Subject: The anonymity question

From: Brian E Carpenter <[email-masked]>
Date: Sun, 25 Jul 2010 13:47:29 +1200

John Levine asked:

> Some people have argued that it should be possible to participate in some or all IETF processes while remaining partly or completely anonymous.  Is this a reasonable expectation?

No. Anonymous or pseudonymous contributions would allow a scumbag
patent troll to inject ideas into a standard for which s/he held
an undisclosed patent. I don't see how we can draw a line between
that and other types of contribution.

Regards
   Brian

---

From: Fred Baker <[email-masked]>
Date: Sun, 25 Jul 2010 05:06:26 +0200

> that and other types of contribution.

I would agree. I don't have a problem with people obfuscating their identity for purposes that don't matter, but behavior covered by the "Note Well" needs to be explorable legally - that's what the "Note Well" is about.

Personally, the people that I know that obfuscate their identity have said they do so because they don't know what will be done with the proper information if they give it. That is an argument for some form of privacy policy, whatever that policy would be.

Everywhere else I go, even if it is shopping in the local supermarket, the only way I can be anonymous is by wearing a disguise and paying cash. I'm not sure I "get" the notion that the IETF should be different.

---

From: John Levine <[email-masked]>
Date: 25 Jul 2010 03:36:04 -0000

>> Some people have argued that it should be possible to participate
>>in some or all IETF processes while remaining partly or completely
>>anonymous.  Is this a reasonable expectation?

>that and other types of contribution.

To tease this out a little more, the IETF makes no effort to verify
the identities of people who join or send mail to mailing lists, while
we expect that people who physically attend IETF meetings register
under their real names and sign the attendance sheets in sessions.  As
far as I know, no RFC (other than perhaps April 1) has an author using
a pseudonym, but is that policy, or just the way it happens to have
worked?

There is certainly some difference here, since the mailing lists and
RFCs are immediately available to the world, while the attendance info
is not, but we seem to have different policies in practice.

I am NOT suggesting that a privacy policy should go into this level of
detail, but it needs to deal with the reality that in some contexts we
require people to provide PII, while in others it is conventional but
not required.

R's,
John

---

From: Fred Baker <[email-masked]>
Date: Sun, 25 Jul 2010 05:44:00 +0200

On Jul 25, 2010, at 5:36 AM, John Levine wrote:

> the identities of people who join or send mail to mailing lists,

Permit me to nitpick... :-)

We don't require that they provide a name for a mailing list, or that it be a "right" name. But we do in effect verify the email address they use, and we do force them to post from that email address. Someone could come up with an email address per working group ("[email-masked]") for the price of a little typing, and some do create "special addresses" for IETF use (example: Ralph Droms is [email-masked] or [email-masked], the latter being for IETF use). In the sense that an email address is in fact used by an identifiable person, it is an identity that is verified in the process of joining a list.

> while
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

http://www.ipinc.net/IPv4.GIF

---

From: "John R. Levine" <[email-masked]>
Date: 25 Jul 2010 00:07:49 -0400

> In the sense that an email address is in fact used by an identifiable 
> person, it is an identity that is verified in the process of joining a 
> list.

This sounds to me like a situation where the Internet has evolved 
underneath us.  Until about 1995, email addresses were generally tied to 
accounts assigned to known users of host systems, an employee, a paying 
customer, or maybe for us hobbyists, a friend.  Then in 1996 Hotmail came 
along, and now we have enormous mail systems whose managers have no idea 
who their users are beyond the IP addresses they connect from.

The ability of users to sign up from throwaway accounts doesn't seem to 
have been a big problem in practice, but it does make it hard to claim 
that the lists are free of submarine patent trolls.

Once again, there isn't necessarily anything to fix here, but a useful 
privacy policy needs to work in our environment where depending on the 
context a user can be entirely anonymous (download a web page), fairly 
well verified (pay with a credit card), and a lot of points in between.

R's,
John

---

From: Fred Baker <[email-masked]>
Date: Sun, 25 Jul 2010 06:21:53 +0200

On Jul 25, 2010, at 6:07 AM, John R. Levine wrote:

> The ability of users to sign up from throwaway accounts doesn't seem to have been a big problem in practice, but it does make it hard to claim that the lists are free of submarine patent trolls.

A person's identity and their behavior are two different things. I would presume that every IETF working group or BOF list has at least one person on it who is lurking in the discussion for the purpose of filing a frivolous lawsuit later. Not sure how we can prevent that.

---

From: Jorge Amodio <[email-masked]>
Date: Sat, 24 Jul 2010 23:42:42 -0500

> The ability of users to sign up from throwaway accounts doesn't seem to have
> been a big problem in practice, but it does make it hard to claim that the
> lists are free of submarine patent trolls.

The problem is not hotmail, nor gmail, etc, I use gmail for email
lists because it is convenient and free.

The problem is people and their behavior, with or without hotmail,
after somebody (no pun intended) wrote "Internet for dummies" and
sniffing for ideas & patentable stuff became a practice to make a
quick profit, many lists and other services got plagued with dummies
and trolls.

> context a user can be entirely anonymous (download a web page), fairly well
> verified (pay with a credit card), and a lot of points in between.

You don't need to register to download drafts/email archives/rfcs ...
IMHO problem is with people that may try to divert/tweak the process
looking for a potential way of making a buck in the future, if you let
them operate in obscurity by letting them being anonymous.

-J

---

From: "Michel Py" <[email-masked]>
Date: Sat, 24 Jul 2010 21:47:56 -0700

> Fred Baker wrote:
> I would presume that every IETF working group or BOF
> list has at least one person on it who is lurking in
> the discussion for the purpose of filing a frivolous
> lawsuit later. Not sure how we can prevent that.

We can't. As long as there is money to make in frivolous lawsuits (I see
no end in it) it will happen. Actually, this is not even the biggest
issue; as long as someone is good at selling a miracle get-rich-quick
scheme, it will happen.

Think about it: what's the difference between spam to sell "male
enhancements" products, spam to sell how to make money on foreclosures,
and spam to sell how to make money on frivolous lawsuits?

This is just like fighting spam: the big issue is not if spam actually
works or not; the big issue is if people actually believe that hiring
the services of spam professionals increases their business or not.

Do you need help filling your oil spill claim against BP?
:-D This one really works good lately. I bet you soon enough there is
going to be a "kit" to help you grow your small business by preparing
the forms to fill claims.

Michel.

Author of the unwritten book:
"How to get rich and famous by trolling IETF mailing lists".
A future best-seller, guaranteed.
$50   Pre-pays for a first-run printed copy.
$400  You get to read the draft before it's published.
$5000 I don't publish it you get the only copy.

:P

---

From: Bob Hinden <[email-masked]>
Date: Sun, 25 Jul 2010 02:45:02 -0700

> that and other types of contribution.

+1

Bob

---

From: Joel Jaeggli <[email-masked]>
Date: Sun, 25 Jul 2010 12:17:48 +0200

>> that and other types of contribution.

anonymous participation is incompatible with 5378/3979

---

From: Joel Jaeggli <[email-masked]>
Date: Sun, 25 Jul 2010 17:34:01 +0200

On 7/25/10 6:21 AM, Fred Baker wrote:
>> The ability of users to sign up from throwaway accounts doesn't
>> seem to have been a big problem in practice, but it does make it
>> hard to claim that the lists are free of submarine patent trolls.
> 
> A person's identity and their behavior are two different things. I
> would presume that every IETF working group or BOF list has at least
> one person on it who is lurking in the discussion for the purpose of
> filing a frivolous lawsuit later. Not sure how we can prevent that.

lurking does not in our definition amount to a contribution.

> _______________________________________________ Ietf mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/ietf
>

---

From: todd glassey <[email-masked]>
Date: Sun, 25 Jul 2010 09:31:07 -0700

> lurking does not in our definition amount to a contribution.

Isnt the real issue with anonymity is that it makes it impossible to
verify the assignment of rights through NoteWell and the other
participatory practices here in the IETF?

Isn't there a requirement to allow people to be able to do proper
diligence on IETF IP's? If so then then the legal staff of any relying
party needs to be able to find all of the people who participated to
verify that they did all of their proper notifications to their sponsors
and the like. That all the proper use agreements and power-of-attorney
between the Sponsor and their representatives is properly in place...
you know the stuff all of our employers need from parties when they do
diligence on use of Intellectual Properties from that party.

Since the IETF doesn't do these things the people relying on the IETF's
use license must do that diligence or face the potential of being
bitch-slapped with litigation when it turns out that someone in the IETF
lied about their practices. This is a very serious outcome that the IETF
should want to avoid.

That said - there should be a "you are required to" I-D I think that is
a concise statement of what you are required to do to use IETF
Intellectual Protocols and what is and is not warranted about them. Its
currently split across multiple documents making it very difficult to
create in one place a statement of proper control for IETF Intellectual
Properties.

Todd

---

From: Marshall Eubanks <[email-masked]>
Date: Sun, 25 Jul 2010 21:46:39 -0400

+1

Marshall

---

From: Martin Rex <[email-masked]>
Date: Tue, 27 Jul 2010 06:03:42 +0200 (MEST)

> lurking does not in our definition amount to a contribution.

"Lurking", i.e. to watch (monitor) what is going on in IETF working groups
is designed to be anonymous.  RFC, I-Ds and mailing list archives do
not require any authentication or subscription.  If they did, things
would no longer be public, but instead membership-only (even if
membership does not require a fee and is open to the public).

Btw. if a person, by his/her own free will decides to publish something
through IETF channels (e.g. on an IETF mailing list, during a WG session
at an IETF meeting or by submitting an I-D), then this is a whole
different kind of PII information than payment data collected
by the IETF (secretariat or whoever handles the payments when registering
for an IETF meeting).

-Martin

PS: you do not need to create an publish a privacy policy before you
    can purchase and read Bill Clintons autobiography, neither as
    a private person, nor as a (representative of) coporate entity.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 25 Jul 2010 07:39:18 -0400

Indeed.

In one group their was a little troll who filed a patent on the entire
standard. They then extorted stock which probably fetched a seven
figure sum when a company using the specification launched their IPO.

Given the sorry fact that the bar to granting a patent in the US is
very low, the bigger problem in my view is that it is difficult to get
any 'clever' idea into a spec since even if the proposer is acting in
good faith there is resistance to anything that might be too good an
idea.

-- 
Website: http://hallambaker.com/