Subject: Montevideo statement

From: IETF Chair <[email-masked]>
Date: Tue, 8 Oct 2013 01:34:58 +0300

I wanted to send a link to a statement that Russ and I signed as a part of a meeting that we held last week with the leaders of other Internet organisations.

http://www.internetsociety.org/news/montevideo-statement-future-internet-cooperation

Jari Arkko
IETF Chair

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 7 Oct 2013 15:51:29 -0700

On Tue, Oct 08, 2013 at 01:34:58AM +0300,
 IETF Chair <[email-masked]> wrote 

> They expressed strong concern over the undermining of the trust and
> confidence of Internet users globally due to recent revelations of
> pervasive monitoring and surveillance.

This wording is surprising. It looks like it is the revelations that
undermined confidence, and not the NSA actions. I would prefer
something like, to avoid shooting the messenger:

They expressed strong concern over the undermining of the trust and
confidence of Internet users globally, due to pervasive monitoring and
surveillance by powerful actor(s).

---

From: Jari Arkko <[email-masked]>
Date: Tue, 8 Oct 2013 02:05:09 +0300

> something like, to avoid shooting the messenger:

Of course :-) We meant that the loss of privacy causes concern, not the revelations.

Jari

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 8 Oct 2013 08:24:49 -0400

> Of course :-) We meant that the loss of privacy causes concern, not the

No, it is the revelations that cause concern.

Nobody is in the least concerned about the fact that the British government
and royal family has been replaced by a group of reptilian dopplegangers
apart from David Ike who is the only person who knows about it.

It is the actions that justify the concern but without the revelations
there is no concern.

The problem with the language used as I see it is that it is unfortunately
rather close to the language used by the establishment types who run round
telling us all not to worry our heads about what they are doing and we must
certainly not ever question their motives or intentions.

The reason I keep reminding people about the previous uses of the syncretic
power of GCHQ and the NSA is that they prove that we do need to keep
questioning their motives. For years people were dismissed as paranoid
leftist hippies for suggesting that the CIA installed a dictatorship in
Greece. And now it is known that exactly that happened.

In the same way, the idea that US government might attempt to use control
over ICANN or IANA for leverage has to be taken seriously. The question is
not whether Steve Crocker is comfortable with the situation, it is whether
the governance infrastructure is strong enough to prevent abuse over
centuries.

The US government is currently shut down because some folk in Congress are
trying to use the threat of a recession to deny access to health care to a
fifth of the population. It is certainly not inconceivable that a future
Congress would attempt to abuse control over ICANN is nonsense. It is a US
registered corporation subject to US law.

If nothing is done then sooner or later there will be some idiot on his
hind legs in the Senate talking for 21 hours demanding that Cuba or
Palestine be dropped out of the DNS root or be denied IPv6 allocations or
some equally stupid grandstanding demand designed to give him a platform on
which to run for higher office.

I think the US executive branch would be better rid of the control before
the vandals work out how to use it for mischief. But better would be to
ensure that no such leverage exists. There is no reason for the apex of the
DNS to be a single root, it could be signed by a quorum of signers (in
addition to the key splitting which I am fully familiar with). And every
government should be assigned a sovereign reserve of IPv6 addresses to
prevent a scarcity being used as leverage.

-- 
Website: http://hallambaker.com/

---

From: Martin Millnert <[email-masked]>
Date: Tue, 08 Oct 2013 14:46:55 +0200

Phillip,

On Tue, 2013-10-08 at 08:24 -0400, Phillip Hallam-Baker wrote:
> If nothing is done then sooner or later there will be some idiot on
> his hind legs in the Senate talking for 21 hours demanding that Cuba
> or Palestine be dropped out of the DNS root or be denied IPv6
> allocations or some equally stupid grandstanding demand designed to
> give him a platform on which to run for higher office.

This has already happened.  Some US-Israeli lobby thing asked RIPE NCC
in 2012 (IIRC) to stop economically support a by some nation states
blockaded Iran via removing its routing registration information and IP
assignments, etc. Not sure exactly how it went from there, but the
request was essentially ignored AFAIK.

The problem is not what happens when a lobbyist approaching on of these
bodies directly is ignored, but when said lobbyists persuades a legal
apparatus with standing, to make similarly ill-advised requests.
  Or to connect back to the Montevideo statement, how to manage a
globally cohesive One Internet without exposing it to the threat of
legal assault.  I.e. how to put the Internet above the law of any one
nation state, essentially. 
 Today, a popular belief in Swedish "IGF" circles is "the law applies
equally to online as it does to offline" -- but this doesn't really
compile well for the Internet IMHO where we have 250 something different
laws, as it is absolutely fragmenting the Internet judicially speaking
to each nation state having some sort of power over its national
Internet segment...

IMHO, the Internet is a global communications fabric, transcending and
superseding individual nation states. Forcefully and offensively
removing someones access to it is a crime by any human standard.

/M

---

From: manning bill <[email-masked]>
Date: Tue, 8 Oct 2013 05:53:42 -0700

> 
> 
> I think the US executive branch would be better rid of the control before the vandals work out how to use it for mischief. But better would be to ensure that no such leverage exists. There is no reason for the apex of the DNS to be a single root, it could be signed by a quorum of signers (in addition to the key splitting which I am fully familiar with). And every government should be assigned a sovereign reserve of IPv6 addresses to prevent a scarcity being used as leverage. 
> 
> -- 

	Quorum signing with split keys  was already built and tested in a root server operator testbed (the OTDR testbed) from 1998-2005.  It was considered more fragile than the current system.

/bill

---

From: Michael Richardson <[email-masked]>
Date: Tue, 08 Oct 2013 09:19:09 -0400

Phillip Hallam-Baker <[email-masked]> wrote:
    > I think the US executive branch would be better rid of the control
    > before the
    > vandals work out how to use it for mischief. But better would be to
    > ensure that
    > no such leverage exists. There is no reason for the apex of the DNS to
    > be a
    > single root, it could be signed by a quorum of signers (in addition to
    > the key

k-of-n signing for the DNSSEC root was talked about by many, including Tatu
Ylonen back in 1996...

I have an alternate proposal: every country's ccTLD should sign the root,
and/or the other TLDs.  That actually hands control of the DNS root back
to the legislatures in each country.  True: some countries might have
perverted notions of what belongs in the root, and we might get different
views of the Internet.  But, this happens already using a variety of
wrong mechanisms that cause harm to the Internet.

Better they do this using good crypto, than that they do this by trying to
subvert the (US-controlled) crypto.

--
Michael Richardson <[email-masked]>, Sandelman Software Works

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 8 Oct 2013 09:19:35 -0400

On Tue, Oct 8, 2013 at 8:53 AM, manning bill <[email-masked]> wrote:

> before the vandals work out how to use it for mischief. But better would be
> to ensure that no such leverage exists. There is no reason for the apex of
> the DNS to be a single root, it could be signed by a quorum of signers (in
>         Quorum signing with split keys  was already built and tested in a
> root server operator testbed (the OTDR testbed) from 1998-2005.  It was
> considered more fragile than the current system.
>

Considered more fragile by whom?

By the members of the $250m/yr NSA mole program?

Very few people in DNS land recognize the class of attack as being
realistic. Even when they have prime ministers and members of the GRU
visiting them to tell them how important the issue is to their country.

We already have one example of lobbyists attempting this type of attack
(see Martin's post). So it is far from unrealistic.

At present ICANN's power over the DNS is entirely discretionary. Attempting
to drop Palestine out of the routing tables would simply be the end of the
ICANN root zone. ICANN could continue to manage .com but their influence
over the rest of the system would end completely.

But DNSSEC changes the balance of power. With the root signed and embedded
infrastructure verifying DNSSEC trust chains, the cost of a switchover
rises remarkably. And when I tried to mention the fact I tended to get
nasty threats.

The third question of power is 'how do we get rid of you'. The answer in
the case of DNSSEC is that you can't.

Fortunately the issue is quite easily fixed, just as the problem of using
IPv6 or BGP allocations for leverage is fixable. Governments don't need to
wait on ICANN or the IETF to develop a quorum signing model for the DNS
apex, they could and should institute one themselves and tell their
infrastructure providers to chain to the quorum roots rather than the
monolithic apex root.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 8 Oct 2013 09:39:07 -0400

> k-of-n signing for the DNSSEC root was talked about by many, including Tatu

Most crypto hardware supports k-of-n keysplitting and most of the code out
there makes use of it. And PKIX CAs use k-of-n keysplitting on a monolithic
trust anchor rather than a composite trust anchor. So it is easy to see how
a technical decision would go that way.

But the idea of signing the root did not become a practical possibility
until much later. I certainly gave the issue no thought when looking at
signing .com. I certainly did not think that it was necessary to wait for
the root to be signed to sign .com.

> wrong mechanisms that cause harm to the Internet.

I think that is a better approach actually. The CC TLDs are in effect
members of a bridge CA and ICANN is merely the bridge administrator.

There would have to be adequate controls to ensure that transfer of the
root was practical of course. It is probably necessary for the CC TLDs to
be able to sign more than one bridge. After all, Europe has just spent many
billions replicating GPS. This would cost less.

And anyone who is a relying party can choose to chain to a single trust
anchor or use multiple anchors. So the quorate approach is still available
for those who want it. If France, Cuba, the US and India all agree on the
validity of the bridge root, then it is probably valid.

> subvert the (US-controlled) crypto.

Its not all US controlled, you can use GOST...

---

From: manning bill <[email-masked]>
Date: Tue, 8 Oct 2013 07:49:35 -0700

On 8October2013Tuesday, at 6:19, Phillip Hallam-Baker wrote:

> Very few people in DNS land recognize the class of attack as being realistic. Even when they have prime ministers and members of the GRU visiting them to tell them how important the issue is to their country.
> 
> We already have one example of lobbyists attempting this type of attack (see Martin's post). So it is far from unrealistic. 
> 
> 
> At present ICANN's power over the DNS is entirely discretionary. Attempting to drop Palestine out of the routing tables would simply be the end of the ICANN root zone. ICANN could continue to manage .com but their influence over the rest of the system would end completely.
> 
> But DNSSEC changes the balance of power. With the root signed and embedded infrastructure verifying DNSSEC trust chains, the cost of a switchover rises remarkably. And when I tried to mention the fact I tended to get nasty threats.
> 
> The third question of power is 'how do we get rid of you'. The answer in the case of DNSSEC is that you can't. 
> 
> 
> Fortunately the issue is quite easily fixed, just as the problem of using IPv6 or BGP allocations for leverage is fixable. Governments don't need to wait on ICANN or the IETF to develop a quorum signing model for the DNS apex, they could and should institute one themselves and tell their infrastructure providers to chain to the quorum roots rather than the monolithic apex root.
> 
> 

	Been there, done that, outgrew the teeshirt.
        Interestingly, the perceived value of a common, global namespace is _MUCH_ higher than the value of a controlled, boundary constrained namespace…

	At least by nearly every government to date.

	The fragile vectors could be classed in two buckets,  Human Factors & Timing.

/bill

---

From: SM <[email-masked]>
Date: Tue, 08 Oct 2013 22:55:08 -0700

Hi Russ,
>surveillance by powerful actor(s).

The wording could have been different instead of one expressing a 
strong concern about the "revelations".

There is a statement from LACNIC about allegations of espionage 
(http://www.lacnic.net/en/web/anuncios/2013-lacnic-acerca-espionaje). 
The statement signed by the IAB Chair 
(http://www.iab.org/documents/correspondence-reports-documents/2013-2/montevideo-statement-on-the-future-of-internet-cooperation/) 
is about future of Internet Cooperation.

This is the second time that the IAB has issued a statement without 
requesting comments from the IETF Community.  In my humble opinion it 
would be good if there was a comment period.

Regards,
-sm

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 9 Oct 2013 02:44:39 -0400

Dear colleagues,

On Tue, Oct 08, 2013 at 10:55:08PM -0700, SM wrote:
> This is the second time that the IAB has issued a statement

Speaking only (empahtically only) for myself, I quite strongly
disagree.  The IAB has issued no statement in this case.

The text as posted is quite clear:

---%<---cut here---

"The leaders of organizations … have met"
[…]
Russ Housley, Chair
Internet Architecture Board (IAB)

--->%---cut here---

That does not say that the IAB has issued a statement.  On the
contrary, the IAB did not issue a statement.  I think the difference
between some individuals issuing a statement in their capacity as
chairs and CEOs and so on, and the body for which they are chair or
CEO or so on issuing a similar statement, is an important one.  We
ought to attend to it.

Please note that this message is not in any way a comment on such
leadership meetings.  In addition, for the purposes of this discussion
I refuse either to affirm or deny concurrence in the IAB chair's
statement.  I merely request that we, all of us, attend to the difference
between "the IAB Chair says" and "the IAB says".

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: joel jaeggli <[email-masked]>
Date: Tue, 8 Oct 2013 23:54:10 -0700

> between "the IAB Chair says" and "the IAB says".

It would be highly salubrious if in the future if things that look like open letters are simply signed by individuals listing their organizational role/affiliation rather than stating that leaders of the following organizations support this statement. There is  abundant historical precedent for that.

---

From: Tobias Gondrom <[email-masked]>
Date: Wed, 09 Oct 2013 11:45:36 +0100

> between "the IAB Chair says" and "the IAB says".

Andrew,
Although there is obviously a difference in wording, it is not that simple.
As people had the meeting and signed this directly linked to their roles
(IAB chair, IETF chair), it implies to the public that there is a
correlation with the organisation's positions and the support from their
organisations,  putting weight behind their statements.
Don't get me wrong, I definitely support that this situation deserved
statement to be made. But I support SM's proposal that it would be good
to do a few days comment period for such important statements in the
future - if timing is not critical. There is no harm in a few days delay
and getting input from the community.

And I second sm's concern that "The wording could have been different
instead of one expressing a strong concern about the "revelations"."
Agree, personally I am not concerned that certain activities were
revealed, I am very concerned that some of these things happened in the
first place.

Best regards, Tobias

---

From: Ted Lemon <[email-masked]>
Date: Wed, 9 Oct 2013 09:14:03 -0400

On Oct 9, 2013, at 6:45 AM, Tobias Gondrom <[email-masked]> wrote:
> But I support SM's proposal that it would be good

This is a nice theory, but the usual last call time at IETF is either two weeks or four weeks, not a few days, and that's for a good reason.  I think there is no way that a statement of the type we are discussing can ever represent IETF consensus unless we go through an actual consensus call.

So the real question here is, is it ever appropriate for the chair of the IAB or the chair of the IETF to sign a statement like this without getting consensus?   I think that's a good question, and I don't have a strong opinion on the answer.   But if the answer is that we need consensus, then we actually need to do a consensus call.

The only value I see in "a few days" would be an opportunity for wordsmithing—as someone pointed out, the current statement could be read as expressing concern that secrets were leaked, rather than concern about what was done in secret, and it would have been nice if that wording could have been corrected.   If that is what you were asking for, then that does make sense.

(thinking out loud...)

---

From: John C Klensin <[email-masked]>
Date: Wed, 09 Oct 2013 10:00:39 -0400

--On Wednesday, October 09, 2013 02:44 -0400 Andrew Sullivan
<[email-masked]> wrote:

>...
> contrary, the IAB did not issue a statement.  I think the
> difference between some individuals issuing a statement in
> their capacity as chairs and CEOs and so on, and the body for
> which they are chair or CEO or so on issuing a similar
> statement, is an important one.  We ought to attend to it.
> 
> Please note that this message is not in any way a comment on
> such leadership meetings.  In addition, for the purposes of
> this discussion I refuse either to affirm or deny concurrence
> in the IAB chair's statement.  I merely request that we, all
> of us, attend to the difference between "the IAB Chair says"
> and "the IAB says".

Andrew,

While I agree that the difference is important for us to note,
this is a press release.  It would be naive at best to assume
that its intended audience would look at it and say "Ah. A bunch
of people with leadership roles in important Internet
organizations happened to be in the same place and decided to
make a statement in their individual capacities".  Not only does
it not read that way, but there are conventions for delivering
the "individual capacity" message, including prominent use of
phrases like "for identification only". 

Independent of how I feel about the content of this particular
statement,  if the community either doesn't like the message or
doesn't like this style of doing things, I think that needs to
be discussed and made clear.  That includes not only at the
level of preferences about community consultation but about
whether, in in the judgment of the relevant people, there is
insufficient time to consult the community, no statement should
be made at all.

Especially from the perspective of having been in the
sometimes-uncomfortable position of IAB Chair, I don't think IAB
members can disclaim responsibility in a situation like this.
Unlike the Nomcom-appointed IETF Chair, the IAB Chair serves at
the pleasure and convenience of the IAB.  If you and your
colleagues are not prepared to share responsibility for
statements (or other actions) the IAB Chair makes that involve
that affiliation, then you are responsible for taking whatever
actions are required to be sure that only those actions are
taken for which you are willing to share responsibility.   Just
as you have done, I want to stress that I'm not recommending any
action here, only that IAB members don't get to disclaim
responsibility made by people whose relationship with the IAB is
the reason why that are, e.g., part of a particular letter or
statement.

      john

---

From: Tobias Gondrom <[email-masked]>
Date: Wed, 09 Oct 2013 17:02:17 +0100

> The only value I see in "a few days" would be an opportunity for wordsmithing—as someone pointed out, the current statement could be read as expressing concern that secrets were leaked, rather than…

Yes, that is what is was thinking about. Probably wisdom of the crowds
could have helped with the wordsmithing part.
And in my view even some little feedback (3-7 days) is better than none.
And just to be clear: with such a short comment option, the goal is just
comments not to get a rough consensus.

All the best, Tobias

---

From: Russ Housley <[email-masked]>
Date: Wed, 9 Oct 2013 12:24:00 -0400

SM:

> This is the second time that the IAB has issued a statement without requesting comments from the IETF Community.  In my humble opinion it would be good if there was a comment period.

This is a statement about what happened at a meeting.  Discussion would not change what happened at the meeting.  Making the statement very public allows a good discussion of what should happen next.  I look forward to that discussion.

Russ

---

From: joel jaeggli <[email-masked]>
Date: Wed, 9 Oct 2013 10:07:16 -0700

On Oct 9, 2013, at 9:02 AM, Tobias Gondrom <[email-masked]> wrote:

> Yes, that is what is was thinking about. Probably wisdom of the crowds could have helped with the wordsmithing part. 

I imagine that's exctly the part of course that they aren't interested in once they're hashed out a high-level statement (and have general agreement between the signatories ) is more input. 

It seems dramatically simpler to just make the satement as individuals who put their name on something.

> And in my view even some little feedback (3-7 days) is better than none. And just to be clear: with such a short comment option, the goal is just comments not to get a rough consensus. 
> 

We have a process for obtaining consensus. It takes a little while.

---

From: Arturo Servin <[email-masked]>
Date: Wed, 09 Oct 2013 17:05:41 -0200

We appointed our leaders, we have to trust them. They had to do a call,
an important one and they made it.

	I support what they did, that is what we chose them for, to represent
us and be our voice. We cannot expect that they ask our opinion for
every decision they made, that is not practical or possible in today's
world. Sometimes like in this statement, we need to trust in their good
judgment.

My 20 cents,
as

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 9 Oct 2013 15:27:16 -0400

Dear colleagues,

Once again, I'm speaking only for myself.  I think there is an
important matter here for the IETF community to think about,
particularly as the Nomcom is _right now_ seeking nominees for open
positions.  I want to be very careful to emphasise that I do not
intend to specify a preference for how things should go.  This is
because I am currently the IAB's liaison to the nomcom, and I
therefore think it's important to avoid expressing my personal
preferences in this case.  But I encourage people to talk to the
nomcom about their views on this general topic.  (Also, if you have
views about this, you might want to consider standing for an open IESG
or IAB position.)

So,

> phrases like "for identification only". 

I don't think that "individual capacity" is what the identified people
were doing at that meeting.  They went to the meeting _as the chairs_
of the IAB and the IETF.  Therefore, it is quite appropriate that they
(but they alone) sign the statement in their capacity as chairs.  And
under those circumstances, I don't actually see what feedback about
the statement could be appropriate.  They did something, as
chairs. They make a statement, as chairs, about it.  Someone else's
thoughts about what the meeting should have been about are certainly
appropriate topics for discussion; but I don't see why those thoughts
should affect the contents of a statement about the actual meeting
that happened.

Now, there is indeed a possible issue, and that is that these chairs
were attending a "chief officer"-type meeting: there were CEOs and so
on, and (presumably by analogy) the chairs got invited to represent
the organizations of which they are chairs.  John is quite right that
people unfamiliar with the way the IETF or IAB work might interpret
the statement along the lines of, "The CEO of the IETF said that the
IETF subscribes to some view."  Normally, the leader of an
organization can direct that organization to some end; the Chair is
the leader; therefore, the Chair can direct the organization.  Of
course, that's not how we operate (this is, I think, at the bottom of
this very discussion).  But others might get that impression.

What I am not sure about is whether people are willing to accept the
chairs acting in that sort of "leader of organization" role.  If we do
accept it, then I think as a consequence some communications will
happen without consultation.  For a CEO is not going to agree to issue
a joint communiqué with someone who has to go negotiate the contents
of that communiqué (and negotiate those contents in public).  If we do
not accept it, then we must face the fact that there will be meetings
where the IETF or IAB just isn't in the room, because we'll have
instructed the chairs not to act in that capacity.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: SM <[email-masked]>
Date: Wed, 09 Oct 2013 12:27:14 -0700

Hi Russ,
At 09:24 09-10-2013, Russ Housley wrote:
>This is a statement about what happened at a 
>meeting.  Discussion would not change what 
>happened at the meeting.  Making the statement 
>very public allows a good discussion of what 
>should happen next.  I look forward to that discussion.

One of the organizations mentioned in the 
statement commented about it as follows:

   "Internet/Web Organizations Issue Montevideo Statement on the Future
    of Internet Cooperation"

   "The leaders of organizations responsible for coordination of the Internet
    technical infrastructure globally met in Montevideo, Uruguay, to consider
    current issues affecting the future of the Internet. They issued today
    a Montevideo Statement on the Future of Internet Cooperation, signed by
    African Network Information Center (AFRINIC), American Registry for
    Internet Numbers (ARIN), Asia-Pacific Network Information Centre (APNIC),
    Internet Architecture Board (IAB), Internet Corporation for Assigned Names
    and Numbers (ICANN), Internet Engineering Task Force (IETF), Internet
    Society (ISOC), Latin America and Caribbean Internet Addresses Registry
    (LACNIC), Réseaux IP Européens Network 
Coordination Centre (RIPE NCC), W3C."

One of the signatories of the statement mentioned 
(if I understood correctly) that the statement was from the organizations.

Is the statement an IAB statement or a statement 
from the IAB Chair?  Please note that I have read 
the message from Andrew (see 
http://www.ietf.org/mail-archive/web/ietf/current/msg82926.html ).

I agree that discussion would not change what 
happened.  I don't think that it is a good idea 
to have a "fait accompli" [1] for the IETF 
Community to discuss about.  It has been said 
that "we reject: kings, presidents and 
voting".  The statement creates the perception 
that the leaders of the Internet Architecture 
Board and the Internet Engineering Task Force are 
like kings or presidents. The Internet 
Architecture Board is supposed to be based on 
collegial responsibility.  I read that as meaning 
not to have statements which commits the Internet 
Architecture Board to a course of action without 
some form of approval from the members of that 
Board.  Obviously, some form of approval would 
not have to be sought if the course of action has been discussed previously.

   "The [IAB] board discussed the issue of a joint OpenStand statement or
    an IAB specific statement. Many members were against a closed review
    period for such a statement and would prefer to have an open discussion
    period in the IETF if such a statement was required."

There is a comment on the www.iab.org web site 
about "allegations of interference by some 
governments in the standards development process" 
and a link to an "OpenStand" statement.  It seems 
that there was a closed review period for the joint OpenStand statement.

I don't think that it is possible to build trust 
if openness and transparency are in name only.  I 
am not enthusiastic about having a discussion 
which does not materially affect the outcome.

Regards,
-sm

1. something that has been done and cannot be changed.

---

From: Russ Housley <[email-masked]>
Date: Wed, 9 Oct 2013 15:43:39 -0400

SM:

Each of these leaders comes from a different organization, and each of these organizations grants their leaders different degrees of autonomy.  So, the amount of coordination that was done differs for each. In all cases, there was one business day to do the coordination.

In my case, I shared the draft statement with the whole IAB, stating my intention to include my name and role at the bottom of the statement.  I asked for no wordsmithing because ten organizations were simultaneously handling the statement in their own way.

Russ

On Oct 9, 2013, at 3:27 PM, SM wrote:

> One of the organizations mentioned in the statement commented about it as follows:
> 
>   (LACNIC), Réseaux IP Européens Network Coordination Centre (RIPE NCC), W3C."
> 
> One of the signatories of the statement mentioned (if I understood correctly) that the statement was from the organizations.
> 
> Is the statement an IAB statement or a statement from the IAB Chair?  Please note that I have read the message from Andrew (see http://www.ietf.org/mail-archive/web/ietf/current/msg82926.html ).
> 
> I agree that discussion would not change what happened.  I don't think that it is a good idea to have a "fait accompli" [1] for the IETF Community to discuss about.  It has been said that "we reject: kings, presidents and voting".  The statement creates the perception that the leaders of the Internet Architecture Board and the Internet Engineering Task Force are like kings or presidents. The Internet Architecture Board is supposed to be based on collegial responsibility.  I read that as meaning not to have statements which commits the Internet Architecture Board to a course of action without some form of approval from the members of that Board.  Obviously, some form of approval would not have to be sought if the course of action has been discussed previously.
> 
> There is a comment on the www.iab.org web site about "allegations of interference by some governments in the standards development process" and a link to an "OpenStand" statement.  It seems that there was a closed review period for the joint OpenStand statement.
> 
> I don't think that it is possible to build trust if openness and transparency are in name only.  I am not enthusiastic about having a discussion which does not materially affect the outcome.
> 
> Regards,
> -sm
>

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 10 Oct 2013 09:02:15 +1300

On 10/10/2013 08:27, Andrew Sullivan wrote:
...
> instructed the chairs not to act in that capacity.

I've been there in the past, as IAB Chair, ISOC Board Chairman, and IETF Chair.

Either we trust our current and future chairs, on certain occasions,
to speak in our name without there being a discursive debate in advance,
or we will have no voice on those occasions.

If there was a pattern of I* chairs subscribing to statements that the
relevant community clearly found quite outrageous, there might be an
argument for having no voice.

I suggest that there is no such pattern. There may be quibbles over
wording sometimes, but that is inevitable when several different
stakeholder organisations have to agree on wording. The wording is
inevitably a compromise; it can't be otherwise.

It's perfectly reasonable to ask our chairs to invite debate in
advance when that is possible; but in many of these cases, it
simply isn't. It's also perfectly reasonable that people should comment
on the wording even after it's set in stone; that helps us to do better
next time.

If we nominate good candidates for our leadership positions, and send
thoughtful comments to the NomCom (and the IESG and IAB for their
nominating duties), we won't get leaders who put their names to
anything outrageous.

We should trust our chairs to act as figureheads and leaders towards
the outside world.

   Brian Carpenter

---

From: Abdussalam Baryun <[email-masked]>
Date: Wed, 9 Oct 2013 21:15:46 +0100

I agree to appoint leader under clear procedures, so I am not sure of
representing without procedure is authorised in ietf, but I trust that ietf
leaders do practice procedure, but not sure if discussion meant that there
was something missing in this statement practice.

AB

On Wednesday, October 9, 2013, Arturo Servin wrote:

> > <[email-masked] <javascript:;>> wrote:
> >
> >> ...

---

From: Abdussalam Baryun <[email-masked]>
Date: Wed, 9 Oct 2013 21:26:34 +0100

There should be known limits for chairs, leaders, only if the procedures
have mentioned no limits of representation. Trust is there but still there
is also levels and limits for trust and representation.

AB

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 09 Oct 2013 23:21:45 +0200

>or we will have no voice on those occasions.

We should think before we speak, and discursive debate is our collective
thought process. Accordingly I would expect Chairs to anticipate and fa-
cilitate debates that might be necessary or useful, especially on issues
where they find giving the collective a voice may be important. It seems
implausible to me that there would be notably many such occasions. Maybe
because as German I am inclined towards disregarding phatic expressions.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 10 Oct 2013 11:42:43 +1300

Björn,

> because as German I am inclined towards disregarding phatic expressions.

I assure you that after looking up "phatic" I feel the same way.
And I agree with your point: when there's time to consult the community,
of course it should be done. But sometimes there isn't time, which
is when IMHO we should show some trust in our various Chairs.

    Brian

---

From: Scott Brim <[email-masked]>
Date: Wed, 9 Oct 2013 19:55:24 -0400

Discursive debate in advance is for establishing principles, and
establishing the level of trust invested in someone. Then you let them go
to do the job you chose them for. If an issue is of such weight that it
requires a lot of discussion, and you chose the right people, they will
know that already.
On Oct 9, 2013 3:43 PM, "Brian E Carpenter" <[email-masked]>

---

From: SM <[email-masked]>
Date: Thu, 10 Oct 2013 01:30:45 -0700

At 12:27 09-10-2013, Andrew Sullivan wrote:
>a joint communique with someone who has to go negotiate the contents
>of that communique (and negotiate those contents in public).  If we do

There might be some history to the "we reject: kings, presidents and voting".

Should the IETF change the way it operates?  There are advantages to 
the Chair directing the organization.  It is easier to set 
policy.  It is easier for the Chair to negotiate with other 
organizations.  There are disadvantages, for example, the policy 
might not reflect the wishes of the community.  The IETF might have 
to reconsider whether people participate as individuals or as corporate folks.

There is the question of openness.  If the IETF were to set policy 
behind closed doors, can it say that it is open?  "We" don't take 
working group decisions behind closed doors.  The IESG tries to take 
its decisions in a transparent manner.  There may have been a time 
when it was not like that.

As I mentioned previously the IAB [1] is supposed to be based on 
collegial responsibility.  There hasn't been any discussion to change 
that during the tenure of the last two IAB Chairs.  What's different 
now?  The IAB has published statements and RFCs about its 
positions.  The Chairs can exercise their discretion.

The members of the IESG and the IAB have not mentioned that they do 
not have the ability to negotiate under current rules [2].  The IETF 
Chair and the IAB Chair have not mentioned that they are not able to 
negotiate due to the current rules.  The question of trust comes up 
every now and then.  Responsibility [3] seems to be an inconvenient 
word on this mailing list.

What's the opinion of the persons who are part of "leadership" about all this?

Regards,
-sm

1. "People outside think IAB has power  :-)"
2. I chose a word quickly.
3. the state or fact of being responsible, answerable, or accountable.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 10 Oct 2013 09:28:20 -0400

As a practical matter any organization that tries to do things with other
organizations needs to have some party that can act on its behalf. That is
why Ambassadors are necessary.

The current constitution of the IETF means that the chairs of the IAB and
the IETF have very limited authority to speak for the organization, but of
course they have to.

I have argued for junking the DARPA constitution for years. It was designed
to keep power in the hands of the few while the rest of the organization
didn't worry their pretty heads about it. They don't even get to call
themselves members.

We should junk the noncon completely and the constituency currently
qualified to stand for noncon should elect the chair.

---

From: Jari Arkko <[email-masked]>
Date: Thu, 10 Oct 2013 18:19:05 +0300

First off, we like to be in a situation where past IETF discussion, consensus, RFCs, and current work program guide what the leaders say. I think this was largely the case with the Montevideo statement as well. Of course these are judgment calls. Please send us feedback - I for instance talk in various external events pretty much on a weekly basis, and I'd appreciate feedback in cases where I've done this well or less well.

Secondly, there may be times where the leaders might make statements that are suggestions for a future path to take. I do think that is important. The S in IESG, for instance. Often the status of these statements would be obvious from the text "I think that we should …" Again, feedback is appreciated if we're not being clear.

Thirdly, you need to understand that the context of the discussion or statements matters a lot from a practical perspective. If I talk to the press, I have very little opportunity to finesse what the final message is. If we talk to other organisations it is in practice difficult to arrange for simultaneous editing by a large group of people. Or get all nuances exactly as you want them. But the best model is to have whatever we say supported by earlier discussions. But I hope that we can use our own words. If we support open standards at the IETF or we have a working group on HTTP 2.0, I need to be able to say so.

In short, my hope at least is that I can speak about IETF matters that are decided & obvious openly, that I can make suggestions on future paths in some contexts, and that where we see a need to make new substantive consensus calls, we actually run them with the usual IETF process. And we appreciate feedback - there will be mistakes, for which I apologize. And I hope we all understand how important communication with the external world is.

Jari - speaking as himself only

---

From: Medel v6 Ramirez <[email-masked]>
Date: Thu, 10 Oct 2013 10:11:59 +0800

Leaders were "processed" thoroughly prior to their appointment so I trust
them. And that they hold through the "spirit" of being an IETF and shall be
responsible under oath for any impact on the organization.

BR,
Medel

GOOGLE IS IPv6 COMPLIANT !

-- 
This e-mail message (including attachments, if any) is intended for the use 
of the individual or the entity to whom it is addressed and may contain 
information that is privileged, proprietary, confidential and exempt from 
disclosure. If you are not the intended recipient, you are notified that 
any dissemination, distribution or copying of this communication is 
strictly prohibited. If you have received this communication in error, 
please notify the sender and delete this E-mail message immediately.

---

From: Dave Crocker <[email-masked]>
Date: Fri, 11 Oct 2013 06:05:54 +1300

On 10/8/2013 11:34 AM, IETF Chair wrote:
> I wanted to send a link to a statement that Russ and I signed as a
> part of a meeting that we held last week with the leaders of other
> Internet organisations.
>

Folks,

There are a few things that we should consider rather more carefully
than we've been doing, beyond a few of the postings. (I'd especially 
like to suggest that there be more careful review of Andrew Sullivan's 
postings on the thread, since he raises essential point, in my view.)

In any event:

      1. In spite of calling itself a press release (at the bottom) and
having gone through an ISOC media person, what was released was not a
press release.   Neither in form nor substance.  Its title says
"statement", and the bottom list of people is in the style of a
signature list, rather than merely listing attendees -- and note that 
Jari does characterize this as being signed.  Hence what was released 
was in the style of a formal statement, issued under the control of its 
signatories.

      2. The statement does not merely say that these folk met and
discussed stuff.  It says they agreed to stuff, or at leased "called 
for" stuff.

      3. These people were acting as representatives of their
organizations; hence the use of their titles.  And the statement does
not explicitly say they were speaking only for themselves.  So their
agreement to the Statement needs to be taken as their speaking for their
organizations.

      4. Having both IETF Chair and IAB Chair makes it look like there 
were two organizations being represented, but in practical terms there 
really weren't.

      5. It has been noted that the IAB is largely autonomous for 
something like this; hence the IAB Chair formally only has to answer to 
the IAB itself, and we are told he was in this case.  What this begs is 
a question about the IAB acting independently of the IETF community...

My initial reading of the Statement was that it was quite benign, so
that any concern about it's speaking for the IETF was purely a matter of
principle.  In that regard, I considered it a nice test case for some
basic IETF discussion of the authority of our 'leaders' to make 
statements on our behalf but without our review or approval.  Then I 
re-read the statement more carefully and landed on:

> They called for accelerating the globalization of ICANN and IANA
> functions, towards an environment in which all stakeholders,
> including all governments, participate on an equal footing.

     5.  It's not at all clear what "accelerating the globalization" 
means here, since the statement offers no context for whatever 
'globalization' efforts with ICANN and IANA are happening.  Worse, this 
item is entirely political, involving organizations with which the IETF 
has on-going agreements and reliance.  Further, I believe there is no 
IETF context -- nevermind consensus -- for the topic.  As far as I know 
the IETF has no basic discomfort with its relationship with IANA, for 
example.  We might individually make guesses about what this item in the 
Statement means, but my point is that a) we shouldn't have to, and b) it 
has no context within the IETF community.  For any of our 'leaders' to 
make agreements on our behalf, about political issues of organizations 
with which we have formal arrangements -- and probably any other 
organizations -- is significantly problematic.

As has been noted, there are practical and formal limits to requirements 
for getting IETF rough consensus.  Any constraints on public statements 
by IETF leaders needs to balance against those limits, if we are to 
allow folk to speak publicly at all.

      6. The realities of trying to get IETF community rough consensus 
means that anything requiring timely action cannot seek formal 
consensus.  To that end, we need to distinguish between 'review' and 
'approval'.  IETF community review can be very quick indeed, though 
probably not less than 24 hours, if the range of review comments is to 
be a good sampling of the community.  In the current example, community 
review quickly noted the erroneous phrasing that confuses concern about 
disclosure of an act from concern about the act itself.  (I'm working on 
the assumption that the Montevideo group is really more concerned that 
monitoring was/is taking place than that someone made this fact public...)

Now to a more basic issue.  It's likely to be uncomfortable, but I'll 
stress that this isn't about individual people.  Fortunately, no sane 
person can have any concerns about the intent of either of the IETF folk 
who participated in this event and its resulting Statement.  So what 
follows is about IETF roles, responsibilities and authorities, not about 
individuals...

What does it mean to be a 'leader' in the IETF, who is Chair of the IETF 
or the IAB?  Unlike CEOs and Presidents and Chairs of corporations, IETF 
leaders mostly don't lead.  They don't set work agendas. They don't 
control overall budgets.  They don't hire and fire people.  For almost 
all of the formal IETF 'decisions' they participate in, it is with 
exactly one vote in a group, and not more authority than that.  (And by 
the way, the IESG largely does not 'steer' the IETF.  Initiatives for 
work come from the community and very nearly never from ADs or the IESG.)

IETF leaders are best viewed as facilitators, rather than leaders.  They 
do huge amounts of organizing, coordinating, interfacing, in the classic 
style of the cliche'd 'shepherding cats'.

So when they speak on our behalf, it really does need to be an accurate 
rendition of IETF community views and not merely their guesses of those 
views or their hopes of what those views might or should be.

      7. The released Statement was formulated by the group including 
two IETF 'leaders'.  It was not subject to random formulation by a 
reporter, or the like.  When people holding formal IETF roles 
participate in the formulation of formal Statements, things need to be 
carefully based on actual IETF community views.

We need to find some sort of language that gives constructive guidance 
and constraint about public representations of the IETF, by our 
'leaders'.  Not very long ago, there was a concern raised by Pete 
Resnick, when an IETF working group chair made statements at an ITU 
gathering and represented himself as an IETF wg chair.  We might want to 
review whatever guidance came out of that.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: manning bill <[email-masked]>
Date: Thu, 10 Oct 2013 10:49:26 -0700

the "leaders" are there to inform and moderate the discussion and where possible, indicate
that consensus has been reached (or not).    when "leaders" speak out on behalf of organization
-particularly- this organization and they are _NOT_ relaying the consensus of the group at large,
they have exceeded their remit.  

glossing over  or ignoring conflicting opinions simply because it does not reflect the "leader" bias
is demonstrable - often to serious harm to an otherwise worthy effort.    Chairs should _NOT_  
presume to speak for an organization without consultation.   

Concerns about "being in the room" reflect a serious insecurity in the type and quality of work that
we are supposed to be producing. 

/bill

---

From: Arturo Servin <[email-masked]>
Date: Thu, 10 Oct 2013 15:55:48 -0200

Then we have a big problem as organization, we are then leaderless.

	That is not good for the IETF and it reflects that we are not ready for
the dynamics of the Internet that we created.

.as

---

From: manning bill <[email-masked]>
Date: Thu, 10 Oct 2013 10:57:07 -0700

On 10October2013Thursday, at 1:30, SM wrote:

> Should the IETF change the way it operates?  There are advantages to the Chair directing the organization.  It is easier to set policy.  It is easier for the Chair to negotiate with other organizations.  There are disadvantages, for example, the policy might not reflect the wishes of the community.  The IETF might have to reconsider whether people participate as individuals or as corporate folks.
> 
> There is the question of openness.  If the IETF were to set policy behind closed doors, can it say that it is open?  "We" don't take working group decisions behind closed doors.  The IESG tries to take its decisions in a transparent manner.  There may have been a time when it was not like that.
> 
> As I mentioned previously the IAB [1] is supposed to be based on collegial responsibility.  There hasn't been any discussion to change that during the tenure of the last two IAB Chairs.  What's different now?  The IAB has published statements and RFCs about its positions.  The Chairs can exercise their discretion.
> 
> The members of the IESG and the IAB have not mentioned that they do not have the ability to negotiate under current rules [2].  The IETF Chair and the IAB Chair have not mentioned that they are not able to negotiate due to the current rules.  The question of trust comes up every now and then.  Responsibility [3] seems to be an inconvenient word on this mailing list.
> 

	well, I will stand up and claim to be part of the "leadership" - since this supposed to be a bottom up organization.

        the IETF has changed the way it works and we see other fora come into existence that reflect a true bottom up approach.  If we (the affected community) feel that a top down approach would be 
        for the best, going forward,  I see no better top-down organization than the ITU-T.    The community will decide the relevance of a group that ignores or dismisses their needs.

/bill

---

From: Melinda Shore <[email-masked]>
Date: Thu, 10 Oct 2013 10:30:17 -0800

On 10/10/13 9:49 AM, manning bill wrote:
> the "leaders" are there to inform and moderate the discussion and
> where possible, indicate that consensus has been reached (or not).
> when "leaders" speak out on behalf of organization -particularly-
> this organization and they are _NOT_ relaying the consensus of the
> group at large, they have exceeded their remit.

I really think we need to stop behaving as if the IETF is a
small group of people who know each other well.  Consensus
decision-making does not scale well with the number of
participants, and if we're going to require consensus on
every leadership decision we're not going to get anything
done.  Now, being frozen and inactive may be preferable to
having Jari and Russ go off and make a cooperative public
statement about internet governance, but it seems to me that
as long as we have recall and appeals processes we have
incentives for IETF and IAB chairs, and IESG and IAB members,
not to go off and do controversial things unilaterally, as
well as a remedy if they do.

Melinda

---

From: Jari Arkko <[email-masked]>
Date: Thu, 10 Oct 2013 21:31:17 +0300

Dave:

On IANA:

> Further, I believe there is no IETF context

RFC 6020 and http://www.iab.org/wp-content/IAB-uploads/2011/07/IANA-IAB-FNOI-2011.pdf

Jari

---

From: Ted Lemon <[email-masked]>
Date: Thu, 10 Oct 2013 14:32:09 -0400

On Oct 9, 2013, at 10:11 PM, Medel v6 Ramirez <[email-masked]> wrote:
> Leaders were "processed" thoroughly prior to their appointment so I trust them. And that they hold through the "spirit" of being an IETF and shall be responsible under oath for any impact on the organization.

I don't know precisely what you mean by this, but I assure you that there is no oath given.   Speaking for myself, much of what I have learned about how to be a leader (at the AD level) in the IETF I have learned on the job.   This is an iterative process.   Nomcom appointees are not magical.   We do our best, and when we screw up the community corrects us, sometimes harshly, sometimes eloquently, but without fail.   This is a good thing.

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Thu, 10 Oct 2013 16:48:03 -0200

Hello,

On 10/10/13 4:30 PM, Melinda Shore wrote:
> done.  

Couldn't be more true. If we want the IETF to have a voice on the larger
stage then we need to trust the people we appoint. While having a public
consultation period would be ideal we need to understand, and come to
terms with, the fact that it will not be possible to have this in all cases.

Now, being frozen and inactive may be preferable to
> well as a remedy if they do.

So true, again.

> Melinda

Carlos

---

From: Dave Crocker <[email-masked]>
Date: Fri, 11 Oct 2013 07:48:45 +1300

> RFC 6020 and http://www.iab.org/wp-content/IAB-uploads/2011/07/IANA-IAB-FNOI-2011.pdf

Jari,

The fact that you had to reach back 2.5 years, to a frankly rather 
obscure document that came from the IAB and not the broader IETF, 
demonstrates my point that we lacked meaningful context and, in 
particular, you lacked mandate for speaking about this on behalf of the 
IETF.

And lest the end of the above sentence be taken as too stern or 
critical, I'll point out that I think we, the IETF, have been marching 
down a path of causing our 'leaders' to feel empowered in this way -- we 
have actually been moving towards kings and voting -- and hence, again, 
this is not a criticism of you or Russ personally.  If anyone feels 
compelled to apply the word criticism here, they need to apply it to all 
of us, the IETF community.

d/

---

From: Abdussalam Baryun <[email-masked]>
Date: Thu, 10 Oct 2013 20:31:17 +0100

I like your approach and comments, and I think that our ietf leaders are
not always leaders but in IESG they are the managers.  Mostly ietf ruled by
community consensus not presidents, so we have many leaders including you
and some others may be additional leaders for the community. The ietf wants
feedback because there are not less than 50 leaders in ietf that lead the
Internet community or leaders that make/discover things for the community
when they participate.

I really want to say the important thing about leaders that they have
followers (not statements). Managers have workers and they may represent
organisation decisions and statements. The body that is managing the
decisions of ietf can make representation statements, but leader statements
has no value if there is no followers. Therefore, IMO, if there is no time
for asking feedback of community then the IETF chair can ask the IESG, to
support such represent statement. Otherwise we wait to review the community
feedback for two weeks.

AB

On Thursday, October 10, 2013, Dave Crocker wrote:

> than we've been doing, beyond a few of the postings. (I'd especially like
> to suggest that there be more careful review of Andrew Sullivan's postings
> on the thread, since he raises essential point, in my view.)
>
> In any event:
>
> signature list, rather than merely listing attendees -- and note that Jari
> does characterize this as being signed.  Hence what was released was in the
> style of a formal statement, issued under the control of its signatories.
>
> discussed stuff.  It says they agreed to stuff, or at leased "called for"
> stuff.
>
>      4. Having both IETF Chair and IAB Chair makes it look like there were
> two organizations being represented, but in practical terms there really
> weren't.
>
>      5. It has been noted that the IAB is largely autonomous for something
> like this; hence the IAB Chair formally only has to answer to the IAB
> itself, and we are told he was in this case.  What this begs is a question
> about the IAB acting independently of the IETF community...
>
>
> basic IETF discussion of the authority of our 'leaders' to make statements
> on our behalf but without our review or approval.  Then I re-read the
> statement more carefully and landed on:
>
>     5.  It's not at all clear what "accelerating the globalization" means
> here, since the statement offers no context for whatever 'globalization'
> efforts with ICANN and IANA are happening.  Worse, this item is entirely
> political, involving organizations with which the IETF has on-going
> agreements and reliance.  Further, I believe there is no IETF context --
> nevermind consensus -- for the topic.  As far as I know the IETF has no
> basic discomfort with its relationship with IANA, for example.  We might
> individually make guesses about what this item in the Statement means, but
> my point is that a) we shouldn't have to, and b) it has no context within
> the IETF community.  For any of our 'leaders' to make agreements on our
> behalf, about political issues of organizations with which we have formal
> arrangements -- and probably any other organizations -- is significantly
> problematic.
>
>
> for getting IETF rough consensus.  Any constraints on public statements by
> IETF leaders needs to balance against those limits, if we are to allow folk
> to speak publicly at all.
>
> means that anything requiring timely action cannot seek formal consensus.
>  To that end, we need to distinguish between 'review' and 'approval'.  IETF
> community review can be very quick indeed, though probably not less than 24
> hours, if the range of review comments is to be a good sampling of the
> community.  In the current example, community review quickly noted the
> erroneous phrasing that confuses concern about disclosure of an act from
> concern about the act itself.  (I'm working on the assumption that the
> Montevideo group is really more concerned that monitoring was/is taking
> place than that someone made this fact public...)
>
>
> leaders mostly don't lead.  They don't set work agendas. They don't control
> overall budgets.  They don't hire and fire people.  For almost all of the
> formal IETF 'decisions' they participate in, it is with exactly one vote in
> a group, and not more authority than that.  (And by the way, the IESG
> largely does not 'steer' the IETF.  Initiatives for work come from the
> community and very nearly never from ADs or the IESG.)
>
>      7. The released Statement was formulated by the group including two
> IETF 'leaders'.  It was not subject to random formulation by a reporter, or
> the like.  When people holding formal IETF roles participate in the
> formulation of formal Statements, things need to be carefully based on
> actual IETF community views.
>
>
> We need to find some sort of language that gives constructive guidance and
> constraint about public representations of the IETF, by our 'leaders'.  Not
> very long ago, there was a concern raised by Pete Resnick, when an IETF
> working group chair made statements at an ITU gathering and represented
> himself as an IETF wg chair.  We might want to review whatever guidance
> came out of that.
>
> d/
> --
> Dave Crocker

---

From: SM <[email-masked]>
Date: Thu, 10 Oct 2013 13:49:37 -0700

Hi Medel,
At 19:11 09-10-2013, Medel v6 Ramirez wrote:
>Leaders were "processed" thoroughly prior to their appointment so I 
>trust them. And that they hold through the "spirit" of being an IETF 
>and shall be responsible under oath for any impact on the organization.

There was a Recall petition last year (see 
http://www.ietf.org/mail-archive/web/ietf/current/msg75672.html 
).  Note that the IETF "Trustee have a fiduciary duty to protect the 
IETF's property".

What are the implications of:

   "They identified the need for ongoing effort to address Internet Governance
    challenges, and agreed to catalyze community-wide efforts towards the
    evolution of global multistakeholder Internet cooperation."

Should a global body have oversight over the IETF?  Some people are 
arguing for that as part of the future of Internet Cooperation.

Regards,
-sm

---

From: Jari Arkko <[email-masked]>
Date: Fri, 11 Oct 2013 00:32:41 +0300

Dave,

> The fact that you had to reach back 2.5 years, to a frankly rather obscure document that came from the IAB and not the broader IETF, demonstrates my point that we lacked meaningful context 

You asked for context and I provided a context. We can certainly debate how meaningful it is. There are obvious arguments that we can make against its meaningfulness. But I disagree with your characterisation of the most recent RFC (6020) on topic from the organisation that in the IETF ecosystem has IANA oversight in its charter (per RFC 2580, a BCP) as "obscure". In any case I don't want to argue too much, because I _do_ agree with your larger points:

> They don't set work agendas. They don't control overall budgets.  They don't hire and fire people.  For almost all of the formal IETF 'decisions' they participate in, it is with exactly one vote in a group, and not more authority than that.
...
> IETF leaders are best viewed as facilitators, rather than leaders.  They do huge amounts of organizing, coordinating, interfacing, in the classic style of the cliche'd 'shepherding cats'.

Although I would claim that while there is no traditional "leading" at the IETF, I do think that IETF facilitators do occasionally lead in the sense of suggesting paths forward, identifying potential challenges, etc.

And I of course would love to have this:

> We need to find some sort of language that gives constructive guidance and constraint about public representations of the IETF, by our 'leaders'.

Jari

---

From: Carsten Bormann <[email-masked]>
Date: Fri, 11 Oct 2013 11:42:38 +0200

> http://www.internetsociety.org/news/montevideo-statement-future-internet-cooperation

http://www.internetgovernance.org/2013/10/11/the-core-internet-institutions-abandon-the-us-government/?
"The core Internet institutions abandon the US Government | IGP Blog"

I'm not quite sure I read the Montevideo statement the way this headline suggests.
(The US government must feel so abandoned these days...)
But that is the danger of saying anything at all.

Grüße, Carsten

---

From: Jorge Amodio <[email-masked]>
Date: Fri, 11 Oct 2013 06:06:06 -0500

Just few quick questions,

In what part of Fadi Chehadé mandate at ICANN this falls ? And who
sanctified him as representative of the Internet Community ?

He is just an employee of ICANN and these actions go way beyond ICANN's
mission and responsibilities.

Cheers
Jorge

---

From: Suzanne Woolf <[email-masked]>
Date: Thu, 10 Oct 2013 14:56:26 -0400

> well as a remedy if they do.

This seems exactly right to me, with the additional observation that even if we're 
insisting that the leadership get consensus on such issues as the Montevideo 
statement, we're still trusting them to find, frame, and bring us the right issues. 

In other words, it's trust all the way down, and if we don't trust the leadership to 
identify relevant issues and address them sanely, obtaining that all-but-impossible 
consensus is just going to leave us with the same problem that people will want
consensus first on what questions are worth addressing and how the consensus 
is to be expressed.

Among other weaknesses, this doesn't seem to be a way to demonstrate to the
interested participant/observer that we know how to manage the challenges of
scaling things.

Suzanne

---

From: "John Levine" <[email-masked]>
Date: 11 Oct 2013 16:25:03 -0000

>mission and responsibilities.

ICANN has a long running fantasy that they are a global
multi-stakeholder organization floating above mere politics, and not a
US government contractor incorporated as a California non-profit.
This will never change, and everyone familiar with the situation knows
it, but for internal political reasons ICANN likes to pretend
otherwise.

I suppose in the current political situation about the NSA there's no
harm in the other groups going along with it for a while.

R's,
John

---

From: Jorge Amodio <[email-masked]>
Date: Fri, 11 Oct 2013 11:37:19 -0500

Until ICANN becomes a "member" based organization where you have real
constituents that can fire a director, the organization is only
representative of itself and its ecosystem.

-J

---

From: Dave Crocker <[email-masked]>
Date: Sat, 12 Oct 2013 05:47:28 +1300

> US government contractor incorporated as a California non-profit.

What's most interesting about your sentence is that both parts are 
phrased in a manner that mostly misses any of the interesting issues 
about ICANN, and tends to focus the reader on misperceptions and 
irrelevancies.

d/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 11 Oct 2013 13:06:48 -0400

On Fri, Oct 11, 2013 at 12:47 PM, Dave Crocker <[email-masked]> wrote:

> What's most interesting about your sentence is that both parts are phrased
> in a manner that mostly misses any of the interesting issues about ICANN,
> and tends to focus the reader on misperceptions and irrelevancies.

You know there is absolutely nothing in the above that could not be stated
as '-1'.

If you can't give a proof point or an explanation then don't bother to say
it. John made a factual statement that is true in every important respect.
If you disagree with those fact then explain why.

When people try to slap others down in that fashion, I get annoyed.

And I get really annoyed when people talk about important issues that they
don't state. Which suggests that the writer is too important to explain
them to the lesser beings he is talking at.

The view from the establishment is that ICANN is US property and that is
both the US establishment and Russia, China, Brazil and pretty much
everywhere else.

The reason that quite a few folk don't want to move ICANN functions into
the UN instead is that nobody trusts them either. In fact the group that
would be in charge is a bit like the old human rights committee which used
to be populated with representatives of the worst abusers because they were
the ones who cared most.

---

From: Michael Richardson <[email-masked]>
Date: Fri, 11 Oct 2013 22:01:03 -0400

> members of a bridge CA and ICANN is merely the bridge administrator.

It is an interesting way to say it, and put that way, I like it.

One activity that I believe is an NSA attack on good crypto is the whole
Certificate Signing Policy thing.  Nobody has a clue what it means, or how
the computer systems are supposed to interpret it anyway, but it scares the
lawyers, and so they would rather having nothing.

However, it the root of the trust in country X is the government of country
X, then government can essentially internalize/nationalize all the liability
associated with trusting them.  It would be much like governments do with
nuclear power: it only works out because the governments provide the
insurance in the form of legislation...

    mcr>     Better they do this using good crypto, than that they do this by
    mcr> trying to subvert the (US-controlled) crypto.

    > Its not all US controlled, you can use GOST...

That's not what I meant.

I didn't mean that the algorithms will be subverted, I meant that the trust
paths will be subverted.

Whether this is by legislating filters against DNS(sec) that ISPs have to
implement, or having an official mitm SSL cert that all desktops must trust,
or just blocking port-443.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Jari Arkko <[email-masked]>
Date: Sat, 12 Oct 2013 09:31:55 +0300

It was pointed out that I got the RFC numbers wrong. Sorry. I should have RFC 6220 (role of IETF protocol parameters operators) and RFC 2850 (IAB charter).

Jari

---

From: John C Klensin <[email-masked]>
Date: Tue, 15 Oct 2013 05:20:12 -0400

--On Friday, October 11, 2013 22:01 -0400 Michael Richardson
<[email-masked]> wrote:

>     > I think that is a better approach actually. The CC TLDs
> are in effect     > members of a bridge CA and ICANN is merely
> the bridge administrator.
> 
> However, it the root of the trust in country X is the
> government of country X, then government can essentially
> internalize/nationalize all the liability associated with
> trusting them.  It would be much like governments do with
> nuclear power: it only works out because the governments
> provide the insurance in the form of legislation...

Without taking a position on the idea, one observation about
possible unintended side effects:

The ccTLD system grew up at a time when many governments were
fairly hostile to the Internet and/or the DNS (that is different
from being hostile to, e.g., free and private flow of
information over the Internet).  The ccTLD environment still
supports ccTLD administrations that are independent of the local
government unless that government is so hostile to them that it
is willing to use national law to force them out.  One
consequence of that model is that, for the ccTLD system to
function, neither IANA nor anyone else needs to figure out who
is the actual, legitimate, government of a country.  Governments
have a tendency to be quite jealous of their rights to
"recognize" other governments (or not).  Keeping IANA out of
that business was an explicit goal at the time RFC 1591 was
written, for multiple reasons.

If the government of a country is the required root of trust in
that country's ccTLD, we take ourselves several steps closer to
requiring that governments approve ccTLD administrations (not
merely not being actively opposed to them).  We create an attack
vector from the government on the ccTLD and registrations in it.
Unlike shutting down a ccTLD administration by offering to throw
its membership in jail, the control and mechanisms that implies
may not require whatever passes for due process in that country.
And such trust authority can provide a vector for required
government approval of individual registrations and registrants,
just as the US Government has turned a general IANA oversight
requirement into case-by-case approval of root entries.

Be careful what you wish for.
    best,
      john

---

From: Randy Bush <[email-masked]>
Date: Tue, 15 Oct 2013 14:20:24 +0300

> Be careful what you wish for.

+1

---

From: Warren Kumari <[email-masked]>
Date: Tue, 15 Oct 2013 15:19:43 +0300

>> Be careful what you wish for.

Dislike doing this, but:
+1

W

-- 
American Non-Sequitur Society; 
we don't make sense, but we do like pizza!

---

From: Jorge Amodio <[email-masked]>
Date: Tue, 15 Oct 2013 07:53:13 -0500

+2

-J

---

From: [email-masked]
Date: Tue, 15 Oct 2013 16:13:40 +0000 (UTC)

When did we change the list from IETF Discuss to IETF Disgust?
Classic, BTW.  Kudos.