Subject: Feedback Requested on Draft Fees Policy

From: IETF Administrative Director <[email-masked]>
Date: Fri, 20 Jul 2012 06:07:33 -0700

The IAOC is seeking community feedback on a proposed policy by the IAOC to impose 
fees to produce information and authenticate documents in response to subpoenas and 
other legal requests.

The IETF receives requests for information, documentation, authentication or other 
matters through subpoenas and less formal means that require manpower and materials 
to be expended.  These requests are on the rise. During the period 2005 to 2010 the IETF 
responded to nine subpoenas.  Since 2011 the IETF has received five subpoenas and three 
other legal requests for authenticated documents.  

Each such request is time sensitive and involves the IETF Counsel, the IAD, and members 
of the IAOC, who together form the Legal Management Committee, to rapidly analyze and 
identify the means for satisfying the request.  Often there is a need to retain outside counsel, 
especially in cases that might lead to depositions or court testimony. 

The IAOC believes a Schedule of Fees is an appropriate and reasonable means to recover 
costs associated with such efforts.

The draft policy entitled Draft Fee Policy for Legal Requests can be found 
at: <http://iaoc.ietf.org/policyandprocedures.html>

Before adopting a policy the IAOC would like feedback on this before making a 
decision.  Comments appreciated to [email-masked] by 6 August 2012.

Ray Pelletier
IETF Administrative Director

---

From: "Jiankang Yao" <[email-masked]>
Date: Fri, 20 Jul 2012 21:23:12 +0800

I have taken a look at this policy. but still not very clear about this 
policy.

could you kindly show some  examples for charging the fee?

Jiankang Yao

----- Original Message ----- 
From: "IETF Administrative Director" <[email-masked]>
To: "IETF Announcement List" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Friday, July 20, 2012 9:07 PM
Subject: Feedback Requested on Draft Fees Policy

The IAOC is seeking community feedback on a proposed policy by the IAOC to 
impose
fees to produce information and authenticate documents in response to 
subpoenas and
other legal requests.

The IETF receives requests for information, documentation, authentication or 
other
matters through subpoenas and less formal means that require manpower and 
materials
to be expended.  These requests are on the rise. During the period 2005 to 
2010 the IETF
responded to nine subpoenas.  Since 2011 the IETF has received five 
subpoenas and three
other legal requests for authenticated documents.

Each such request is time sensitive and involves the IETF Counsel, the IAD, 
and members
of the IAOC, who together form the Legal Management Committee, to rapidly 
analyze and
identify the means for satisfying the request.  Often there is a need to 
retain outside counsel,
especially in cases that might lead to depositions or court testimony.

The IAOC believes a Schedule of Fees is an appropriate and reasonable means 
to recover
costs associated with such efforts.

Before adopting a policy the IAOC would like feedback on this before making 
a
decision.  Comments appreciated to [email-masked] by 6 August 2012.

Ray Pelletier

---

From: Warren Kumari <[email-masked]>
Date: Fri, 20 Jul 2012 10:05:33 -0400

> IETF Administrative Director

LGTM++.

Seems like a grand idea -- who knows, may even help avoid nuisance suits (although the fees are so small (compared to all the other costs) that I don't hold much hope of this…).

W

--
For every complex problem, there is a solution that is simple, neat, and wrong.
                -- H. L. Mencken

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 20 Jul 2012 10:08:43 -0400

+1

Although I wonder whether radical openness would be cheaper in the long run: Put everything online and have an auto-responder at [email-masked] that says "Go look it up yourself."

--Richard

---

From: "Bradner, Scott" <[email-masked]>
Date: Fri, 20 Jul 2012 14:17:08 +0000

great idea - just does not jive with the legal system which often need authenticated 
copies of documents

Scott

On Jul 20, 2012, at 10:14 AM, Scott Brim wrote:

> Fine idea.

---

From: Scott Brim <[email-masked]>
Date: Fri, 20 Jul 2012 07:14:34 -0700

Fine idea.

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 20 Jul 2012 10:25:03 -0400

[assuming you mean the "go look it up" idea]

We have the technology.  Surely a CMS signed object (or even just an HTTPS download) would provide adequate authentication that it came from the IETF.  And it doesn't seem like we would have a problem providing authenticated documents to the world.

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Fri, 20 Jul 2012 16:27:54 +0200

Except that there is a cost of taking all the existing paper archives and making them available in such a manner. How many thousand pages are out there?

Keith

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Richard L. Barnes
> Sent: 20 July 2012 15:25
> To: Bradner, Scott
> Cc: [email-masked]; [email-masked]; Scott Brim; [email-masked];
> [email-masked]
> Subject: Re: Feedback Requested on Draft Fees Policy
> 
> We have the technology.  Surely a CMS signed object (or even just an HTTPS
> download) would provide adequate authentication that it came from the IETF.
> And it doesn't seem like we would have a problem providing authenticated
> documents to the world.
> 
> 
> 
>

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 20 Jul 2012 15:39:31 +0100

> fees to produce information and authenticate documents in response to subpoenas and 

Do it. This will dissuade trivial requests and will be a drop in the ocean
of costs for serious lawsuits.

Don't forget to appropriately update http://iaoc.ietf.org/subpoena.html.

 Brian

---

From: Dave Crocker <[email-masked]>
Date: Fri, 20 Jul 2012 08:56:30 -0700

> We have the technology.  Surely a CMS signed object (or even just an HTTPS download) would provide adequate authentication that it came from the IETF.  And it doesn't seem like we would have a prob…

Do you know that these are acceptable to most/all courts?

d/
-- 
  Dave Crocker
  Brandenburg InternetWorking
  bbiw.net

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 20 Jul 2012 12:40:39 -0400

> Do you know that these are acceptable to most/all courts?

IANAL, so no.  But what else are we going to provide that's better?

--Richard

---

From: "John Levine" <[email-masked]>
Date: 20 Jul 2012 16:52:23 -0000

>IANAL, so no.  But what else are we going to provide that's better?

Technically, nothing.  But that's not how courts work.  When they want
an authenticated document, they want one that is authenticated by a
person.  A blob of text with a bunch of crypto signatures would need a
technical expert to tell the court why the crypto means the document
is authentic.

Keep in mind that RFCs and I-Ds are used in lawsuits all the time
(speaking from personal experience here) and in most cases, both sides
accept that the copy of the document is OK and that's that.  In the
few cases that show up at the IETF, it means that someone in the case
is being pissy, and they don't want a streamlined process.

R's,
John

PS: I still think we should set an hourly rate for research, to deter
subpoenas for "all mail from A about B" and so forth.

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 20 Jul 2012 13:23:49 -0400

> technical expert to tell the court why the crypto means the document

For the US, at least: 
<http://en.wikipedia.org/wiki/Electronic_Signatures_in_Global_and_National_Commerce_Act>

---

From: Bob Hinden <[email-masked]>
Date: Fri, 20 Jul 2012 10:53:27 -0700

Richard,

> IANAL, so no.  But what else are we going to provide that's better?

We are doing things like signing internet-drafts and RFCs to make this possible, but it will be a long while before the courts catch up.  They are not exactly early adopters of things like this :-)

Bob

---

From: John C Klensin <[email-masked]>
Date: Fri, 20 Jul 2012 14:08:15 -0400

--On Friday, July 20, 2012 16:52 +0000 John Levine
<[email-masked]> wrote:

> Keep in mind that RFCs and I-Ds are used in lawsuits all the
> time (speaking from personal experience here) and in most
> cases, both sides accept that the copy of the document is OK
> and that's that.  In the few cases that show up at the IETF,
> it means that someone in the case is being pissy, and they
> don't want a streamlined process.
> 
> R's,
> John
> 
> PS: I still think we should set an hourly rate for research,
> to deter subpoenas for "all mail from A about B" and so forth.

FWIW, +1 to both of these comments.  

If I recall, John's first version of the research comment was
"all mail from A about B during month M".  If someone is trying
to use the document process to be difficult, "all mail from A
about B within a three-year period" is as, or more, likely and
could involve serious time.  Where possible, I'd rather see us
reject such requests than return documents (even if we have to
tell them where the associates can go to learn how to work the
archives or hire a consultant to do the search).  If that isn't
possible, we shouldn't incur uncompensated costs.

    john

---

From: "John R Levine" <[email-masked]>
Date: 20 Jul 2012 14:13:27 -0400

> <http://en.wikipedia.org/wiki/Electronic_Signatures_in_Global_and_National_Commerce_Act>

That's about contracts, not authenticated documents.  An RFC may be many 
things, but it's not a contract.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: "Leif Johansson" <[email-masked]>
Date: Fri, 20 Jul 2012 17:33:01 +0200

> Although I wonder whether radical openness would be cheaper in the long run: Put everything online and have an auto-responder at [email-masked] that says "Go look it up yourself."

I could think of some other things it could say too...

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 20 Jul 2012 14:45:25 -0400

> could you kindly show some  examples for charging the fee?

I looked at this before the policy was created.

Many internet companies do this.

Yahoo :
http://cryptome.org/isp-spy/yahoo-spy.pdf
•	Basic subscriber records: approx. $20 for the first ID, $10 per ID thereafter
 •	Basic Group Information (including information about moderators):
approx. $20 for a group with a single moderator
•	Contents of subscriber accounts, including email: approx. $30-$40
per user •	Contents of Groups: approx. $40 - $80 per group

Verizon :
http://www.verizon.net/policies/civil_subpoena.asp

Verizon Online charges the following rates for compliance with civil
subpoenas and other legal process. For subpoenas and other legal
process that require substantial effort by Verizon Online, Verizon
Online reserves the right to charge a rate of $75 per hour (plus
overtime costs if necessary) and to collect an estimated fee in
advance. Except as set forth in the preceding sentence, Verizon
Online's subpoena compliance fees and charges are as follows:

$40.00 per IP record requested (unless overtime charges apply)
$22.00 per Federal Express or actual shipping charges if higher
$0.25 cents per copy

Sprint
http://info.publicintelligence.net/SprintSubpoenaManual.pdf

Lots of different fees. Minimum $50.00 administrative processing fee
for Civil requests.

AT&T
https://contact.bellsouth.com/subpoena/
Fees for Subpoena Processing: AT&T charges a fee for the processing of
civil subpoenas.

I do not think that the fees suggested here are at all out of line
with either the actual burden or with what other organizations do.

Regards
Marshall

>
> Jiankang Yao
>
> ----- Original Message ----- From: "IETF Administrative Director"
> <[email-masked]>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 22 Jul 2012 10:54:57 -0400

In theory yes, a signed document would be sufficient.

In practice it would then require an expert witness at $400/hr to
explain that it meant it was authentic.

The schedule of fees seems a reasonable response to a real cost being
imposed on the organization.

-- 
Website: http://hallambaker.com/