IETF Privacy Considerations Working Group

IETF Privacy Considerations Working Group
Name	IETF Privacy Considerations Working Group
Formed	2010s
Parent organization	Internet Engineering Task Force
Focus	privacy in Internet protocols

IETF Privacy Considerations Working Group

The IETF Privacy Considerations Working Group addressed privacy aspects of Internet protocol design within the Internet Engineering Task Force framework, engaging participants from Internet Research Task Force, World Wide Web Consortium, European Telecommunications Standards Institute, Internet Society, and academic institutions such as Massachusetts Institute of Technology, Stanford University, University of Cambridge. The group produced guidance and documents intended to influence standards developed by groups including Transport Layer Security Working Group, HTTP Working Group, Domain Name System Working Group, Routing Area Directorate, and implementers at organizations like Google, Microsoft, Apple Inc..

Background

The working group was formed amid growing attention to surveillance revelations associated with incidents involving Edward Snowden, debates in legislative bodies such as the United States Congress and the European Parliament, and technical responses from consortia including OpenID Foundation and OAuth Working Group. Influences included prior privacy engineering efforts at International Organization for Standardization, research from labs at Carnegie Mellon University, policy analysis by Electronic Frontier Foundation, and proposals appearing in venues like USENIX Security Symposium and ACM Conference on Computer and Communications Security.

Objectives and Scope

The group's charter emphasized creating practical guidance for authors of protocol specifications across IETF areas such as Transport Layer Security Working Group, S/MIME Working Group, and Internet Protocol Version 6 Working Group. Scope covered recommendations on metadata minimization, threat modeling, consent mechanisms, and data protection practices aligned with laws and instruments like the General Data Protection Regulation and discussions in bodies such as Organisation for Economic Co-operation and Development and Council of Europe. The group sought to harmonize engineering practices with advice from National Institute of Standards and Technology and standards from International Telecommunication Union.

Activities and Deliverables

Primary outputs were informational documents and RFCs offering checklists, privacy guidelines, and threat-model templates referenced by other IETF groups such as Hypertext Transfer Protocol Working Group and Multipath TCP Working Group. Deliverables included privacy considerations templates, examples for protocol design in areas like Real Time Streaming Protocol, guidance on identifiers and pseudonymity with relevance to Domain Name System Security Extensions and JSON Web Token. The group organized sessions at meetings co-located with IETF meetings and workshops involving participants from Electronic Privacy Information Center, Open Rights Group, and research presented at conferences including IEEE Symposium on Security and Privacy.

Working Group Organization and Process

The working group operated under IETF procedures with chairs, an area director, mailing lists, and periodic drafts subject to community review similar to processes in IETF Working Group models. Participation included engineers from Cisco Systems, Juniper Networks, and academic contributors from University of Oxford and Technische Universität Darmstadt. Decision-making relied on rough consensus as in other IETF groups associated with entities such as Internet Architecture Board and coordination with standards bodies like IETF Administrative Oversight Committee.

Impact and Adoption

Guidance from the group informed privacy sections in RFCs produced by protocol groups such as QUIC Working Group and Messaging Layer Security Working Group, influencing implementers at companies including Mozilla Foundation and Cloudflare. The materials were cited in engineering discussions for projects like Let's Encrypt and in academic work at conferences such as Network and Distributed System Security Symposium. National authorities and standards bodies, including staff at European Data Protection Board and contributors to ISO/IEC JTC 1/SC 27, referenced the group’s practical approach to embedding privacy into protocol design.

Criticism and Challenges

Critics noted tensions between IETF engineering culture and privacy advocacy represented by organizations like Privacy International and Amnesty International, arguing that guidance could be non-normative or insufficiently enforceable compared with legal instruments such as the ePrivacy Directive. Challenges included divergent expectations among stakeholders from industry incumbents like AT&T and civil society groups, the technical complexity exemplified by debates in Border Gateway Protocol Working Group, and the difficulty of creating universally applicable prescriptions given regulatory differences in jurisdictions like United States and European Union.

Category:Internet Engineering Task Force