<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Richard</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Re: I<span style="color:rgb(31,73,125);font-family:Calibri,sans-serif">SOC policies are not aligned with US policies: encryption and data protection/privacy. </span></div><div class="gmail_default"><span style="color:rgb(31,73,125);font-family:Calibri,sans-serif">Actually, the US is still allowing encryption and different officials have made different comments. As recently as June 2019, some in the US gov was considering blocking encryption but others effectively blocked them so far. </span></div><h1 class="gmail-" style="box-sizing:border-box;margin:0px;line-height:1.12;font-family:din-2014,"Arial Narrow","Helvetica Neue",Helvetica,Arial,sans-serif;letter-spacing:-0.02rem;color:rgb(0,0,0)"><font size="2"><span style="box-sizing:border-box"><a href="https://www.politico.com/story/2019/06/27/trump-officials-weigh-encryption-crackdown-1385306">Trump officials weigh encryption crackdown</a><span class="gmail_default" style="font-family:"trebuchet ms",sans-serif"> <span style="font-weight:normal">"</span></span></span><span style="font-weight:normal">DHS is internally divided.</span><span class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><span style="font-weight:normal">"</span></span><span style="font-family:Georgia,Times,"Times New Roman",serif;letter-spacing:normal"> </span></font></h1><div class="gmail_default"><span style="color:rgb(31,73,125);font-family:Calibri,sans-serif">There remain some conservative republicans who join with liberals to block legislation so far. I could have encrypted this email to you.  </span><br></div><div class="gmail_default"><font color="#1f497d" face="Calibri, sans-serif">============</font></div><div class="gmail_default"><span style="color:rgb(31,73,125);font-family:Calibri,sans-serif">On privacy, again US (and ISOC) have deliberately ambiguous policies. </span></div><div class="gmail_default"><span style="color:rgb(31,73,125);font-family:Calibri,sans-serif"><br></span></div><div class="gmail_default"><span style="color:rgb(31,73,125);font-family:Calibri,sans-serif">The US government under both Obama and Trump supported and signed  "</span>the Organisation for Economic Co-operation and Development (OECD) 2013 Privacy Guidelines," (below) a typical political document that has not changed things. It's as close to an official US position on privacy as I could find. Richard, does ISOC strongly disagree? </div><div class="gmail_default"> </div><div class="gmail_default">Every Trump Republican I've read is strongly in favour of privacy, including some close to ISOC. <span style="color:rgb(31,73,125);font-family:Calibri,sans-serif">From the Trump Presidential platform</span><br></div><div class="gmail_default"><font color="#1f497d" face="Calibri, sans-serif">"</font>We intend to advance policies that protect data privacy" "In recent years, technology companies have
responded to market demand for products and
services that protect the privacy of customers
through increasingly sophisticated encryption
technology. These increased privacy protections
have become crucial to the digital economy." "We applaud the advance of technology in electronic
medical records while affirming patient privacy and
ownership of personal health information"</div><div class="gmail_default"><br></div><div class="gmail_default">To make a difference on privacy, we need to get past the hypocrisy even if that will anger our government and corporate allies. What we have is a lot of talk and pr, not action.</div><div class="gmail_default"><br></div><div class="gmail_default">I just read <a href="https://www.internetsociety.org/policybriefs/privacy/" target="_blank">https://www.internetsociety.org/policybriefs/privacy/</a> and some of ISOC's other statements. They do not read very differently than the official government statements. High order principles that everyone can agree with but almost no specific government or private/collective actions that would make much difference.  Not merely are they so vague as to be meaningless, <b>it actually turns out ISOC's official policy is based on on the US government approved OECD </b></div><div class="gmail_default"><a href="https://www.internetsociety.org/policybriefs/privacy/"><br></a></div><div class="gmail_default"><a href="https://www.internetsociety.org/policybriefs/privacy/">Quote</a></div><div class="gmail_default"><p style="margin:0px 0px 30px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;font-family:Hind,Helvetica,Arial,sans-serif;color:rgb(12,28,44);line-height:1.3">The following principles are derived from the Organisation for Economic Co-operation and Development (OECD) 2013 Privacy Guidelines, and are widely recognized as providing a good foundation for developing online privacy policies and practices:</p><ul style="margin:0px 0px 30px 40px;padding:0px;border:0px;font-size:10px;vertical-align:baseline;box-sizing:border-box;font-family:Hind,Helvetica,Arial,sans-serif;list-style:none;color:rgb(12,28,44)"><li style="margin:0px 0px 10px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Collection limitation</span>. There should be limits to the collection of personal data. Any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.</li><li style="margin:0px 0px 10px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Data quality</span>. Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete, and kept up-to-date.</li><li style="margin:0px 0px 10px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Purpose specification</span>. The purposes for which personal data is collected should be specified. The use should be limited to those purposes or other purposes that are not incompatible.</li><li style="margin:0px 0px 10px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Use limitation</span>. Personal data should not be disclosed, made available, or used for other purposes except with the consent of the individual or where authorised by law.</li><li style="margin:0px 0px 10px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Security safeguards</span>. Personal data should be protected by reasonable security safeguards.</li><li style="margin:0px 0px 10px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Openness</span>. There should be a general policy of openness about developments, practices, and policies with respect to personal data.</li><li style="margin:0px 0px 10px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Individual participation</span>. Individuals should have the right to obtain information about personal data held by others and to have it erased, rectified, completed, or amended, as appropriate.</li><li style="margin:0px;padding:0px;border:0px;font-size:21px;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-weight:inherit;line-height:1.4;list-style-type:disc"><span style="font-weight:600;margin:0px;padding:0px;border:0px;font-size:inherit;vertical-align:baseline;box-sizing:border-box;letter-spacing:0px;font-family:inherit;color:inherit;line-height:inherit">Accountability</span>. Those who collect personal data should be accountable for complying with the principles.</li></ul></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 17, 2019 at 3:55 AM Richard Hill via Chapter-delegates <<a href="mailto:chapter-delegates@elists.isoc.org" target="_blank">chapter-delegates@elists.isoc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_3811859663902259470gmail-m_2693985806947586747WordSection1"><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">Dear Dave,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">While I agree with the gist of what you say below, I can think of at least two instances in which ISOC policies are not aligned with US policies: encryption and data protection/privacy.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">Best,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)">Richard<u></u><u></u></span></p><p class="MsoNormal"><span style="font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> </span></p></div></div>
</blockquote></div>
</div>