Subject: RE: IETF Operational question

From: "Valerie See \(LCA\)" <[email-masked]>
Date: Fri, 26 Mar 2004 09:33:54 -0800

Hi Todd - I am not an attorney, so I'm coming at this from purely a
technical/business perspective. As I recall the WG discussions, and
from a purely practical perspective, it's not really reasonable to
ask people (as a mandatory request) to disclose third party IPR, 
though it's a very reasonable thing to encourage them if the 
situation permits. For instance, if they are not under 
non-disclosure (an obvious difficulty) or aren't afraid of
other repercussions. 

If somebody knows of third party IP and can't disclose it, we
can't (and imho, shouldn't) prejudge them for this. There are
outside factors that may prevent them from being able to do so. 

thanks, Val See

-----Original Message-----
From: todd glassey [mailto:[email-masked]] 
Sent: Friday, March 26, 2004 9:22 AM
To: Valerie See (LCA); [email-masked]
Subject: Re: IETF Operational question

Valerie - what do you think the damage would be for someone withholding
that
info intentionally.

T
----- Original Message ----- 
From: "Valerie See (LCA)" <[email-masked]>
To: <[email-masked]>
Sent: Friday, March 26, 2004 9:14 AM
Subject: RE: IETF Operational question

On Fri, 26 Mar 2004, Chuck AdamsJr wrote:
> Brian and Jorge, I have been away from the IETF policy documents for a
> while, but in a statement as Brian referenced:
>
> >    By submitting this Internet-Draft, I certify that any applicable
> >    patent or other IPR claims of which I am aware have been
disclosed,
> >    and any of which I become aware will be disclosed, in accordance
with
> >    RFC 3667.
>
> I understand that this includes disclosures under the submitter's
control.
> Patents and IPR associated with 3rd parties is not included.
> Am I correct in this interpretation?  Chuck

Chuck, as I read Section 6.1.3, "IPR of others" in RFC 3668 (aka
technology-rights), I would think that your interpretation is right
(though obviously we need Jorge's/Harald's/IESG guidance). The specific
text in 6.1.3 is:

"If a person has information about IPR that may Cover IETF
Contributions, but the participant is not required to disclose
because they do not meet the criteria in Section 6.6 (e.g., the IPR
is owned by some other company), such person is encouraged to notify
the IETF by sending an email message to [email-masked].  Such a
notice should be sent as soon as reasonably possible after the person
realizes the connection."

In other words, a participant is encouraged to disclose knowledge
of third-party patents but not required to do so, or so I interpret
this.

Jorge, Harald - is this how this should be read?

thanks, Val See

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: "todd glassey" <[email-masked]>
Date: Fri, 26 Mar 2004 09:54:29 -0800

Val - yes this is the dilemma - and one of those factors is that those
individuals may not legally represent the IP Owners interests although they
may be the authors of the IP in question. The current policy is totally
broken with regard to this and its a serious issue.

Likewise the submissions process is also broken since there is no release or
otherwise against the use of any of this IP in the IETF or other orgs.

But the biggest problem herein is what to do when some impropriety is found.
Or how to remove any one protocol... For instance there is no statement in
any documents that I have seen saying that the IETF has a IP retraction
policy or process, that the IETF will retract or remove from publication
with its copyright statement, anything that turns out to be "not the
property of the submitter"...

This also dove-tails into the issues of how to retire protocols and how one
protocol challenges and removes a WG's protocol's if that WG refuses to
allow more than one instance of a protocol type in it. This is critical as
an open standards platform since what there is in place now is "the IETF is
a one-way publishing" entity in my opinion, and if the IETF wants to be
immune from any damages done with its processes, then it MUST (IMHO) also
deal with how to retire and what to do with violations of IP rights that
occur inside of it.

Todd Glassey
----- Original Message ----- 
From: "Valerie See (LCA)" <[email-masked]>
To: "todd glassey" <[email-masked]>; <[email-masked]>
Sent: Friday, March 26, 2004 9:33 AM
Subject: RE: IETF Operational question

thanks, Val See

-----Original Message-----
From: todd glassey [mailto:[email-masked]]
Sent: Friday, March 26, 2004 9:22 AM
To: Valerie See (LCA); [email-masked]
Subject: Re: IETF Operational question

T
----- Original Message ----- 
From: "Valerie See (LCA)" <[email-masked]>
To: <[email-masked]>
Sent: Friday, March 26, 2004 9:14 AM
Subject: RE: IETF Operational question

disclosed,
with
control.

thanks, Val See

---

From: Pekka Savola <[email-masked]>
Date: Fri, 26 Mar 2004 20:06:56 +0200 (EET)

> outside factors that may prevent them from being able to do so. 

Then such a person should not be participating in the discussions 
regarding the technology.

How is this different from the case that you are not allowed to 
disclose your own IPR?

No practical difference, except the rules appear to have a loophole
for 3rd party disclosure requirements.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: "Richard Barr Hibbs" <[email-masked]>
Date: Fri, 26 Mar 2004 10:45:35 -0800

comments inline

--Barr

> From: todd glassey
> Sent: Friday, 26 March 2004 09:54
>
> ... yes this is the dilemma - and one of those
> factors is that those individuals may not legally
> represent the IP Owners interests although they
> may be the authors of the IP in question. The
> current policy is totally broken with regard to
> this and its a serious issue.
>
...trying to resolve this is like trying to establish
unequivocally "who knew what, when?" after the fact -- in
other words, not very likely to ever have a resolution that
is completely satisfactory to everyone.  This is made much
more complicated by the [inferred] policy of many IPR
holders to deliberately say as little as possible about the
details of their IPR claims:  as mentioned, the author of an
I-D may not even be fully cognizant of their organization's
IPR.  Can we even request that no I-D be submitted without
full identification of IPR claims, given the reluctance many
IPR holders have to doing so?

> Likewise the submissions process is also broken
> since there is no release or otherwise against
> the use of any of this IP in the IETF or other orgs.
>
...again, the reluctance of IPR holders to even describe in
general terms the nature of their claims, and their further
reluctance to grant general rights a priori makes this
problematic.  While I personally believe that the IPR holder
would not be damaged in any meaningful way if disclosures of
their claimed rights and policies for licensing were
required to be disclosed as a pre-condition for acceptance
of an I-D as a work item, I'm certain that I'm in the
minority with that opinion.

> But the biggest problem herein is what to do when
> some impropriety is found.  Or how to remove any
> one protocol... For instance there is no statement
> in any documents that I have seen saying that the
> IETF has a IP retraction policy or process, that
> the IETF will retract or remove from publication
> with its copyright statement, anything that turns
> out to be "not the property of the submitter"...
>
...not just with respect to IPR issues:  the IETF has never
had much success deprecating obsolete or disused options and
protocols, despite the obvious "greater good" that can often
be argued for deprecation or obsolescence.  Likewise there
is no "sunset" policy in place, either.  Effective
deprecation and sunsetting in protocol matters would benefit
IPR matters as well.  Thus I generally agree with the
remainder of Todd's points....

> This also dove-tails into the issues of how to
> retire protocols and how one protocol challenges
> and removes a WG's protocol's if that WG refuses
> to allow more than one instance of a protocol
> type in it. This is critical as an open standards
> platform since what there is in place now is "the
> IETF is a one-way publishing" entity in my
> opinion, and if the IETF wants to be immune from
> any damages done with its processes, then it MUST
> (IMHO) also deal with how to retire and what to
> do with violations of IP rights that occur inside
> of it.

---

From: "todd glassey" <[email-masked]>
Date: Fri, 26 Mar 2004 16:35:47 -0800

----- Original Message ----- 
From: "Richard Barr Hibbs" <[email-masked]>
To: <[email-masked]>
Sent: Friday, March 26, 2004 10:45 AM
Subject: RE: IETF Operational question

> is completely satisfactory to everyone.

Which is why a formal release process is the only real possible solution to
this problem. It is the smallest increase in workflow process overhead too
of any of the possible solutions I think also. So this is an instance where
the Release Solution is the lesser of all evils here.

> This is made much
> details of their IPR claims:

Yeah - but then vetting them here in the IETF is almost an abuse of the
IETF's IP Vetting Resource then wouldnt you say? Anyone that expends any
amount of effort or works on a protocol with someone who has knowledge of
the IP issues but is not saying... its just messy.

> as mentioned, the author of an
> IPR.

Then what are they doing submitting their employer's IP to the IETF for?

> Can we even request that no I-D be submitted without

Dont need to - just need a release against the IETF's publishing the
document, a hold harmless release.

> minority with that opinion.

Richard - Say someone pays a consultant to develop something and that
Consultant publishes this material. What recourse does the actual owner of
the material have? Now the only possible recourse is to sue the IETF to
force a public retraction of the assertion of the ISOC copyright and damages
resulting from this action.

The only question that is relevant is whether the IETF's process
intentionally turns a blind eye to this and IMHO the obvious answer is that
it does now.

The solution is so simple its ridiculous. Anyone filing ANYTHING needs to
have a release on file with the IETF. Nothing else will protect the IETF or
the rest of the players from any reasonably competent attorney otherwise
IMHO and not doing this because people don't want to be held accountable for
what they do, is negligent also IMO. As a standards body the IETF knows that
IP Rights are critical and even Note Well is dealt with. So why not also
deal with this release issue?

> remainder of Todd's points....

Thanks - By the way - I think that there  needs to be some process to expire
or force the expiry of incumbent protocols too, otherwise this is the "Idi
IETF, President For Life" kinda standards thing...

And that there is no formal routine for what to do when the IETF needs to
retract a document in print for Copyright Violations means the first time
something evil happens here, the only opportunity is for a Court ordered
solution and that is bad news for a Standards Body.

---

From: "Richard Barr Hibbs" <[email-masked]>
Date: Sat, 27 Mar 2004 11:39:46 -0800

comments inline

--Barr

> Sent: Friday, 26 March 2004 16:36
>
> > unequivocally "who knew what, when?" after the fact--
> > in other words, not very likely to ever have a
> > resolution that is completely satisfactory to
> > everyone.
>
> Which is why a formal release process is the only
> real possible solution to this problem. It is the
> smallest increase in workflow process overhead too
> of any of the possible solutions I think also. So
> this is an instance where the Release Solution is
> the lesser of all evils here.
>
...whether a formal release process is a better solution
than simply requiring identification and description of IPR
claims is something that I'll leave to the I-D and RFC
Editors, but I agree that the general interests of IETF
participants are not well-served by obscuring or hiding IPR
claims.

> > This is made much more complicated by the
> > [inferred] policy of many IPR holders to
> > deliberately say as little as possible about the
> Yeah - but then vetting them here in the IETF is
> almost an abuse of the IETF's IP Vetting Resource
> then wouldnt you say?
>
...forced vetting by someone other than the IPR holders is
likely to be considered abusive, but that's not what I'd
intended.  I believe that it is in the best interests of
both the IPR holders and potential implementors of IETF
documents for IPR claims to be identified openly so that
legal issues can be handled straightforwardly.

Clearly some legal counsel for IPR holders does advise that
no representation of the breadth, depth, or scope of an IPR
claim be made publicly:  as an implementor, my reaction
(being that I'm of very limited resources) would be to
choose not to implement an RFC containing such murky claims.
The obvious danger is that if many of us were to choose to
do that, the IETF voluntary standards process would quickly
degenerate into irrelevance.

I also disagree with the current tacit policy of separating
RFCs and I-Ds from IPR statements about them.  My own belief
is, again, that it would be in the best interests of both
IPR holders and implementors if such claims were either
contained verbatim (my preference) or specifically
referenced in all IETF documents to which they might apply.

I have been party to discussions in individual working
groups that were clearly divided about IPR claims:  one
group wishing to refuse to advance any I-D that contained
any IPR claims, and the other not taking such a bold stand.
An eventual compromise of sorts was reached by agreeing to
work solely under a general IETF policy to prevent having
multiple policies in effect (one per work group, or worse,
one per work item) though it is a somewhat uneasy truce.

> Anyone that expends any amount of effort or works
> on a protocol with someone who has knowledge of
> > as mentioned, the author of an I-D may not even
> >be fully cognizant of their organization's IPR.
>
...example:  Very Small Networks, Inc., contributes an I-D
that is advancing through the appropriate working group.
Very Big Networks, Inc., purchases the smaller company and
has IPR claims (closely held as Trade Secrets and Patent
Applied For) in a related area.  The I-D authors may not
even be aware of the closely held IPR claims.  Now what?
Legally, Very Big Networks, Inc., probably does have
responsibility for the I-D, but practically?  How could a
rational observer claim that work done by Very Small
Networks prior to their acquisition should somehow be
covered by this policy?

In organizations which have R&D labs it is entirely possible
that parallel lines of development and investigation are
occurring which may not be known to the other because of
secrecy.  Does legal counsel review every single submission
even in companies having a long history of protecting their
IPR?  I doubt it.  Comments made to the mailing lists are
also very unlikely to be reviewed.  What we must strive to
develop is a comprehensive and completely workable policy.

> > full identification of IPR claims, given the
> > reluctance many IPR holders have to doing so?
>
> Dont need to - just need a release against the IETF's
> publishing the document, a hold harmless release.
>
...I think that would have to be tested with a lawsuit, but
requiring a "Hold Harmless" release as a condition of
submittal is still probably a GoodThing(tm).

> > ...again, the reluctance of IPR holders to even
> > describe in general terms the nature of their claims,
> > and their further reluctance to grant general rights
> > a priori makes this problematic.  While I personally
> > believe that the IPR holder would not be damaged in
> > any meaningful way if disclosures of their claimed
> > rights and policies for licensing were required to
> > be disclosed as a pre-condition for acceptance
> Richard - Say someone pays a consultant to
> develop something and that Consultant publishes
> this material. What recourse does the actual
> owner of the material have?
>
...while in most jurisdictions, "Work for Hire" is the
property of the customer, that is not universally the case,
nor have you considered that the Consultant may
contractually retain ownership of the material.

> Now the only possible recourse is to sue the
> IETF to force a public retraction of the
> assertion of the ISOC copyright and damages
...probably not the only recourse, and certainly not the
best advised in all cases, given that some jurisdictions
severely limit "Deep Pockets" lawsuits or totally disallow
them.

Still, your point of the theoretical liability of the IETF,
IESG, and ISoc is indeed relevant, and I agree that the IETF
truly needs to develop and enforce a policy that limits the
liability of the IETF, IESG, ISoc, and individual
contributors to the standards process as well as
implementors.

> The only question that is relevant is whether the
> IETF's process intentionally turns a blind eye to
> this and IMHO the obvious answer is that it does
> now.
>
...yes, I agree that the IETF has not adequately addressed
the issue, which is why this discussion is valuable.

> The solution is so simple its ridiculous. Anyone
> filing ANYTHING needs to have a release on file
> with the IETF. Nothing else will protect the IETF
> or the rest of the players from any reasonably
> competent attorney otherwise IMHO and not doing
> this because people don't want to be held
> accountable for what they do, is negligent also
> IMO. As a standards body the IETF knows that
> IP Rights are critical and even Note Well is
> dealt with. So why not also deal with this
> release issue?
>
...I don't think that the IPR attorneys are going to be at
all pleased if this is a requirement.  That said, I'm not
advocating that the issue should be ignored, but rather that
we should adopt some common-sense policies that address the
issues as best we can.  For example:

--authors of new I-D's must include a statement of their (or
their employer's) IPR claims for material contained in the
I-D [this assumes that no work would be submitted as an I-D
if it's covered by Trade Secret or Patent Applied For
status, but both these cases may need to be covered as well]

--authors must include in the References section any known
IPR claims held by others

--authors must include a statement of licensing terms and
conditions for any IPR claimed, specifically covering
implementations and derived works

--authors must release the IETF, IESG, and ISoc from any IPR
liability arising from publishing the document

> > ...not just with respect to IPR issues:  the IETF
> > has never had much success deprecating obsolete or
> > disused options and protocols, despite the obvious
> > "greater good" that can often be argued for
> > deprecation or obsolescence.  Likewise there is no
> > "sunset" policy in place, either.  Effective
> > deprecation and sunsetting in protocol matters
> > would benefit IPR matters as well.  Thus I
> > generally agree with the remainder of Todd's points.
>
> Thanks - By the way - I think that there  needs
> to be some process to expire or force the expiry
> of incumbent protocols too, ....
>
...that's the "sunset" provisions....

> And that there is no formal routine for what to
> do when the IETF needs to retract a document in
> print for Copyright Violations means the first time
> something evil happens here, the only opportunity
> is for a Court ordered solution and that is bad
> news for a Standards Body.
>
...gladly, the only IETF documents I've seen which
incorporated other published work (and occasionally,
copyrighted unpublished work) generally followed accepted
practice for "fair use," or included passages (even entire
works) by reference only, which is an allowed method.  I've
even had the I-D and RFC Editors point out errors in quoted
passages and referenced work.  My opinion is that we're
reasonably clean with respect to Copyrights, but a clear
policy might deflect any future claims.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Sat, 27 Mar 2004 22:12:20 -0500

In message <[email-masked]>, "Richard Barr Hi

>referenced in all IETF documents to which they might apply.

Just to be clear -- the reason the IETF has not adopted this policy is 
that IPR claims change; RFCs, once issued, do not.  It's only against 
our practices to recall RFCs, it's impossible -- there are too many 
copies of them.  Nor is it clear that rapidly reissuing new versions of 
existing RFCs, with just the IPR section changing, is a net benefit to 
the community -- implementors would have to know that the differences 
between rfcXXXX, rfcYYYY, and rfcZZZZ were solely in the assertion of 
IPR claims, rather than anything substantive.  We could, I suppose, use 
the RFC Errata process for this, but it's quite unclear to me that 
that's better than the existing IPR web page.

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: "Richard Barr Hibbs" <[email-masked]>
Date: Sun, 28 Mar 2004 10:26:37 -0800

> From: Steven M. Bellovin [mailto:[email-masked]]
> Sent: Saturday, 27 March 2004 19:12
>
> "Richard Barr Hibbs" writes:
>
> >I also disagree with the current tacit policy of
> >separating RFCs and I-Ds from IPR statements about them.
> >My own belief is, again, that it would be in the best
> >interests of both IPR holders and implementors if such
> >claims were either contained verbatim (my preference)
> >or specifically referenced in all IETF documents to
> >which they might apply.
>
> Just to be clear -- the reason the IETF has not
> adopted this policy is that IPR claims change; RFCs,
> once issued, do not.  It's only against our practices
> to recall RFCs, it's impossible -- there are too many
> copies of them.  Nor is it clear that rapidly
> reissuing new versions of existing RFCs, with just the
> IPR section changing, is a net benefit to the
> community -- implementors would have to know that the
> differences between rfcXXXX, rfcYYYY, and rfcZZZZ were
> solely in the assertion of IPR claims, rather than
> anything substantive.  We could, I suppose, use the
> RFC Errata process for this, but it's quite unclear to
> me that that's better than the existing IPR web page.
>
Steve, you and I will politely disagree about the mechanism,
though I imagine that our ultimate goals are pretty much the
same.  I'm hoping for a clear and concise set of
requirements (either mandatory--"MUST"--or strongly
recommended--"SHOULD") that simplifies the identification of
IPR claims for all interested parties.  I completely agree
with you that burdening the authors and editors with a
continuing stream of updates because of changing IPR claims
may be entirely wrong-headed, but I'm not convinced that the
IPR web page is the best means of keeping information about
the claims current.  Is there a workable compromise, such as
requiring a reference (in I-Ds and RFCs) to an IPR resource,
perhaps with specifically useful keywords to enable an easy
search?

I remain unconvinced that "an RFC is forever" is the best
policy.  I'm aware of several RFCs and options delineated in
other RFCs that do not now have, nor have ever had
implementations, even by the RFC authors or their
organizations.  Do we really benefit by maintaining those in
perpetuity?  While an obsolete or unimplemented RFC can be
ignored in many cases, RFCs that forever reserve a portion
of their option numbering space for unimplemented (and maybe
unimplementable) options poses a burden on later authors,
who may find themselves in the position of not having an
available option number for a useful addition.  I'd very
much like to have a "sunset" provision for RFCs, or a
requirement that an RFC MUST have a minimum number of
interoperable implementations before it could be advanced to
Draft Standard or Internet Standard.

--Barr

---

From: "Robert Barr " <[email-masked]>
Date: Mon, 29 Mar 2004 10:22:46 -0800

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Steven M. Bellovin
> Sent: Saturday, March 27, 2004 7:12 PM
> To: [email-masked]
> Cc: [email-masked]
> In message 
> <[email-masked]>, "Richard Barr Hi
> bbs" writes:
> 
But how is an IPR statement associated with an RFC if it is initially posted
to the web page with a reference to the I-draft?
rbarr

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 30 Mar 2004 05:54:28 -0800

> Draft Standard or Internet Standard.

The topic of sunsetting standards is something that has been discussed 
numerous times, and is probably most closely related to the (newly formed) 
NEWTRK WG.

In this context, I will just note two things:

- RFCs do not go away. Ever. Even if the documents are declared Historic 
and all their IANA registrations are repurposed for other things (usually a 
Bad Idea, but it could happen), the RFCs stay around and available. Doing 
otherwise (even if it was possible) would just be destroying part of the 
historical record.

- The standards-track status of an RFC does not impact the IPR claims made 
on it. A standard that can't be implemented without infringing on a patent 
will still infringe the patent after it's retired.

But the rest of this discussion belongs in NEWTRK.

                       Harald

---

From: "Bob Wyman" <[email-masked]>
Date: Wed, 31 Mar 2004 16:28:31 -0500

Robert Barr wrote:
> But how is an IPR statement associated with an RFC
> if it is initially posted to the web page with a
> reference to the I-draft? rbarr
	An RFC is a "resource" right? And thus, it could or should
have a unique and persistent URI associated with it. Similarly, we can
define unique and persistent URIs for a listing of IPR statements
associated with an RFC. Thus,

	http://ietf.org/rfc/rfcXXXXX.txt
might be the URI for an RFC (also, conveniently its URL) while
	http://ietf.org/ipr/rfcXXXXX.txt
might be the URI for IPR statements associated with it.

	Similar URI's would be defined for ID's and their IPR
statements. One of the actions required of the RFC editor, upon
creation of an RFC from an ID, would be to associate the ID's IPR
statements with the RFC's IPR URI... It also might make sense to
incorporate into the body of new RFCs the URIs of the IDs that they
were based on. (This will facilitate a variety of searching and
analysis functions.)
	Additionally, those who discuss or document IPR issues
relative to RFCs should be encouraged to include the RFC's IPR URI in
their writings. This will allow others using searching tools like
Google, AltaVista or PubSub.com to track and discover such documents
even when they are not maintained by the IETF.
	In the parlance of Topic Maps, XTM, etc., the URI's that I'm
suggesting above would be known as and function as "Published Subject
Indicators." i.e. the provide taxonomy independent markers for
discussions of specific subjects. For instance,
"http://ietf.org/ipr/rfcXXXX.txt" would indicate that IPR claims
relative to RFCXXXX.txt where being discussed in the email message,
newsgroup posting, weblog item, chat room discussion, or HTML document
that incorporated a reference to the URI. You could then go to a
search engine, search for the URI, and discover all "visible"
references to the subject.
	Does this make sense?

		bob wyman