Subject: IETF subpoena processes update and a request

From: IETF Chair <[email-masked]>
Date: Thu, 23 Mar 2017 23:06:41 -0700

Occasionally the IETF is served with a subpoena, typically to assist
finding prior art, documents and list discussions, in an effort to 
resolve patent disputes. We encourage everyone to just use our 
publicly available resources instead of formal requests, but we 
do get a few subpoenas every year. The IETF charges a fee 
for the service. The IETF makes these civil subpoenas and 
the primary response public at [1].

The IAOC Legal Committee has identified two issues with the 
existing procedures [2]. First off, practices have evolved somewhat
since the procedures were last updated in 2007, and are out of 
date. For instance, the subpoenas are today handled by IETF Legal
Counsel, the Legal Committee Chair, the IAD and record custodians
such as the Secretariat and the RFC Publisher. Others, such as the
IETF Chair are not usually involved, despite what the existing 
procedures say.

Secondly, due to a recent request that we received, we now
realize that the existing procedures for the publication of 
subpoenas do not address situations where we might be 
ordered or requested by law enforcement authorities to not 
post the subpoena and response. These may include cases
where a subpoena identifies a person or a company. These
are criminal rather than civil cases. We do not think it is 
necessarily obvious what we should do here. For instance, 
it might not be the right thing from the privacy point to 
post details of requests that identify a person. There are
more cases, and some tradeoffs to consider.

Large Internet companies that hold user data have developed
policies to deal with some of these issues. The IETF’s situation
is of course somewhat different. For instance, most data that
the IETF has is publicly visible anyway. There’s some additional
data of course, and even for the public data our ability to vouch
for the authenticity of, e.g., an Internet-Draft from a given year
can be important. And of course, unlike the large Internet
companies, our legal department consists of much smaller
force, at least in terms of number of people :-)

The IAOC legal committee believes that we need two things.
First, we need an update of the procedures in general, which
is largely an internal organisational matter. Secondly, we need
to develop a policy to answer the cases where confidentiality
is either requested by law enforcement authorities or is 
otherwise the right thing. This is a policy question which we
believe is best answered through community opinion, and
obviously also careful legal review.

The plan is for the Legal committee to do two things this
spring. First develop and post the general update, which we
post to the community for information and feedback. Second,
develop an initial approach regarding an answer to the policy
question and post it to the community for discussion. Please
participate in that discussion — we’ll send details about where
and how when we post the initial proposal. Once the community
discussion comes to a conclusion, we will adopt the policy as
defined by the community and the legal situation. If anyone
has input on this topic, let us know. It is also fine to send
suggestions before the proposal is posted.

Jari Arkko, IETF Chair

[1] https://iaoc.ietf.org/subpoenas.html
[2] https://iaoc.ietf.org/subpoena-procedures.html

---

From: Angela <[email-masked]>
Date: Fri, 24 Mar 2017 07:24:15 +0100

I've forwarded this to SBWASP, OC OWASP, & LA OWASP & my patent attorney as well :)

Sent: Thursday, March 23, 2017 at 11:06 PM

From: "IETF Chair" <[email-masked]>

To: "IETF Announcement List" <[email-masked]>

Cc: [email-masked]

Subject: IETF subpoena processes update and a request

procedures say.

Jari Arkko, IETF Chair

---

From: Randy Bush <[email-masked]>
Date: Fri, 24 Mar 2017 08:25:55 -0500

in what legal juristiction is the ietf?  in what juristiction is the
subpoena served?  how does an american (for example) gag order apply to
a nebulous entity such as the ietf?

can we move to iceland?

randy

---

From: Scott Bradner <[email-masked]>
Date: Fri, 24 Mar 2017 09:30:08 -0400

all good questions - any suggested answers?

Scott

> On Mar 24, 2017, at 9:25 AM, Randy Bush <[email-masked]> wrote:
>

---

From: Michael Cameron <[email-masked]>
Date: Fri, 24 Mar 2017 13:35:35 +0000

Isn't the IETF part of the ISOC?

https://tools.ietf.org/html/rfc2134

The address, including street and number, of the initial registered office of the corporation is c/o C T Corporation System, 1030 15th Street, N.W., Washington, D.C. 20005, and the name of its initial registered agent at such address is C T Corporation System.

-----Original Message-----
From: ietf [mailto:[email-masked]] On Behalf Of Scott Bradner
Sent: Friday, March 24, 2017 8:30 AM
To: Randy Bush <[email-masked]>
Cc: IETF Chair <[email-masked]>; IETF Rinse Repeat <[email-masked]>
Subject: Re: IETF subpoena processes update and a request

Scott

> subpoena served?  how does an american (for example) gag order apply 
> to a nebulous entity such as the ietf?
> 
> can we move to iceland?
> 
> randy
>

---

From: Scott Bradner <[email-masked]>
Date: Fri, 24 Mar 2017 09:38:52 -0400

from the IETF home page

The Internet Engineering Task Force (IETF) is an organized activity of the Internet Society (ISOC).

(see also RFC 2028)

i.e., the IETF is not a legal entity itself but the ISOC has been the legal contact point 

Scott

> On Mar 24, 2017, at 9:35 AM, Michael Cameron <[email-masked]> wrote:
>

---

From: Michael Cameron <[email-masked]>
Date: Fri, 24 Mar 2017 13:41:10 +0000

Confirmed that you serve the IETF with a subpoena by serving ISOC.

-----Original Message-----
From: Scott Bradner [mailto:[email-masked]] 
Sent: Friday, March 24, 2017 8:39 AM
To: Michael Cameron <[email-masked]>
Cc: Randy Bush <[email-masked]>; IETF Chair <[email-masked]>; IETF Rinse Repeat <[email-masked]>
Subject: Re: IETF subpoena processes update and a request

from the IETF home page

(see also RFC 2028)

Scott

---

From: Randy Bush <[email-masked]>
Date: Fri, 24 Mar 2017 08:49:12 -0500

> all good questions - any suggested answers?

IANAL, IANAL, IANAL, IANAL, IANAL, IANAL, IANAL, IANAL, IANAL, IANAL

the ietf does not exist, but has a service address in the states.  the
latter could easily be changed, e.g. to genevé.

"is an organized activity of" seems vague and could be interpreted as
the ietf is, for legal purposes, subsumed by isoc.  this was likely not
an accident.

i assume the subpoena with the gag order was in the states, and the
server wore a brown shirt.

it would be cost effective not to have to get a us court decision
whether or not the subpoena/gag applied to the ietf.

>> can we move to iceland?

it is not an accident that cryptech's servers are in iceland and admin
in københavn.

i would be asking george if he minded if the eff was consulted; though
they are likely already a bit overwhelmed with brown shirts.

randy

---

From: Scott Bradner <[email-masked]>
Date: Fri, 24 Mar 2017 09:55:21 -0400

I expect that the IAOC legal committee will post the initial approach and discussion request that Jari mentioned early next 
week (well before the plenary :-) )

Scott

---

From: John C Klensin <[email-masked]>
Date: Fri, 24 Mar 2017 12:27:15 -0400

--On Friday, March 24, 2017 08:49 -0500 Randy Bush
<[email-masked]> wrote:

>>> in what legal juristiction is the ietf?  in what
>>> juristiction is the subpoena served?  how does an american
>>> (for example) gag order apply to a nebulous entity such as
>>> the ietf?
>> 
> the ietf does not exist, but has a service address in the
> states.  the latter could easily be changed, e.g. to genevé.
> 
> "is an organized activity of" seems vague and could be
> interpreted as the ietf is, for legal purposes, subsumed by
> isoc.  this was likely not an accident.
> 
> i assume the subpoena with the gag order was in the states,
> and the server wore a brown shirt.
>...

Randy,

IANAL either, but it seems to me that Jari's note suggests a
more basic question that is almost independent of jurisdictional
issues.  Suppose the IETF (or whomever) receives a subpoena that
names individuals or companies in a way that might be
unfortunate, contain implicit accusations that might be
completely unfounded,  or even, in the opinion of those parties
if they knew, were libelous, and suppose it directs IETF to not
disclose the subpoena in any way.  Without offering anything
resembling a legal opinion, it probably makes a difference
whether the subpoena is associated with a law enforcement action
rather than the civil actions for which I think the policies
were designed.

Whether we are in a position to ignore or fight the subpoena or
not and independent of what we think about the alleged law
enforcement entities involved (including their choice of shirt
covers), it seems to me that a policy of posting subpoenas
raises several issues (with Jari's note explicitly identifying
the first).   "Lawyer" in parentheses identifies a question that
I think we need advice about if I'm not the only one who thinks
it is relevant but that would probably not be profitable to
debate on this list, at least before we have that advice.

I believe that many of the issues below would apply also to a
subpoena in a law enforcement action directed against an
individual or company (rather than, e.g., asking for
authenticated documents) even if it contained no demand for
confidentiality (again, IANAL).

(1) If the subpoena names an individual or company, is it
consistent with our privacy policies to disclose those names?

(2) If we think the answer is to avoid disclosing names by
posting the subpoena in redacted form (e.g., to eliminate
names), does the community want the IETF Trustees (or a
committee appointed by them and with membership and parties
consulted sometimes being less than transparent) to go into the
redaction business?  Does it make a difference if any
attorney-client confidentiality provisions apply only to ISOC or
the IAOC/IETF Trustees and not the community?  Would that
constitute a different sort of privacy or transparency problem
by encouraging members of the community to keep secrets from
each other?

(3) (Lawyer) If the subpoena's content, or even the fact that it
has been issued and served, implies things that the named person
or company would consider libelous if disclosed, does the IETF
become a party to the libel by making the subpoena public
(whether or not told to not do that)?

(4) (Lawyer)  I believe, but people with applicable professional
legal credentials and experience should confirm, that, if we
want to base the answers to any of these questions (including
whether the subpoena should be resisted if that is a
possibility) on knowing what sort of action is involved, based
on what laws, etc., we should get over it because a subpoena may
not disclose that information. 

(5) (Lawyer) I understand that it is generally harder to serve
civil subpoenas across international boundaries than criminal
(or other law enforcement-initiated ones although there are
variations even within those categories.  If a criminal (or
other law enforcement) action is involved, how much protection
would "move to Iceland / Geneva/ somewhere else" provide.   Of
course, most, if not all, of those places have their own legal
systems and processes and moving there (if even if were
possible) might provide more protection from the processes of
the US but obviously less from those of the new host country.

(6) (Lawyer) Assuming the IETF (or IETF Trust) were to establish
some sort of locus/ HQ in Iceland / Geneva/ Lower Slobbovia and
claim that subpoenas need to be served there, would that provide
any significant protection, especially from subpoenas initiated
by law enforcement, or would they just treat whatever we would
say about where to serve the subpoenas and instead seek out ISOC
or AMS offices or particular named individuals in a convenient
country, serve them, and make the international issues their
problem.  I note in that regard that, while Finland may be a
good place to live, the ISOC Chair, AMS officers and HQ, and
incoming IETF Chair are all based in the US.

I have no reason to believe that those are all of the questions
that should be asked, but they are a start.

   john

---

From: "Scott O. Bradner" <[email-masked]>
Date: Fri, 24 Mar 2017 12:32:57 -0400

> On Mar 24, 2017, at 12:27 PM, John C Klensin <[email-masked]> wrote:
> 

I know of no case of a civil subpoena that included a gag order

& yes, the procedures were deigned for civil cases (like patent prior art)

Scott

---

From: Pete Resnick <[email-masked]>
Date: Fri, 24 Mar 2017 11:47:13 -0500

To deal with the second issue, it seems to me that we should address the 
first issue by making it crystal clear in the procedures that the 
subpoena must go to the entire IESG, not just the chair, and that 
whatever action is taken on the subpoena be approved by the IESG (with 
advice of counsel). If the entire IESG gets a copy of the subpoena, and  
our procedures make it clear to any court or other issuing authority 
that more than one person outside of their jurisdiction will be seeing 
the subpoena, perhaps that will mitigate the second issue.

If the current de-facto procedure has removed IETF leadership from the 
process, it is a problem that should be fixed not by changing the 
documented procedures, but by returning to them. It may be that most of 
the time IETF leadership ends up simply nodding at counsel, the IAOC, 
the IAD, etc., but they should absolutely be included.

Like others, I wonder about the prudence of naming ISOC (and certainly 
ISOC in the US) as the recipient for legal service. I'd like to hear 
from lawyers about other possibilities.

pr

---

From: Jari Arkko <[email-masked]>
Date: Fri, 24 Mar 2017 12:52:57 -0500

Thanks John, this was useful.

Jari

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 25 Mar 2017 07:14:14 +1300

> I know of no case of a civil subpoena that included a gag order

IANAL but there are those "superinjunctions" that sometimes allegedly
occur in English civil libel cases where even the existence of the
superinjunction is secret, under penalty of contempt of court. And
many countries do not have a generic right of free speech.

So, never say never :-(.

   Brian

---

From: Michael Richardson <[email-masked]>
Date: Fri, 24 Mar 2017 15:15:18 -0400

Pete Resnick <[email-masked]> wrote:
    > To deal with the second issue, it seems to me that we should address
    > the first issue by making it crystal clear in the procedures that the

Is your goal here to dissuade them from placing gag orders on the subpeona,
or is it to make it clear that their subpoena should omit unnecessary
identifying information, as we will post it publically.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: "John Levine" <[email-masked]>
Date: 24 Mar 2017 19:39:51 -0000

>from lawyers about other possibilities.

It's been like this for well over a decade. Remember that a major
reason to set up ISOC was to have an organizational home for the IETF.
For reasons I can explain if anyone cares, there is no way that ISOC
could move out of the US.

>advice of counsel).

Nearly all of the subpoenas that the IETF gets are stupendously boring
and routine, and I think this would be a poor addition to the IESG's
crowded schedule.  They typically ask for a certified copy of RFCs or
I-Ds, or for the date when various documents were published.  Read
them and snooze here:

https://iaoc.ietf.org/subpoenas.html

I know none of the details of the subpoena that led to this discussion
but I would be pretty surprised if weren't along the lines of asking
for documentation that a certain person was present at meeting
sessions, in the form of blue sheets or meeting recordings.  That
still doesn't sound like something the IESG needs to deal with.

As Klensin noted, just because someone is named does not mean that he
or she is a suspect in a case, and there's no compelling reason for
the IESG to know who it is.

R's,
John

---

From: Pete Resnick <[email-masked]>
Date: Fri, 24 Mar 2017 14:40:21 -0500

> identifying information, as we will post it publically.

Certainly I hope to dissuade gag orders, and certainly I want to make it 
clear that they should omit unnecessary identifying information, but 
note that I did not say that "we will post it publicly". We may, or we 
may not, post it publicly (cf. JCK's message), but either way I'd like 
it to be crystal clear that at least some persons over whom the issuer 
has no jurisdictional control (e.g., because the court is outside of the 
US and members of the IESG are US citizens, or vice versa) will be 
getting copies of the subpoena. So, gag orders will at best be advisory 
and it would be wise to omit unnecessary identifying information.

(My un-legally-educated guess here is that publicly posting something 
that is subject to a gag order, even by someone not normally subject to 
a particular jurisdiction, is a bit of a game of legal "chicken", since 
that person might want to enter that jurisdiction some day. But this is 
where I'd like like to leave it to our leadership to take advice of 
counsel and make their best judgment about what is right for the 
community. What I don't want is to have procedures that make it easy for 
any particular jurisdiction to dictate terms to us.)

pr
-- 
Pete Resnick <http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: Nico Williams <[email-masked]>
Date: Fri, 24 Mar 2017 14:45:29 -0500

> identifying information, as we will post it publically.

The latter is certainly not going to work out where the identifying
information is necessary to fulfilling the subpoena.  Intent to publish
might disuade civil parties from pressing subpoenas, but not law
enforcement agencies.

The former is unlikely to succeed as to LEAs.  I cannot imagine a
private organization by-law that could disuade a LEA from pressing a
subpoena on that party when that LEA has access to friendly courts (they
always do).

I agree that the IESG should get a copy as a matter of course, but as
the legal entity to which the subpoenas are and will be served to is
ISOC, the IESG and IETF may not get much say as to that.  It's hardly as
though ISOC might risk incurring criminal liability in order to abide by
our rules.  On the other hand, ISOC might be more inclined to fight a
gag order that requires it not inform even the IESG, than to fight a gag
order that allows it to inform the IESG.

In any case, I'm surprised to see nothing about a warrant canary yet in
this thread.  (Though even those might not work legally in some
jurisdictions.  ISOC is vulnerable to rubber hoses.)

Lastly, I agree that where it is clear that a subpoena relates to a
criminal investigation, as opposed to a civil matter, the subpoena
should not be published as-is, at least not without the approval of the
targets named in it or extraordinary action by ISOC/IESG where they
think the public's interest is much stronger than the targets'.  Any
redaction by the ISOC/IESG in such cases would presumably be at the
request of the targets, thus the targets might be the ones proposing
redactions (which, ISOC/IESG might reject).  I suppose the relevant
distinguishing characteristic is: who pressed the subpoena, an LEA or a
non-LEA.

Nico
--

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 25 Mar 2017 10:22:33 +1300

On 25/03/2017 08:39, John Levine wrote:
...
> crowded schedule.  

+1. This would be a pointless and annoying addition to the IESG's already
high workload. I am quite certain that IASA will bring them in if a
case arises that they need to be involved in. But indeed, ISOC was
partly created, and IASA was 100% created, to save the IETF leadership
from as much legal, financial and admin stuff as possible.

Setting subpoena policy is a fine topic for community discussion. Beyond
that, the engineers of the IETF should not be involved unless absolutely
unavoidable.

   Brian

---

From: Pete Resnick <[email-masked]>
Date: Fri, 24 Mar 2017 16:31:56 -0500

> reason to set up ISOC was to have an organizational home for the IETF.

I will say, as someone who was on the IAB when BCP 101 was written, that 
I favored a tight financial coupling and a more minimal organizational 
coupling. There are times when being somewhat separate is a good thing.

> could move out of the US.

As luck would have it, I never suggested that.

> and routine, and I think this would be a poor addition to the IESG's

And hence my earlier comment that I expect that "most of the time IETF 
leadership ends up simply nodding at counsel, the IAOC, the IAD, etc.". 
I am someone that has believed for quite some time that the IAB and IETF 
chairs themselves really do not need to be members of the IAOC, as I 
think it's a waste of resources, and BCP 101 should be updated to allow 
for at least delegates. And I equally expect that most members of the 
IESG will summarily ignore most subpoenas that fly by. But having them 
made available is not a burden, and even having a pro-forma agenda item 
on the IESG's agenda where Amy can say, "Any questions or discussions of 
the subpoenas? [5 second pause] Next on the agenda..." is really not a 
significant burden. Most of the time, the agenda item will be 
exceedingly boring...until it's not. I can certainly imagine the kind of 
case where the cursory read of a subpoena causes an AD to say, "Whoa! 
Someone needs to go to court to get that quashed!"

> ...there's no compelling reason for

Whenever someone says, "there's no need for you to know this 
information", when not preceded by a long explanation of an additional 
harm one is incurring by simply knowing the piece of information, 
particularly when "you" is the leadership of an organization, it sends 
up a giant red flag for me. The leadership should have available every 
piece of information available to them, and they can choose whether or 
not they need to examine it or act on it. But to withhold information 
without compelling reason is deeply problematic. Unless you spend your 
time in a SCIF, the burden is to show why someone should not have 
information available to them, not the other way around.

pr

---

From: Dave Crocker <[email-masked]>
Date: Fri, 24 Mar 2017 16:47:25 -0500

On 3/24/2017 4:31 PM, Pete Resnick wrote:
> think it's a waste of resources,

The primary argument in favor of their ex-oficio membership is breadth 
of view -- they have a degree of involvement in IETF-related activity 
that no one else does, thus permitting a currency in assessment that 
others cannot reliably provide.

 From my time on the IAOC, I have to admit to seeing some legitimacy in 
this view.  Not enough to think they need to be voting members -- I'd 
like to see the voting membership expanded, per the IASA 2.0 discussions 
now underway.  But enough to justify their ex-oficio participation.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Joe Touch <[email-masked]>
Date: Fri, 24 Mar 2017 15:25:08 -0700

On 3/24/2017 9:27 AM, John C Klensin wrote:
> Suppose the IETF (or whomever) receives a subpoena that
This seems like it also raises the EU's "right to be forgotten"
principle, which would affect whether the ISOC can archive even notices
that were originally public.

Sort of running a boat, blimp, or satellite in "international waters",
it seems like these are complications to operating *anywhere*.

Joe

---

From: Michael Richardson <[email-masked]>
Date: Fri, 24 Mar 2017 19:12:57 -0400

Pete Resnick <[email-masked]> wrote:
    > Certainly I hope to dissuade gag orders, and certainly I want to make
    > it clear that they should omit unnecessary identifying information, but
    > has no jurisdictional control (e.g., because the court is outside of
    > the US and members of the IESG are US citizens, or vice versa) will be

Well... we will distribute it outside of the court's jurisdiction, using
unencrypted email (where it might be subject to access to information
process...), and then discuss it at an IETF telechat where anyone may dial
in.  This is what I meant... we aren't going to try to keep it very secret.

---

From: "John R Levine" <[email-masked]>
Date: 24 Mar 2017 20:50:04 -0400

> leadership ends up simply nodding at counsel, the IAOC, the IAD, etc.". ...

You've been on the IESG and I haven't, but I'm still scratching my head 
about why this process needs to change to give the IESG even a little more 
work after it's been working OK for over a decade.

>> ...there's no compelling reason for the IESG to know who it is.
>
> Whenever someone says, "there's no need for you to know this information", 
> when not preceded by a long explanation of an additional harm one is 
> incurring by simply knowing the piece of information, particularly when "you" 
> is the leadership of an organization, it sends up a giant red flag for me.

See Klensin's previous message.  The chance of reputation damage to 
someone named in a subpoena is significant, and the IESG has no legal 
expertise.

Here's a scenario: ISOC gets a subpoena from the L.A. county attorney, in 
connection with an investigation of abuse of a minor, send them what you 
have that shows whether Bob and Pete were in the foo session on March 25, 
2015.  Fine says the IESG, send them the blue sheets and the recording. 
The backstory is that Bob is in a messy divorce with accusations going 
back and forth, and he told the cops that he couldn't have done it because 
he was in Texas at the IETF, in fact he was in a session where Pete was 
presenting and they had a long argument at the mike which Pete will surely 
recall, but of course that's not in the subpoena.  So the cops sent the 
subpoena to see if the story holds up.

An IESG member, who was selected for his expertise in crypto algorithms, 
not criminal law, mentions in the bar late some evening, wow, there's 
something going on in L.A. about Bob and Pete and child abuse, and word 
gets around, with bad effects on Pete's career.  The timing makes it clear 
that the leak was from the IETF, the guilty party doesn't confess (he 
doesn't remember talking about it) so ISOC is hauled in front of a judge 
who asks why we show criminal subpoenas to a bunch of nerds with no legal 
experience rather than having our lawyer handle it like everyone else 
does.

Maybe that wouldn't happen, but the more people who know about something, 
the more likely it is to leak with bad results.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 25 Mar 2017 01:18:25 -0000

>that were originally public.

Only if ISOC were subject to EU law.  Since ISOC has no physical
presence in the EU and the IETF has no office anywhere, I don't see
why EU law would apply.

R's,
John

---

From: Pete Resnick <[email-masked]>
Date: Fri, 24 Mar 2017 21:04:06 -0500

On 24 Mar 2017, at 19:50, John R Levine wrote:

> You've been on the IESG and I haven't, but I'm still scratching my 
> head about why this process needs to change to give the IESG even a 
> little more work after it's been working OK for over a decade.

First of all, this whole discussion started because of something that is 
not working (or at least wasn't anticipated and there are concerns 
about): Dealing with gag orders and the like. My contention was (is) 
that in addressing that, it would help to be absolutely clear in our 
procedure documents that IETF leadership, who will inevitably consist of 
people from different nations under different laws, will have full 
access to any subpoena, in the way that the officers of any organization 
would have access to any legal documents.

Second, I would be perfectly OK (and would not at all be surprised) if 
the IESG were to say to legal counsel, for example, "While you should 
supply the IESG with all subpoenas through our normal procedure, any 
subpoena that simply asks for certified blue sheets you should simply 
satisfy such a subpoena, since blue sheets are public information 
anyway." The addition of any "process" is only to ensure that subpoenas 
are visible to leadership, not because any particular kind of subpoena 
needs review.

>> information", when not preceded by a long explanation of an 
>> additional harm one is incurring by simply knowing the piece of 
>> information, particularly when "you" is the leadership of an 
>> organization, it sends up a giant red flag for me.
>

The IESG has legal expertise in the form of a legal advisor, the same 
way the Board of Directors of any corporation does, and the same way I 
do with my personal attorney. And it would behoove any and all of us to 
follow that legal advice and make ourselves aware of what should and 
should not be publicized. And an AD who goes blabbing about the contents 
of any legal document without talking to counsel is not suited to be an 
AD.

> ...judge who asks why we show criminal subpoenas to a bunch of nerds 
> with no legal experience rather than having our lawyer handle it like
> everyone else does.

That's insulting of the intelligence and integrity of the IESG, and I 
think it's the height of hubris on your part. Any judge who asks why 
criminal subpoenas are shown to a "bunch of idiots" on the Board of 
Directors of a corporation who have "no legal experience" should be told 
to piss off; they are the people responsible for the corporation, and 
they can look at any legal document served on the company, and they have 
the eventual responsibility for any information that goes out the door.  
I can tell you that the day my attorney supplies my documents in 
response to a subpoena without asking me, or without having prior 
instructions on particular documents that they can supply, and says 
anything close to, "You don't need to know what's in the subpoena", is 
the day my attorney gets fired.

And please, do consider the case where the subpoena is from an authority 
in <<insert country that you're not impressed with>> and the subpoena is 
for all of the server logs in order to discover whether John, a citizen 
of said country, has been reading messages from a particular WG that 
said the authorities in this country deem to be talking about tools of 
sedition like encryption. I'd like to think that our leadership might 
weigh in on such a request.

Again, I am fine if the IESG wants to delegate the authority to answer 
certain (or even most) subpoenas. But I want our procedures to be clear 
that they can look at them and everyone to be on notice about what that 
implies. What I absolutely do not want is a contractor or advisor who is 
not answerable to the community having the power to withhold information 
from our chosen leadership.

pr

---

From: Joe Touch <[email-masked]>
Date: Fri, 24 Mar 2017 20:09:23 -0700

> On Mar 24, 2017, at 6:18 PM, John Levine <[email-masked]> wrote:
> 

I was wondering more if it would matter if the subpoena were issued by the EU or referred to a party who were an EU citizen. 

Joe

---

From: Jari Arkko <[email-masked]>
Date: Sat, 25 Mar 2017 12:23:00 -0500

John, Pete,

I think you’re diving deep into the details of one particular aspect
of this problem. That’s fine, but I wanted to point out that the overall
issues are broader. Even on the aspect of creating pushback for
authorities generating unnecessary subpoenas, there are multiple
approaches, document distribution within the leadership is just one
way.

And then there are other issues, worrying about the privacy
of the people mentioned in any subpoena, re-examining if we
could tune what information we retain at the IETF, rewriting the
algorithm on what our staff should do automatically and when
they need to alert the leadership, looking at what other organisations
have done in these kinds of situations, and so on.

FWIW, I think we at the legal committee and leadership want to be on
listening and learning mode about this issue for a while before
jumping into specific ways to address the issues. Keep those thoughts
coming!

Jari

---

From: Pete Resnick <[email-masked]>
Date: Sat, 25 Mar 2017 15:42:28 -0500

Thanks Jari. I was absolutely contributing to missing the forest for the 
trees. Sorry for that. My apparent vehemence notwithstanding, it's not 
the particular mechanism I care about; it's that we end up with a 
structure where the IETF maintains control over its own affairs, and 
decides for itself what is (or is not) important to it. You are exactly 
right that we need to figure out what's important first, and figure out 
mechanism to make that happen second.

Discussions of what lawyers should or should not do will be taken to the 
pub.

pr

---

From: John C Klensin <[email-masked]>
Date: Sun, 26 Mar 2017 05:11:50 -0400

--On Saturday, 25 March, 2017 15:42 -0500 Pete Resnick
<[email-masked]> wrote:

> Thanks Jari. I was absolutely contributing to missing the
> forest for the trees. Sorry for that. My apparent vehemence
> notwithstanding, it's not the particular mechanism I care
> about; it's that we end up with a structure where the IETF
> maintains control over its own affairs, and decides for itself
> what is (or is not) important to it. You are exactly right
> that we need to figure out what's important first, and figure
> out mechanism to make that happen second.

Pete,
One quick observation.  While this certainly won't be applicable
to all situations, responding to a judge who has said, or
authorized someone to say "do X" by "well, our rules or bylaws
don't allow us to do X so we are either going to just interpret
your order as 'do Y' or we will do nothing until you tell us to
do Y" is not likely to have an attractive outcome.   Of course,
"unattractive" doesn't necessarily mean "undesirable" -- that
depends on what one is trying to accomplish.  It seems to me
that some of what you have suggested is quite analogous to civil
disobedience -- entirely justified and appropriate if one feels
strongly enough about an issue to make that type of public
statement, but something that one should do only if one is
willing to accept the possibility of hostile attacks and/or jail
time.  As you know, those are not just metaphors.

    john