tomholford/dbor

Digital Bill of Rights

Digital Bill of Rights

About

This document is a first step to nudge the mainstream discourse around fundamental digital rights for all Users.

Feedback welcome via pull request, Urbit (~datder-sonnet), Twitter (@tholford0), or email (info at tholf dot org).

Rights

The Right to Encrypt

• Users are free to encrypt any data or information with any algorithm
• Users cannot be compelled to share keys with a third party, or use a backdoored algorithm

Rationale

Encryption is the fundamental backbone of the modern Web. It allows for myriad use cases including secure communication, online banking and e-commerce, and cryptocurrency. Nation state actors have attempted to covertly insert backdoors into standardized algorithms¹, and government regulators have attempted to compel Users to install decryption devices². Unencrypted or weakly encrypted information poses a threat to Users' security as well as their privacy.

The Right to Compute

• Users are free to execute any binary or executable on their own hardware, or virtual devices under their control (e.g, Virtual Private Servers in the cloud)
• Users cannot be compelled to uninstall, shutdown or modify the execution of any program. Similarly, Users cannot be compelled to install or execute a program.

Rationale

Centralized app stores operated by both Apple and Google have "pulled" apps previously purchased by users³. Governments have passed regulation that proscribe infrastructure providers from operating privacy-preserving technology such as Tor or VPNs⁴. In the future, other software may also potentially be banned - e.g., Bitcoin nodes or Urbit personal servers. Further, in the past Users have been compelled to run insecure software (for example, a certain government required usage of Internet Explorer with a bespoke ActiveX plugin for many years⁵.)

The Right to Repair

• Users are free to repair, modify, or upgrade their own hardware
• Users are free to remove, uninstall, or disable trackers, keyloggers, and backdoors

Rationale

Device manufacturers use restrictive terms of service and unfriendly hardware designed to prevent users from repairing or modifying their devices. This practice leads to increased cost, waste and over-dependence on such manufacturers. Further, Users can remove backdoors that are preinstalled on modern CPUs⁶ and 5G hardware⁷.

The Right to Export

• Users of centralized providers such as Gmail or iCloud are free to export their data
• Users are free to import their data to use with other providers, or on onto their own self-hosted alternative

Rationale

Centralized providers attempt to "lock in" their existing users by making it difficult to transfer their data to another service provider. Users become involuntarily bound to such providers. Ultimately, this leads to consolidation and eventual monopolization, and is a key factor in the rise of Big Tech⁸. With healthcare data, where such lock in can have serious health or financial consequences, significant measures are being made to ensure patients have access to their own health data⁹]. User's general data should be no less protected.

Sources

Footnotes

1. https://www.atlasobscura.com/articles/a-brief-history-of-the-nsa-attempting-to-insert-backdoors-into-encrypted-data ↩

2. https://en.wikipedia.org/wiki/Clipper_chip ↩

3. https://appleinsider.com/articles/22/04/24/apple-warns-developers-it-will-pull-apps-without-recent-updates-from-the-app-store ↩

4. https://www.bleepingcomputer.com/news/government/russia-passes-bill-banning-proxies-tor-and-vpns/ ↩

5. https://en.wikipedia.org/wiki/Web_compatibility_issues_in_South_Korea ↩

6. https://en.wikipedia.org/wiki/Intel_Management_Engine#Assertions_that_ME_is_a_backdoor ↩

7. https://www.cnet.com/tech/mobile/us-finds-huawei-has-backdoor-access-to-mobile-networks-globally-report-says/ ↩

8. https://locusmag.com/2021/07/cory-doctorow-tech-monopolies-and-the-insufficient-necessity-of-interoperability/ ↩

9. https://public3.pagefreezer.com/content/HHS.gov/31-12-2020T08:51/https://www.hhs.gov/about/news/2020/12/10/hhs-proposes-modifications-hipaa-privacy-rule-empower-patients-improve-coordinated-care-reduce-regulatory-burdens.html ↩

dbor's Issues

Discussion of Right to Compute section

Centralized app stores operated by both Apple and Google have "pulled" apps previously purchased by users

• This does not sound unreasonable on the face of it. What are the contexts in which this violates Users' rights while respecting the rights of the platforms and/or the app devs?
• This doesn't feel like it fits into "Right to Compute" as well as the other examples (VPNs, cryptocurrency nodes)

Right to Transact

https://twitter.com/PashaKamyshev/status/1569376420408721408

https://twitter.com/e_d_broders/status/1569379097863749633

Right to ZKP

Right to have ZKP attestation accepted as legal proof

I like this idea, especailly with ZKP primed to be used for just about everything in the near future.

Raises some questions:, Could it potentially be abused? Can ZKPs be spoofed? Or what if the prover is compromised?

The copy for this Right should be drafted with these potential risks in mind.

https://twitter.com/Diaboli_Advocat/status/1569617998788415488

Right to Trustless Compute

Right to Trustless Compute

You have the right to share interest and attention data in a manner that preserves the integrity and security of that data in such a way that such data cannot be stored or retained by a third party. By way example, calculations of recommendations and personalization data shall only be performed in an execution enclave that does not allow either party to retain source data from the other party. Work that is derived from the marriage of the source data such as personalized recommendations shall be owned and retained sole by you and accrue for your benefit.

Right to Own Your Interest and Attention Data

Right to Own Your Data

You are the sole owner of your interests and attention and any such data shall accrue and be owned by the user for their sole benefit. Such interest and attention data shall include visits, comments, likes, swipes, pins, preferences, purchases, and any other actionable form of interest and/or attention. Such ownership right shall be irrevocable with limited rights to sublicense which can be revoked by you at any time.

Right to Delete

In addition to export, we should also be able demand deletion from providers such as social media, email, or cloud servers (aka Right to Be Forgotten)

Not sure how this could be enforced since a copy could always be kept, but perhaps a steep penalty would be enough to deter.

https://twitter.com/aamikalyan/status/1569371213268393984