Subject: Re: Possible RFC 3683 PR-action

From: Peter Constable <[email-masked]>
Date: Tue, 25 Mar 2008 08:45:04 -0700

From: Russ Housley...

> > Since IETF does not vote, it is certainly not an issue here?
>
> This is not totally true.  A WG Chair or Area Director cannot
> judge rough consensus if they are unsure if the portion of the
> population that is representing a dissenting view is one person
> or many different people.  This is especially true when there
> are a large number of silent observers.

Frankly, it strikes me as somewhat odd that a body acting as a standards-setting organization with public impact might allow any technical decision on its specifications to be driven by people operating under a cloak of anonymity. Expressing an anonymous voice? No problem. Influencing determination of a consensus with public impact? That should not be allowed, IMO.

Peter Constable
_______________________________________________
IETF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 25 Mar 2008 17:12:33 +0100

Peter Constable <[email-masked]> writes:

> Frankly, it strikes me as somewhat odd that a body acting as a
> standards-setting organization with public impact might allow any
> technical decision on its specifications to be driven by people
> operating under a cloak of anonymity. Expressing an anonymous voice?
> No problem. Influencing determination of a consensus with public
> impact? That should not be allowed, IMO.

What if the pseudonymous voice raise a valid technical concern, provide
useful text for a specification, or even co-author a specification?

I think decisions should be based on technically sound arguments.
Whether someone wants to reveal their real identity is not necessarily
correlated to the same person providing useful contributions.

/Simon

---

From: Peter Constable <[email-masked]>
Date: Tue, 25 Mar 2008 09:27:32 -0700

> From: Simon Josefsson [mailto:[email-masked]]

> useful text for a specification, or even co-author a specification?

That's having voice. We can be open to any voice. If a concern has valid technical merits, then that should be evident to others, and drive a consensus on its own. But the consensus can still be determined by identifiable people.

> I think decisions should be based on technically sound arguments.

Just so.

> correlated to the same person providing useful contributions.

True. But neither is ability to provide useful contributions necessarily correlated with being counted as part of a consensus.

Peter

---

From: Melinda Shore <[email-masked]>
Date: Tue, 25 Mar 2008 12:28:19 -0400

> correlated to the same person providing useful contributions.

In practice I don't think there's really been much of a problem
with that.  The problem in practice has been with people using
process arguments to tie up progress, and that's somewhat harder
to judge.

Melinda

---

From: Theodore Tso <[email-masked]>
Date: Tue, 25 Mar 2008 12:37:56 -0400

> correlated to the same person providing useful contributions.

A valid technical concern is easy to deal with.  If they provide an
idea, I suspect a cautious working group chair might insist on knowing
their real name and company affiliation, since there have been past
examples where companies have tried to inject patented technologies
into a standards specification.  (For example, see the FTC's decision
re: Rambus[1].)

[1]  http://www.law.com/jsp/article.jsp?id=1161606920964

If someone is providing text or co-authoring a specification, there
are once again copyright considerations which could cause the IETF
much headaches.  If a Cisco employee were to provide text, and then
suddenly yank back copyright permission and disclaim the Note Well,
their are consequences to the engineer and to his/her employer if they
were to do so.  A contributor operating under the cloak of anonymity
can evade many of the consequences of being a bad actor.

Which once again brings us back to the question of what is the value
of letting contributors operate under a cloak of anonymity, and do the
benefits outweigh the costs.  For political speech where someone wants
to distribute the equivalent of leaflets decrying their current's
government position on say, torture in violation of the Geneva
convention, it's much easier to make the case that allowing anonymous
speech is hugely important.  In a standards organization, it's much
harder to make the argument that anonymity is really a benefit.

For example, in the current MS-OOXML controversy, anonymity would make
it impossible, or at least much more difficult, to determine whether
or not Microsoft really did pack various countries' national bodies
with their business partners, and reimbursed membership fees via
"marketing considerations".  So I'm rather glad that all or most ISO
national body rules do require declaration and disclosure of legal
names and corporate affiliations.....

							- Ted

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 25 Mar 2008 18:28:40 +0100

> names and corporate affiliations.....

I think that is interesting analogy.  I'm not at all as convinced you
are that ISO's model is better than the IETF's model here.  First, if
ISO had been acting only on the technical merits in this matter, the
proposal would be dead a long time ago.  The reason the proposal is
still around in ISO seems to be because ISO is membership-driven, and
needs to decide based on what the members vote.  I think this model
leads to quite different participators than a more open and technical
focused process.

The more I think about it, I like the IETF's pasts model better than ISO
current.  Fortunately, if the IETF becomes more like ISO, then I am
confident that there will be another organization that is similar to the
original IETF spirit.  When there is damage, route around it...

/Simon

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 25 Mar 2008 19:48:42 +0100

Simon Josefsson wrote:

> Fortunately, if the IETF becomes more like ISO, then I am
> confident that there will be another organization that is
> similar to the original IETF spirit.  When there is damage,
> route around it...

Strong ACK

---

From: Russ Housley <[email-masked]>
Date: Tue, 25 Mar 2008 14:47:16 -0400

>correlated to the same person providing useful contributions.

Raising a technical problem anonymously does not seem to be a 
concern.  However, there could be significant IPR problems with 
anonymous solutions to technical problems.

Russ

---

From: Thierry Moreau <[email-masked]>
Date: Tue, 25 Mar 2008 14:43:05 -0500

> anonymous solutions to technical problems.

It is my understanding that IETF is already in this type of problems.

Solutions contributed by employees of large organizations could be 
problematic, as soon as unpublished patent applications are considered 
confidential corporate trade secrets circulated on a "need-to-know" 
basis, which is recommended practice by patent practitioners anyway.

Sometimes one wonders even about published patent applications, 
especially when a US patent agent expects broad claims to be tailored to 
the prior art in the course of examination - hardly anyone from the 
corporation would be allowed to make well-informed statements about the 
connection of the patent application to an SDO activity.

In practice, I suspect that many corporations abstain from contributing 
to IETF in specific standardization areas where they have an IPR 
strategy, and so the scope of IETF activities - and achievements - is 
shrinking.

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 25 Mar 2008 21:41:39 +0100

> anonymous solutions to technical problems.

What kind of problems?

/Simon

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 26 Mar 2008 09:57:45 +1300

> It is my understanding that IETF is already in this type of problems.

What you describe is a different problem...

> basis, which is recommended practice by patent practitioners anyway.

Correct. That's one reason we have the "reasonably and personally
known" clause. If an IETF contributor is on the need-to-know list,
s/he certainly has to force the issue with the corporate IPR
folk. It can be painful and slow.

> connection of the patent application to an SDO activity.

But that doesn't remove the obligation to disclose. You'll notice that
most disclosures are very general in actual content, since nobody
wants to give away the details of a patent in advance.

> strategy, and so the scope of IETF activities - and achievements - is 

That's unknowable, but is certainly a very old story - well understood
when the IPR BCPs were first developed. I don't think there's any
news here.

    Brian

---

From: Russ Housley <[email-masked]>
Date: Tue, 25 Mar 2008 17:40:40 -0400

> > anonymous solutions to technical problems.

If there is IPR associated with a potential solution, then a 
malicious person could use an anonymous posting to avoid the NOTE 
WELL.  This would allow the IPR holder could reasonably claim that 
they were unaware that the IETF was considering the use of their 
encumbered technology.  Thus, they would not make an IPR 
statement.  If we learned that the anonymous posting actually came 
from person was affiliated with the IPR holder, then there is legal 
recourse.  My point is that by avoiding anonymous posting, the 
likelihood of such abuse is significantly reduced.

Russ

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 25 Mar 2008 22:51:12 +0100

Russ Housley <[email-masked]> writes:

> encumbered technology. Thus, they would not make an IPR statement. 

Are there examples where something like that may have been attempted?

Jorge has explained why the NOTE WELL is binding for all IETF
contributors in:

https://rt.psg.com/Ticket/Display.html?id=1239

That discussion appears to apply equally well to an anonymous
contributor.

> If we learned that the anonymous posting actually came from person was
> affiliated with the IPR holder, then there is legal recourse.  My
> point is that by avoiding anonymous posting, the likelihood of such
> abuse is significantly reduced.

I think the point would be valid if there were significant abuse today.

/Simon

---

From: [email-masked]
Date: Tue, 25 Mar 2008 22:30:29 +0100 (CET)

> [...]

I don't know what would qualify as significant here, but there has been at
least one rather high profile antitrust case in the recent history
(semiconductor industry), in which a situation similar to the one we are
discussing has played a role.

Stephan

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 25 Mar 2008 23:33:17 +0100

> discussing has played a role.

If the account at

http://en.wikipedia.org/wiki/Rambus#Lawsuits

is to be trusted, I can't find many similarities with the situation we
are discussing here.  Could you clarify how anonymous contributions
played a role in your example?

/Simon

---

From: Stephan Wenger <[email-masked]>
Date: Wed, 26 Mar 2008 03:39:33 -0700

Hi Simon,
the case I was thinking about was this one:
http://www.consortiuminfo.org/standardsblog/article.php?story=20070323094639
964

Stephan

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 26 Mar 2008 13:38:20 +0100

Thanks for clarifying, given the lack of details I jumped to
conclusions.  Still, I don't see how anonymous contributions were
involved?

/Simon

---

From: "Doug Ewell" <[email-masked]>
Date: Sun, 30 Mar 2008 21:00:30 -0700

Theodore Tso <tytso at MIT dot EDU> wrote:

> into a standards specification.

I suppose a few personal notes might be in order regarding "company 
affiliation," since I've served as editor for both RFC 4645 and 
draft-ietf-ltru-4645bis, both products of the LTRU Working Group that 
started this thread, and both under the title "Consultant" instead of a 
company or other organizational affiliation.

There are a couple of reasons.  One is that my company, which had 
apparently been embarrassed by employees posting personal opinions on an 
industry message board in a way which made them sound like official 
company positions, instituted a set of "Internet and Electronic 
Communications Guidelines" some years ago which prohibits employees from 
"stating their [company] affiliation over the Internet" unless required 
as part of their job description.  This went way too far in my 
opinion -- stating that you work for XYZ Company is quite different from 
stating that you represent the official position of XYZ Company -- but 
it is the approved policy, it allows for termination in the event of 
violation, and we all signed it.

The other reason is that three years ago, there was an attempt by --  
surprise! -- JFC Morfin to contact the professional employer of one of 
the LTRU participants and single him out for corporate disciplinary 
action, in retaliation for his support of a PR-action against Morfin. 
Together with the "Internet and Electronic Communications Guidelines," 
this hostile and unprofessional action further convinced me that it was 
not in my best interests to disclose my employer in documents published 
on the Internet, and especially not in an RFC where the text:

D. Ewell, Ed.
XYZ Company

might present the impression, rightly or wrongly, of company sponsorship 
or representation.

Next week I start work for a new employer, and I hope they will have a 
more enlightened attitude toward employees "stating their [company] 
affiliation over the Internet" and will understand that stating one's 
affiliation in an IETF document is a matter of author identification, 
not corporate sponsorship.

In passing, I will restate that my involvement with the LTRU has always 
been individual in nature, and has never been sponsored or sanctioned by 
any commercial interest nor driven by any corporate goal, although I 
believe the work may be of value to any entity (corporate or otherwise) 
concerned with the identification of linguistic content.

--
Doug Ewell  *  Fullerton, California, USA  *  RFC 4645  *  UTN #14
http://www.ewellic.org
http://www1.ietf.org/html.charters/ltru-charter.html
http://www.alvestrand.no/mailman/listinfo/ietf-languages  ˆ

---

From: John C Klensin <[email-masked]>
Date: Mon, 31 Mar 2008 00:19:12 -0400

--On Sunday, March 30, 2008 9:00 PM -0700 Doug Ewell 
<[email-masked]> wrote:

>> A valid technical concern is easy to deal with.  If they
>> provide an idea, I suspect a cautious working group chair
>> might insist on knowing their real name and company
>> affiliation, since there have been past examples where
>> companies have tried to inject patented technologies into a
>> standards specification.
>
> I suppose a few personal notes might be in order regarding
> "company  affiliation," since I've served as editor for both
> RFC 4645 and  draft-ietf-ltru-4645bis, both products of the
> LTRU Working Group that  started this thread, and both under
> the title "Consultant" instead of a  company or other
> organizational affiliation.
>
> There are a couple of reasons.  One is that my company, which
> had  apparently been embarrassed by employees posting personal
> opinions on an  industry message board in a way which made
> them sound like official  company positions, instituted a set
> of "Internet and Electronic  Communications Guidelines" some
> years ago which prohibits employees from  "stating their
> [company] affiliation over the Internet" unless required  as
> part of their job description.
>...

Doug,

Even this stringent a rule would presumably not prevent you from 
disclosing your affiliation to a WG Chair or the Secretariat if 
you were asked a specific question in order to help authenticate 
you.  If it is possible to read our rules to prevent the 
entities who might legitimately ask you for that information 
from keeping it confidential if that were reasonably required, 
then those rules may need clarification or tweaking.

But there is a huge difference between stating/ advertising a 
company affiliation in a mailing list email address or at the 
top of an RFC and responding to the sort of query that I think 
Ted's note suggests.

    john