Subject: IETF LLC & IETF Participation from USA-sanctioned countries

From: Fernando Gont <[email-masked]>
Date: Wed, 3 Mar 2021 18:32:22 -0300

Folks,

While studying the topic of diversity and inclusiveness in the IETF, the 
question arouse about what are the implications of the IETF LLC being 
registered in the USA.

In particular, I'm concerned about the possible implications for 
participants from USA-sanctioned countries or organizations.

I asked a few people here and there, and was referred to this document: 
https://www.ietf.org/media/documents/IETF_LLC_OFAC_Compliance_Policy_2020-10-06.pdf

That document contains text such as:

---- cut here ----
Meeting Registrations
The current automated meeting registration system can continue, but at 
regular intervals, and no later than 30 days before the meeting begins, 
the list of registered participants and financial institutions 
associated with payment of registration fees must be checked (both for 
individual names and country of domicile and residence).
---- cut here ----

and

---- cut here ----
Action
The IETF Executive Director will work with IETF LLC counsel to determine 
what action to take in each individual case. This may include not 
pursuing the contractual relationship, revoking the meeting 
registration, cancelling any existing contract or other action.
---- cut here ----

I'm certainly not a lawyer, and hence I'd like an authoritative and 
clear explanation about what are the possible outcomes of this "OFAC 
Compliance Policy".

For example, could it result in participants from Cuba, Iran, Myanmar, 
North Korea, Sudan or Syria being rejected their registration, and hence 
being prevented to participate in IETF meetings?

If that were the case, I'm sure that we'd all agree that that would be 
inappropriate, discriminatory, oppressive, and ultimately unacceptable. 
I hope that that's not even a possibility.

Could anyone please clarify this?

P.S.: Besides sanctions on countries such as the above, there also seems 
to be a whole list of people and organizations that are 
sanctioned/banned: 
https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Keith Moore <[email-masked]>
Date: Wed, 3 Mar 2021 16:43:59 -0500

In addition to the clarification that Fernando asked for, I guess I'd 
like to know (vaguely) whether this has been a problem in the past, 
maybe how many people have been turned away.

I'm guessing that there are other barriers in a similar category: do we 
have any  idea how many people haven't been able to attend meetings in 
person because of visa issues?

And perhaps also: do we have any idea how many people have been unable 
to participate remotely due to internet censorship in the countries 
where they were located?

(note: we don't need to try to address these problems at the moment, 
just trying to make the list of issues that limit participation 
reasonably complete.)

On 3/3/21 4:32 PM, Fernando Gont wrote:
> Folks,
>
> While studying the topic of diversity and inclusiveness in the IETF, 
> the question arouse about what are the implications of the IETF LLC 
> being registered in the USA.
>
> regular intervals, and no later than 30 days before the meeting 
> begins, the list of registered participants and financial institutions 
> The IETF Executive Director will work with IETF LLC counsel to 
> determine what action to take in each individual case. This may 
> include not pursuing the contractual relationship, revoking the 
> meeting registration, cancelling any existing contract or other action.
> ---- cut here ----
>
>
> North Korea, Sudan or Syria being rejected their registration, and 
> hence being prevented to participate in IETF meetings?
>
> inappropriate, discriminatory, oppressive, and ultimately 
> unacceptable. I hope that that's not even a possibility.
>
> P.S.: Besides sanctions on countries such as the above, there also 
> seems to be a whole list of people and organizations that are 
> sanctioned/banned:

---

From: Bill Woodcock <[email-masked]>
Date: Wed, 3 Mar 2021 22:47:17 +0100

> On Mar 3, 2021, at 10:43 PM, Keith Moore <[email-masked]> wrote:
> 
> In addition to the clarification that Fernando asked for, I guess I'd like to know (vaguely) whether this has been a problem in the past, maybe how many people have been turned away.
> 
> I'm guessing that there are other barriers in a similar category: do we have any  idea how many people haven't been able to attend meetings in person because of visa issues?

Anecdotally, my understanding is that getting US (and sometimes Schengen and other country) visas has been a much larger problem than the sanctions problem.

PCH has staff globally, and we’ve had our staff refused visas for conference participation with some regularity.

                                -Bill

---

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 3 Mar 2021 22:10:37 +0000

The best list for this is [email-masked]. I will reply shortly with a response to you and that list.

Thanks
Jason

On 3/3/21, 4:33 PM, "ietf on behalf of Fernando Gont" <[email-masked] on behalf of [email-masked]> wrote:

    Folks,

    I asked a few people here and there, and was referred to this document:
    https://urldefense.com/v3/__https://www.ietf.org/media/documents/IETF_LLC_OFAC_Compliance_Policy_2020-10-06.pdf__;!!CQl3mcHX2A!VSkOxyiXxuuG1uPa9USj7e3GAT2nL-D9ZpLeurEvTJzkrOjCTDqdumyOzkuZ_YU7lLlIhw$

    ---- cut here ----
    Meeting Registrations
    ---- cut here ----

    and

    ---- cut here ----
    Action
    ---- cut here ----

    P.S.: Besides sanctions on countries such as the above, there also seems
    to be a whole list of people and organizations that are
    sanctioned/banned:
    https://urldefense.com/v3/__https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists__;!!CQl3mcHX2A!VSkOxyiXxuuG1uPa9USj7e3GAT2nL-D9ZpLeurEvTJzkrOjCTDqdumyOzkuZ_YW28A79Fg$

    Thanks,

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 3 Mar 2021 17:14:33 -0500

Hi,

ObDisclaimer: I work for the Internet Society (as its CEO) and I'm replying with that background in mind, but this is not an official position of the Internet Society or me speaking with my hat on.  If the IETF in general or IETF LLC wants an official legal opinion, I think it's probably necessary for IETF Counsel to reply, and _maybe_ to talk to ISOC Counsel as well.

>hence being prevented to participate in IETF meetings?

Depending on precisely how one interprets the relevant statutes, one might not even be able to answer that question completely, because (depending on the country or the individual) one might not be allowed to acknowledge that the application to attend was received because even that would be transacting with a person under sanction.  It is certainly possible that such things could happen, though I am definitely not now in a position to say whether they have during the IETF LLC period.  I have good reason to believe that there have been IANA protocol parameters that have had this problem, for what it's worth.

>unacceptable. I hope that that's not even a possibility.

The problem is that there isn't an alternative to living with OFAC, because the Internet Society is incorporated in the United States and the IETF LLC is (a disregarded entity that is in some sense) a ypart of the Internet Society.  There are structural reasons why incorporating the Internet Society outside that United States is not a practical possibility either, but the reasons for this are probably best discussed on a list about the Internet Society rather than the IETF.

>sanctioned/banned: https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists
>

Yes, it is not just countries.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Fernando Gont <[email-masked]>
Date: Wed, 3 Mar 2021 19:10:53 -0300

> person because of visa issues?

FWIW, all of the questions that you raise are certainly valid and important.

However, if the "OFAC Compliance Policy" could result in people 
prevented from participating, much more than an obstacle, but rather 
outright discrimination being exercised by the IETF itself. -- as noted, 
I'd hope that's not even among the possible outcomes.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: "John Levine" <[email-masked]>
Date: 3 Mar 2021 17:36:04 -0500

>being prevented to participate in IETF meetings?

The question of ISOC's location comes up from time to time from people
in ISOC chapters.  (I presume we all know that the IETF LLC is a subsidiary of ISOC.)

There is no bar to people anywhere participating in the IETF by e-mail, since that
doesn't involve any transactions or payments to anyone.

In the hypothetical case that someone on the sanctions list wanted to
register for a meeting, we clearly could not accept payment from her.
Possibly it would be OK it we waived the registration fee; that would
be a question for lawyers if and when it happened.  As far as I know, it never has.

>I hope that that's not even a possibility.

The world is not a perfect place.  Everything we might do has costs and benefits
and the choice of domicile is no different.  Every country has its version of OFAC,
and there is no place that everyone in the world can visit without trouble.  As Woody
pointed out, visas for physical meetings are a problem and not just in the U.S.

I do know that were ISOC to move out of the US, that would make the
.ORG revenue on which ISOC and the IETF depends drop by about 25%. (If
you care, ask me privately for details.)  That would be a disaster for us.
So can we argue about ASN.1 or something else instead?

R's,
John

---

From: Nico Williams <[email-masked]>
Date: Wed, 3 Mar 2021 17:05:47 -0600

> So can we argue about ASN.1 or something else instead?

I've tried, but I think that one's out of steam for this quarter.

---

From: Fernando Gont <[email-masked]>
Date: Wed, 3 Mar 2021 21:15:03 -0300

Hello, Jay,

Thanks for your response! In-line....

On 3/3/21 20:42, Jay Daley wrote:
[...]
> 
> You may also not be aware of just how widespread the impact of
> sanctions policies are and the nature of direct and indirect impact.

Not sure why you'd think so....

>  Looking at the direct impact, every US company and individual
> including the LLC is covered.  For example, every online service such
> as Twitter, GitHub, every US based airline, every US drug company and
> so on.   The much broader impact is indirect - a company outside of
> the US that does business with sanctioned people/companies/countries
> can in turn be subject to sanctions.

FWIW, I find this *very* oppressive.

> So, to answer your question, yes we may end up in a situation where
> we deny access to an in-person meeting to someone from an OFAC
> sanctioned country - it depends on the specific person and the
> circumstances around that.  We may even need to deny them remote
> participation.  There are options available to us, such as applying
> for a license or pursuing a more general exemption as a standards
> setting organisation, but none of those can be guaranteed.

Is the issue associated with the economic transaction involved to pay 
the meeting fee?  Or actually with participation (regardless of whether 
a fee is being paid or not)?

Put another way: would a fee waiver guarantee f2f/online meeting
participation of individuals from USA-sanctioned countries, as far as
the IETF LLC is concerned?   (of course, visas and others are not up to 
the IETF).

And if such participation is not guaranteed, why would mailing-list
participation be any different in this respect?  Or should one also 
expect that participants from USA-sanctioned countries could also be 
banned from employing the IETF mailing-lists?

> No matter how much we might wish it to be different, we are
> constrained by two inescapable facts:
> 
> 1.  It is simply not possible to locate a company anywhere in the
> world where it does not need to consider the impact of sanctions. 2.
> It is simply not possible to find any location on the planet where 
> everyone is free to travel to.

I haven't done such an assessment myself to be able to tell if things 
could be any different..

That said, in this particular case the sanctions would seem to affect 
even on-line participation (aside from travel/visa issues).

Thanks,

---

From: Keith Moore <[email-masked]>
Date: Wed, 3 Mar 2021 19:38:19 -0500

On 3/3/21 7:15 PM, Fernando Gont wrote:

> the IETF LLC is concerned? 

It might be the case that a fee waiver from IETF would still be 
interpreted as an exchange of value.   Clearly IETF/ISOC has to be very 
careful about such things.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 4 Mar 2021 02:10:23 -0500

Since when did we check people's passports before letting them come to an
IETF meeting? And merely holding a particular passport doesn't make you
subject to sanctions.

The four countries on the terrorism list have some difficulty in making
payments through the international system but thats a problem for the
people trying to come from those countries.

Getting visas for international conferences has always been an issue for
some people.

Unless ISOC is planning to outsource running the NOC to Cuba, I can't see
how it is likely to come up.

---

From: Stewart Bryant <[email-masked]>
Date: Thu, 4 Mar 2021 11:44:11 +0000

> On 3 Mar 2021, at 22:14, Andrew Sullivan <[email-masked]> wrote:
> 

Incorporation in Switzerland, or running under the umbrella of the UN seems to be the approach that most truly neutral global players  take, and I wonder if IETF needs to seriously consider that.

The IETF are the technical custodians of a global utility, where access is now pretty much a human right, and yet we still seem to be subjected to a lot of control and constraints by the USG.

- Stewart

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 4 Mar 2021 10:52:03 -0500

Hi,

Disclaimer: still employed by ISOC, still speaking for myself.

>Incorporation in Switzerland, or running under the umbrella of the UN seems to be the approach that most truly neutral global players  take, and I wonder if IETF needs to seriously consider that.

If standards-makers wish to undertake standards work under the aegis of the United Nations, there is a standards body that I believe already exists to undertake such work.  Please note that, in so doing, one will have converted from an open organization of willing participants that is occasionally pinched by certain realities of a particular government's rules into an organization where rather more than one government is in the position to put special constraints on activities.

Moving the IETF LLC to Switzerland is incompatible with the current relationship between IETF LLC and the Internet Society.  Getting the status you are referring to is a not-entirely-trivial matter.

>The IETF are the technical custodians of a global utility, where access is now pretty much a human right, and yet we still seem to be subjected to a lot of control and constraints by the USG.

I think assertions about whether a thing is a human right may be beyond the remit of this list; I am not sure what being "pretty much" a human right is anyway.

There are constraints that are imposed by governments and the link between the Internet Society and the United States is a fact of history that I am not really in a position to change given the realities of income and so on.  The link between the IETF and the Internet Society is something the community only recently settled on, and funding that the Internet Society provides remains encumbered by OFAC considerations even after the funds are released to the IETF; so this is perhaps more complicated than you appear to be suggesting.  In any case, if the community sets up IASA3 and decides to consider again its relationship to the Internet Society I should (assuming I were still employed this way) be pleased to participate.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Eliot Lear <[email-masked]>
Date: Thu, 4 Mar 2021 17:21:17 +0100

I agree with Andrew that I think we’ve gone off track.  The participation element is what is at issue, and when it comes to sanctions, it’s not just a matter of where an organization is homed.  That is a very small matter in comparison to- the participants from various countries and what restrictions they would be under (regardless of where an organization is homed), travel restrictions to and from various countries (again, regardless of where an organization is homed).

I’m sure the LLC and Andrew could tell us where being homed does play a role, such as perhaps with fellowships, etc; and that might require some thought.

Eliot

---

From: Keith Moore <[email-masked]>
Date: Thu, 4 Mar 2021 13:40:52 -0500

> I’m sure the LLC and Andrew could tell us where being homed does play a role, such as perhaps with fellowships, etc; and that might require some thought.

Especially when we're just trying to get a sense of the spectrum of 
barriers to participation, I don't think it's "off track" to consider 
anything that impairs individuals' ability to participate.    We 
shouldn't prematurely prune that list to just the problems that we think 
are easily solved.   Of course, identifying a problem and addressing it 
are two different things.   The opportunity to address some problems may 
not appear immediately, or for that matter ever, but that's no reason to 
not be aware of them.

(And it's the nature of problems and solutions, that solutions sometimes 
create new problems, and sometimes the new problems are worse that the 
problems that were "solved".  Nobody should think these problems are easy.)

Keith

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 4 Mar 2021 14:57:44 -0500

Disclaimer: still employed, still speaking for me

On Thu, Mar 04, 2021 at 01:40:52PM -0500, Keith Moore wrote:
>anything that impairs individuals' ability to participate.

In that case, there are multiple issues here.  Off the top of my head:

	• People from sanctioned countries under the laws of wherever the IETF is incorporated may face legal barriers to interactions with the corporate body of the IETF.

	• People from sanctioned countries under any law may face legal barriers in arranging support for or travel to their IETF activities.

	• People from sanctioned countries may have their network connectivity impaired in various ways.

	• People from sanctioned countries under any law may face barriers to arranging payments for any paid IETF activities due to the rules imposed by payment processors.  These may be beyond the control of the IETF and may not be in place or foreseeable at the time of the IETF's contract with the processor, so they may not be possible to fix.

I do think that it is useful to lay out issues in a way such that the things that are actually addressable get priority.  Geopolitical harmony does not seem to be the barrier to inclusion and diversity that the IETF needs to prioritize compared to some other things that are perhaps closer to home.

Hope that helps,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 5 Mar 2021 09:03:03 +1300

On 05-Mar-21 00:44, Stewart Bryant wrote:
> 
> 
>> On 3 Mar 2021, at 22:14, Andrew Sullivan <[email-masked] <mailto:[email-masked]>> wrote:
>>
> Incorporation in Switzerland, or running under the umbrella of the UN 

Those are two very, very different things. And you wouldn't "incorporate" in Switzerland, you would create some other kind of entity (most likely called a "fondation" in Geneva or a "Stiftung" in Zurich) and negotiate NGO status with the Swiss authorities, because being an NGO is not a binary issue at all; it's a very broad umbrella. Not being a Swiss lawyer, I don't pretend to understand it, although I was the first President of the former Geneva chapter of the Internet Society, which I seem to remember was a "fondation" under Geneva law but (since its activities were local) never attempted to get formal NGO status. So yes, this would be an option IMHO, but with many financial implications as others have noted.

As for "under the UN" there is zero chance politically; the ITU would win that one. The members of the UN are national governments and an out-of-control rabble like the IETF would be laughed out of the room.

> seems to be the approach that most truly neutral global players  take, and I wonder if IETF needs to seriously consider that.

It was seriously considered during the IETF2.0 process, and rejected. (I was in the rough. Most IETF participants simply ignored the discussion.)

> The IETF are the technical custodians of a global utility, where access is now pretty much a human right, and yet we still seem to be subjected to a lot of control and constraints by the USG.

I hope you don't prefer a lot of control and constraints by the UN.

   Brian

---

From: Keith Moore <[email-masked]>
Date: Thu, 4 Mar 2021 15:03:11 -0500

On 3/4/21 2:57 PM, Andrew Sullivan wrote:

>     • People from sanctioned countries under the laws of wherever the 
> IETF is incorporated may face legal barriers to interactions with the 
> corporate body of the IETF.
>
>     • People from sanctioned countries under any law may face legal 
> barriers in arranging support for or travel to their IETF activities.
>
>     • People from sanctioned countries under any law may face barriers 
> to arranging payments for any paid IETF activities due to the rules 
> imposed by payment processors.  These may be beyond the control of the 
> IETF and may not be in place or foreseeable at the time of the IETF's 
> contract with the processor, so they may not be possible to fix.

Yes, I think all of those are true, and thanks for the list.

> I do think that it is useful to lay out issues in a way such that the 
> things that are actually addressable get priority.  Geopolitical 
> harmony does not seem to be the barrier to inclusion and diversity 
> that the IETF needs to prioritize compared to some other things that 
> are perhaps closer to home.

I think it makes sense to work on the issues that actually seem to be 
addressable before working on the issues that do not seem addressible, 
but you don't want to prune the list premature. Because sometimes there 
are workarounds that aren't immediately obvious.  (Though perhaps not 
for any of the cases you mention.)

thanks again,

Keith

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 5 Mar 2021 09:08:11 +1300

s/IETF2.0/IASA2.0/

sorry

Regards
   Brian

---

From: Eliot Lear <[email-masked]>
Date: Thu, 4 Mar 2021 21:16:09 +0100

> On 4 Mar 2021, at 21:03, Keith Moore <[email-masked]> wrote:
> 
> I think it makes sense to work on the issues that actually seem to be addressable before working on the issues that do not seem addressible,

But you’re not doing that, Keith.  You are proposing a solution (e.g., rehoming the LLC or its parent) without exploring the problem first.  Have you a single example of where the LLC home was even an issue?

Eliot

---

From: Keith Moore <[email-masked]>
Date: Thu, 4 Mar 2021 15:45:44 -0500

On 3/4/21 3:16 PM, Eliot Lear wrote:

>> On 4 Mar 2021, at 21:03, Keith Moore <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>
> But you’re not doing that, Keith.  You are proposing a solution (e.g., 
> rehoming the LLC or its parent) without exploring the problem first. 
>  Have you a single example of where the LLC home was even an issue?
>
I won't speak for my co-author, but I'm not proposing anything. I'm just 
trying to get a picture.  And as much as I empathize with the desire to 
be free of US government control, I have no assumptions that it would be 
easy or even feasible.

Keith

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 4 Mar 2021 23:01:11 +0000

Reminder that the appropriate list for discussion of things like where the LLC is homed is [email-masked]<mailto:[email-masked]>.

Thanks
Jason

From: ietf <[email-masked]> on behalf of Keith Moore <[email-masked]>
Date: Thursday, March 4, 2021 at 3:46 PM
To: "[email-masked]" <[email-masked]>
Subject: Re: IETF LLC & IETF Participation from USA-sanctioned countries

On 3/4/21 3:16 PM, Eliot Lear wrote:
On 4 Mar 2021, at 21:03, Keith Moore <[email-masked]<mailto:[email-masked]>> wrote:

I won't speak for my co-author, but I'm not proposing anything.   I'm just trying to get a picture.  And as much as I empathize with the desire to be free of US government control, I have no assumptions that it would be easy or even feasible.

Keith

---

From: S Moonesamy <[email-masked]>
Date: Thu, 04 Mar 2021 21:01:11 -0800

Hi Keith,
At 01:43 PM 03-03-2021, Keith Moore wrote:
>In addition to the clarification that Fernando asked for, I guess 
>I'd like to know (vaguely) whether this has been a problem in the 
>past, maybe how many people have been turned away.

There was a well-known case several years ago.  I commented about 
that at https://mailarchive.ietf.org/arch/msg/ietf/41o9rJEfNU-eN2NxsE7sZGkO2Ew/

Regards,
S. Moonesamy

---

From: Lars Eggert <[email-masked]>
Date: Fri, 5 Mar 2021 09:59:54 +0200

Hi,

On 2021-3-4, at 21:57, Andrew Sullivan <[email-masked]> wrote:
> I do think that it is useful to lay out issues in a way such that the things that are actually addressable get priority.

I fully agree.

I get that there is a certain sense of completeness and satisfaction to producing an exhaustive list here. That said, we'll likely want to focus our (limited) resources on those issues that can enable large practical improvements. Re-incorporating the organization is a huge effort with IMO very unclear benefits in significantly broadening opportunities for participation.

Thanks,
Lars

---

From: Keith Moore <[email-masked]>
Date: Fri, 5 Mar 2021 08:28:27 -0500

On 3/5/21 2:59 AM, Lars Eggert wrote:

> I get that there is a certain sense of completeness and satisfaction to producing an exhaustive list here.
More than that, it is just basically being honest with ourselves about 
what barriers exist.
> That said, we'll likely want to focus our (limited) resources on those issues that can enable large practical improvements.

To me a few things are apparent:

  * some fixes may be easy; others difficult; some can probably be done
    quickly; others more slowly.
  * some things probably can't be fixed at all, at least under current
    conditions, and some things perhaps not ever.
  * the landscape changes over time, somewhat unpredictably, potentially
    making some things easier to fix but also introducing new challenges.
  * diversity and inclusion are efforts that require an ongoing
    organizational commitment to continuous improvement.

So I see the draft we're working on as a kind of snapshot of the current 
situation, rather than a list of everything that needs to be fixed and 
then we're done.

Keith

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 5 Mar 2021 10:58:40 -0500

Reincorporating makes no difference unless people are prepared to give up
their US citizenship to serve on the ISOC etc.

On Fri, Mar 5, 2021 at 3:00 AM Lars Eggert <[email-masked]> wrote:

> things that are actually addressable get priority.
>
> I fully agree.
>
> I get that there is a certain sense of completeness and satisfaction to
> producing an exhaustive list here. That said, we'll likely want to focus
> our (limited) resources on those issues that can enable large practical
> improvements. Re-incorporating the organization is a huge effort with IMO
> very unclear benefits in significantly broadening opportunities for
> participation.
>
> Thanks,
> Lars
>
>

---

From: Fred Baker <[email-masked]>
Date: Fri, 5 Mar 2021 08:32:08 -0800

Ok, that at least makes sense.

Sent using a machine that autocorrects in interesting ways...

> On Mar 5, 2021, at 7:59 AM, Phillip Hallam-Baker <[email-masked]> wrote:
> 
> 
> Reincorporating makes no difference unless people are prepared to give up their US citizenship to serve on the ISOC etc.
> 
> 
>

---

From: Fernando Gont <[email-masked]>
Date: Thu, 4 Mar 2021 18:13:36 -0300

On 4/3/21 17:45, Keith Moore wrote:
> trying to get a picture.

Same here.

> And as much as I empathize with the desire to 

FWIW, I'm not, either.

For the most part, I'm still trying to understand how sanctions 
would/could apply to participants.

i.e., I wished someone could shed light on this:

* Are participants from sanctioned countries or organizations allowed to 
participate in mailing-list discussions, and e.g. publish 
Internet-Drafts, or RFCs?

* Could they join fwf meetings? Could they join online meetings?  If 
not, is the limitation associated with payment of the fee, or with 
something else?  Would a fee waiver "solve" this?

Without answers to these basic questions, it's hard to 
understand/evaluate the problem, let alone try to mitigate it.

Thanks,

---

From: Michael Richardson <[email-masked]>
Date: Sun, 07 Mar 2021 11:11:39 -0500

> * Are participants from sanctioned countries or organizations allowed
    > to participate in mailing-list discussions, and e.g. publish

I suspect that we won't like the answer, so maybe we shouldn't ask the
question :-)
We might be forced to put unpleasant controls in place.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Keith Moore <[email-masked]>
Date: Sun, 7 Mar 2021 12:22:03 -0500

> I suspect that we won't like the answer, so maybe we shouldn't ask the

No, we need to know, even if we won't like the answer, and even if we 
can't change the situation.    Far too much prejudice is perpetuated by 
those kinds of taboos.

---

From: Christian Huitema <[email-masked]>
Date: Sun, 7 Mar 2021 11:14:47 -0800

On 3/7/2021 9:22 AM, Keith Moore wrote:
>>      > * Are participants from sanctioned countries or organizations 
>> allowed
>>      > to participate in mailing-list discussions, and e.g. publish
>>      > Internet-Drafts, or RFCs?
>>
> can't change the situation.    Far too much prejudice is perpetuated 
> by those kinds of taboos.

This is not exactly an issue of prejudice. AFAIK, we do not have checks 
to verify that some new subscriber to an IETF working group is not 
accessing the server from a penalized country through a VPN, or any such 
workaround. We don't really want to set up any check like that, because 
they are intrusive and complicated, and also because they are beyond 
commonly held standards. Yet, if we conducted an in depth study of the 
issue, who knows whether some bureaucrat somewhere would force the IETF 
to enforce such checks, or force the LLC to spend a good chunk of money 
asserting our rights to not do that. It is probably much wiser to let 
sleeping dogs lie.

-- Christian Huitema

---

From: Keith Moore <[email-masked]>
Date: Sun, 7 Mar 2021 14:42:00 -0500

On 3/7/21 2:14 PM, Christian Huitema wrote:

> This is not exactly an issue of prejudice. AFAIK, we do not have 
> checks to verify that some new subscriber to an IETF working group is 
> not accessing the server from a penalized country through a VPN, or 
> any such workaround. We don't really want to set up any check like 
> that, because they are intrusive and complicated, and also because 
> they are beyond commonly held standards. Yet, if we conducted an in 
> depth study of the issue, who knows whether some bureaucrat somewhere 
> would force the IETF to enforce such checks, or force the LLC to spend 
> a good chunk of money asserting our rights to not do that. It is 
> probably much wiser to let sleeping dogs lie.
>
Any time someone says we shouldn't ask whether we're effectively 
discriminating against people in some way, that's a huge red flag.

Keith

---

From: Fernando Gont <[email-masked]>
Date: Sun, 7 Mar 2021 21:44:38 -0300

On 7/3/21 16:14, Christian Huitema wrote:
[....]
> workaround.

FWIW, at the very least, I was wondering what would be the effect of 
things for folks that openly and truthfully employ email addresses from 
e.g. ccTLDs from said countries, or that indicate a postal address from 
one of said countries when registering to an IETF meeting.

> It is probably much wiser to let 
> sleeping dogs lie.

I would expect that said folks would probably want to know what to 
expect, other than e.g. giving it a try and learning about it the hard 
(and sad) way.

I guess I also wonder, in the case of document what the implications are 
(if any) for said folks, as well for fellow co-authors (who might 
participate from non-sanctioned countries).

Thanks,

---

From: Bob Hinden <[email-masked]>
Date: Mon, 8 Mar 2021 07:05:01 -0800

Fernando,

> On Mar 7, 2021, at 4:44 PM, Fernando Gont <[email-masked]> wrote:
> 
>> This is not exactly an issue of prejudice. AFAIK, we do not have checks to verify that some new subscriber to an IETF working group is not accessing the server from a penalized country through a VPN, or any such workaround.
> 
> FWIW, at the very least, I was wondering what would be the effect of things for folks that openly and truthfully employ email addresses from e.g. ccTLDs from said countries, or that indicate a postal address from one of said countries when registering to an IETF meeting.

I note that filtering by ccTLD wouldn’t work very well, as a ccTLD only says where the domain was registered, not where the user is.  For example, I checked and I could register hinden.ir.

Bob

> 
> 
> 
>> It is probably much wiser to let sleeping dogs lie.
> 
> I would expect that said folks would probably want to know what to expect, other than e.g. giving it a try and learning about it the hard (and sad) way.
> 
> I guess I also wonder, in the case of document what the implications are (if any) for said folks, as well for fellow co-authors (who might participate from non-sanctioned countries).
> 
> Thanks,
> --
> Fernando Gont
> SI6 Networks

---

From: Keith Moore <[email-masked]>
Date: Mon, 8 Mar 2021 12:20:44 -0500

> I note that filtering by ccTLD wouldn’t work very well, as a ccTLD only says where the domain was registered, not where the user is.  For example, I checked and I could register hinden.ir.

For that matter, I'm pretty sure that anyone in the DPRK (just to pick 
one example) who is authorized by that government to access and/or 
participate in IETF discussions, will have the resources needed to evade 
whatever mechanisms IETF might impose to discourage that.

Heck, IETF even lets Americans participate.   Might as well let all the 
riff raff in.

Keith

---

From: Fred Baker <[email-masked]>
Date: Mon, 8 Mar 2021 15:20:54 -0800

Sigh. I suspect that our colleagues in China and Africa might have some experience with that. Their email isn't filtered that I know of, but there are issues with email implementations of various kinds, and they have found it advisable to use gmail and other tools to work around the issues.

---

From: Fernando Gont <[email-masked]>
Date: Mon, 8 Mar 2021 23:44:59 -0300

Hi, Bob,

On 8/3/21 12:05, Bob Hinden wrote:
>> On 7/3/21 16:14, Christian Huitema wrote: [....]
>>> checks to verify that some new subscriber to an IETF working
>>> group is not accessing the server from a penalized country
>>> through a VPN, or any such workaround.
>> 
>> FWIW, at the very least, I was wondering what would be the effect
>> of things for folks that openly and truthfully employ email
>> addresses from e.g. ccTLDs from said countries, or that indicate a
>> postal address from one of said countries when registering to an
>> IETF meeting.
> 
> I note that filtering by ccTLD wouldn’t work very well, as a ccTLD
> only says where the domain was registered, not where the user is.
> For example, I checked and I could register hinden.ir.

For the most part, the motivation of this thread has been to find an 
authoritative answer regarding how OFAC compliance could possibly affect 
participation.

The registration process requires a share of personal information, and 
part of my question is whether such information provided during 
registration could affect the ability of affected parties to participate.

Similarly, I wonder if there are any constraints for the same group to 
e.g. author internet-drafts, and attest affiliation with organizations 
from said countries (e.g. universities).

P.S.: FWIW, I'm generally against of *any* form of blocking/filtering 
people people from participating in the IETF based on attributes such as 
their country of origin, nationality, or their whereabouts (whether 
implemented by looking at email addresses or in any other way).

Thanks,

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 11 Mar 2021 06:56:35 +0100

Andrew,

On Wed, Mar 03, 2021 at 05:14:33PM -0500, Andrew Sullivan wrote:
> Depending on precisely how one interprets the relevant statutes, one might not even be able to answer that question completely, because (depending on the country or the individual) one might not be allowed to acknowledge that the application to attend was received because even that would be transacting with a person under sanction.  It is certainly possible that such things could happen, though I am definitely not now in a position to say whether they have during the IETF LLC period.

>  I have good reason to believe that there have been IANA protocol parameters that have had this problem, for what it's worth.

What is the easily found public URL where any such case is documented ?

And in case where specific classes of events can not be well publically
documented, wehre is the easily found public URL documenting the
type of events that can not be documented - because of US law prohibiting
it, i guess..

As the original question asked, i would really love to start raising
more awareness of any such issues by creating more easily found comprehensive
documentation. Having to point to some email in an email archive as was
also done in this thread is just ridiculous.

Toerless

-- 
---
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 11 Mar 2021 14:19:24 -0500

Hi,

Usual disclaimer: I work for ISOC, but this isn't their opinion.  For the avoidance of doubt, nothing I am talking about is somethng I learned during my current employment.

>What is the easily found public URL where any such case is documented ?

I would be astonished if there were one.  Documenting such a case would be publicly acting on a request from a sanctioned entity, which would be tantamount to admission that one processed their request, which (under the relevant interpretation) would incur a legal risk of having violated the sanctions.  If you feel that you are reading a passage from _Catch 22_, I appreciate your sensation.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 12 Mar 2021 12:25:39 +0100

Thanks, Andrew

So, when i understand this correctly the normal procedure would be to
ignore or report to the authorities requests for sanctioned transactions.

Would it not also be possible to forward such requests to the IETF lawyer
and have them publish the request, therefore letting folks (lawyers)
who do know how to handle these things legally correctly do the job ?

Cheers
    Toerless

-- 
---
[email-masked]

---

From: Khashayar Danesh <[email-masked]>
Date: Fri, 12 Mar 2021 19:07:10 +0100

Hi, An Iranian national over here. 

Firstly, I’m very happy and a bit surprised to see this issue recognized by entities other than the affected group of people (nationals of sanctioned countries).

Having lived in Iran for 20 years and the last 2 years in the Netherlands, I can say there are a whole lot of preventive schemes for a hypothetical person interested in community-based activities in general and more specifically in the area of computers, networking and electronics. 

I’m going to explain some of my observations and obviously these paragraphs will contain my opinions, feelings and overall understandings. 

There are a lot of moving parts in being included in activities in an International task force, for example IETF: 

1. The government of the interested person’s country of origin
	- The international relations of the interested person’s country 
		- The environment that person lives in
			- The person interested in participation
					|
					|
					|
					|
				       V
2. The country in which the community of interest is registered and based
    - The Government of the country in which the community of interest is registered
        - The immigration policies of the Government of the country in which the community of interest is registered

(The community itself is excluded from this diagram, and let’s say the community itself is in a state of art in the area of inclusivity)

All the mentioned items play significant roles in having a person included in X kind of activity, in the country of Y in the area of Z. 

First off, having people go towards the X kind of activity and getting interested in them has a lot of different pre-requirements, such as freedom to experiment, peace of mind, having enough personal freedom, somewhat stable financial situation (an annual inflation rate that is not around 300%), some kind of social and job security, having the privilege of not being crippled by fear and being able to have concerns other than survival.
Many of these rule a lot of people out, because it’s just too much and bearing a part of this myself has had consequences that I’m dealing with still.
If the activity requires traveling per-se, it requires a passport that’s not completely worthless and the person should be able to pay for things over their trip. 

Let’s say the person has had enough resources, peace of mind, means of research and development (yes, this is a problem as well, where people have their social and job security on the line every day this is a bit of a 1st world problem), a stable financial situation and their national travel documents (yes, the dictatorships have turned this one into a kind of mercy as well.)
And freedom of access to information itself is a problem in Iran at least, they enforce a very sophisticated scheme of filtering and censorship over the internet you get from an ISP or Datacenter. 

And not only there are issues with the Country of X, making a whole lot of problem for the person, there will be restrictions for them enforced by the US of A in the area of use and contribution in/to opensource software, use of free services (such as github), payment and so on and so forth (in case of free services and opensource, it’s just wrong.)
The person has had to fight all these things to be able to find what they’re interested in, try and learn things in that area, experiment a bit, try and fix some small problems, then a very rare percentage of those people would reach a state in which they’re able to innovate and have meaningful participation. Going through more trouble in general increases the chances of being bored, tired and de-motivated. 

Many of the mentioned restrictions about Iranian people at least are driven by the US Embargo Sanctions, due to the seizure of the US Embassy in 1979. And worth to mention: Many of the people who are suffering the consequences of that event are born way after 1979. And also not only seizing an embassy is not approved and it is highly despised, we couldn’t have possibly had anything to do with it and we are willing to go through c-14 radiocarbon dating to prove it; in case a date of birth way after 1979 is not enough. 

So, people are subject to enforcement of the policies of their government, and if they’re discriminatory or exclusive, or vague, or senseless, everything applies to everyone unless proven otherwise. 

Traveling from such a state is a whole other story. 
Assuming the financial stability being there (even though it’s not and most people in Iran are making a median of 10K USD per year if they’re highly talented and this money has to get them through a whole year with unpredictable inflation), you need to apply for visas, go through extensive wait times, interviews, background checks, etc, I’d freely say Immigration to most of Europe for work purposes is way easier than going to a conference/meetup/event you have to pay for yourself and go through the pain of visas. 

So, the residents of the mentioned states and specifically Iran have something like this going on. From one side dictatorship and from the other side highly vague rules and policies from EU/US which mostly affect normal citizens rather than actual people in charge of destruction and illegal/criminal activities.

Sorry for the long email, but I had to write this down and share my personal pain.
Feel free to contact me about any of these.

P.S: I’d be happy to help anyone who wants to register a .ir domain.

Kind regards from Amsterdam-ish, 
Khashayar Danesh