
          <country>Ireland</country>
        </postal>
        <email>stephen.farrell@cs.tcd.ie</email>
      </address>
    </author>
    <author initials="F." surname="Badii" fullname="Farzaneh Badii">
      <organization showOnFrontPage="true">Digital Medusa</organization>
      <address>
        <email>farzaneh.badii@gmail.com</email>
      </address>
    </author>
    <author initials="B." surname="Schneier" fullname="Bruce Schneier">
      <organization showOnFrontPage="true">Harvard University</organization>
      <address>
        <postal>
          <country>United States of America</country>
        </postal>
        <email>schneier@schneier.com</email>
      </address>
    </author>
    <author initials="S. M." surname="Bellovin" fullname="Steven M. Bellovin">
      <organization showOnFrontPage="true">Columbia University</organization>
      <address>
        <postal>
          <country>United States of America</country>
        </postal>
        <email>smb@cs.columbia.edu</email>
      </address>
    </author>
    <date month="07" year="2023"/>
    <keyword>pervasive monitoring</keyword>
    <keyword>privacy</keyword>
    <keyword>security</keyword>
    <abstract pn="section-abstract">
      <t indent="0" pn="section-abstract-1">This memo contains the thoughts and recountings of events that
transpired during and after the release of information about the United States National Security Agency (NSA)
by Edward Snowden in 2013.  There are four perspectives: that of someone 
who was involved with sifting through the information to responsibly 
inform the public, that of a security area director of the IETF, that of a human 
rights expert, and that of a computer science and affiliate law professor. The purpose 
of this memo is to provide some historical perspective, while at the 
same time offering a view as to what security and privacy challenges 
the technical community should consider.  These essays do not represent a consensus view, but that of the individual authors.
</t>
    </abstract>
    <boilerplate>
      <section anchor="status-of-memo" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.1">
        <name slugifiedName="name-status-of-this-memo">Status of This Memo</name>
        <t indent="0" pn="section-boilerplate.1-1">
            This document is not an Internet Standards Track specification; it is
            published for informational purposes.
        </t>
        <t indent="0" pn="section-boilerplate.1-2">
            This is a contribution to the RFC Series, independently of any
            other RFC stream.  The RFC Editor has chosen to publish this
            document at its discretion and makes no statement about its value
            for implementation or deployment.  Documents approved for
            publication by the RFC Editor are not candidates for any level of
            Internet Standard; see Section 2 of RFC 7841.
        </t>
        <t indent="0" pn="section-boilerplate.1-3">
            Information about the current status of this document, any
            errata, and how to provide feedback on it may be obtained at
            <eref target="https://www.rfc-editor.org/info/rfc9446" brackets="none"/>.
        </t>
      </section>
      <section anchor="copyright" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.2">
        <name slugifiedName="name-copyright-notice">Copyright Notice</name>
        <t indent="0" pn="section-boilerplate.2-1">
            Copyright (c) 2023 IETF Trust and the persons identified as the
            document authors. All rights reserved.
        </t>
        <t indent="0" pn="section-boilerplate.2-2">
            This document is subject to BCP 78 and the IETF Trust's Legal
            Provisions Relating to IETF Documents
            (<eref target="https://trustee.ietf.org/license-info" brackets="none"/>) in effect on the date of
            publication of this document. Please review these documents
            carefully, as they describe your rights and restrictions with
            respect to this document.
        </t>
      </section>
    </boilerplate>
    <toc>
      <section anchor="toc" numbered="false" removeInRFC="false" toc="exclude" pn="section-toc.1">
        <name slugifiedName="name-table-of-contents">Table of Contents</name>
        <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1">
          <li pn="section-toc.1-1.1">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.1"><xref derivedContent="1" format="counter" sectionFormat="of" target="section-1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-introduction">Introduction</xref></t>
          </li>
          <li pn="section-toc.1-1.2">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.2.1"><xref derivedContent="2" format="counter" sectionFormat="of" target="section-2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-bruce-schneier-snowden-ten-">Bruce Schneier: Snowden Ten Years Later</xref></t>
          </li>
          <li pn="section-toc.1-1.3">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.3.1"><xref derivedContent="3" format="counter" sectionFormat="of" target="section-3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-stephen-farrell-ietf-and-in">Stephen Farrell: IETF and Internet Technical Community Reaction</xref></t>
          </li>
          <li pn="section-toc.1-1.4">
            <t indent="0" pn="section-toc.1-1.4.1"><xref derivedContent="4" format="counter" sectionFormat="of" target="section-4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-farzaneh-badii-did-snowdens">Farzaneh Badii: Did Snowden's Revelations Help with Protecting Human Rights on the Internet?</xref></t>
          </li>
          <li pn="section-toc.1-1.5">
            <t indent="0" pn="section-toc.1-1.5.1"><xref derivedContent="5" format="counter" sectionFormat="of" target="section-5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-steven-m-bellovin-governmen">Steven M. Bellovin: Governments and Cryptography: The Crypto Wars</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.5.2">
              <li pn="section-toc.1-1.5.2.1">
                <t indent="0" pn="section-toc.1-1.5.2.1.1"><xref derivedContent="5.1" format="counter" sectionFormat="of" target="section-5.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-historical-background">Historical Background</xref></t>
              </li>
              <li pn="section-toc.1-1.5.2.2">
                <t indent="0" pn="section-toc.1-1.5.2.2.1"><xref derivedContent="5.2" format="counter" sectionFormat="of" target="section-5.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-the-crypto-wars-begin">The Crypto Wars Begin</xref></t>
              </li>
              <li pn="section-toc.1-1.5.2.3">
                <t indent="0" pn="section-toc.1-1.5.2.3.1"><xref derivedContent="5.3" format="counter" sectionFormat="of" target="section-5.3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-the-battle-is-joined">The Battle Is Joined</xref></t>
              </li>
              <li pn="section-toc.1-1.5.2.4">
                <t indent="0" pn="section-toc.1-1.5.2.4.1"><xref derivedContent="5.4" format="counter" sectionFormat="of" target="section-5.4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-the-hidden-battle">The Hidden Battle</xref></t>
              </li>
              <li pn="section-toc.1-1.5.2.5">
                <t indent="0" pn="section-toc.1-1.5.2.5.1"><xref derivedContent="5.5" format="counter" sectionFormat="of" target="section-5.5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-whither-the-ietf">Whither the IETF?</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.6">
            <t indent="0" pn="section-toc.1-1.6.1"><xref derivedContent="6" format="counter" sectionFormat="of" target="section-6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-security-considerations">Security Considerations</xref></t>
          </li>
          <li pn="section-toc.1-1.7">
            <t indent="0" pn="section-toc.1-1.7.1"><xref derivedContent="7" format="counter" sectionFormat="of" target="section-7"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-iana-considerations">IANA Considerations</xref></t>
          </li>
          <li pn="section-toc.1-1.8">
            <t indent="0" pn="section-toc.1-1.8.1"><xref derivedContent="8" format="counter" sectionFormat="of" target="section-8"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-informative-references">Informative References</xref></t>
          </li>
          <li pn="section-toc.1-1.9">
            <t indent="0" pn="section-toc.1-1.9.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.a"/><xref derivedContent="" format="title" sectionFormat="of" target="name-acknowledgments">Acknowledgments</xref></t>
          </li>
          <li pn="section-toc.1-1.10">
            <t indent="0" pn="section-toc.1-1.10.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.b"/><xref derivedContent="" format="title" sectionFormat="of" target="name-authors-addresses">Authors' Addresses</xref></t>
          </li>
        </ul>
      </section>
    </toc>
  </front>
  <middle>
    <section anchor="introduction" numbered="true" removeInRFC="false" toc="include" pn="section-1">
      <name slugifiedName="name-introduction">Introduction</name>
      <t indent="0" pn="section-1-1">On June 6th, 2013, an article appeared in <em>The Guardian</em> <xref target="Guard2013" format="default" sectionFormat="of" derivedContent="Guard2013"/>
that was the beginning of a series of what have come to be known as
the Snowden revelations, describing certain activities of the United
States National Security Agency (NSA).  These activities included,
amongst others: secret court orders; secret agreements for the receipt
of so-called "meta-information" that includes source, destination, and
timing of communications; and tapping of communications lines.  The
breathtaking scope of the operations shocked the Internet technical
community and resulted in a sea change within the IETF, IAB,
and other standards organizations.</t>
      <t indent="0" pn="section-1-2">Now that some years have passed, it seems appropriate to reflect on that
period of time and to consider what effect the community's actions had,
where security has improved, how the threat surface has evolved, what
areas haven't improved, and where the community might invest future
efforts.</t>
      <t indent="0" pn="section-1-3">Bruce Schneier begins this compendium of individual essays by bringing
us back to 2013, recalling how it was for him and others to report
what was happening, and the mindset of those involved.  Next, Stephen
Farrell reviews the technical community's reactions and in particular
the reactions of the IETF community, technical advances, and where
threats remain.  Then Farzaneh Badii discusses the impact of those
advances -- or lack thereof -- on human rights.  Finally Steven
M. Bellovin puts the Snowden revelations into an ever-evolving
historical context of secrets and secret stealing that spans
centuries, closing with some suggestions for IETF.</t>
      <t indent="0" pn="section-1-4">Readers are invited to consider what impact we as a community have
had, what challenges remain, and what positive contribution the
technical community can and should make to address security and
privacy of citizens of the world.</t>
      <t indent="0" pn="section-1-5">-- Eliot Lear, Independent Submissions Editor for the RFC Series</t>
    </section>
    <section anchor="bruce-schneier-snowden-ten-years-later" numbered="true" removeInRFC="false" toc="include" pn="section-2">
      <name slugifiedName="name-bruce-schneier-snowden-ten-">Bruce Schneier: Snowden Ten Years Later</name>
      <t indent="0" pn="section-2-1">In 2013 and 2014, I wrote extensively about new revelations regarding
NSA surveillance based on the documents provided by Edward
Snowden. But I had a more personal involvement as well.</t>
      <t indent="0" pn="section-2-2">I wrote the essay below in September 2013. <em>The New Yorker</em> agreed to
publish it, but <em>The Guardian</em> asked me not to. It was
scared of UK law enforcement and worried that this essay would
reflect badly on it. And given that the UK police would raid its
offices in July 2014, it had legitimate cause to be worried.</t>
      <t indent="0" pn="section-2-3">Now, ten years later, I offer this as a time capsule of what those
early months of Snowden were like.</t>
      <blockquote pn="section-2-4">
        <t indent="0" pn="section-2-4.1">It's a surreal experience, paging through hundreds of top-secret NSA
documents. You're peering into a forbidden world: strange, confusing,
and fascinating all at the same time.</t>
        <t indent="0" pn="section-2-4.2">I had flown down to Rio de Janeiro in late August at the request of
Glenn Greenwald. He had been working on the Edward Snowden archive for
a couple of months, and had a pile of more technical documents that he
wanted help interpreting. According to Greenwald, Snowden also thought
that bringing me down was a good idea.</t>
        <t indent="0" pn="section-2-4.3">It made sense. I didn't know either of them, but I have been writing
about cryptography, security, and privacy for decades. I could
decipher some of the technical language that Greenwald had difficulty
with, and understand the context and importance of various
document. And I have long been publicly critical of the NSA's
eavesdropping capabilities. My knowledge and expertise could help
figure out which stories needed to be reported.</t>
        <t indent="0" pn="section-2-4.4">I thought about it a lot before agreeing. This was before David
Miranda, Greenwald's partner, was detained at Heathrow airport by the
UK authorities; but even without that, I knew there was a risk. I fly
a lot -- a quarter of a million miles per year -- and being put on a TSA
list, or being detained at the US border and having my electronics
confiscated, would be a major problem. So would the FBI breaking into my
home and seizing my personal electronics. But in the end, that made me
more determined to do it.</t>
        <t indent="0" pn="section-2-4.5">I did spend some time on the phone with the attorneys recommended to
me by the ACLU and the EFF. And I talked about it with my partner,
especially when Miranda was detained three days before my departure.
Both Greenwald and his employer, <em>The Guardian</em>, are careful about whom
they show the documents to. They publish only those portions essential
to getting the story out. It was important to them that I be a
co-author, not a source. I didn't follow the legal reasoning, but the
point is that <em>The Guardian</em> doesn't want to leak the documents to
random people. It will, however, write stories in the public interest,
and I would be allowed to review the documents as part of that
process. So after a Skype conversation with someone at <em>The Guardian</em>, I
signed a letter of engagement.</t>
        <t indent="0" pn="section-2-4.6">And then I flew to Brazil.</t>
        <t indent="0" pn="section-2-4.7">I saw only a tiny slice of the documents, and most of what I saw was
surprisingly banal. The concerns of the top-secret world are largely
tactical: system upgrades, operational problems owing to weather,
delays because of work backlogs, and so on. I paged through weekly
reports, presentation slides from status meetings, and general
briefings to educate visitors. Management is management, even inside
the NSA. Reading the documents, I felt as though I were sitting through
some of those endless meetings.</t>
        <t indent="0" pn="section-2-4.8">The meeting presenters try to spice things up. Presentations regularly
include intelligence success stories. There were details -- what had been
found, and how, and where it helped -- and sometimes there were attaboys
from "customers" who used the intelligence. I'm sure these are
intended to remind NSA employees that they're doing good. It
definitely had an effect on me. Those were all things I want the NSA
to be doing.</t>
        <t indent="0" pn="section-2-4.9">There were so many code names. Everything has one: every program,
every piece of equipment, every piece of software. Sometimes code
names had their own code names. The biggest secrets seem to be the
underlying real-world information: which particular company
MONEYROCKET is; what software vulnerability EGOTISTICALGIRAFFE -- really,
I am not making that one up -- is; how TURBINE works. Those secrets
collectively have a code name -- ECI, for exceptionally compartmented
information -- and almost never appear in the documents. Chatting with
Snowden on an encrypted IM connection, I joked that the NSA cafeteria
menu probably has code names for menu items. His response: "Trust me
when I say you have no idea."</t>
        <t indent="0" pn="section-2-4.10">Those code names all come with logos, most of them amateurish and a
lot of them dumb. Note to the NSA: take some of that more than
ten-billion-dollar annual budget and hire yourself a design
firm. Really; it'll pay off in morale.</t>
        <t indent="0" pn="section-2-4.11">Once in a while, though, I would see something that made me stop,
stand up, and pace around in circles. It wasn't that what I read was
particularly exciting, or important. It was just that it was
startling. It changed -- ever so slightly -- how I thought about the world.</t>
        <t indent="0" pn="section-2-4.12">Greenwald said that that reaction was normal when people started
reading through the documents.</t>
        <t indent="0" pn="section-2-4.13">Intelligence professionals talk about how disorienting it is living on
the inside. You read so much classified information about the world's
geopolitical events that you start seeing the world differently. You
become convinced that only the insiders know what's really going on,
because the news media is so often wrong. Your family is
ignorant. Your friends are ignorant. The world is ignorant. The only
thing keeping you from ignorance is that constant stream of classified
knowledge. It's hard not to feel superior, not to say things like "If
you only knew what we know" all the time. I can understand how General
Keith Alexander, the director of the NSA, comes across as so
supercilious; I only saw a minute fraction of that secret world, and I
started feeling it.</t>
        <t indent="0" pn="section-2-4.14">It turned out to be a terrible week to visit Greenwald, as he was
still dealing with the fallout from Miranda's detention. Two other
journalists, one from <em>The Nation</em> and the other from <em>The Hindu</em>, were
also in town working with him. A lot of my week involved Greenwald
rushing into my hotel room, giving me a thumb drive of new stuff to
look through, and rushing out again.</t>
        <t indent="0" pn="section-2-4.15">A technician from <em>The Guardian</em> got a search capability working while I
was there, and I spent some time with it. Question: when you're given
the capability to search through a database of NSA secrets, what's the
first thing you look for? Answer: your name.</t>
        <t indent="0" pn="section-2-4.16">It wasn't there. Neither were any of the algorithm names I knew, not
even algorithms I knew that the US government used.</t>
        <t indent="0" pn="section-2-4.17">I tried to talk to Greenwald about his own operational security. It
had been incredibly stupid for Miranda to be traveling with NSA
documents on the thumb drive. Transferring files electronically is
what encryption is for. I told Greenwald that he and Laura Poitras
should be sending large encrypted files of dummy documents back and
forth every day.</t>
        <t indent="0" pn="section-2-4.18">Once, at Greenwald's home, I walked into the backyard and looked for
TEMPEST receivers hiding in the trees. I didn't find any, but that
doesn't mean they weren't there. Greenwald has a lot of dogs, but I
don't think that would hinder professionals. I'm sure that a bunch of
major governments have a complete copy of everything Greenwald
has. Maybe the black bag teams bumped into each other in those early
weeks.</t>
        <t indent="0" pn="section-2-4.19">I started doubting my own security procedures. Reading about the NSA's
hacking abilities will do that to you. Can it break the encryption on
my hard drive? Probably not. Has the company that makes my encryption
software deliberately weakened the implementation for it?
Probably. Are NSA agents listening in on my calls back to the US? Very
probably. Could agents take control of my computer over the Internet
if they wanted to? Definitely. In the end, I decided to do my best and
stop worrying about it. It was the agency's documents, after all. And
what I was working on would become public in a few weeks.</t>
        <t indent="0" pn="section-2-4.20">I wasn't sleeping well, either. A lot of it was the sheer magnitude of
what I saw. It's not that any of it was a real surprise. Those of us
in the information security community had long assumed that the NSA
was doing things like this. But we never really sat down and figured
out the details, and to have the details confirmed made a big
difference. Maybe I can make it clearer with an analogy. Everyone
knows that death is inevitable; there's absolutely no surprise about
that. Yet it arrives as a surprise, because we spend most of our lives
refusing to think about it. The NSA documents were a bit like
that. Knowing that it is surely true that the NSA is eavesdropping on
the world, and doing it in such a methodical and robust manner, is
very different from coming face-to-face with the reality that it is
and the details of how it is doing it.</t>
        <t indent="0" pn="section-2-4.21">I also found it incredibly difficult to keep the secrets.
<em>The Guardian</em>'s process is slow and methodical. I move much faster. I
drafted stories based on what I found. Then I wrote essays about those
stories, and essays about the essays. Writing was therapy; I would
wake up in the wee hours of the morning, and write an essay. But that
put me at least three levels beyond what was published.</t>
        <t indent="0" pn="section-2-4.22">Now that my involvement is out, and my first essays are out, I feel a
lot better. I'm sure it will get worse again when I find another
monumental revelation; there are still more documents to go through.</t>
        <t indent="0" pn="section-2-4.23">I've heard it said that Snowden wants to damage America. I can say
with certainty that he does not. So far, everyone involved in this
incident has been incredibly careful about what is released to the
public. There are many documents that could be immensely harmful to
the US, and no one has any intention of releasing them. The documents
the reporters release are carefully redacted. Greenwald and I
repeatedly debated with <em>The Guardian</em> editors the newsworthiness of story
ideas, stressing that we would not expose government secrets simply
because they're interesting.</t>
        <t indent="0" pn="section-2-4.24">The NSA got incredibly lucky; this could have ended with a massive
public dump like Chelsea Manning's State Department cables. I suppose
it still could. Despite that, I can imagine how this feels to the NSA.
It's used to keeping this stuff behind multiple levels of security:
gates with alarms, armed guards, safe doors, and military-grade
cryptography. It's not supposed to be on a bunch of thumb drives in
Brazil, Germany, the UK, the US, and who knows where else, protected
largely by some random people's opinions about what should or should
not remain secret. This is easily the greatest intelligence failure in
the history of ever. It's amazing that one person could have had so
much access with so little accountability, and could sneak all of this
data out without raising any alarms. The odds are close to zero that
Snowden is the first person to do this; he's just the first person to
make public that he did. It's a testament to General Alexander's power
that he hasn't been forced to resign.</t>
        <t indent="0" pn="section-2-4.25">It's not that we weren't being careful about security, it's that our
standards of care are so different. From the NSA's point of view,
we're all major security risks, myself included. I was taking notes
about classified material, crumpling them up, and throwing them into
the wastebasket. I was printing documents marked "TOP
SECRET/COMINT/NOFORN" in a hotel lobby. And once, I took the wrong
thumb drive with me to dinner, accidentally leaving the unencrypted
one filled with top-secret documents in my hotel room. It was an
honest mistake; they were both blue.</t>
        <t indent="0" pn="section-2-4.26">If I were an NSA employee, the policy would be to fire me for that alone.</t>
        <t indent="0" pn="section-2-4.27">Many have written about how being under constant surveillance changes
a person. When you know you're being watched, you censor yourself. You
become less open, less spontaneous. You look at what you write on your
computer and dwell on what you've said on the telephone, wonder how it
would sound taken out of context, from the perspective of a
hypothetical observer. You're more likely to conform. You suppress
your individuality. Even though I have worked in privacy for decades,
and already knew a lot about the NSA and what it does, the change was
palpable. That feeling hasn't faded. I am now more careful about what
I say and write. I am less trusting of communications technology. I am
less trusting of the computer industry.</t>
        <t indent="0" pn="section-2-4.28">After much discussion, Greenwald and I agreed to write three stories
together to start. All of those are still in progress. In addition, I
wrote two commentaries on the Snowden documents that were recently
made public. There's a lot more to come; even Greenwald hasn't looked
through everything.</t>
        <t indent="0" pn="section-2-4.29">Since my trip to Brazil (one month before), I've flown back to the US
once and domestically seven times -- all without incident. I'm not on any
list yet. At least, none that I know about.</t>
      </blockquote>
      <t indent="0" pn="section-2-5">As it happened, I didn't write much more with Greenwald or 
<em>The Guardian</em>. Those two had a falling out, and by the time everything
settled and both began writing about the documents
independently -- Greenwald at the newly formed website <em>The Intercept</em> -- I
got cut out of the process somehow. I remember hearing that Greenwald
was annoyed with me, but I never learned the reason. We haven't spoken
since.</t>
      <t indent="0" pn="section-2-6">Still, I was happy with the one story I was part of: how the NSA hacks
Tor. I consider it a personal success that I pushed <em>The Guardian</em> to
publish NSA documents detailing QUANTUM. I don't think that would have
gotten out any other way. And I still use those pages today when I
teach cybersecurity to policymakers at the Harvard Kennedy School.</t>
      <t indent="0" pn="section-2-7">Other people wrote about the Snowden files, and wrote a lot. It was a
slow trickle at first, and then a more consistent flow. Between
Greenwald, Bart Gellman, and <em>The Guardian</em> reporters, there ended up
being steady stream of news. (Bart brought in Ashkan Soltani to help
him with the technical aspects, which was a great move on his part,
even if it cost Ashkan a government job later.) More stories were
covered by other publications.</t>
      <t indent="0" pn="section-2-8">It started getting weird. Both Greenwald and Gellman held documents
back so they could publish them in their books. Jake Appelbaum, who
had not yet been accused of sexual assault by multiple women, was
working with Poitras. He partnered with <em>Der Spiegel</em> to release an implant
catalog from the NSA's Tailored Access Operations group. To this day,
I am convinced that the document was not in the Snowden archives:
that Jake got it somehow, and it was released with the implication
that it was from Edward Snowden. I thought it was important enough
that I started writing about each item in that document in my blog:
"NSA Exploit of the Week." That got my website blocked by the DoD: I
keep a framed print of the censor's message on my wall.</t>
      <t indent="0" pn="section-2-9">Perhaps the most surreal document disclosures were when artists
started writing fiction based on the documents. This was in 2016, when
Laura Poitras built a secure room in New York to house the
documents. By then, the documents were years out of date.  And now
they're over a decade out of date. (They were leaked in 2013, but most
of them were from 2012 or before.)</t>
      <t indent="0" pn="section-2-10">I ended up being something of a public ambassador for the
documents. When I got back from Rio, I gave talks at a private
conference in Woods Hole, the Berkman Center at Harvard, something
called the Congress on Privacy and Surveillance in Geneva, events at
both CATO and New America in DC, an event at the University of
Pennsylvania, an event at EPIC, a "Stop Watching Us" rally in DC,
the RISCS conference in London, the ISF in Paris, and...then...at the
IETF meeting in Vancouver in November 2013. (I remember little of
this; I am reconstructing it all from my calendar.)</t>
      <t indent="0" pn="section-2-11">What struck me at the IETF was the indignation in the room, and the
calls to action. And there was action, across many fronts. We
technologists did a lot to help secure the Internet, for example.</t>
      <t indent="0" pn="section-2-12">The government didn't do its part, though. Despite the public outcry,
investigations by Congress, pronouncements by President Obama, and
federal court rulings, I don't think much has changed. The NSA
canceled a program here and a program there, and it is now more public
about defense. But I don't think it is any less aggressive about
either bulk or targeted surveillance. Certainly its government
authorities haven't been restricted in any way. And surveillance
capitalism is still the business model of the Internet.</t>
      <t indent="0" pn="section-2-13">And Edward Snowden? We were in contact for a while on Signal. I
visited him once in Moscow, in 2016. And I had him do a guest
lecture to my class at Harvard for a few years, remotely by
Jitsi. Afterwards, I would hold a session where I promised to answer
every question he would evade or not answer, explain every response he
did give, and be candid in a way that someone with an outstanding
arrest warrant simply cannot. Sometimes I thought I could channel
Snowden better than he could.</t>
      <t indent="0" pn="section-2-14">But now it's been a decade. Everything he knows is old and out of
date. Everything we know is old and out of date. The NSA suffered an
even worse leak of its secrets by the Russians, under the guise of the
Shadow Brokers, in 2016 and 2017. The NSA has rebuilt. It again has
capabilities we can only surmise.</t>
    </section>
    <section anchor="stephen-farrell-ietf-and-internet-technical-community-reaction" numbered="true" removeInRFC="false" toc="include" pn="section-3">
      <name slugifiedName="name-stephen-farrell-ietf-and-in">Stephen Farrell: IETF and Internet Technical Community Reaction</name>
      <t indent="0" pn="section-3-1">In 2013, the IETF and, more broadly, the Internet technical, security, and
privacy research communities, were surprised by the surveillance and attack
efforts exposed by the Snowden revelations <xref target="Timeline" format="default" sectionFormat="of" derivedContent="Timeline"/>. While the
potential for such was known, it was the scale and pervasiveness of the
activities disclosed that was alarming and, I think it fair to say, quite
annoying, for very many Internet engineers.</t>
      <t indent="0" pn="section-3-2">As for the IETF's reaction, informal meetings during the July 2013 IETF meeting
in Berlin indicated that IETF participants considered that these revelations
showed that we needed to do more to improve the security and privacy properties
of IETF protocols, and to help ensure deployments made better use of the
security and privacy mechanisms that already existed. In August, the IETF set up
a new mailing list <xref target="Perpass" format="default" sectionFormat="of" derivedContent="Perpass"/>, which became a useful venue for triaging
proposals for work on these topics. At the November 2013 IETF meeting, there
was a lively and very well attended plenary session <xref target="Plenary-video" format="default" sectionFormat="of" derivedContent="Plenary-video"/> on
"hardening the Internet" against such attacks, followed by a "birds of a
feather" session <xref target="Perpass-BoF" format="default" sectionFormat="of" derivedContent="Perpass-BoF"/> devoted to more detailed discussion of possible
actions in terms of new working groups, protocols, and Best Current Practice
(BCP) documents that could help improve matters.  This was followed in
February/March 2014 by a joint IAB/W3C workshop on "strengthening the Internet
against pervasive monitoring" <xref target="STRINT" format="default" sectionFormat="of" derivedContent="STRINT"/> held in London and attended by 150
engineers (still the only IAB workshop in my experience where we needed a
waiting list for people after capacity for the venue was reached!). The STRINT
workshop report was eventually published as <xref target="RFC7687" format="default" sectionFormat="of" derivedContent="RFC7687"/> in 2015, but in the
meantime, work proceeded on a BCP document codifying
that the IETF community considered that "pervasive monitoring is an attack"
<xref target="RFC7258" format="default" sectionFormat="of" derivedContent="RFC7258"/> (aka BCP 188). The IETF Last Call discussion for that short
document included more than 1000 emails -- while there was broad agreement on
the overall message, a number of IETF participants considered enshrining that
message in the RFC Series and IETF processes controversial. In any case, the
BCP was published in May 2014. The key statement on which rough consensus was
reached is in the abstract of RFC 7258 and says "Pervasive monitoring is a
technical attack that should be mitigated in the design of IETF protocols,
where possible." That document has since been referenced <xref target="Refs-to-7258" format="default" sectionFormat="of" derivedContent="Refs-to-7258"/> by
many IETF working groups and RFCs as justifying additional work on security and
privacy. Throughout that period and beyond, the repercussions of the Snowden
revelations remained a major and ongoing agenda item for both of the IETF's
main technical management bodies, the IAB and the IESG (on which I served at
the time).</t>
      <t indent="0" pn="section-3-3">So far, I've only described the processes with which the IETF dealt with
the attacks, but there was, of course, also much technical work started by IETF
participants that was at least partly motivated by the Snowden revelations.</t>
      <t indent="0" pn="section-3-4">In November 2013, a working group was established to document better practices
for using TLS in applications <xref target="UTA" format="default" sectionFormat="of" derivedContent="UTA"/> so that deployments would be less at risk
in the face of some of the attacks related to stripping TLS or having
applications misuse TLS APIs or parameters.  Similar work was done later to update
recommendations for use of cryptography in other protocols in the CURDLE 
Working Group <xref target="CURDLE" format="default" sectionFormat="of" derivedContent="CURDLE"/>.  The CURDLE Working Group was, to an extent, created to
enable use of a set of new elliptic curves that had been documented by the IRTF
Crypto Forum Research Group <xref target="CFRG" format="default" sectionFormat="of" derivedContent="CFRG"/>. That work in turn had been partly
motivated by (perhaps ultimately unfounded) concerns about elliptic curves
defined in NIST standards, following the DUAL_EC_DRBG debacle <xref target="Dual-EC" format="default" sectionFormat="of" derivedContent="Dual-EC"/> 
(described further below) where a
NIST random number generator had been deliberately engineered to produce output
that could be vulnerable to NSA attack.</t>
      <t indent="0" pn="section-3-5">Work to develop a new version of TLS was started in 2014, mainly due to
concerns that TLS 1.2 and earlier version implementations had been shown to be
vulnerable to a range of attacks over the years. The work to develop TLS 1.3
<xref target="RFC8446" format="default" sectionFormat="of" derivedContent="RFC8446"/> also aimed to encrypt more of the handshake so as to
expose less information to network observers -- a fairly direct result of the
Snowden revelations.  Work to further improve TLS in this respect continues
today using the so-called Encrypted Client Hello (ECH) mechanism <xref target="I-D.ietf-tls-esni" format="default" sectionFormat="of" derivedContent="TLS-ECH"/>
to remove one of the last privacy leaks present in current TLS.</t>
      <t indent="0" pn="section-3-6">Work on ECH was enabled by significant developments to encrypt DNS traffic,
using DNS over TLS (DoT) <xref target="RFC7858" format="default" sectionFormat="of" derivedContent="RFC7858"/> or DNS Queries over HTTPS (DoH) <xref target="RFC8484" format="default" sectionFormat="of" derivedContent="RFC8484"/>, which also started as a result of
the Snowden revelations. Prior to that, privacy hadn't really been considered
when it came to DNS data or (more importantly) the act of accessing DNS data.
The trend towards encrypting DNS traffic represents a significant change for
the Internet, both in terms of reducing cleartext, but also in terms of moving
points-of-control. The latter aspect was, and remains, controversial, but the
IETF did its job of defining new protocols that can enable better DNS privacy.
Work on HTTP version 2 <xref target="RFC9113" format="default" sectionFormat="of" derivedContent="RFC9113"/> and QUIC <xref target="RFC9000" format="default" sectionFormat="of" derivedContent="RFC9000"/> further demonstrates
the trend in the IETF towards always encrypting protocols as the new norm, at
least at and above the transport layer.</t>
      <t indent="0" pn="section-3-7">Of course, not all such initiatives bore fruit; for example, attempts to define
a new MPLS encryption mechanism <xref target="I-D.ietf-mpls-opportunistic-encrypt" format="default" sectionFormat="of" derivedContent="MPLS-OPPORTUNISTIC-ENCRYPT"/>
foundered due to a lack of interest and the existence of the already deployed
IEEE Media Access Control Security (MACsec) scheme. But there has been a fairly clear trend towards trying to
remove cleartext from the Internet as a precursor to provide improved privacy
when considering network observers as attackers.</t>
      <t indent="0" pn="section-3-8">The IETF, of course, forms only one part of the broader Internet technical
community, and there were many non-IETF activities triggered by the Snowden
revelations, a number of which also eventually resulted in new IETF work to
standardise better security and privacy mechanisms developed elsewhere.</t>
      <t indent="0" pn="section-3-9">In 2013, the web was largely unencrypted despite HTTPS being relatively
usable, and that was partly due to problems using the Web PKI at scale. The
Let's Encrypt initiative <xref target="LE" format="default" sectionFormat="of" derivedContent="LE"/> issued its first certificates in 2015 as
part of its aim to try to move the web
towards being fully encrypted, and it has been extremely successful in helping
achieve that goal.  Subsequently, the automation protocols developed for
Let's Encrypt were standardised in the IETF's ACME Working Group <xref target="ACME" format="default" sectionFormat="of" derivedContent="ACME"/>.</t>
      <t indent="0" pn="section-3-10">In 2013, most email transport between mail servers was cleartext,
directly enabling some of the attacks documented in the Snowden documents.
Significant effort by major mail services and MTA software developers since
then have resulted in more than 90% of email being encrypted between mail
servers, and various IETF protocols have been defined in order to improve that
situation, e.g., SMTP MTA Strict Transport Security (MTA-STS) <xref target="RFC8461" format="default" sectionFormat="of" derivedContent="RFC8461"/>.</t>
      <t indent="0" pn="section-3-11">Lastly, MAC addresses have historically been long-term fixed values visible to
local networks (and beyond), which enabled some tracking attacks that were
documented in the Snowden documents <xref target="Toronto" format="default" sectionFormat="of" derivedContent="Toronto"/>. 
Implementers, vendors, and the IEEE 802
standards group recognised this weakness and started work on MAC address
randomisation that in turn led to the IETF's MADINAS Working Group <xref target="MADINAS" format="default" sectionFormat="of" derivedContent="MADINAS"/>, which
aims to ensure randomised MAC addresses can be used on the Internet without
causing unintentional harm.
There is also a history of IETF work on deprecating MAC-address-based IPv6 interface identifiers
and advocating pseudorandom identifiers and temporary addresses, some of
which pre-dates Snowden <xref target="RFC7217" format="default" sectionFormat="of" derivedContent="RFC7217"/> <xref target="RFC8064" format="default" sectionFormat="of" derivedContent="RFC8064"/> <xref target="RFC8981" format="default" sectionFormat="of" derivedContent="RFC8981"/>.</t>
      <t indent="0" pn="section-3-12">In summary, the significantly large volume of technical work pursued in the
IETF and elsewhere as a result of the Snowden revelations has focussed on two
main things: decreasing the amount of plaintext that remains visible to network
observers and secondly reducing the number of long-term identifiers that enable
unexpected identification or re-identification of devices or users. This work
is not by any means complete, nor is deployment universal, but significant
progress has been made, and the work continues even if the level of annoyance
at the attack has faded somewhat over time.</t>
      <t indent="0" pn="section-3-13">One should also note that there has been pushback against these improvements
in security and privacy and the changes they cause for deployments. That has
come from more or less two camps: those on whom these improvements force
change tend to react badly, but later figure out how to adjust, and 
those who seemingly prefer not to strengthen security so as to, for
example, continue to achieve what they call "visibility" even in the face of the
many engineers who correctly argue that such an anti-encryption approach
inevitably leads to worse security overall. The recurring nature of this kind
of pushback is nicely illustrated by <xref target="RFC1984" format="default" sectionFormat="of" derivedContent="RFC1984"/>. That informational document
was published in 1996 as an IETF response to an early iteration of the
perennial "encryption is bad" argument. In 2015, the unmodified 1996 text was
upgraded to a BCP (BCP 200) as the underlying arguments have
not changed, and will not change.</t>
      <t indent="0" pn="section-3-14">Looking back on all the above from a 2023 vantage point, I think that, as a
community of Internet engineers, we got a lot right, but that today there's way
more that needs to be done to better protect the security and privacy of people
who use the Internet. In particular, we (the technical community) haven't done
nearly as good a job at countering surveillance capitalism <xref target="Zubhoff2019" format="default" sectionFormat="of" derivedContent="Zubhoff2019"/>, which has exploded
in the last decade. In part, that's because many of the problems are outside of
the scope of bodies such as the IETF. For example, intrusive backend sharing
of people's data for advertising purposes can't really be mitigated via
Internet protocols.</t>
      <t indent="0" pn="section-3-15">However, I also think that the real annoyance felt with respect to the Snowden
revelations is (in general) not felt nearly as much when it comes to the legal
but hugely privacy-invasive activities of major employers of Internet
engineers.</t>
      <t indent="0" pn="section-3-16">It's noteworthy that RFC 7258 doesn't consider that bad actors are limited to
governments, and personally, I think many advertising industry schemes for
collecting data are egregious examples of pervasive monitoring and hence ought
also be considered an attack on the Internet that ought be mitigated where
possible.  However, the Internet technical community clearly hasn't acted in
that way over the last decade.</t>
      <t indent="0" pn="section-3-17">Perhaps that indicates that Internet engineers and the bodies in which they
congregate need to place much more emphasis on standards for ethical behaviour
than has been the case for the first half-century of the Internet.  And while
it would be good to see the current leaders of Internet bodies work to make
progress in that regard, at the time of writing, it sadly seems more likely that
government regulators will be the ones to try force better behaviour. That of
course comes with a significant risk of having regulations that stymie the kind
of permissionless innovation that characterised many earlier Internet
successes.</t>
      <t indent="0" pn="section-3-18">So while we got a lot right in our reaction to Snowden's revelations,
currently, we have a "worse" Internet.  Nonetheless, I do still hope to see a
sea change there, as the importance of real Internet security and privacy for
people becomes utterly obvious to all, even the most hard-core capitalists and
government signals intelligence agencies.  That may seem naive, but I remain
optimistic that, as a fact-based community, we (and eventually our employers)
will recognise that the lesser risk is to honestly aim to provide the best
security and privacy practically possible.</t>
    </section>
    <section anchor="farzaneh-badii-did-snowdens-revelations-help-with-protecting-human-rights-on-the-internet" numbered="true" removeInRFC="false" toc="include" pn="section-4">
      <name slugifiedName="name-farzaneh-badii-did-snowdens">Farzaneh Badii: Did Snowden's Revelations Help with Protecting Human Rights on the Internet?</name>
      <t indent="0" pn="section-4-1">It is very difficult to empirically measure the effect of Snowden's
revelations on human rights and the Internet. Anecdotally, we have
been witnessing dominant regulatory and policy approaches that impact
technologies and services that are at the core of protecting human
rights on the Internet. (A range of European Union laws aims to
address online safety or concentration of data. There are many more
regulations that have an impact on the Internet <xref target="Masnick2023" format="default" sectionFormat="of" derivedContent="Masnick2023"/>.) There
has been little progress in fixing technical and policy issues that
help enable human rights. The Snowden revelations did not
revolutionize the Internet governance and
technical approaches to support human rights such as freedom
of expression, freedom of association and assembly, and privacy. It did not decrease the number of 
Internet shutdowns nor the eagerness of authoritarian (and even to some extent democratic) countries to territorialize the Internet. 
In some cases, the governments argued that they should have more data sovereignty or Internet sovereignty. Perhaps the revelations helped with the evolution of some technical and policy aspects.</t>
      <t indent="0" pn="section-4-2">After Snowden's revelations 10 years ago, engineers and advocates at
the IETF responded in a few
ways. One prominent response was the issuance of a BCP 
document, "Pervasive Monitoring Is an Attack" <xref target="RFC7258" format="default" sectionFormat="of" derivedContent="RFC7258"/> by
Farrell and Tschofenig. The responses to the Snowden revelations did not
mean that IETF had lost sight of issues such as privacy and
surveillance. There were instances of resistance to surveillance in
the past by engineers (we do not delve into how successful that was in
protecting human rights). However, historically, many engineers believed
that widespread and habitual surveillance was too expensive to be
practical. The revelations proved them wrong.</t>
      <t indent="0" pn="section-4-3">Rights-centered activists were also involved with the IETF before the
revelations. For example, staff from Center for Democracy and
Technology (CDT) was undertaking work at the IETF (and was a member of
the Internet Architecture Board) and held workshops about the
challenges of creating privacy-protective protocols and systems. The
technical shortcomings that were exploited by the National Security
Agency to carry out mass-scale surveillance were recognized by the
IETF before the Snowden revelations <xref target="Garfinkel1995" format="default" sectionFormat="of" derivedContent="Garfinkel1995"/> <xref target="RFC6462" format="default" sectionFormat="of" derivedContent="RFC6462"/>. In
2012, Joy Liddicoat and Avri Doria wrote a report for the Internet Society
that extensively discussed the processes and principles of human
rights and Internet protocols <xref target="Doria2012" format="default" sectionFormat="of" derivedContent="Doria2012"/>.</t>
      <t indent="0" pn="section-4-4">Perhaps the Snowden revelations brought more attention to the IETF and
its work as it related to important issues, such as privacy and
freedom of expression. It might have also expedited and helped with
more easily convening the Human Rights Protocol Considerations
Research Group (HRPC) in the Internet Research Task Force (IRTF) in July 2015. The HRPC RG was originally co-chaired
by Niels ten Oever (who worked at Article 19 at the time) and Internet
governance activist Avri Doria.
The charter of the HRPC RG states that
the group was established: "to research whether standards and
protocols can enable, strengthen or threaten human rights, as defined
in the Universal Declaration of Human Rights (UDHR) and the International Covenant on Civil and Political
Rights (ICCPR)."</t>
      <t indent="0" pn="section-4-5">During the past decade, a few successful strides were made to create
protocols that, when and if implemented, aim at protecting privacy of
the users, as well as help with reducing pervasive surveillance. These
efforts were in keeping with the consensus of the IETF found in RFC
7258.  Sometimes these protocols have anti-censorship qualities as
well. A few examples immediately come to mind: 1) the encryption of DNS
queries (for example, DNS over HTTPS), 2) ACME protocol underpinning
the Let's Encrypt initiative, and 3) Registration Data Access Protocol
(RDAP) <xref target="RFC7480" format="default" sectionFormat="of" derivedContent="RFC7480"/> <xref target="RFC7481" format="default" sectionFormat="of" derivedContent="RFC7481"/> <xref target="RFC8056" format="default" sectionFormat="of" derivedContent="RFC8056"/> <xref target="RFC9082" format="default" sectionFormat="of" derivedContent="RFC9082"/> <xref target="RFC9083" format="default" sectionFormat="of" derivedContent="RFC9083"/> <xref target="RFC9224" format="default" sectionFormat="of" derivedContent="RFC9224"/>. (It is debatable that RDAP had anything to do with
the Snowden revelations, but it is still a good example and is finally
being implemented.)</t>
      <t indent="0" pn="section-4-6">The DNS Queries over HTTPS protocol aimed to encrypt DNS queries. Four
years after RFC 7258, DoH was developed to tackle both active and
passive monitoring of DNS queries. It is also a tool that can help
with combatting censorship. Before the revelations, DNS query privacy
would have been controversial due to being expensive or unnecessary, but the 
Snowden revelations made it more plausible. 
Let's Encrypt was not an Internet protocol, but it was an initiative that aimed to encrypt the web, and later on
some of the automation protocols were standardized in the IETF ACME
Working Group. RDAP could solve a
long-term problem: redacting the domain name registrants' (and IP
address holders') sensitive, personal data but at the same time
enabling legitimate access to the information. As to the work of HRPC
Research Group, it has so far issued <xref target="RFC8280" format="default" sectionFormat="of" derivedContent="RFC8280"/> by ten Oever and
Cath and a number of informational Internet-Drafts.</t>
      <t indent="0" pn="section-4-7">While we cannot really argue that all the movements and privacy-preserving 
protocols and initiatives that enable protecting human
rights at the infrastructure layer solely or directly result from the Snowden
revelations, I think it is safe to say that the revelations helped
with expediting the resolution of some of the "technical" hesitations
that had an effect on fixing Internet protocols that enabled
protection of human rights.</t>
      <t indent="0" pn="section-4-8">Unfortunately, the Snowden revelations have not yet helped us
meaningfully with adopting a human rights approach. We can't agree on
prioritizing human rights in our Internet communities for a host of
reasons. This could be due to: 1) human rights are sometimes in
conflict with each other; 2) it is simply not possible to mitigate the
human right violation through the Internet protocol; 3) it is not
obvious for the engineers in advance how the Internet protocol
contributes to enabling human rights protections, or precisely what they ought to do; 
 4) the protocol is already there, but market, law, and a
host of other societal and political issues do not allow for
widespread implementation.</t>
      <t indent="0" pn="section-4-9">IETF did not purposefully take a long time to adopt and implement protocols that
enabled human rights. There were technical and political issues that
created barriers. For example, as WHOIS was not capable of accommodating a tiered-access option, 
the IETF community attempted a few times before to create a protocol that would disclose the necessary
information of IP holders and domain name registrants while at the
same time protecting their data (Cross Registry Internet Service Protocol (CRISP) and later on Internet Registry Information Service (IRIS) are the
examples). However, IRIS was technically very difficult to implement. It was not until RDAP was developed and the
General Data Protection Regulation (GDPR) was enacted that Internet
Corporation for Assigned Names and Numbers had to consider instructing
registries and registrars to implement RDAP and its community had to
come up with a privacy-compliant policy.  Overall, a host of
regulatory and market incentives can halt or slow down the
implementation of human-rights-enabling protocols and implementation
could depend on other organizations with their own political and
stakeholder conflicts. Sometimes the protocol is available, but the regulatory framework and
the market do not allow for implementation. 
Sometimes the surrounding context includes 
practical dimensions that are easy to overlook in a purely engineering-focused argument.</t>
      <t indent="0" pn="section-4-10">
A curious example of this is sanctions regimes that target transactions involving
economically valuable assets.  As a result, sanctions might limit
sanctioned nations' and entities' access to IPv4 resources (because the existence of
a resale market for these addresses causes acquiring them to be
interpreted as buying something of value), though the same consideration
may not apply to IPv6 address resources.  But IPv6 adoption itself
depends on a host of complex factors that are by no means limited to
technical comparisons of the properties of IPv4 and IPv6.  Someone
focused only on technical features of protocols may devise an elegant
solution but be surprised both by deployment challenges and unintended
downstream effects.
Sometimes there are arguments over implementation of a protocol
because as it is perceived, while it can protect freedom of expression
and reduce surveillance, it can hamper other human rights. For
instance, the technical community and some network operators still have doubts about the implementation of DNS over HTTPS,
despite its potential to circumvent 
censorship and its ability to encrypt DNS queries. The arguments against
implementation of DoH include protection of children online and lack
of law enforcement access to data.</t>
      <t indent="0" pn="section-4-11">We must acknowledge that sometimes the technical solutions that we use
that protect one right (for example, encryption to protect the right to
privacy or to prevent surveillance) could potentially affect technical
and policy solutions that try to protect other human rights (for
example, encryption could prevent financial institutions from
monitoring employees' network activities to detect fraudulent
behavior). Acknowledging and identifying these conflicts can help us
come up with alternative techniques that could protect human rights
while not hampering other technical solutions such as
encryption. Where such alternative techniques are not possible,
acknowledging the shortcoming could clarify and bring to light the
trade-offs that we have accepted in our Internet system.</t>
      <t indent="0" pn="section-4-12">Ironically, we advocate for connectivity and believe expressing
oneself on the Internet is a human right, but when a war erupts, we
resort to tools that impact that very concept. For example, some
believe that, by imposing sanctions on critical properties of the Internet,
we can punish the perpetrators of a war. The Regional Internet
Registries that are in charge of registration of IP addresses have
shown resilience to these requests.  However, some tech companies (for
example, Cogent <xref target="Roth2022" format="default" sectionFormat="of" derivedContent="Roth2022"/>) decided not to serve sanctioned countries
and overcomplied with sanctions. Overcompliance with sanctions could
hamper ordinary people's access to the Internet <xref target="Badii2023" format="default" sectionFormat="of" derivedContent="Badii2023"/>.</t>
      <t indent="0" pn="section-4-13">Perhaps we can solve some of these problems by undertaking a thorough
impact assessment and contextualization to reveal how and why Internet
protocols affect human rights (something Fidler and I argued
for <xref target="Badii2021" format="default" sectionFormat="of" derivedContent="Badii2021"/>). Contextualization and
impact assessment can reveal how each Internet protocol or each line
of code, in which systems, have an impact on which and whose human
rights.</t>
      <t indent="0" pn="section-4-14">The HRPC RG (which I am a part of) and the larger human rights and
policy analyst communities are still struggling to analyze legal,
social, and market factors alongside the protocols to have a good
understanding of what has an impact and what has to be changed. It is
hard, but it is not impossible. If we thoroughly document and research
the lifecycle of an Internet protocol and contextualize it, we might
have a better understanding of which
parts of the protocol to fix and how to fix them in order to protect human rights.</t>
      <t indent="0" pn="section-4-15">Overall, the revelations did, to some extent, contribute to the
evolution of our ideas and perspectives. Our next step should be to
undertake research on the impact of Internet systems (including
Internet protocols) on human rights, promote the implementation of
protocols good for human rights through policy and advocacy, and focus
on which technical parts we can standardize to help with more
widespread implementation of human-rights-enabling Internet protocols.</t>
    </section>
    <section anchor="steven-m-bellovin-governments-and-cryptography-the-crypto-wars" numbered="true" removeInRFC="false" toc="include" pn="section-5">
      <name slugifiedName="name-steven-m-bellovin-governmen">Steven M. Bellovin: Governments and Cryptography: The Crypto Wars</name>
      <section anchor="historical-background" numbered="true" removeInRFC="false" toc="include" pn="section-5.1">
        <name slugifiedName="name-historical-background">Historical Background</name>
        <t indent="0" pn="section-5.1-1">It's not a secret: many governments in the world don't like it when
people encrypt their traffic. More precisely, they like strong
cryptography for themselves but not for others, whether those others
are private citizens or other countries. But the history is longer and
more complex than that.</t>
        <t indent="0" pn="section-5.1-2">For much of written history, both governments and individuals used
cryptography to protect their messages. To cite just one famous
example, Julius Caesar is said to have encrypted messages by shifting
letters in the alphabet by 3 <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>. In modern parlance, 3 was
the key, and each letter was encrypted with</t>
        <t indent="6" pn="section-5.1-3">
            C[i] = (P[i] + 3) mod 23
        </t>
        <t indent="0" pn="section-5.1-4">(The Latin alphabet of his time had only 23 letters.)
Known
Arabic writings on cryptanalysis go back to at least the 8th century;
their sophistication shows that encryption was reasonably commonly
used. In the 9th century, Abū Yūsuf Yaʻqūb ibn ʼIsḥāq aṣ-Ṣabbāḥ 
al-Kindī developed and wrote about frequency analysis as a way to
crack ciphers <xref target="Borda2011" format="default" sectionFormat="of" derivedContent="Borda2011"/> <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>.</t>
        <t indent="0" pn="section-5.1-5">In an era of minimal literacy, though, there wasn't that much use of
encryption, simply because most people could neither read nor
write. Governments used encryption for diplomatic messages, and
cryptanalysts followed close behind. The famed Black Chambers of the
Renaissance era read messages from many different governments, while
early cryptographers devised stronger and stronger ciphers
<xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>. In Elizabethan times in England, Sir Francis Walsingham's
intelligence agency intercepted and decrypted messages from Mary,
Queen of Scots; these messages formed some of the strongest evidence
against her and eventually led to her execution <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>.</t>
        <t indent="0" pn="section-5.1-6">This pattern continued for centuries. In the United States, Thomas
Jefferson invented the so-called wheel cipher in the late 18th
century; it was reinvented about 100 years later by Étienne Bazeries
and used as a standard American military cipher well into World War II
<xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>. Jefferson and other statesmen of the late 18th and early 19th centuries regularly used
cryptography when communicating with each other. An encrypted message
was even part of the evidence introduced in Aaron Burr's 1807 trial
for treason <xref target="Kerr2020" format="default" sectionFormat="of" derivedContent="Kerr2020"/> <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>. Edgar Allan Poe claimed that he
could cryptanalyze any message sent to him <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>.</t>
        <t indent="0" pn="section-5.1-7">The telegraph era upped the ante. In the US, just a year after
Samuel Morse deployed his first telegraph line between Baltimore and
Washington, his business partner, Francis Smith, published a codebook
to help customers protect their traffic from prying eyes
<xref target="Smith1845" format="default" sectionFormat="of" derivedContent="Smith1845"/>.  In 1870, Britain nationalized its domestic telegraph network;
in response, Robert Slater published a more sophisticated codebook
<xref target="Slater1870" format="default" sectionFormat="of" derivedContent="Slater1870"/>. On the government side, Britain took advantage of its
position as the central node in the world's international telegraphic
networks to read a great deal of traffic passing through the country
<xref target="Headrick1991" format="default" sectionFormat="of" derivedContent="Headrick1991"/> <xref target="Kennedy1971" format="default" sectionFormat="of" derivedContent="Kennedy1971"/>. They used this ability strategically,
too -- when war broke out in 1914, the British Navy cut Germany's
undersea telegraph cables, forcing them to use radio; an intercept of
the so-called Zimmermann telegram, when cryptanalyzed, arguably led to
American entry into the war and thence to Germany's defeat. Once the
US entered the war, it required users of international telegraph
lines to deposit copies of the codebooks they used for compression, so
that censors could check messages for prohibited content <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>.</t>
        <t indent="0" pn="section-5.1-8">In Victorian Britain, private citizens, often lovers, used encryption
in newspapers' personal columns to communicate without their parents'
knowledge. Charles Wheatstone and Charles Babbage used to solve these
elementary ciphers routinely for their own amusement <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/>.</t>
        <t indent="0" pn="section-5.1-9">This pattern continued for many years. Governments regularly used
ciphers and codes, while other countries tried to break them; private
individuals would sometimes use encryption but not often, and rarely
well. But the two World Wars marked a sea change, one that would soon
reverberate into the civilian world.</t>
        <t indent="0" pn="section-5.1-10">The first World War featured vast troop movements by all parties; this
in turn required a lot of encrypted communications, often by telegraph
or radio. These messages were often easily intercepted in
bulk. Furthermore, the difficulty of encrypting large volumes of
plaintext led to the development of a variety of mechanical encryption
devices, including Germany's famed Enigma machine. World War II
amplified both trends. It also gave rise to machine-assisted
cryptanalysis, such as the United Kingdom's bombes (derived from an
earlier Polish design) and Colossus machine, and the American's device
for cracking Japan's PURPLE system. The US also used punch
card-based tabulators to assist in breaking other Japanese codes, such
as the Japanese Imperial Navy's JN-25 <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/> <xref target="Rowlett1998" format="default" sectionFormat="of" derivedContent="Rowlett1998"/>.</t>
        <t indent="0" pn="section-5.1-11">These developments set the stage for the postwar SIGINT (Signals
Intelligence) environment. Many intragovernmental messages were sent by
radio, making them easy to intercept; advanced cryptanalytic machines
made cryptanalysis easier. Ciphers were getting stronger, though, and
government SIGINT agencies did not want to give up their access to
data. While there were undoubtedly many developments, two are well
known.</t>
        <t indent="0" pn="section-5.1-12">The first involved CryptoAG, a Swedish (and later Swiss) manufacturer
of encryption devices. The head of that company, Boris Hagelin, was a
friend of William F. Friedman, a pioneering American
cryptologist. During the 1950s, CryptoAG sold its devices to other
governments; apparently at Friedman's behest, Hagelin weakened the
encryption in a way that let the NSA read the traffic <xref target="Miller2020" format="default" sectionFormat="of" derivedContent="Miller2020"/>.</t>
        <t indent="0" pn="section-5.1-13">The story involving the British is less well-documented and less
clear. When some of Britain's former colonies gained their
independence, the British government gave them captured, war-surplus
Enigma machines to protect their own traffic. Some authors contend
that this was deceptive, in that these former colonies did not realize
that the British could read Enigma-protected traffic; others claim
that this was obvious but that these countries didn't care: Britain
was no longer their enemy; it was neighboring countries they were
worried about. Again, though, this concerned governmental use of
encryption <xref target="Kahn1996" format="default" sectionFormat="of" derivedContent="Kahn1996"/> <xref target="Baldwin2022" format="default" sectionFormat="of" derivedContent="Baldwin2022"/>. There was still little private
use.</t>
      </section>
      <section anchor="the-crypto-wars-begin" numbered="true" removeInRFC="false" toc="include" pn="section-5.2">
        <name slugifiedName="name-the-crypto-wars-begin">The Crypto Wars Begin</name>
        <t indent="0" pn="section-5.2-1">The modern era of conflict between an individual's desire for privacy and
the government desires to read traffic began around 1972. The grain
harvest in the USSR had failed; since relations between the Soviet
Union and the United States were temporarily comparatively warm, the
Soviet grain company -- an arm of the Soviet government, of
course -- entered into negotiations with private American
companies. Unknown to Americans at the time, Soviet intelligence was
intercepting the phone calls of the American negotiating teams. In
other words, private companies had to deal with state actors as a
threat. Eventually, US intelligence learned of this and came to a
realization: the private sector needed strong cryptography, too, to
protect American national interests <xref target="Broad1982" format="default" sectionFormat="of" derivedContent="Broad1982"/> <xref target="Johnson1998" format="default" sectionFormat="of" derivedContent="Johnson1998"/>. This
underscored the need for strong cryptography to protect American
civilian traffic -- but the SIGINT people were unhappy at the thought of
more encryption that they couldn't break.</t>
        <t indent="0" pn="section-5.2-2">Meanwhile, the US was concerned about protecting 
unclassified data <xref target="Landau2014" format="default" sectionFormat="of" derivedContent="Landau2014"/>. In 1973 and again in 1974, the
National Bureau of Standards (NBS) put out a call for a strong, modern
encryption algorithm. IBM submitted Lucifer, an internally developed
algorithm based on what has become known as a 16-round Feistel network. The
original version used a long key.
It seemed quite strong, so NBS sent it off to the NSA to
get their take. The eventual design, which was adopted in 1976 as the
Data Encryption Standard (DES), differed in some important ways from
Lucifer. 
First, the so-called S-boxes, the source of the cryptologic
strength of DES, were changed, and were now demonstrably not composed of
random integers. Many researchers alleged that the S-boxes contained
an NSA back door. It took nearly 20 years for the truth to come out: the
S-boxes were in fact strengthened, not weakened. Most likely, IBM
independently discovered the attack now known as differential
cryptanalysis, though some scholars suspect that the NSA told them
about it. The nonrandom S-boxes protected against this attack. The
second change, though, was clearly insisted on by the NSA: the key size
was shortened, from Lucifer's 112 bits to DES's 56 bits. We now know
that the NSA wanted a 48-bit key size, while IBM wanted 64 bits; they
compromised at 56 bits.</t>
        <t indent="0" pn="section-5.2-3">Whitfield Diffie and Martin Hellman, at Stanford University, wondered
about the 56-bit keys. In 1979, they published a paper demonstrating
that the US government, but few others, could afford to build a
brute-force cracking machine, one that could try all 2<sup>56</sup> possible
keys to crack a message. NSA denied tampering with the design; a
Senate investigating committee found that assertion to be correct, but did
not discuss the shortened key length issue.</t>
        <t indent="0" pn="section-5.2-4">This, however, was not Diffie and Hellman's greatest contribution to
cryptology. A few years earlier, they had published a paper inventing what
is now known as public key cryptography.
(In fact, public key encryption had been invented a few years earlier
at UK Government Communications Headquarters (GCHQ), but they kept their discovery classified until 1997.)
In 1978, Ronald Rivest, Adi
Shamir, and Leonard Adleman devised the RSA algorithm, which made it
usable. (An NSA employee, acting on his own, sent a letter warning
that academic conferences on cryptology might violate US export
laws.)</t>
        <t indent="0" pn="section-5.2-5">Around the same time, George Davida at the University of Wisconsin
applied for a patent on a stream cipher; the NSA slapped a secrecy
order on the application. This barred him from even talking about his
invention. The publicity was devastating; the NSA had to back down.</t>
        <t indent="0" pn="section-5.2-6">The Crypto Wars had thus begun: civilians were inventing strong
encryption systems, and the NSA was tampering with them or trying to
suppress them. Bobby Inman, the then-director of the NSA, tried
creating a voluntary review process for academic papers, but very few
researchers were interested in participating <xref target="Landau1988" format="default" sectionFormat="of" derivedContent="Landau1988"/>.</t>
        <t indent="0" pn="section-5.2-7">There were few major public battles during the 1980s because there
were few new major use cases for civilian cryptography during that
time. There was one notable incident, though: Shamir, Amos Fiat, and
Uriel Feige invented zero-knowledge proofs and applied for a US
patent. In response, the US Army slapped a secrecy order on the
patent. After a great deal of public outrage and intervention by, of
all organizations, the NSA, the order was lifted on very narrow
grounds: the inventors were not American, and they had been discussing
their work all over the world <xref target="Landau1988" format="default" sectionFormat="of" derivedContent="Landau1988"/>.</t>
        <t indent="0" pn="section-5.2-8">In the 1990s, though, everything changed.</t>
      </section>
      <section anchor="the-battle-is-joined" numbered="true" removeInRFC="false" toc="include" pn="section-5.3">
        <name slugifiedName="name-the-battle-is-joined">The Battle Is Joined</name>
        <t indent="0" pn="section-5.3-1">There were three major developments in cryptography in the early
1990s. First, Phil Zimmermann released PGP (Pretty Good Privacy), a
package to encrypt email messages. In 1993, AT&amp;T planned to release
the TSD-3600, an easy-to-use phone encryptor aimed at business
travelers. Shortly after that, the Netscape Communications Corporation released SSL
(Secure Socket Layer) as a way to enable web-based commerce using
their browser and web server. All of these were seen as threats by the
NSA and the FBI.</t>
        <t indent="0" pn="section-5.3-2">PGP was, at least arguably, covered by what was known as ITAR, the
International Trafficking in Arms Regulations -- under American law,
encryption software was regarded as a weapon, so exports required a
license. It was also alleged to infringe the patents on the RSA
algorithm. Needless to say, both issues were problematic for what was
intended to be open source software. Eventually, the criminal
investigation into Zimmermann's role in the spread of PGP overseas was
dropped, but the threat of such investigations remained to deter
others <xref target="Levy2001" format="default" sectionFormat="of" derivedContent="Levy2001"/>.</t>
        <t indent="0" pn="section-5.3-3">The TSD-3600 was another matter. AT&amp;T was a major corporation that did
not want to pick a fight with the US government, but international
business travelers were seen as a major market for the device. At the
government's "request", the DES chip was replaced with what was known
as the Clipper chip. The Clipper chip used Skipjack, a cipher with
80-bit keys; it was thus much stronger against brute-force attacks
than DES. However, it provided "key escrow". Without going into any
details, the key escrow mechanism allowed US government
eavesdroppers to consult a pair of (presumably secure) internal
databases and decrypt all communications protected by the chip. The
Clipper chip proved to be extremely unpopular with industry; that AT&amp;T
Bell Labs' Matt Blaze found a weakness in the design <xref target="Blaze1994" format="default" sectionFormat="of" derivedContent="Blaze1994"/>, one
that let you use Skipjack without the key escrow feature, didn't help
its reputation.</t>
        <t indent="0" pn="section-5.3-4">The third major development, SSL, was even trickier. SSL was aimed at
e-commerce, and of course Netscape wanted to be able to sell its
products outside the US. That would require an export license, so they
made a deal with the government: non-American users would receive a
version that used 40-bit keys, a key length far shorter than what the
NSA had agreed to 20 years earlier. (To get ahead of the story: there
was a compromise mode of operation, wherein an export-grade browser
could use strong encryption when talking to a financial
institution. This hybrid mode led to cryptographic weaknesses
discovered some 20 years later <xref target="Adrian2015" format="default" sectionFormat="of" derivedContent="Adrian2015"/>.)</t>
        <t indent="0" pn="section-5.3-5">Technologists and American industry pushed back. The IETF adopted the
Danvers Doctrine, described in <xref target="RFC3365" format="default" sectionFormat="of" derivedContent="RFC3365"/>:</t>
        <blockquote pn="section-5.3-6">
          <t indent="0" pn="section-5.3-6.1">At the 32cd [sic] IETF held in Danvers, Massachusetts during April of 1995
the IESG asked the plenary for a consensus on the strength of security
that should be provided by IETF standards.  Although the immediate
issue before the IETF was whether or not to support "export" grade
security (which is to say weak security) in standards the question
raised the generic issue of security in general.</t>
          <t indent="0" pn="section-5.3-6.2">The overwhelming consensus was that the IETF should standardize on the
use of the best security available, regardless of national policies.
This consensus is often referred to as the "Danvers Doctrine".</t>
        </blockquote>
        <t indent="0" pn="section-5.3-7">Then American companies started losing business to their overseas
competitors, who did not have to comply with US export laws. All of
this led to what seemed like a happy conclusion: the US government
drastically loosened its export rules for cryptographic software. All
was well -- or so it seemed...</t>
      </section>
      <section anchor="the-hidden-battle" numbered="true" removeInRFC="false" toc="include" pn="section-5.4">
        <name slugifiedName="name-the-hidden-battle">The Hidden Battle</name>
        <t indent="0" pn="section-5.4-1">Strong cryptography was here to stay, and it was no longer an American
monopoly, if indeed it ever was. The Information Assurance Directorate
of the NSA, the part of the agency that is supposed to protect
US data, was pleased by the spread of strong cryptography. When the
Advanced Encryption Standard (AES) competition was held, there were no
allegations of malign NSA interference; in fact, the winning entry was
devised by two Europeans, Joan Daemen and Vincent Rijmen. But the NSA
and its SIGINT needs did not go away -- the agency merely adopted other
techniques.</t>
        <t indent="0" pn="section-5.4-2">I have often noted that one doesn't go through strong security, one
goes around it. When strong encryption became more common and much
more necessary, the NSA started going around it, by targeting
computers and the software that they run. And it seems clear that they
believe that AES is quite strong; they've even endorsed its use for
protecting TOP SECRET information. But there was an asterisk attached
to that endorsement: AES is suitable if and only if properly used and
implemented. Therein lies the rub.</t>
        <t indent="0" pn="section-5.4-3">The first apparent attempt to tamper with outside cryptographic
mechanisms was discovered in 2007, when two Microsoft researchers, Dan
Shumow and Niels Ferguson, noted an odd property of a
NIST-standardized random number generator, DUAL_EC_DRBG. (The NBS
had been renamed to NIST, the National Institute of Standards and
Technology.) Random numbers are vital for
cryptography, but Shumow and Ferguson showed that if certain constants
in DUAL_EC_DRBG were chosen in a particular way with a
known-but-hidden other number, whoever knew that number could predict
all future random numbers from a system given a few sample bytes to
start from <xref target="Kostyuk2022" format="default" sectionFormat="of" derivedContent="Kostyuk2022"/>. These sample bytes could come from
known keys, nonces, or anything else. Where did the constants in
DUAL_EC_DRBG come from and how were they chosen or generated? No one
who knows is talking. But although cryptographers and security
specialists were very suspicious -- Bruce Schneier wrote in 2007, before
more facts came out, that "both NIST and the NSA have some explaining
to do"; I assigned my students reading on the topic -- the issue didn't
really get any traction until six years later, when among the papers
that Edward Snowden disclosed was the information that the NSA had
indeed tampered with a major cryptographic standard, though published
reports did not specifically name DUAL_EC_DRBG or explain what the
purpose was.</t>
        <t indent="0" pn="section-5.4-4">The revelations didn't stop there. There have been allegations that
the NSA paid some companies to use DUAL_EC_DRBG in their
products. Some people have claimed that there were attempts to modify
some IETF standards to make enough random bytes visible, to aid in
exploiting the random number generator. A major vendor of networking
gear, Juniper, did use DUAL_EC_DRBG in some of its products, but with
different constants <xref target="Checkoway2016" format="default" sectionFormat="of" derivedContent="Checkoway2016"/>. Where did these come from? Were
they from the NSA or some other government? Could their source tree
have been hacked by an intelligence agency? There was a different hack
of their code at around the same time <xref target="Moore2015" format="default" sectionFormat="of" derivedContent="Moore2015"/>. No one is talking.</t>
        <t indent="0" pn="section-5.4-5">The Snowden revelations also included data suggesting that the NSA had
a worldwide eavesdropping network and a group that tried very
specific, targeted hacks on very specific targets' systems. In
retrospect, neither is surprising: "spies gonna spy". The NSA's
business is signals intelligence; of course they're going to try to
intercept traffic. Indeed, the DUAL_EC_DRBG tampering is useless to
anyone who has not collected messages to decrypt. And targeted hacks
are a natural way around strong encryption: collect the data before it
is encrypted or after it is decrypted, and don't worry about the
strength of the algorithms.</t>
        <t indent="0" pn="section-5.4-6">The privacy community, worldwide, was appalled, though perhaps they
shouldn't have been. It calls to mind the line that Claude Rains'
character uttered in the movie
Casablanca <xref target="Curtiz" format="default" sectionFormat="of" derivedContent="Curtiz"/>: "I'm shocked, shocked to find that gambling is going on in
here." The immediate and continuing reaction was to deploy more
encryption. The standards have long existed; what was missing was
adoption. One barrier was the difficulty and expense of getting
certificates to use with TLS, the
successor to SSL; that void was filled by Let's Encrypt <xref target="LE" format="default" sectionFormat="of" derivedContent="LE"/>,
which made free certificates easy to get online. Today, most HTTP
traffic is encrypted, so much so that Google's search engine
down-ranks sites that do not use it. Major email providers uniformly
use TLS to protect all traffic. Wi-Fi, though a local area issue, now
uses much stronger encryption. (It's important to remember that
security and insecurity have economic components. Security doesn't have
to be perfect to be very useful, if it raises the attackers' costs
by enough.)</t>
        <t indent="0" pn="section-5.4-7">The news on the software side is less good. Not a day goes by when one
does not read of organizations being hit by ransomware. It goes
without saying that any threat actor capable of encrypting disks is
also capable of stealing the information on them; indeed, that is a
frequent accompanying activity, since the threat of disclosure is
another incentive to pay for those sites that do have good enough
backups. Major vendors have put a lot of effort into securing their
software, but bugs and operational errors by end-user sites persist.</t>
      </section>
      <section anchor="whither-the-ietf" numbered="true" removeInRFC="false" toc="include" pn="section-5.5">
        <name slugifiedName="name-whither-the-ietf">Whither the IETF?</name>
        <t indent="0" pn="section-5.5-1">Signal intelligence agencies, not just the NSA, but its peers around
the globe -- most major countries have their own -- are not going to go
away. The challenges that have beset the NSA are common to all such
agencies, and their solutions are likely the same. The question is
what should be done to protect individual privacy. A number of strong
democracies, such as Australia and the United Kingdom, are, in
a resumption of the Crypto Wars,
moving to restrict encryption. Spurred on by complaints from the FBI
and other law enforcement agencies, the US Congress frequently
considers bills to do the same.</t>
        <t indent="0" pn="section-5.5-2">The IETF has long had a commitment to strong, ubiquitous
encryption. This is a good thing. It needs to continue, with
cryptography and other security features designed into protocols from
the beginning. But there is also a need for maintenance. Parameters
such as key lengths and modulus sizes age; a value that is acceptable
today may not be 10 years hence. (We've already seen apparent problems
from 1024-bit moduli specified in an RFC, an RFC that was not modified
when technology improved enough that attacking encryption based on
them had become feasible <xref target="Adrian2015" format="default" sectionFormat="of" derivedContent="Adrian2015"/>.) The IETF can do nothing about
the code that vendors ship or that sites use, but it can alert the
world that it thinks things have changed.</t>
        <t indent="0" pn="section-5.5-3">Cryptoagility is of increasing importance. In the next very few years,
we will have so-called post-quantum algorithms. Both protocols and key
lengths will need to change, perhaps drastically. Is the IETF ready?
What will happen to, say, DNSSEC if key lengths become drastically
longer? Backwards compatibility will remain important, but that, of
course, opens the door to other attacks. We've long thought about
them; we need to be sure that our mechanisms work -- we've
been surprised in the past <xref target="BellovinRescorla2006" format="default" sectionFormat="of" derivedContent="BellovinRescorla2006"/>.</t>
        <t indent="0" pn="section-5.5-4">We also need to worry more about metadata. General Michael Hayden,
former director of both the NSA and the CIA, once remarked, "We kill
people based on metadata" <xref target="Ferran2014" format="default" sectionFormat="of" derivedContent="Ferran2014"/>. But caution is necessary;
attempts to hide metadata can have side effects. To give a trivial
example, Tor is quite strong, but if your exit node is in a different
country than you are in, web sites that use IP geolocation may present
their content in a language foreign to you.
Some sites even block connections from known Tor exit nodes.
More generally, many
attempts to hide metadata involve trusting a different party; that
party may turn out to be untrustworthy or it may itself become a
target of attack. As another prominent IETFer has remarked,
"Insecurity is like entropy; you can't destroy it, but you can move it
around." The IETF has done a lot; it needs to do more. And remember
that the risk here is not just governments acting directly, it's also
private companies that collect the data and sell it to all comers.</t>
        <t indent="0" pn="section-5.5-5">Finally, the IETF must remember that its middle name is
"Engineering". To me, one of the attributes of engineering is the art
of picking the right solution in an over-constrained
environment. Intelligence agencies won't go away, nor will national
restrictions on cryptography. We have to pick the right path while
staying true to our principles.</t>
      </section>
    </section>
    <section anchor="security-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-6">
      <name slugifiedName="name-security-considerations">Security Considerations</name>
      <t indent="0" pn="section-6-1">Each or any of the authors may have forgotten or omitted things
or gotten things wrong. We're sorry if that's the case, but that's
in the nature of a look-back such as this. Such flaws almost 
certainly won't worsen security or privacy, though.</t>
    </section>
    <section anchor="iana-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-7">
      <name slugifiedName="name-iana-considerations">IANA Considerations</name>
      <t indent="0" pn="section-7-1">This document has no IANA actions.</t>
    </section>
  </middle>
  <back>
    <displayreference target="I-D.ietf-tls-esni" to="TLS-ECH"/>
    <displayreference target="I-D.ietf-mpls-opportunistic-encrypt" to="MPLS-OPPORTUNISTIC-ENCRYPT"/>
    <references pn="section-8">
      <name slugifiedName="name-informative-references">Informative References</name>
      <reference anchor="ACME" target="https://datatracker.ietf.org/wg/acme/about/" quoteTitle="true" derivedAnchor="ACME">
        <front>
          <title>Automated Certificate Management Environment (acme)</title>
          <author>
            <organization showOnFrontPage="true">IETF</organization>
          </author>
        </front>
      </reference>
      <reference anchor="Adrian2015" target="https://dl.acm.org/doi/10.1145/2810103.2813707" quoteTitle="true" derivedAnchor="Adrian2015">
        <front>
          <title>Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice</title>
          <author initials="D." surname="Adrian" fullname="David Adrian">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="K." surname="Bhargavan" fullname="Karthikeyan Bhargavan">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="Z." surname="Durumeric" fullname="Zakir Durumeric">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="P." surname="Gaudry" fullname="Pierrick Gaudry">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="M." surname="Green" fullname="Matthew Green">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="J. A." surname="Halderman" fullname="J. Alex Halderman">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="N." surname="Heninger" fullname="Nadia Heninger">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="D." surname="Springhall" fullname="Drew Springall">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="E." surname="Thomé" fullname="Emmanuel Thomé">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="L." surname="Valenta" fullname="Luke Valenta">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="B." surname="VanderSloot" fullname="Benjamin VanderSloot">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="E." surname="Wustrow" fullname="Eric Wustrow">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="S." surname="Zanella-Béguelin" fullname="Santiago Zanella-Béguelin">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="P." surname="Zimmermann" fullname="Paul Zimmermann">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="October" year="2015"/>
        </front>
        <refcontent>CCS '15: Proceedings of the 22th ACM Conference on Computer and Communications Security</refcontent>
      </reference>
      <reference anchor="Badii2021" target="https://doi.org/10.5325/jinfopoli.11.2021.0376" quoteTitle="true" derivedAnchor="Badii2021">
        <front>
          <title>The Would-Be Technocracy: Evaluating Efforts to Direct and Control Social Change with Internet Protocol Design</title>
          <author fullname="Farzaneh Badiei" surname="Badiei">
            <organization showOnFrontPage="true">Yale Law School, New Haven, US</organization>
          </author>
          <author fullname="Bradley Fidler" surname="Fidler">
            <organization showOnFrontPage="true">Stevens Institute of Technology, Hoboken, US</organization>
          </author>
          <author>
            <organization showOnFrontPage="true">The Pennsylvania State University Press</organization>
          </author>
          <date month="December" year="2021"/>
          <abstract>
            <t indent="0">This article discusses the shortcomings of value in design approach to protect human rights on the Internet. It argues that Internet protocols do not single handedly mitigate human rights on the Internet and in order to measure their impact, they need to be put in context. In other words, instead of design determinism, contextual analysis of Internet technologies that involve Internet protocols should take place.</t>
          </abstract>
        </front>
        <refcontent>Journal of Information Policy, vol. 11, pp. 376-402</refcontent>
        <seriesInfo name="DOI" value="10.5325/jinfopoli.11.2021.0376"/>
      </reference>
      <reference anchor="Badii2023" target="https://digitalmedusa.org/wp-content/uploads/2023/05/SanctionsandtheInternet-DigitalMedusa.pdf" quoteTitle="true" derivedAnchor="Badii2023">
        <front>
          <title>Sanctions and the Internet</title>
          <author initials="F." surname="Badiei" fullname="Farzaneh Badiei">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="2023"/>
        </front>
        <refcontent>Digital Medusa</refcontent>
      </reference>
      <reference anchor="Baldwin2022" target="https://drenigma.org/2022/03/02/did-britain-sell-enigmas-postwar/" quoteTitle="true" derivedAnchor="Baldwin2022">
        <front>
          <title>Did Britain sell Enigmas postwar?</title>
          <author initials="M." surname="Baldwin" fullname="Mark Baldwin">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="march" year="2022"/>
        </front>
        <refcontent>Dr. Enigma</refcontent>
      </reference>
      <reference anchor="BellovinRescorla2006" target="https://www.cs.columbia.edu/~smb/papers/new-hash.pdf" quoteTitle="true" derivedAnchor="BellovinRescorla2006">
        <front>
          <title>Deploying a New Hash Algorithm</title>
          <author initials="S. M." surname="Bellovin" fullname="Steven M. Bellovin">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="E. K." surname="Rescorla" fullname="Eric K. Rescorla">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="February" year="2006"/>
        </front>
        <refcontent>Proceedings of NDSS '06</refcontent>
      </reference>
      <reference anchor="Blaze1994" target="https://dl.acm.org/doi/10.1145/191177.191193" quoteTitle="true" derivedAnchor="Blaze1994">
        <front>
          <title>Protocol Failure in the Escrowed Encryption Standard</title>
          <author initials="M." surname="Blaze" fullname="Matt Blaze">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="1994"/>
        </front>
        <refcontent>CCS '94: Proceedings of Second ACM Conference on Computer and Communications Security</refcontent>
      </reference>
      <reference anchor="Borda2011" quoteTitle="true" derivedAnchor="Borda2011">
        <front>
          <title>Fundamentals in Information Theory and Coding</title>
          <author initials="M." surname="Borda" fullname="Monica Borda">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="May" year="2011"/>
        </front>
        <refcontent>Springer-Berlin</refcontent>
      </reference>
      <reference anchor="Broad1982" target="https://www.science.org/doi/abs/10.1126/science.217.4563.910" quoteTitle="true" derivedAnchor="Broad1982">
        <front>
          <title>Evading the Soviet Ear at Glen Cove</title>
          <author initials="W. J." surname="Broad" fullname="William J. Broad">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="September" year="1982"/>
        </front>
        <refcontent>Science, 217:4563, pp. 910-911</refcontent>
      </reference>
      <reference anchor="CFRG" target="https://datatracker.ietf.org/rg/cfrg/about/" quoteTitle="true" derivedAnchor="CFRG">
        <front>
          <title>Crypto Forum (cfrg)</title>
          <author>
            <organization showOnFrontPage="true">IRTF</organization>
          </author>
        </front>
      </reference>
      <reference anchor="Checkoway2016" target="https://dl.acm.org/citation.cfm?id=2978395" quoteTitle="true" derivedAnchor="Checkoway2016">
        <front>
          <title>A Systematic Analysis of the Juniper Dual EC Incident</title>
          <author initials="S." surname="Checkoway" fullname="Stephen Checkoway">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="J." surname="Maskiewicz" fullname="Jacob Maskiewicz">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="C." surname="Garman" fullname="Christina Garman">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="J." surname="Fried" fullname="Joshua Fried">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="S." surname="Cohney" fullname="Shaanan Cohney">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="M." surname="Green" fullname="Matthew Green">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="N." surname="Heninger" fullname="Nadia Heninger">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="R. P." surname="Weinmann" fullname="Ralf-Philipp Weinmann">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="E." surname="Rescorla" fullname="Eric Rescorla">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="" surname="Hovav Shacham" fullname="Hovav Shacham">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="October" year="2016"/>
        </front>
        <refcontent>CCS '16: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 468-479</refcontent>
      </reference>
      <reference anchor="CURDLE" target="https://datatracker.ietf.org/wg/curdle/about/" quoteTitle="true" derivedAnchor="CURDLE">
        <front>
          <title>CURves, Deprecating and a Little more Encryption (curdle)</title>
          <author>
            <organization showOnFrontPage="true">IETF</organization>
          </author>
        </front>
      </reference>
      <reference anchor="Curtiz" quoteTitle="true" derivedAnchor="Curtiz">
        <front>
          <title>Casablanca</title>
          <author initials="M." surname="Curtiz" fullname="Michael Curtiz">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="J. J." surname="Epstein" fullname="Julius J. Epstein">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="P. G." surname="Epstein" fullname="Philip G. Epstein">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="H." surname="Koch" fullname="Howard Koch">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="November" year="1942"/>
        </front>
        <refcontent>Warner Bros. Pictures</refcontent>
      </reference>
      <reference anchor="Doria2012" target="https://www.internetsociety.org/resources/doc/2012/human-rights-and-internet-protocols-comparing-processes-and-principles/" quoteTitle="true" derivedAnchor="Doria2012">
        <front>
          <title>Human Rights and Internet Protocols: Comparing Processes and Principles</title>
          <author initials="J." surname="Liddicoat" fullname="Joy Liddicoat">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="A." surname="Doria" fullname="Avri Doria">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="December" year="2012"/>
        </front>
        <refcontent>The Internet Society</refcontent>
      </reference>
      <reference anchor="Dual-EC" target="https://eprint.iacr.org/2015/767.pdf" quoteTitle="true" derivedAnchor="Dual-EC">
        <front>
          <title>Dual EC: A Standardized Back Door</title>
          <author initials="D." surname="Bernstein" fullname="Daniel Bernstein">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="T." surname="Lange" fullname="Tanja Lange">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="R." surname="Niederhagen" fullname="Ruben Niederhagen">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="July" year="2016"/>
        </front>
      </reference>
      <reference anchor="Ferran2014" target="https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-we-kill-people-based-on-metadata" quoteTitle="true" derivedAnchor="Ferran2014">
        <front>
          <title>Ex-NSA Chief: "We Kill People Based on Metadata"</title>
          <author initials="L." surname="Ferran" fullname="Lee Ferran">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="2014" month="May"/>
        </front>
        <refcontent>ABC News</refcontent>
      </reference>
      <reference anchor="Garfinkel1995" quoteTitle="true" derivedAnchor="Garfinkel1995">
        <front>
          <title>PGP: Pretty Good Privacy</title>
          <author initials="S." surname="Garfinkel" fullname="Simson Garfinkel">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="January" year="1995"/>
        </front>
        <refcontent>O'Reilly and Associates</refcontent>
      </reference>
      <reference anchor="Guard2013" quoteTitle="true" derivedAnchor="Guard2013">
        <front>
          <title>NSA collecting phone records of millions of Verizon customers daily</title>
          <author initials="G." surname="Greenwald" fullname="Glenn Greenwald">
            <organization showOnFrontPage="true">The Guardian</organization>
          </author>
          <date year="2013" month="June"/>
        </front>
        <refcontent>The Guardian</refcontent>
      </reference>
      <reference anchor="Headrick1991" quoteTitle="true" derivedAnchor="Headrick1991">
        <front>
          <title>The Invisible Weapon: Telecommunications and International Politics, 1851-1945</title>
          <author initials="D. R." surname="Headrick" fullname="Daniel R. Headrick">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="1991"/>
        </front>
        <refcontent>Oxford University Press</refcontent>
      </reference>
      <reference anchor="Johnson1998" target="https://www.nsa.gov/portals/75/documents/news-features/declassified-documents/cryptologic-histories/cold_war_iii.pdf" quoteTitle="true" derivedAnchor="Johnson1998">
        <front>
          <title>American Cryptology During the Cold War, 1945-1989; Book III: Retrenchment and Reform, 1972-1980</title>
          <author initials="T. R." surname="Johnson" fullname="Thomas R. Johnson">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="1998"/>
        </front>
        <refcontent>Center for Cryptologic History, NSA</refcontent>
      </reference>
      <reference anchor="Kahn1996" quoteTitle="true" derivedAnchor="Kahn1996">
        <front>
          <title>The Codebreakers: The Comprehensive History of Secret Communication from Ancient Times to the Internet</title>
          <author initials="D." surname="Kahn" fullname="David Kahn">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="1996"/>
        </front>
        <refcontent>2nd Edition</refcontent>
        <refcontent>Scribner</refcontent>
      </reference>
      <reference anchor="Kennedy1971" target="https://www.jstor.org/stable/563928" quoteTitle="true" derivedAnchor="Kennedy1971">
        <front>
          <title>Imperial cable communications and strategy, 1870-1914</title>
          <author initials="P. M." surname="Kennedy" fullname="Paul M. Kennedy">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="October" year="1971"/>
        </front>
        <refcontent>English Historical Review, 86:341, pp. 728-752</refcontent>
        <refcontent>Oxford University Press</refcontent>
      </reference>
      <reference anchor="Kerr2020" target="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3533069" quoteTitle="true" derivedAnchor="Kerr2020">
        <front>
          <title>Decryption Originalism: The Lessons of Burr</title>
          <author initials="O. S." surname="Kerr" fullname="Orin S. Kerr">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="January" year="2021"/>
        </front>
        <refcontent>Harvard Law Review, 134:905</refcontent>
      </reference>
      <reference anchor="Kostyuk2022" target="https://www.harvardnsj.org/wp-content/uploads/sites/13/2022/06/Vol13Iss2_Kostyuk-Landau_Dual-EC-DRGB.pdf" quoteTitle="true" derivedAnchor="Kostyuk2022">
        <front>
          <title>Dueling over DUAL_EC_DRBG: The Consequences of Corrupting a Cryptographic Standardization Process</title>
          <author initials="N." surname="Kostyuk" fullname="Nadyia Kostyuk">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="S." surname="Landau" fullname="Susan Landau">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="June" year="2022"/>
        </front>
        <refcontent>Harvard National Security Journal, 13:2, pp. 224-284</refcontent>
      </reference>
      <reference anchor="Landau1988" target="https://privacyink.org/pdf/Zero_Knowledge.pdf" quoteTitle="true" derivedAnchor="Landau1988">
        <front>
          <title>Zero Knowledge and the Department of Defense</title>
          <author initials="S." surname="Landau" fullname="Susan Landau">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="January" year="1988"/>
        </front>
        <refcontent>Notices of the American Mathematical Society, 35:1, pp. 5-12</refcontent>
      </reference>
      <reference anchor="Landau2014" target="https://jnslp.com/wp-content/uploads/2015/03/NSA%E2%80%99s-Efforts-to-Secure-Private-Sector-Telecommunications-Infrastructure_2.pdf" quoteTitle="true" derivedAnchor="Landau2014">
        <front>
          <title>Under the Radar: NSA's Efforts to Secure Private-Sector Telecommunications Infrastructure</title>
          <author initials="S." surname="Landau" fullname="Susan Landau">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="September" year="2014"/>
        </front>
        <refcontent>Journal of National Security Law &amp; Policy, 7:3</refcontent>
      </reference>
      <reference anchor="LE" target="https://dl.acm.org/doi/pdf/10.1145/3319535.3363192" quoteTitle="true" derivedAnchor="LE">
        <front>
          <title>Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web</title>
          <author initials="J." surname="Aas" fullname="Josh Aas">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="R." surname="Barnes" fullname="Richard Barnes">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="B." surname="Case" fullname="Benton Case">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="Z." surname="Durumeric" fullname="Zakir Durumeric">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="P." surname="Eckersley" fullname="Peter Eckersley">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="A." surname="Flores-López" fullname="Alan Flores-López">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="A." surname="Halderman" fullname="Alex Halderman">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="J." surname="Hoffman-Andrews" fullname="Jacob Hoffman-Andrews">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="J." surname="Kasten" fullname="James Kasten">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="E." surname="Rescorla" fullname="Eric Rescorla">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="S. D." surname="Schoen" fullname="Seth David Schoen">
            <organization showOnFrontPage="true"/>
          </author>
          <author initials="B." surname="Warren" fullname="Brad Warren">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="November" year="2019"/>
        </front>
        <refcontent>CCS '19: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security</refcontent>
      </reference>
      <reference anchor="Levy2001" quoteTitle="true" derivedAnchor="Levy2001">
        <front>
          <title>Crypto: How the Code Rebels Beat the Government-Saving Privacy in the Digital Age</title>
          <author initials="S." surname="Levy" fullname="Steven Levy">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="January" year="2001"/>
        </front>
        <refcontent>Penguin Publishing Group</refcontent>
      </reference>
      <reference anchor="MADINAS" target="https://datatracker.ietf.org/wg/madinas/about" quoteTitle="true" derivedAnchor="MADINAS">
        <front>
          <title>MAC Address Device Identification for Network and Application Services (madinas)</title>
          <author>
            <organization showOnFrontPage="true">IETF</organization>
          </author>
        </front>
      </reference>
      <reference anchor="Masnick2023" target="https://copia.is/library/unintended-consequences/" quoteTitle="true" derivedAnchor="Masnick2023">
        <front>
          <title>The Unintended Consequences of Internet Regulation</title>
          <author initials="M." surname="Masnick" fullname="Mike Masnick">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="April" year="2023"/>
        </front>
        <refcontent>Copia</refcontent>
      </reference>
      <reference anchor="Miller2020" target="https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/" quoteTitle="true" derivedAnchor="Miller2020">
        <front>
          <title>The intelligence coup of the century</title>
          <author initials="G." surname="Miller" fullname="Greg Miller">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="2020" month="February"/>
        </front>
        <refcontent>The Washington Post</refcontent>
      </reference>
      <reference anchor="Moore2015" target="https://www.rapid7.com/blog/post/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor/" quoteTitle="true" derivedAnchor="Moore2015">
        <front>
          <title>CVE-2015-7755: Juniper ScreenOS Authentication Backdoor</title>
          <author initials="H. D." surname="Moore" fullname="H.D. Moore">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="December" year="2015"/>
        </front>
        <refcontent>Rapid7</refcontent>
      </reference>
      <reference anchor="I-D.ietf-mpls-opportunistic-encrypt" target="https://datatracker.ietf.org/doc/html/draft-ietf-mpls-opportunistic-encrypt-03" quoteTitle="true" derivedAnchor="MPLS-OPPORTUNISTIC-ENCRYPT">
        <front>
          <title>Opportunistic Security in MPLS Networks</title>
          <author fullname="Adrian Farrel" initials="A." surname="Farrel">
            <organization showOnFrontPage="true">Juniper Networks</organization>
          </author>
          <author fullname="Stephen Farrell" initials="S." surname="Farrell">
            <organization showOnFrontPage="true">Trinity College Dublin</organization>
          </author>
          <date day="28" month="March" year="2017"/>
          <abstract>
            <t indent="0">This document describes a way to apply opportunistic security between adjacent nodes on an MPLS Label Switched Path (LSP) or between end points of an LSP. It explains how keys may be agreed to enable encryption, and how key identifiers are exchanged in encrypted MPLS packets. Finally, this document describes the applicability of this approach to opportunistic security in MPLS networks with an indication of the level of improved security as well as the continued vulnerabilities. This document does not describe security for MPLS control plane protocols.</t>
          </abstract>
        </front>
        <seriesInfo name="Internet-Draft" value="draft-ietf-mpls-opportunistic-encrypt-03"/>
        <refcontent>Work in Progress</refcontent>
      </reference>
      <reference anchor="Perpass" target="https://mailarchive.ietf.org/arch/browse/perpass/" quoteTitle="true" derivedAnchor="Perpass">
        <front>
          <title>perpass mailing list</title>
          <author>
            <organization showOnFrontPage="true">IETF</organization>
          </author>
        </front>
      </reference>
      <reference anchor="Perpass-BoF" target="https://www.ietf.org/proceedings/88/perpass.html" quoteTitle="true" derivedAnchor="Perpass-BoF">
        <front>
          <title>perpass BoF -- Handling Pervasive Monitoring in the IETF</title>
          <author>
            <organization showOnFrontPage="true">IETF</organization>
          </author>
          <date month="November" year="2013"/>
        </front>
        <refcontent>IETF 88 Proceedings</refcontent>
      </reference>
      <reference anchor="Plenary-video" target="https://www.youtube.com/watch?v=oV71hhEpQ20&amp;pp=ygUQaWV0ZiA4OCBwbGVuYXJ5IA%3D%3D" quoteTitle="true" derivedAnchor="Plenary-video">
        <front>
          <title>IETF 88 Technical Plenary: Hardening The Internet</title>
          <author>
            <organization showOnFrontPage="true"/>
          </author>
          <date month="November" year="2013"/>
        </front>
        <refcontent>YouTube video, 2:37:28, posted by "IETF - Internet Engineering Task Force"</refcontent>
      </reference>
      <reference anchor="Refs-to-7258" target="https://datatracker.ietf.org/doc/rfc7258/referencedby/" quoteTitle="true" derivedAnchor="Refs-to-7258">
        <front>
          <title>References to RFC7258</title>
          <author>
            <organization showOnFrontPage="true">IETF</organization>
          </author>
        </front>
      </reference>
      <reference anchor="RFC1984" target="https://www.rfc-editor.org/info/rfc1984" quoteTitle="true" derivedAnchor="RFC1984">
        <front>
          <title>IAB and IESG Statement on Cryptographic Technology and the Internet</title>
          <author>
            <organization abbrev="IAB" showOnFrontPage="true">Internet Architecture Board</organization>
          </author>
          <author>
            <organization abbrev="IESG" showOnFrontPage="true">Internet Engineering Steering Group</organization>
          </author>
          <date month="August" year="1996"/>
          <abstract>
            <t indent="0">The Internet Architecture Board (IAB) and the Internet Engineering Steering Group (IESG), the bodies which oversee architecture and standards for the Internet, are concerned by the need for increased protection of international commercial transactions on the Internet, and by the need to offer all Internet users an adequate degree of privacy. This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="200"/>
        <seriesInfo name="RFC" value="1984"/>
        <seriesInfo name="DOI" value="10.17487/RFC1984"/>
      </reference>
      <reference anchor="RFC3365" target="https://www.rfc-editor.org/info/rfc3365" quoteTitle="true" derivedAnchor="RFC3365">
        <front>
          <title>Strong Security Requirements for Internet Engineering Task Force Standard Protocols</title>
          <author fullname="J. Schiller" initials="J." surname="Schiller"/>
          <date month="August" year="2002"/>
        </front>
        <seriesInfo name="BCP" value="61"/>
        <seriesInfo name="RFC" value="3365"/>
        <seriesInfo name="DOI" value="10.17487/RFC3365"/>
      </reference>
      <reference anchor="RFC6462" target="https://www.rfc-editor.org/info/rfc6462" quoteTitle="true" derivedAnchor="RFC6462">
        <front>
          <title>Report from the Internet Privacy Workshop</title>
          <author fullname="A. Cooper" initials="A." surname="Cooper"/>
          <date month="January" year="2012"/>
          <abstract>
            <t indent="0">On December 8-9, 2010, the IAB co-hosted an Internet privacy workshop with the World Wide Web Consortium (W3C), the Internet Society (ISOC), and MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL). The workshop revealed some of the fundamental challenges in designing, deploying, and analyzing privacy-protective Internet protocols and systems. Although workshop participants and the community as a whole are still far from understanding how best to systematically address privacy within Internet standards development, workshop participants identified a number of potential next steps. For the IETF, these included the creation of a privacy directorate to review Internet-Drafts, further work on documenting privacy considerations for protocol developers, and a number of exploratory efforts concerning fingerprinting and anonymized routing. Potential action items for the W3C included investigating the formation of a privacy interest group and formulating guidance about fingerprinting, referrer headers, data minimization in APIs, usability, and general considerations for non-browser-based protocols.</t>
            <t indent="0">Note that this document is a report on the proceedings of the workshop. The views and positions documented in this report are those of the workshop participants and do not necessarily reflect the views of the IAB, W3C, ISOC, or MIT CSAIL. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="6462"/>
        <seriesInfo name="DOI" value="10.17487/RFC6462"/>
      </reference>
      <reference anchor="RFC7217" target="https://www.rfc-editor.org/info/rfc7217" quoteTitle="true" derivedAnchor="RFC7217">
        <front>
          <title>A Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)</title>
          <author fullname="F. Gont" initials="F." surname="Gont"/>
          <date month="April" year="2014"/>
          <abstract>
            <t indent="0">This document specifies a method for generating IPv6 Interface Identifiers to be used with IPv6 Stateless Address Autoconfiguration (SLAAC), such that an IPv6 address configured using this method is stable within each subnet, but the corresponding Interface Identifier changes when the host moves from one network to another. This method is meant to be an alternative to generating Interface Identifiers based on hardware addresses (e.g., IEEE LAN Media Access Control (MAC) addresses), such that the benefits of stable addresses can be achieved without sacrificing the security and privacy of users. The method specified in this document applies to all prefixes a host may be employing, including link-local, global, and unique-local prefixes (and their corresponding addresses).</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="7217"/>
        <seriesInfo name="DOI" value="10.17487/RFC7217"/>
      </reference>
      <reference anchor="RFC7258" target="https://www.rfc-editor.org/info/rfc7258" quoteTitle="true" derivedAnchor="RFC7258">
        <front>
          <title>Pervasive Monitoring Is an Attack</title>
          <author fullname="S. Farrell" initials="S." surname="Farrell"/>
          <author fullname="H. Tschofenig" initials="H." surname="Tschofenig"/>
          <date month="May" year="2014"/>
          <abstract>
            <t indent="0">Pervasive monitoring is a technical attack that should be mitigated in the design of IETF protocols, where possible.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="188"/>
        <seriesInfo name="RFC" value="7258"/>
        <seriesInfo name="DOI" value="10.17487/RFC7258"/>
      </reference>
      <reference anchor="RFC7480" target="https://www.rfc-editor.org/info/rfc7480" quoteTitle="true" derivedAnchor="RFC7480">
        <front>
          <title>HTTP Usage in the Registration Data Access Protocol (RDAP)</title>
          <author fullname="A. Newton" initials="A." surname="Newton"/>
          <author fullname="B. Ellacott" initials="B." surname="Ellacott"/>
          <author fullname="N. Kong" initials="N." surname="Kong"/>
          <date month="March" year="2015"/>
          <abstract>
            <t indent="0">This document is one of a collection that together describes the Registration Data Access Protocol (RDAP). It describes how RDAP is transported using the Hypertext Transfer Protocol (HTTP). RDAP is a successor protocol to the very old WHOIS protocol. The purpose of this document is to clarify the use of standard HTTP mechanisms for this application.</t>
          </abstract>
        </front>
        <seriesInfo name="STD" value="95"/>
        <seriesInfo name="RFC" value="7480"/>
        <seriesInfo name="DOI" value="10.17487/RFC7480"/>
      </reference>
      <reference anchor="RFC7481" target="https://www.rfc-editor.org/info/rfc7481" quoteTitle="true" derivedAnchor="RFC7481">
        <front>
          <title>Security Services for the Registration Data Access Protocol (RDAP)</title>
          <author fullname="S. Hollenbeck" initials="S." surname="Hollenbeck"/>
          <author fullname="N. Kong" initials="N." surname="Kong"/>
          <date month="March" year="2015"/>
          <abstract>
            <t indent="0">The Registration Data Access Protocol (RDAP) provides "RESTful" web services to retrieve registration metadata from Domain Name and Regional Internet Registries. This document describes information security services, including access control, authentication, authorization, availability, data confidentiality, and data integrity for RDAP.</t>
          </abstract>
        </front>
        <seriesInfo name="STD" value="95"/>
        <seriesInfo name="RFC" value="7481"/>
        <seriesInfo name="DOI" value="10.17487/RFC7481"/>
      </reference>
      <reference anchor="RFC7687" target="https://www.rfc-editor.org/info/rfc7687" quoteTitle="true" derivedAnchor="RFC7687">
        <front>
          <title>Report from the Strengthening the Internet (STRINT) Workshop</title>
          <author fullname="S. Farrell" initials="S." surname="Farrell"/>
          <author fullname="R. Wenning" initials="R." surname="Wenning"/>
          <author fullname="B. Bos" initials="B." surname="Bos"/>
          <author fullname="M. Blanchet" initials="M." surname="Blanchet"/>
          <author fullname="H. Tschofenig" initials="H." surname="Tschofenig"/>
          <date month="December" year="2015"/>
          <abstract>
            <t indent="0">The Strengthening the Internet (STRINT) workshop assembled one hundred participants in London for two days in early 2014 to discuss how the technical community, and in particular the IETF and the W3C, should react to Pervasive Monitoring and more generally how to strengthen the Internet in the face of such attacks. The discussions covered issues of terminology, the role of user interfaces, classes of mitigation, some specific use cases, transition strategies (including opportunistic encryption), and more. The workshop ended with a few high-level recommendations, that it is believed could be implemented and could help strengthen the Internet. This is the report of that workshop.</t>
            <t indent="0">Note that this document is a report on the proceedings of the workshop. The views and positions documented in this report are those of the workshop participants and do not necessarily reflect IAB views and positions.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="7687"/>
        <seriesInfo name="DOI" value="10.17487/RFC7687"/>
      </reference>
      <reference anchor="RFC7858" target="https://www.rfc-editor.org/info/rfc7858" quoteTitle="true" derivedAnchor="RFC7858">
        <front>
          <title>Specification for DNS over Transport Layer Security (TLS)</title>
          <author fullname="Z. Hu" initials="Z." surname="Hu"/>
          <author fullname="L. Zhu" initials="L." surname="Zhu"/>
          <author fullname="J. Heidemann" initials="J." surname="Heidemann"/>
          <author fullname="A. Mankin" initials="A." surname="Mankin"/>
          <author fullname="D. Wessels" initials="D." surname="Wessels"/>
          <author fullname="P. Hoffman" initials="P." surname="Hoffman"/>
          <date month="May" year="2016"/>
          <abstract>
            <t indent="0">This document describes the use of Transport Layer Security (TLS) to provide privacy for DNS. Encryption provided by TLS eliminates opportunities for eavesdropping and on-path tampering with DNS queries in the network, such as discussed in RFC 7626. In addition, this document specifies two usage profiles for DNS over TLS and provides advice on performance considerations to minimize overhead from using TCP and TLS with DNS.</t>
            <t indent="0">This document focuses on securing stub-to-recursive traffic, as per the charter of the DPRIVE Working Group. It does not prevent future applications of the protocol to recursive-to-authoritative traffic.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="7858"/>
        <seriesInfo name="DOI" value="10.17487/RFC7858"/>
      </reference>
      <reference anchor="RFC8056" target="https://www.rfc-editor.org/info/rfc8056" quoteTitle="true" derivedAnchor="RFC8056">
        <front>
          <title>Extensible Provisioning Protocol (EPP) and Registration Data Access Protocol (RDAP) Status Mapping</title>
          <author fullname="J. Gould" initials="J." surname="Gould"/>
          <date month="January" year="2017"/>
          <abstract>
            <t indent="0">This document describes the mapping of the Extensible Provisioning Protocol (EPP) statuses with the statuses registered for use in the Registration Data Access Protocol (RDAP). This document identifies gaps in the mapping, and registers RDAP statuses to fill those gaps to ensure that all of the EPP statuses specified in RFCs are supported in RDAP.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="8056"/>
        <seriesInfo name="DOI" value="10.17487/RFC8056"/>
      </reference>
      <reference anchor="RFC8064" target="https://www.rfc-editor.org/info/rfc8064" quoteTitle="true" derivedAnchor="RFC8064">
        <front>
          <title>Recommendation on Stable IPv6 Interface Identifiers</title>
          <author fullname="F. Gont" initials="F." surname="Gont"/>
          <author fullname="A. Cooper" initials="A." surname="Cooper"/>
          <author fullname="D. Thaler" initials="D." surname="Thaler"/>
          <author fullname="W. Liu" initials="W." surname="Liu"/>
          <date month="February" year="2017"/>
          <abstract>
            <t indent="0">This document changes the recommended default Interface Identifier (IID) generation scheme for cases where Stateless Address Autoconfiguration (SLAAC) is used to generate a stable IPv6 address. It recommends using the mechanism specified in RFC 7217 in such cases, and recommends against embedding stable link-layer addresses in IPv6 IIDs. It formally updates RFC 2464, RFC 2467, RFC 2470, RFC 2491, RFC 2492, RFC 2497, RFC 2590, RFC 3146, RFC 3572, RFC 4291, RFC 4338, RFC 4391, RFC 5072, and RFC 5121. This document does not change any existing recommendations concerning the use of temporary addresses as specified in RFC 4941.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="8064"/>
        <seriesInfo name="DOI" value="10.17487/RFC8064"/>
      </reference>
      <reference anchor="RFC8280" target="https://www.rfc-editor.org/info/rfc8280" quoteTitle="true" derivedAnchor="RFC8280">
        <front>
          <title>Research into Human Rights Protocol Considerations</title>
          <author fullname="N. ten Oever" initials="N." surname="ten Oever"/>
          <author fullname="C. Cath" initials="C." surname="Cath"/>
          <date month="October" year="2017"/>
          <abstract>
            <t indent="0">This document aims to propose guidelines for human rights considerations, similar to the work done on the guidelines for privacy considerations (RFC 6973). The other parts of this document explain the background of the guidelines and how they were developed.</t>
            <t indent="0">This document is the first milestone in a longer-term research effort. It has been reviewed by the Human Rights Protocol Considerations (HRPC) Research Group and also by individuals from outside the research group.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="8280"/>
        <seriesInfo name="DOI" value="10.17487/RFC8280"/>
      </reference>
      <reference anchor="RFC8446" target="https://www.rfc-editor.org/info/rfc8446" quoteTitle="true" derivedAnchor="RFC8446">
        <front>
          <title>The Transport Layer Security (TLS) Protocol Version 1.3</title>
          <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
          <date month="August" year="2018"/>
          <abstract>
            <t indent="0">This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery.</t>
            <t indent="0">This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="8446"/>
        <seriesInfo name="DOI" value="10.17487/RFC8446"/>
      </reference>
      <reference anchor="RFC8461" target="https://www.rfc-editor.org/info/rfc8461" quoteTitle="true" derivedAnchor="RFC8461">
        <front>
          <title>SMTP MTA Strict Transport Security (MTA-STS)</title>
          <author fullname="D. Margolis" initials="D." surname="Margolis"/>
          <author fullname="M. Risher" initials="M." surname="Risher"/>
          <author fullname="B. Ramakrishnan" initials="B." surname="Ramakrishnan"/>
          <author fullname="A. Brotman" initials="A." surname="Brotman"/>
          <author fullname="J. Jones" initials="J." surname="Jones"/>
          <date month="September" year="2018"/>
          <abstract>
            <t indent="0">SMTP MTA Strict Transport Security (MTA-STS) is a mechanism enabling mail service providers (SPs) to declare their ability to receive Transport Layer Security (TLS) secure SMTP connections and to specify whether sending SMTP servers should refuse to deliver to MX hosts that do not offer TLS with a trusted server certificate.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="8461"/>
        <seriesInfo name="DOI" value="10.17487/RFC8461"/>
      </reference>
      <reference anchor="RFC8484" target="https://www.rfc-editor.org/info/rfc8484" quoteTitle="true" derivedAnchor="RFC8484">
        <front>
          <title>DNS Queries over HTTPS (DoH)</title>
          <author fullname="P. Hoffman" initials="P." surname="Hoffman"/>
          <author fullname="P. McManus" initials="P." surname="McManus"/>
          <date month="October" year="2018"/>
          <abstract>
            <t indent="0">This document defines a protocol for sending DNS queries and getting DNS responses over HTTPS. Each DNS query-response pair is mapped into an HTTP exchange.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="8484"/>
        <seriesInfo name="DOI" value="10.17487/RFC8484"/>
      </reference>
      <reference anchor="RFC8981" target="https://www.rfc-editor.org/info/rfc8981" quoteTitle="true" derivedAnchor="RFC8981">
        <front>
          <title>Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6</title>
          <author fullname="F. Gont" initials="F." surname="Gont"/>
          <author fullname="S. Krishnan" initials="S." surname="Krishnan"/>
          <author fullname="T. Narten" initials="T." surname="Narten"/>
          <author fullname="R. Draves" initials="R." surname="Draves"/>
          <date month="February" year="2021"/>
          <abstract>
            <t indent="0">This document describes an extension to IPv6 Stateless Address Autoconfiguration that causes hosts to generate temporary addresses with randomized interface identifiers for each prefix advertised with autoconfiguration enabled. Changing addresses over time limits the window of time during which eavesdroppers and other information collectors may trivially perform address-based network-activity correlation when the same address is employed for multiple transactions by the same host. Additionally, it reduces the window of exposure of a host as being accessible via an address that becomes revealed as a result of active communication. This document obsoletes RFC 4941.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="8981"/>
        <seriesInfo name="DOI" value="10.17487/RFC8981"/>
      </reference>
      <reference anchor="RFC9000" target="https://www.rfc-editor.org/info/rfc9000" quoteTitle="true" derivedAnchor="RFC9000">
        <front>
          <title>QUIC: A UDP-Based Multiplexed and Secure Transport</title>
          <author fullname="J. Iyengar" initials="J." role="editor" surname="Iyengar"/>
          <author fullname="M. Thomson" initials="M." role="editor" surname="Thomson"/>
          <date month="May" year="2021"/>
          <abstract>
            <t indent="0">This document defines the core of the QUIC transport protocol. QUIC provides applications with flow-controlled streams for structured communication, low-latency connection establishment, and network path migration. QUIC includes security measures that ensure confidentiality, integrity, and availability in a range of deployment circumstances. Accompanying documents describe the integration of TLS for key negotiation, loss detection, and an exemplary congestion control algorithm.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="9000"/>
        <seriesInfo name="DOI" value="10.17487/RFC9000"/>
      </reference>
      <reference anchor="RFC9082" target="https://www.rfc-editor.org/info/rfc9082" quoteTitle="true" derivedAnchor="RFC9082">
        <front>
          <title>Registration Data Access Protocol (RDAP) Query Format</title>
          <author fullname="S. Hollenbeck" initials="S." surname="Hollenbeck"/>
          <author fullname="A. Newton" initials="A." surname="Newton"/>
          <date month="June" year="2021"/>
          <abstract>
            <t indent="0">This document describes uniform patterns to construct HTTP URLs that may be used to retrieve registration information from registries (including both Regional Internet Registries (RIRs) and Domain Name Registries (DNRs)) using "RESTful" web access patterns. These uniform patterns define the query syntax for the Registration Data Access Protocol (RDAP). This document obsoletes RFC 7482.</t>
          </abstract>
        </front>
        <seriesInfo name="STD" value="95"/>
        <seriesInfo name="RFC" value="9082"/>
        <seriesInfo name="DOI" value="10.17487/RFC9082"/>
      </reference>
      <reference anchor="RFC9083" target="https://www.rfc-editor.org/info/rfc9083" quoteTitle="true" derivedAnchor="RFC9083">
        <front>
          <title>JSON Responses for the Registration Data Access Protocol (RDAP)</title>
          <author fullname="S. Hollenbeck" initials="S." surname="Hollenbeck"/>
          <author fullname="A. Newton" initials="A." surname="Newton"/>
          <date month="June" year="2021"/>
          <abstract>
            <t indent="0">This document describes JSON data structures representing registration information maintained by Regional Internet Registries (RIRs) and Domain Name Registries (DNRs). These data structures are used to form Registration Data Access Protocol (RDAP) query responses. This document obsoletes RFC 7483.</t>
          </abstract>
        </front>
        <seriesInfo name="STD" value="95"/>
        <seriesInfo name="RFC" value="9083"/>
        <seriesInfo name="DOI" value="10.17487/RFC9083"/>
      </reference>
      <reference anchor="RFC9113" target="https://www.rfc-editor.org/info/rfc9113" quoteTitle="true" derivedAnchor="RFC9113">
        <front>
          <title>HTTP/2</title>
          <author fullname="M. Thomson" initials="M." role="editor" surname="Thomson"/>
          <author fullname="C. Benfield" initials="C." role="editor" surname="Benfield"/>
          <date month="June" year="2022"/>
          <abstract>
            <t indent="0">This specification describes an optimized expression of the semantics of the Hypertext Transfer Protocol (HTTP), referred to as HTTP version 2 (HTTP/2). HTTP/2 enables a more efficient use of network resources and a reduced latency by introducing field compression and allowing multiple concurrent exchanges on the same connection.</t>
            <t indent="0">This document obsoletes RFCs 7540 and 8740.</t>
          </abstract>
        </front>
        <seriesInfo name="RFC" value="9113"/>
        <seriesInfo name="DOI" value="10.17487/RFC9113"/>
      </reference>
      <reference anchor="RFC9224" target="https://www.rfc-editor.org/info/rfc9224" quoteTitle="true" derivedAnchor="RFC9224">
        <front>
          <title>Finding the Authoritative Registration Data Access Protocol (RDAP) Service</title>
          <author fullname="M. Blanchet" initials="M." surname="Blanchet"/>
          <date month="March" year="2022"/>
          <abstract>
            <t indent="0">This document specifies a method to find which Registration Data Access Protocol (RDAP) server is authoritative to answer queries for a requested scope, such as domain names, IP addresses, or Autonomous System numbers. This document obsoletes RFC 7484.</t>
          </abstract>
        </front>
        <seriesInfo name="STD" value="95"/>
        <seriesInfo name="RFC" value="9224"/>
        <seriesInfo name="DOI" value="10.17487/RFC9224"/>
      </reference>
      <reference anchor="Roth2022" target="https://www.theverge.com/2022/3/5/22962822/internet-backbone-provider-cogent-shuts-off-service-russia" quoteTitle="true" derivedAnchor="Roth2022">
        <front>
          <title>Internet backbone provider shuts off service in Russia</title>
          <author initials="E." surname="Roth" fullname="Emma Roth">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="2022" month="March"/>
        </front>
        <refcontent>The Verge</refcontent>
      </reference>
      <reference anchor="Rowlett1998" quoteTitle="true" derivedAnchor="Rowlett1998">
        <front>
          <title>The Story of Magic, Memoirs of an American Cryptologic Pioneer</title>
          <author initials="F. B." surname="Rowlett" fullname="Frank B. Rowlett">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="1998"/>
        </front>
        <refcontent>Aegean Park Press</refcontent>
      </reference>
      <reference anchor="Slater1870" target="https://books.google.com/books?id=MJYBAAAAQAAJ" quoteTitle="true" derivedAnchor="Slater1870">
        <front>
          <title>Telegraphic Code, to Ensure Secresy in the Transmission of Telegrams</title>
          <author initials="R." surname="Slater" fullname="Robert Slater">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="1870"/>
        </front>
        <refcontent>First Edition</refcontent>
        <refcontent>W.R. Gray</refcontent>
      </reference>
      <reference anchor="Smith1845" target="https://books.google.com/books?id=Z45clCxsF7EC" quoteTitle="true" derivedAnchor="Smith1845">
        <front>
          <title>The Secret Corresponding Vocabulary: Adapted for Use to Morse's Electro-Magnetic Telegraph, and Also in Conducting Written Correspondence, Transmitted by the Mails, or Otherwise</title>
          <author initials="F. O." surname="Smith" fullname="Francis O. Smith">
            <organization showOnFrontPage="true"/>
          </author>
          <date year="1845"/>
        </front>
        <refcontent>Thurston, Isley &amp; Company</refcontent>
      </reference>
      <reference anchor="STRINT" target="https://www.w3.org/2014/strint/" quoteTitle="true" derivedAnchor="STRINT">
        <front>
          <title>A W3C/IAB workshop on Strengthening the Internet Against Pervasive Monitoring (STRINT)</title>
          <author>
            <organization showOnFrontPage="true">W3C</organization>
          </author>
          <author>
            <organization showOnFrontPage="true">IAB</organization>
          </author>
          <date month="March" year="2014"/>
        </front>
      </reference>
      <reference anchor="Timeline" target="https://en.wikipedia.org/w/index.php?title=Global_surveillance_disclosures_(2013%E2%80%93present)&amp;oldid=1161557819" quoteTitle="true" derivedAnchor="Timeline">
        <front>
          <title>Global surveillance disclosures (2013-present)</title>
          <author>
            <organization showOnFrontPage="true">Wikipedia</organization>
          </author>
          <date month="July" year="2023"/>
        </front>
      </reference>
      <reference anchor="I-D.ietf-tls-esni" target="https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-16" quoteTitle="true" derivedAnchor="TLS-ECH">
        <front>
          <title>TLS Encrypted Client Hello</title>
          <author fullname="Eric Rescorla" initials="E." surname="Rescorla">
            <organization showOnFrontPage="true">RTFM, Inc.</organization>
          </author>
          <author fullname="Kazuho Oku" initials="K." surname="Oku">
            <organization showOnFrontPage="true">Fastly</organization>
          </author>
          <author fullname="Nick Sullivan" initials="N." surname="Sullivan">
            <organization showOnFrontPage="true">Cloudflare</organization>
          </author>
          <author fullname="Christopher A. Wood" initials="C. A." surname="Wood">
            <organization showOnFrontPage="true">Cloudflare</organization>
          </author>
          <date day="6" month="April" year="2023"/>
          <abstract>
            <t indent="0">This document describes a mechanism in Transport Layer Security (TLS) for encrypting a ClientHello message under a server public key. Discussion Venues This note is to be removed before publishing as an RFC. Source for this draft and an issue tracker can be found at https://github.com/tlswg/draft-ietf-tls-esni (https://github.com/tlswg/draft-ietf-tls-esni).</t>
          </abstract>
        </front>
        <seriesInfo name="Internet-Draft" value="draft-ietf-tls-esni-16"/>
        <refcontent>Work in Progress</refcontent>
      </reference>
      <reference anchor="Toronto" target="https://www.npr.org/sections/thetwo-way/2014/01/31/269418375/airport-wi-fi-used-to-track-travelers-snowden-leak-alleges" quoteTitle="true" derivedAnchor="Toronto">
        <front>
          <title>Canada Used Airport Wi-Fi To Track Travelers, Snowden Leak Alleges</title>
          <author initials="M." surname="Memmott" fullname="Mark Memmott">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="January" year="2014"/>
        </front>
        <refcontent>NPR</refcontent>
      </reference>
      <reference anchor="UTA" target="https://datatracker.ietf.org/wg/uta/about" quoteTitle="true" derivedAnchor="UTA">
        <front>
          <title>Using TLS in Applications (uta)</title>
          <author>
            <organization showOnFrontPage="true">IETF</organization>
          </author>
        </front>
      </reference>
      <reference anchor="Zubhoff2019" quoteTitle="true" derivedAnchor="Zubhoff2019">
        <front>
          <title>The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power</title>
          <author initials="S." surname="Zuboff" fullname="Shoshana Zuboff">
            <organization showOnFrontPage="true"/>
          </author>
          <date month="January" year="2019"/>
        </front>
        <seriesInfo name="ISBN" value="9781781256855"/>
        <refcontent>PublicAffairs</refcontent>
      </reference>
    </references>
    <section anchor="acknowledgments" numbered="false" removeInRFC="false" toc="include" pn="section-appendix.a">
      <name slugifiedName="name-acknowledgments">Acknowledgments</name>
      <t indent="0" pn="section-appendix.a-1"><contact fullname="Susan Landau"/> added many valuable comments to <contact fullname="Steve Bellovin"/>'s essay.</t>
      <t indent="0" pn="section-appendix.a-2">We thank <contact fullname="Carsten Bormann"/>, <contact fullname="Brian Carpenter"/>, <contact fullname="Wendy Grossman"/>, <contact fullname="Kathleen Moriarty"/>,
<contact fullname="Jan Schaumann"/>, <contact fullname="Seth David Schoen"/>, and <contact fullname="Paul Wouters"/> for comments and review of this text, though
that of course doesn't mean that they necessarily agree with the text.</t>
      <t indent="0" pn="section-appendix.a-3">This document was created at the behest of <contact fullname="Eliot Lear"/>, who also 
cat herded and did some editing.</t>
    </section>
    <section anchor="authors-addresses" numbered="false" removeInRFC="false" toc="include" pn="section-appendix.b">
      <name slugifiedName="name-authors-addresses">Authors' Addresses</name>
      <author initials="S." surname="Farrell" fullname="Stephen Farrell">
        <organization showOnFrontPage="true">Trinity College, Dublin</organization>
        <address>
          <postal>
            <country>Ireland</country>
          </postal>
          <email>stephen.farrell@cs.tcd.ie</email>
        </address>
      </author>
      <author initials="F." surname="Badii" fullname="Farzaneh Badii">
        <organization showOnFrontPage="true">Digital Medusa</organization>
        <address>
          <email>farzaneh.badii@gmail.com</email>
        </address>
      </author>
      <author initials="B." surname="Schneier" fullname="Bruce Schneier">
        <organization showOnFrontPage="true">Harvard University</organization>
        <address>
          <postal>
            <country>United States of America</country>
          </postal>
          <email>schneier@schneier.com</email>
        </address>
      </author>
      <author initials="S. M." surname="Bellovin" fullname="Steven M. Bellovin">
        <organization showOnFrontPage="true">Columbia University</organization>
        <address>
          <postal>
            <country>United States of America</country>
          </postal>
          <email>smb@cs.columbia.edu</email>
        </address>
      </author>
    </section>
  </back>
</rfc>
