search

w3cping / privacy-threat-model

A target privacy threat model for the Web
https://w3cping.github.io/privacy-threat-model
Apache License 2.0
23 stars 7 forks source link

Surveillance: distinguish between positive and negative connotations #23

Open JoGSal opened 4 years ago

JoGSal commented 4 years ago

Although it's out of scope to rewrite RFC6973 §section-5.1.1 in order to distinguish between the surveillance of communications or activities requested/authorized by an user and those that are against their consent, it might still be a needed differentiation

jyasskin commented 4 years ago

What kind of change to the text are you thinking of? The two threats that mention surveillance talk about "unwanted" recognition, so they already anticipate users choosing to be visible in certain ways.

JoGSal commented 4 years ago

I thought having the distinction stated in the surveillance definition itself could be more clear

Surveillance is the unwanted observation or monitoring of an individual’s communications or activities.

Or

Surveillance is the observation or monitoring of an individual’s communications or activities without their consent.

However, your point is fair : )

jyasskin commented 4 years ago

I think it's reasonable for this document to define terms differently from RFC 6973 where the web community thinks that's the right thing to do. The current definitions aren't even necessarily ones that the authors of RFC 6973 would agree with: I just copied a sentence or two from that RFC in order to get something to start with.

I don't have an informed opinion about exactly how we should define surveillance here. Intuitively, I feel like even wanted and consented observation or monitoring are surveillance, and that if we want to make a distinction here, we might add a sentence saying that users sometimes want to be surveilled. We'd probably also want to say that folks should assume surveillance is unwanted in the absence of strong evidence otherwise, and give an example or two of surveillance that is clearly wanted.

Would you be able to send a pull request with some concrete wording for this?