Johan, I haven't been paying close attention to the latest on the anonymity debate, so please tell me if the following has been raised before. In your message <9302260807.aa01498@penet.penet.FI> of Fri, 26 Feb 93 08:50:19 +0200 on the subject "Moral dilemma." to the cypherpunks list, you mentioned that

One rule is that I *never* reveal the true identity of an anon user,

While I believe that you should be able to use any policy you want for this sort of thing, I do not believe that both your server and this policy can survive together. Because you/the-server cannot censor the content of anonymous postings/mail (you lack the time, and knowledge of what is legal in every corner of the world), you can only withdraw someone's anonymous posting permission in response to complaints to something that they have already posted. I believe that eventually, someone will post something so damaging/incensing that sufficient pressure will be applied that either: the service cannot continue (e.g. disconnected from the network), or you will be forced to reveal or destroy the mappings between alias(es) and user(s). For example, on the cypherpunks list, the question of what would happen if someone claiming responsibility for the New York bombing posted through the anonymous server. Bodies in the US (from people providing parts of the Internet service through to political and criminal bodies such as the FBI/CIA/NSA) could easily apply very strong pressure. Unfortunately, I feel that this pressure will come sooner rather than later because there is nothing preventing people opposed to the anonymous service from making these postings merely to discredit your service. I think that there *MAY* be a way around this. I assume the reasons behind your non-disclosure policy are: i. You cannot decide which identities should be revealed. ii. Revealing an identity removes their anonymity from all of their previous postings, some of which may have had reason to be anonymous. For example, I think it "unjust" to reveal what someone wrote to alt.sex.abuse because they violated copyright or whatever in some other group. The second of these reasons could be avoided by permitting anonymous users to have a different alias for each posting that they make. This would increase the loading on the alias space and records of alias<->ID mappings. I can see no reason why you would need to reveal all of the aliases of one real identity. The decision of when an identity should be revealed could be left to a jury: If you receive a reasonable complaint about a posting (not just a flame, but something more significant such as copyright violation, libel, etc) then you would post this complaint to a group of anonymous jurors who decide on what action should be taken. The plaintiff and defendant could even argue their positions to the jury, and might advertise on a newsgroup asking for assistance from relevant groups (e.g. pro/anti-anonymity groups). The problem now is how to select the jury. Some factors are: i. The number of jurors influences the probability that the decision can be swayed because of the random composition of the jury. So one juror would be too few, 12 as used in orthodox courts might be reasonable, etc. ii. Jurors would not want to spend too much time on the case, so there should be an upper limit on the number of bytes transmitted by defendant and plaintiff, and the time span of the case. iii. The degree of "consensus" required for a decision. Perhaps 2/3 majority is OK, perhaps 75%. The larger the majority required, the less likely that the case will be swayed by the composition of the jury, but also the longer it would take to reach the decision. iv. The jury can't be composed just of users of the anonymous service because of their bias. Perhaps jurors could be selected at random from the names of people who have posted to the news in the past? v. Jurors would have to accept their position -- there's no use in having a juror who doesn't read the information passed to him/her. I feel that the problem of selecting a jury would be easier to solve than that of defending the anonymous service against the uproar that may result from some postings. With this judicial process, anonymous users would also be accountable for what they post. Some other issues would be i. What happens if the jury can't decide? ii. What sort of "punishment" is possible? Warning the person? Barring the person from anonymous posting? Revealing their identity to the necessary body? etc The idea is *VERY* rough at the moment, but perhaps it has some merit? As I see it, the good part for the anonymous service provider is that they do not have to participate in the process (apart from filtering trivial flaming cases from the judicial system), which will avoid claims of bias and lessens your already considerable load. Comments? Tim ---- 8< Cut Here 8< ---- Tim Moors __________________________________________________________ Australian Telecommunications Research Institute .-_!\ GPO Box U 1987 Email: tim@atri.curtin.edu.au / \ Perth, WA 6001 Phone: +61 9 351 3243 \_.-._/ Australia Fax: +61 9 351 3244 o "beLIEve" -- U2 Zoo TV Tour