Ben - If you look at the public policy obligations narrowly from their assumed technical implications, then indeed it would appear to be the case that they are mutually exclusive – and that’s perfectly reasonable to do, since it’s both the most straightforward approach and what has historically occurred. However, the actual public policy requirements are likely to be far less specific: e.g., the ability to provide security and privacy for individuals and organizations to conduct their lives/business (this does not automatically equate to a requirement for perfect end-to-end encryption, but may be composed of various technical solutions operating at different layers and different key management depending on the particular situation). Similarly, a public policy requirement to enable prosecution of CSAM production doesn’t necessarily equate to a requirement to pervasive content monitoring for detection purposes – but might instead be aided by solutions for better tracking of sale of such materials in online marketplaces, or ready attribution & prosecution of those who deal in such materials, or some other solution yet to be defined. The question is whether engaging constructively with governments to address their Internet public policy concerns is an activity that falls within the remit of the IETF – thus allowing exploration of various approaches and tradeoffs involved – or whether the IETF’s mode of operation (structured primarily around _technical_ problem solving) isn’t inherently not amenable to such efforts, and thus it would be better if they’re conducted elsewhere. Thanks! /John p.s. disclaimer(s): my views alone - take in moderation - may cause dizziness or nausea. |
