Past, Present and Future of Privacy Reviews in Internet Standard-Setting

The functionality of the Internet and the Web are determined in large part by the standards that allow for interoperable implementations; as a result, the privacy and security of our online interactions are greatly impacted by the work done within standard-setting organizations. While _privacy impact assessments_ present a systematic model for privacy reviews of large-scale software systems, reviewing Internet standards provides a different set of challenges. Participation in consensus standard-setting is voluntary and in most cases work is bottom-up, unlike the top-down organization within large firms. And Internet protocols are generative: designed to enable a variety of applications, the applications themselves can't be statically analyzed. Based on prior work analyzing these multistakeholder groups as _boundary organizations_ which can provoke innovative responses [@Doty2013], this organizational structure provides a different approach to implementing values such as privacy that is not yet fully understood. This research will consider the practice of privacy and security reviews within technical standard-setting organizations for the Internet and the World Wide Web through an ethnographic approach: qualitative methods including semi-structured interviews; automated and manual text analysis; and fieldnotes from observing and participating in these processes. Standard-setting provides a rich source to study: including extensive public documentation of all meetings, mailing list conversations and historical drafts of all standards. Interviews of participants --- engineers, laywers and businesspeople who volunteer their time to develop standards but also have roles within tech companies or other organizations --- provide insight into the variety of participants and their own perspectives on how they consider values such as privacy during the standardization process. As a participant observer, I also aim to include my own perspective, including the challenges faced, and responses received, in attempting to develop systematic privacy reviews for new Web features. For this paper, first I consider the history of privacy reviews --- and previously, security considerations --- at the Internet Engineering Task Force (IETF) and World Wide Web Consortium (W3C) through analysis of historical documents and interviews with participants. Next, I document recent developments, part of a community reaction to revelations of mass government surveillance. Finally, based on that history, similar experience in other cross-cutting technical fields (internationalization and accessibility) and alternative tools for privacy-by-design, I outline some recommendations for improving privacy reviews for future Internet and Web standards. Understanding how values like privacy and security are enacted in foundational Internet standards is of particular importance now, as our community learns and responds to intelligence agencies' efforts to influence or weaken security-related standards. Furthermore, what we learn about implementing privacy within a standard-setting process may also apply to areas with similarly collaborative characteristics: open source software development and other multistakeholder institutions.