Subject: Re: Future Handling of Blue Sheets

From: IETF Chair <[email-masked]>
Date: Sun, 6 May 2012 12:46:18 -0400

We have heard from many community participants, and consensus is quite rough on this topic.  The IESG discussed this thread and reached two conclusions:

(1) Rough consensus: an open and transparent standards process is more important to the IETF than privacy of blue sheet information.

(2) Rough consensus: inclusion of email addresses is a good way to distinguish participants with the same or similar names.

Based on these conclusions, the plan is to handle blue sheets as follows:

  - Continue to collect email addresses on blue sheets;

  - Scan the blue sheet and include the image in the proceedings for the WG session;

  - Add indication to top of the blue sheet so people know it will be part of the proceedings; and

  - Discard paper blue sheets after scanning.

On behalf of the IESG,
  Russ

---

From: Doug Barton <[email-masked]>
Date: Sun, 06 May 2012 15:07:16 -0700

>   - Discard paper blue sheets after scanning.

Everything else seems fine, but I'm concerned about this one. Have you
run this idea past some sort of legal counsel who is knowledgeable about
intellectual property litigation? If so, no worries.

Doug

-- 
    If you're never wrong, you're not trying hard enough

---

From: Russ Housley <[email-masked]>
Date: Sun, 6 May 2012 18:54:03 -0400

> intellectual property litigation? If so, no worries.

The IETF Counsel has been consulted, and he sees no trouble in this regard.

Russ

---

From: David Morris <[email-masked]>
Date: Sun, 6 May 2012 16:03:49 -0700 (PDT)

>From my following of the topic, that concensus was really rough, in 
particular the part about publishing the scans on-line. That represents
a significant difference in ease access which I think required more than
the very very rough concensus you seem to think you found.

---

From: IETF Chair <[email-masked]>
Date: Sun, 6 May 2012 21:26:05 -0400

David:

The list of participants and their addresses are already part of the proceedings.  The incremental difference shows which participants signed in at each session.

Russ

---

From: David Morris <[email-masked]>
Date: Sun, 6 May 2012 19:04:02 -0700 (PDT)

I consider that there is a significant difference between the information 
provided in the registered attendee list and the individual blue sheets:

a) to the extent that the information on the blue sheet is valid, it 
provides an hour by hour log of location, the overall list of attendees at 
most indicates an individual was present to pick up their badge at some
point during the meeting.
b) the validity of the list of registered attendees has a higher degree
of probable validity because of the requirement for a significant payment
and the processes required to process that payment.
c) Individual blue sheets can suffer from any number of unintentional and
intentional issues which limit their factual validity but not the mischief
which can be caused by their easy online access.
d) Scanning and publication imports a validity to the data which is not
widely accepted by the community.

David Morris

---

From: IETF Chair <[email-masked]>
Date: Mon, 7 May 2012 11:02:04 -0400

During the IESG discussion of this thread, we recognized the quality of the information on the blue sheets.  This point was made very clearly at the open mic discussion at the plenary and on the mail list.

Some people voiced agreement with your position, and others supported the posting of this information.  As I said in my earlier message, the consensus is quite rough.  By my review of the thread, which was made more difficult by the many off-topic postings, there is rough consensus for the inclusion of blue sheet information in the proceedings.

Russ

---

From: Ted Hardie <[email-masked]>
Date: Mon, 7 May 2012 08:50:55 -0700

As a clarifying question, did the IESG discuss whether the image of
the blue sheets might be made available online under other terms of
use, rather than within the proceedings?  For example, making these
available to anyone with a tools login, so that anyone willing to
register as a user has access, but they are not broadcast?

regards,

Ted Hardie

---

From: IETF Chair <[email-masked]>
Date: Mon, 7 May 2012 12:02:32 -0400

Ted:

I will raise this with the IESG.  Of the many variants that were discussed, this was not one of them.

Russ

---

From: Doug Barton <[email-masked]>
Date: Mon, 07 May 2012 10:33:36 -0700

> The IETF Counsel has been consulted, and he sees no trouble in this regard.

Excellent! Thanks for clarifying.

Doug

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 10 May 2012 14:23:20 +0800

Dear Russ,

please forgive me for adding one more comment on that after you judged 
on rough consensus.

As you said this rough consensus is quite rough (if we may call it 
"rough consensus").
I would like to point out two things:
1. the statement "(1) Rough consensus: an open and transparent standards 
process is more important to the IETF than privacy of blue sheet 
information." puts transparent process in competition with privacy. This 
is misleading, because there is no contradiction between an open and 
transparent process and privacy of personal information on this one. For 
example the availability of blue sheet information on request by an 
authenticated person does allow full transparency without broadcasting 
the personal location information. (e.g. see also Ted's proposal from 
yesterday)
(Furthermore, if I would be devil's advocate, I would question this 
comparison even further, because it could be misread as stating that the 
current standards process as it is today (with blue sheets on request) 
is not open or transparent...)

2. if consensus is so rough, we should also consider that the subject of 
the email discussion was maybe not clear enough about its impact to 
inform the audience of the consequences of the discussion and the 
consensus to be measured. We could equally have used a subject like 
this: "IETF wants to publish your specific locations / whereabouts 
(within 10m) on an 2-hourly basis during the day for each meeting and 
keep this information available published on the website indefinitely." 
It might have resulted in a different rough consensus.

Just my 5cents.

Best regards, Tobias

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 10 May 2012 15:59:35 +0800

John,

sorry, maybe I did not articulate myself precisely enough. I did not 
intend to say it would be published in real-time. What I wanted to 
communicate is that we would collect that data only during daytime and 
only with 2hours-granularity as it's only meeting attendance in which 
room you are (and publish it at any point in time later). However, we 
would keep it public indefinitely (in the proceedings).

Like you, I am very cautious about broadcasting my travel plans. Plus, I 
am not only concerned about in advance and real-time, but also about 
broadcasting to the public places I've been in the past (or for that 
matter any personal information).

Best regards, Tobias

On 10/05/12 15:09, John C Klensin wrote:
> (top post)
> Tobias,
>
> Constructing and then attacking strawmen is not helpful.
>
> As far as I know, no one has proposed making blue sheet
> information --and hence precise location information for
> identified individuals-- available to the public in real time
> during the meetings.   As one of, I assume, many members of this
> community who will not broadcast my travel plans to social
> networks, etc., until after I return home, I would strenuously
> object to any such thing but, again, as far as I know, no one
> proposed it.
>
>       john
>
>
> --On Thursday, May 10, 2012 14:23 +0800 Tobias Gondrom
> <[email-masked]>  wrote:
>
>> Dear Russ,
>>
>> please forgive me for adding one more comment on that after
>> you judged on rough consensus.
>>
>> As you said this rough consensus is quite rough (if we may
>> call it "rough consensus").
>> 1. the statement "(1) Rough consensus: an open and transparent
>> standards process is more important to the IETF than privacy
>> of blue sheet information." puts transparent process in
>> competition with privacy. This is misleading, because there is
>> no contradiction between an open and transparent process and
>> privacy of personal information on this one. For example the
>> availability of blue sheet information on request by an
>> authenticated person does allow full transparency without
>> broadcasting the personal location information. (e.g. see also
>> Ted's proposal from yesterday)
>> (Furthermore, if I would be devil's advocate, I would question
>> this comparison even further, because it could be misread as
>> stating that the current standards process as it is today
>> (with blue sheets on request) is not open or transparent...)
>>
>> 2. if consensus is so rough, we should also consider that the
>> subject of the email discussion was maybe not clear enough
>> about its impact to inform the audience of the consequences of
>> the discussion and the consensus to be measured. We could
>> equally have used a subject like this: "IETF wants to publish
>> your specific locations / whereabouts (within 10m) on an
>> 2-hourly basis during the day for each meeting and keep this
>> information available published on the website indefinitely."

---

From: John C Klensin <[email-masked]>
Date: Thu, 10 May 2012 04:35:19 -0400

--On Thursday, May 10, 2012 15:59 +0800 Tobias Gondrom
<[email-masked]> wrote:

> John,
> 
> sorry, maybe I did not articulate myself precisely enough. I
> did not intend to say it would be published in real-time. What
> I wanted to communicate is that we would collect that data
> only during daytime and only with 2hours-granularity as it's
> only meeting attendance in which room you are (and publish it
> at any point in time later). However, we would keep it public
> indefinitely (in the proceedings).

Good.  My apologies for misunderstanding your intent.

> Like you, I am very cautious about broadcasting my travel
> plans. Plus, I am not only concerned about in advance and
> real-time, but also about broadcasting to the public places
> I've been in the past (or for that matter any personal
> information).

But it seems to me that takes us back to Russ's summary in that
it is normal, and arguably necessary, for a standards body to
record --and make available to those who are interested-- the
identities of those participating in meetings.

best regards,
   john

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 10 May 2012 16:48:57 +0800

> identities of those participating in meetings.

I do not dispute that.
What I dispute is that "make available to those who are interested" 
necessarily leads to the need to broadcast the data (i.e. publish in the 
proceedings).
As we did in the past, we can equally achieve this openness by requiring 
that an interested person requests this data (including then providing 
his own identify) as we do at the moment.

Best regards, Tobias

---

From: Doug Barton <[email-masked]>
Date: Thu, 10 May 2012 02:10:02 -0700

> necessarily leads to the need to broadcast the data (i.e. publish in the

What is the harm you are trying to guard against by requiring the request?

Or, to take a completely different tack, given that there are a non-zero
number of people who think the data should be published, how do you
intend to deal with someone who makes the request, and then puts it up
on their own website?

I don't hesitate to criticize when I think that the IESG gets it wrong,
but in this case I think they threaded the needle about as well as it
could be threaded.

Doug

---

From: David Morris <[email-masked]>
Date: Thu, 10 May 2012 02:17:14 -0700 (PDT)

On Thu, 10 May 2012, Tobias Gondrom wrote:

> As we did in the past, we can equally achieve this openness by requiring that
> an interested person requests this data (including then providing his own
> identify) as we do at the moment.

I object to the quantum change in ease of access and persistence of the
information. I see way too much aggregation of personal information and
don't think open-ness is justification for increasing that potential.

One of the ways we deal with SPAM and DOS attacks is to intentionally slow
the process. Ted's proposal would be vastly improved with the provision
that access, once authenticated, was delayed approximately the same
amount of time as the current manual process. Propably with some
form of the failed login approach ... maximum requests per week or
other similar unit of time.

David Morris

---

From: Yoav Nir <[email-masked]>
Date: Thu, 10 May 2012 12:35:01 +0300

> What is the harm you are trying to guard against by requiring the request?

Well, there's the obvious issue of spam, although this post that I'm making right now provides my email address to the spammers in a much more convenient form. It's also convenient for headhunters. It also allows my employer to check whether I really went to sessions instead of just touring Paris. Is it the business of the IETF to help in these activities?

I still don't get why you would want this published. My name on a blue sheet could mean that I was presenting for half the session, or that I was at the mike telling people they were wrong, or just sitting quietly in the back minding my own business and reading email. Blue sheets (unlike minutes and jabber logs) don't make such a distinction.

> intend to deal with someone who makes the request, and then puts it up

I think this would be a copyright violation, unless the IETF specifically authorized them to do so (which it shouldn't). I don't think the IETF should prosecute, but it's still a violation.

> but in this case I think they threaded the needle about as well as it

I think that needle should not be threaded at all. A list of participants should maybe be kept (scanned or not) but never published without subpoena, just as it is now. I don't see any reason why publishing it (as opposed to recording actual participation) is a requirement for an open process.

Yoav

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 10 May 2012 17:42:41 +0800

Doug,

you are right in the end I can not prevent someone else from publishing 
this. Even today a party that subpoena'ed them might publish the data. 
(Or a person might just take a photo of the blue sheet in the room and 
publish that...)

Of course we can not control other people's actions, however the 
question remains whether we (as the IETF) do publish that data and how 
easy/fast we make it for others to publish that data.

Just to be clear, I agree basically with most of the proposal from the 
IESG.*
But when it comes to privacy I think we must be extremely careful and 
conservative with information, only releasing information where it 
really adds benefit to transparency. Because once released, it's 
impossible to get it back.
Thinking about how to thread the needle (as you put it), I don't agree 
that the current proposal is optimal, and I would reiterate my proposal 
to not publish the bluesheets in the proceedings but to make them 
available to an individual upon email request to the IETF secretariat, 
providing name and email of the requesting person (and with a disclaimer 
in the IETF answer that this information is not meant to be re-published 
to the public (note I intentionally say "public", i.e. sharing among 
groups would still be ok.)).
If we are worried about high volumes of requests, I would like to ask 
for more information on current volumes of subpoenas and why we get high 
volumes in the future. And if it's really too cumbersome for a person to 
answer the requests, we could then still discuss to use an email account 
based request system (IETF tools login) as proposed by Ted yesterday.

Best regards, Tobias

Ps.: *just as a disclaimer regarding the scanning part of the IESG 
proposal: I like it, but IMHO I would be slightly more cautious than the 
IETF counsel with the admissibility of scanned documents in court 
compared to paper originals. I've experienced quite some cases and legal 
discussions around value of proof of scanned documents.... - what I 
basically learned there was: scanning is ok in most IP jurisdictions, 
but handling the scanned data must use well documented procedures and 
access controls to keep the same level of non-repudiation of integrity 
and authenticity later in court.

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 10 May 2012 17:43:05 +0800

+1
Agree with Yoav.
BR, Tobias

---

From: Peter Sylvester <[email-masked]>
Date: Thu, 10 May 2012 12:51:07 +0200

+1

---

From: Martin Rex <[email-masked]>
Date: Thu, 10 May 2012 15:04:21 +0200 (MEST)

+1

---

From: John C Klensin <[email-masked]>
Date: Thu, 10 May 2012 03:09:15 -0400

(top post) 
Tobias,

     john

---

From: Melinda Shore <[email-masked]>
Date: Thu, 10 May 2012 08:52:17 -0800

>>> don't think open-ness is justification for increasing that potential.

I disagree rather strongly.  This is an open standards body with an open
process, and I think if we're going to change that it needs to be as a
result of a more general discussion rather than simply chipping away
around the edges.

Melinda

---

From: Ted Hardie <[email-masked]>
Date: Thu, 10 May 2012 10:00:09 -0700

> other similar unit of time.

Just as a point of clarification, I did not actually make a proposal;
I asked whether the IESG had considered using making them available
outside the proceedings and other a different set of terms of use.  I
would be happy to make an actual proposal if the IESG decides it is
willing to consider that approach, but I'm not going to bother
drafting such a thing if they are firmly convinced that the
proceedings are the right way to go.

regards,

Ted

---

From: Martin Rex <[email-masked]>
Date: Thu, 10 May 2012 19:32:26 +0200 (MEST)

> result of a more general discussion rather than simply chipping away

There has never been a need to actively broadcast these massive amounts
of personally identifiable information (PII), and I haven't seen any
convincing rationale for doing it now.

Whenever dealing with PII the most responsible action is to distribute
it only when a real need has been demonstrated.  When publishing information
on the internet, it is not possible to undo it, so it is better to err
on the safe side for PII.

-Martin

---

From: Melinda Shore <[email-masked]>
Date: Thu, 10 May 2012 09:42:43 -0800

> convincing rationale for doing it now.

To be honest, "I don't want to receive more spam" and "My boss might
find out I skipped a session" are not reasons not to be open about
who's participating in sessions, particularly as we drift towards a
meetings/voting model.  I understand sensitivity about broadcasting
travel plans but in general some of the arguments being offered for
being a less open organization with a less open process are drifting
into "The FBI implanted a radio transmitter in my teeth" territory,
and it seems to me that making blue sheets available after meetings
does not reveal much PII beyond what's already available on the mailing
lists.

There's a serious question here about tradeoffs between privacy and
openness.  Openness is not just a core institutional value (although
it is one - do not forget that), but it's also a defense against
charges of collusion, which, unfortunately, we've been seeing.

Melinda

---

From: Yoav Nir <[email-masked]>
Date: Thu, 10 May 2012 21:25:14 +0300

On May 10, 2012, at 8:42 PM, Melinda Shore wrote:

> meetings/voting model.

Participating is one thing. Presence is another. Reporting that I spoke up against the hard-fail requirement at Websec is part of the openness. Reporting that I was at SCIM, where I never once approached the microphone is not.

>  I understand sensitivity about broadcasting

The FBI needn't bother. They can just read the blue sheets :-)

> charges of collusion, which, unfortunately, we've been seeing.

And how does the existence of such a lame attempt to list attendees help in this?

Yoav

---

From: John C Klensin <[email-masked]>
Date: Thu, 10 May 2012 14:31:04 -0400

--On Thursday, May 10, 2012 09:42 -0800 Melinda Shore
<[email-masked]> wrote:

>> There has never been a need to actively broadcast these
>> massive amounts of personally identifiable information (PII),
>> and I haven't seen any convincing rationale for doing it now.
> 

+1

Also, please note that there is an interaction between this and
draft-farrresnickel-ipr-sanctions (now in Last Call).
Regardless of the other issues with that particular proposal,
the only real way to escape the IETF's IPR disclosure
requirements about something of which one is aware is to not
participate in any way in an affected WG.  I hate the idea of
the community getting embroiled in accusations and
counter-accusations but one advantage to a working IPR policy
(as well as general openness) of publishing the blue sheets is
the ability to notice and send reminder notes of the form of
"hey, I think I say you in WG FooBar and you've mentioned that
your company is doing work in the area, did you accidentally
forget to sign the blue sheet".   Of course, that means there is
one missing part of the current IESG picture and that is the
ability of people to add their names (perhaps as errata) to the
published blue sheets if an omission was unintentional.

    john

---

From: Martin Rex <[email-masked]>
Date: Thu, 10 May 2012 20:53:11 +0200 (MEST)

John C Klensin wrote:
> 
> I hate the idea of the community getting embroiled in accusations and

I think this blowing the issue out of proportion.

Do you want to require anyone listening to the audio stream
from the IETF Meeting (realtime or from the archive) to sign
up with name first and append it to the blue sheet?

I attended a few IETF meetings in person during 1995-1998 plus
one in 2000 and since then I've only been remotely participating
if at all.  While I did go to the meetings of WGs I actively
participated & signed the blue sheets there, I attended several
other WG meetings.  In case I attended primarily out of curiosity,
I sometimes came late, sometimes left early, and rarely signed
blue sheets.  The idea behind this is "cross-pollination",
something that the ADs of the security area had been actively
advocating for.

If the IESG decides it wants to publish the blue sheets, that may
result in attendees to deliberately not sign it or sign with fake
data, which may impair the usefulness of the blue sheets.

-Martin

---

From: Warren Kumari <[email-masked]>
Date: Thu, 10 May 2012 15:32:04 -0400

> does not reveal much PII beyond what's already available on the mailing

Oh dear, oh dear oh dear….

I've been trying hard to stay out of this discussion, but finally cannot anymore…

I fully agree with Melinda here -- if you are active in the IETF (or even if you aren't), you email address is already known to the spammers. Our lists, and list archives are all public -- if you think that you are important enough that spammers would download and OCR blue sheets to get your address, you are A: out of touch with the current spam model and / or b: believe that you are much more important than you really are...

If you are concerned that your bossman might figure out that you skipped a session -- well, here's an idea, actually two:
1: work somewhere where you manager trusts you enough to do what's in the best interests of the organization (and then do so) and / or
2: attend the friggin' sessions. Presumably you flew half way round the world to participate, not to drink espressos in some new and exotic city.

For the record:
1: My email addresses are [email-masked], [email-masked], [email-masked], [email-masked] and ...
2: I was sitting in seat 3A in room 243 at 15:25 on TUESDAY, March 27, 2012.  I cannot remember what I was wearing, but it probably involved a t-shirt, sandals and some kind of hat. When you invent a time machines and travel back, you should be able to find me there..
3: I didn't attend a single session on Afternoon Session I, WEDNESDAY, March 28, 2012

(I feel that I have gotten much much rantier than intended, but, oh well…)

W

[0]: and mailman's super secure s/[email-masked]/warren at kumari.net/ was figured out a long time ago!

---

From: Martin Rex <[email-masked]>
Date: Thu, 10 May 2012 21:49:33 +0200 (MEST)

Warren Kumari wrote:
> 
> -- if you are active in the IETF (or even if you aren't), you email
> address is already known to the spammers. Our lists, and list archives
> are all public

If the blue sheets would _only_ contain PII that is _already_available_
in other places, then we should stop creating them in the first place.

The arguments of the folks that want to see it published is that
these sheet contain PII that is _not_yet_published_.

Which means we're talking past each other.

-Martin

---

From: SM <[email-masked]>
Date: Thu, 10 May 2012 15:11:25 -0700

Hi John,
>(as well as general openness) of publishing the blue sheets is

I am fine either way with the handling of the blue sheets.  I am also 
fine with whatever the IESG decides (on this topic only :-)).  This 
topic has been sold as a matter of openness.  The question can be 
traced back to newspaperization.  In those days, propagation of 
information was localized.  Nowadays, it can be globalized.  That can 
be good; it can also be bad.

The scrawls from the blue sheets will be accessible after around a 
month.  Should the world be able to find out that:

   (i)  you were in Paris

   (ii) you attended the EAI session

Now let's assume that the work is covered by one of your 
inventions.  Although you were in that session according to the blue 
sheets, you did not participate in the discussion according to the 
minutes (the analogy is that you are subscribed to the mailing list 
but you have not posted any messages).  Do you have to file an IPR disclosure?

Coming back to being open and transparent, the IETF tends to have a 
variable stance on that.  Exposing information allows other people to 
evaluate fairness, whether there is conflict of interest, etc.  It 
does not always work out well; some people may be unhappy, offended 
or uncomfortable.  If you look at the list of WGs being tracked, you 
will notice that some people provided the information, some 
didn't.  I didn't ask why.  As a quick thought, I guess that people 
are uneasy with the idea of the information being publicized to the 
world or they used the default, this information is not relevant to 
any random person.

Let's ignore the IPR argument.  What question(s) should one ask in 
setting the boundaries for open and transparent?

Regards,
-sm

---

From: Peter Sylvester <[email-masked]>
Date: Sat, 12 May 2012 16:31:59 +0200

> Which means we're talking past each other.
Not even that: the information which is on a blue sheet
is not the same as the information that the former is on the blue sheet.

<flame>The arguments to publish them, even to keep them secret as today,
begin to sound close to (or stink like) those used to justify to store travel
information, mobile phone tracking, etc etc.
</flame>

The number of participants in a meeting can be counted to get an
idea for meeting planning, and then the blue sheets should be distroyed.
Or, no blue sheets at all, the chairman makes a rough count
and this number, announces it at the end, and it is put into the minutes.

<fun>could the persons who are in favor of publishing confirm that
they don't work for spam companies, secret services ...  :-)</fun>

Anyway, adding an X and an unreadable address on a blue sheet
remains always an option. It serves the purpose of meeting preparation.

I did not had the impression that there was  "rough consensus" for
any change.

it's weekend :-)

---

From: Marshall Eubanks <[email-masked]>
Date: Thu, 24 May 2012 10:12:09 -0400

For what it is worth, here is my opinion on this subject (which I was
asked to post here).

I see  possible privacy law problems with posting the blue sheets, so
I would not.

I see a good reason to scan and have images of new blue sheets, make
it easier to respond to subpoenas.

I do see a historical benefit to keeping the blue sheets (as blue
sheets, not just scans), and the expense
of doing so is minimal, so I would urge that their archiving be continued.

Regards
Marshall

On Thu, May 10, 2012 at 6:11 PM, SM <[email-masked]> wrote:
> I am fine either way with the handling of the blue sheets.  I am also fine
> with whatever the IESG decides (on this topic only :-)).  This topic has
> been sold as a matter of openness.  The question can be traced back to
> newspaperization.  In those days, propagation of information was localized.
>  Nowadays, it can be globalized.  That can be good; it can also be bad.
>
> The scrawls from the blue sheets will be accessible after around a month.
>  Should the world be able to find out that:
>
>  (i)  you were in Paris
>
> Now let's assume that the work is covered by one of your inventions.
>  Although you were in that session according to the blue sheets, you did not
> participate in the discussion according to the minutes (the analogy is that
> you are subscribed to the mailing list but you have not posted any
> messages).  Do you have to file an IPR disclosure?
>
> Coming back to being open and transparent, the IETF tends to have a variable
> stance on that.  Exposing information allows other people to evaluate
> fairness, whether there is conflict of interest, etc.  It does not always
> work out well; some people may be unhappy, offended or uncomfortable.  If
> you look at the list of WGs being tracked, you will notice that some people
> provided the information, some didn't.  I didn't ask why.  As a quick
> thought, I guess that people are uneasy with the idea of the information
> being publicized to the world or they used the default, this information is
> not relevant to any random person.
>
> Let's ignore the IPR argument.  What question(s) should one ask in setting
> the boundaries for open and transparent?
>
> Regards,
> -sm

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 24 May 2012 17:37:20 +0200

> of doing so is minimal, so I would urge that their archiving be continued.

To me this seems to be the compelling, non-surprising result of this discussion.
We don't need another 100 messages to finally arrive at the same result.
So it would help if the responsible I* would make a decision, please.

Grüße, Carsten

---

From: Russ Housley <[email-masked]>
Date: Thu, 24 May 2012 14:42:45 -0400

> of doing so is minimal, so I would urge that their archiving be continued.

During the IESG off-site meeting, this topic received quite a bit of discussion.  The IESG recognized that blue sheet information is valuable for peer pressure to abide by the IPR rules.  In contrast, I understand the concerns that have been raised on this thread.  As a result, I am looking into a mechanism where a datatracker password is needed to get the blue sheet images.  This would be the same password that an IETF community participant will to use with the soon-to-be-released Internet-Draft Tracking features (see RFC 6293).  These accounts are available to anyone; however, the need for an account to access blue sheet images raises the bar for access.  Additionally, the need for an account will keep the blue sheet images hidden from web crawlers.

Thanks to Ted hardie for the question that lead to this potential solution.

Russ