Subject: Future Handling of Blue Sheets

From: IETF Chair <[email-masked]>
Date: Sun, 22 Apr 2012 10:31:15 -0400

At IETF 83, we had a discussion about the future of blue sheets, many spoke at the mic in support of the proposal.  There has been very little discussion on the mail list.  However, all of the discussion that I have see has been very supportive.

The suggestion is three blue sheet changes:
1.  No longer ask for email address;
2.  Scan the blue sheet and include the image in the proceedings for the WG session; and
3.  Discard paper blue sheets after scanning.

Please speak up if you think this is the wrong thing to do.

Thanks,
  Russ

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 23 Apr 2012 11:44:31 +0800

Hi Russ,

from a privacy perspective: may I ask for what purpose you propose to 
publish the blue sheets (with the names of all WG session attendees) 
with the proceedings?
AFAIK, at the moment the blue sheets are basically available on request 
especially in case of IP questions. What would lead to the proposal to 
publish the list of names of attendees always with the proceedings?

Best regards, Tobias

Ps.: btw. though I might be the only one, but I liked the blue sheet 
replacement experiment (RFID) in Hiroshima...

---

From: Robert Raszuk <[email-masked]>
Date: Mon, 23 Apr 2012 05:48:51 +0200

+1 = 2

R.

---

From: Shishio Tsuchiya <[email-masked]>
Date: Mon, 23 Apr 2012 12:59:05 +0900

I also like it.
http://www.ietf.org/proceedings/76/slides/plenaryw-2.ppt

---

From: Joel jaeggli <[email-masked]>
Date: Sun, 22 Apr 2012 21:14:48 -0700

> publish the list of names of attendees always with the proceedings?

The attendee list is published with the proceedings already.

The blue sheets are role call and accountability for a public meeting.

>> At IETF 83, we had a discussion about the future of blue sheets, many
>> spoke at the mic in support of the proposal.  There has been very
>> little discussion on the mail list.  However, all of the discussion
>> that I have see has been very supportive.
>>

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 23 Apr 2012 12:21:36 +0800

> The attendee list is published with the proceedings already.
I know.
> The blue sheets are role call and accountability for a public meeting.

I understand that. But my question would be why do we need/want to 
publish the blue sheets with the proceedings?

---

From: Russ Housley <[email-masked]>
Date: Mon, 23 Apr 2012 00:41:49 -0400

Hi Tobias.

I would like to make them available as part of the proceedings so that anyone can find them and view them.  This _may_ reduce subpoenas for the blue sheets in the future.

Many people have expressed similar thoughts about the RFID experiment.  Last time we investigated a system for IETF meetings, it was quite expensive.  I'll ask again to see if this has changed.

Russ

On Apr 22, 2012, at 11:44 PM, Tobias Gondrom wrote:

> Hi Russ,
> 
> from a privacy perspective: may I ask for what purpose you propose to publish the blue sheets (with the names of all WG session attendees) with the proceedings?
> AFAIK, at the moment the blue sheets are basically available on request especially in case of IP questions. What would lead to the proposal to publish the list of names of attendees always with the proceedings?
> 
> Best regards, Tobias
> 
> 
> Ps.: btw. though I might be the only one, but I liked the blue sheet replacement experiment (RFID) in Hiroshima...
> 
> 
>

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 23 Apr 2012 13:12:11 +0800

Hi Russ,

thank you for the information.
In this case, my preference would be not to publish the blue sheets with 
the proceedings.

Reasoning:
The blue sheet data can at some point be used to determine movement 
profiles of individual attendees at the meeting to a finer granularity 
than today and therefore can be an issue for privacy (even though I 
recognize that this is a public meeting). The fact that we "may reduce" 
the amount of subpoenas is a viable reason, still personal data should 
be handled as conservative as possible. Without a significant and 
measurable economic advantage by the publication, we should rather not 
publish this data with the proceedings.
(My underlying assumption is of course that currently our cost of 
subpoenas is not forbiddingly high compared to overall conference costs. 
If that assumption proves to be false, I would have to rethink my 
statement above.)

Besides that:
- am agnostic on whether we ask for email address or not (in the end I 
gave up on hiding my email address as a way to reduce spam...)
- even without publication, we could still scan the blue sheets and 
maintain them in an electronic archive without keeping the hard copies 
(please note there may be legal requirements on procedures of handling 
non-paper copies that are later to be used in a court of law).
- And if we would go to a Hiroshima/RFID model, the discovery in 
subpoenas could be much easier compared to scanned paper documents with 
handwritten names.

Just my 5cents.

Tobias

---

From: Randy Bush <[email-masked]>
Date: Mon, 23 Apr 2012 07:21:27 +0200

> subpoenas could be much easier compared to scanned paper documents with 

fwiw, i am with tobias all the way up to, but not including, the rfid.
i find it interesting that he does not like the publication of fine
grained personal location data by blue sheet, but does not mind a likely
much finer grained electronic one.

i see ourselves some years from now having electronic tracking of
whether X was in the room during which parts of the discussion.  do not
like.

randy

---

From: Joel jaeggli <[email-masked]>
Date: Sun, 22 Apr 2012 22:41:43 -0700

On 4/22/12 22:12 , Tobias Gondrom wrote:
> be handled as conservative as possible.

What property of the blue sheet makes it personal data.

> Without a significant and
>> I would like to make them available as part of the proceedings so that
>> anyone can find them and view them.  This _may_ reduce subpoenas for
>> the blue sheets in the future.
>>
>> Many people have expressed similar thoughts about the RFID
>> experiment.  Last time we investigated a system for IETF meetings, it
>> was quite expensive.  I'll ask again to see if this has changed.
>>
>> Russ
>>
>>
>>> AFAIK, at the moment the blue sheets are basically available on
>>> request especially in case of IP questions. What would lead to the
>>> proposal to publish the list of names of attendees always with the
>>> proceedings?
>>>
>>> Best regards, Tobias
>>>
>>>
>>>> At IETF 83, we had a discussion about the future of blue sheets,
>>>> many spoke at the mic in support of the proposal.  There has been
>>>> very little discussion on the mail list.  However, all of the
>>>> discussion that I have see has been very supportive.
>>>>

---

From: Robert Raszuk <[email-masked]>
Date: Mon, 23 Apr 2012 07:42:01 +0200

> much finer grained electronic one.

Scanning a tag when you enter the room does not equal publishing your 
location points to public. Those are completely orthogonal spaces.

> whether X was in the room during which parts of the discussion.  do not

You do not need to touch RFID or any form of reader when you exit the 
room. No one is to determine "parts of discussion".

Anyhow for those who just can not keep up with advances in technology - 
for some transition period - we could still have blue sheets and pen at 
the doors ;-)

r.

---

From: Robert Raszuk <[email-masked]>
Date: Mon, 23 Apr 2012 07:45:34 +0200

Joel,

> What property of the blue sheet makes it personal data.

WG meeting title and name or email address.

Nothing more helpful for recruiters to get hold of such list and start 
spamming with job offers in given area of technology.

r.

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 23 Apr 2012 13:48:12 +0800

> What property of the blue sheet makes it personal data.

The fact that publishing them will allow to track in which location 
(i.e. meeting room) you are/were at a given point in time. Basically a 
person could track your movement over the time of the IETF week.

---

From: Joel jaeggli <[email-masked]>
Date: Sun, 22 Apr 2012 23:00:39 -0700

> spamming with job offers in given area of technology.

The participants are readily identifiable already.

But that wasn't my question. What data on the blue sheet is personal?

Every person who has registered since at least the publication of 3979
if not before has consented to the public disclosure of records of the
meeting. a list of the meeting attendees is required by 2418.

---

From: Tim Chown <[email-masked]>
Date: Mon, 23 Apr 2012 07:05:25 +0100

On 23 Apr 2012, at 06:48, Tobias Gondrom <[email-masked]> wrote:

> On 23/04/12 13:41, Joel jaeggli wrote:.
>> 
> The fact that publishing them will allow to track in which location (i.e. meeting room) you are/were at a given point in time. Basically a person could track your movement over the time of the IETF week.

I thought one main purpose of blue sheets was to size the rooms appropriately.

If people stop signing the sheets due to privacy concerns, and I would expect many to do so if this change is made, we might be seeing a few cramped rooms.

Tim

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 Apr 2012 09:55:30 +0300

> I thought one main purpose of blue sheets was to size the rooms appropriately.

If that was the purpose, we could sign pseudonymously. Dibs on "Justin Bieber"

> If people stop signing the sheets due to privacy concerns, and I would expect many to do so if this change is made, we might be seeing a few cramped rooms.

Shouldn't matter as long as the people who stop signing are evenly distributed. Might make security area meetings more cramped.

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 Apr 2012 09:54:24 +0300

> The participants are readily identifiable already.

Effort matters. If getting that data requires a subpoena, or if it requires a formal letter from a lawyer, or if it's available on the website, these are different things. I'm with Tobias on this.

> But that wasn't my question. What data on the blue sheet is personal?

It says where I was, and at what time, and it's nobody's business. It's information that does not need to be disclosed to the public, and therefore shouldn't. We don't have to come up with an attack vector first. 

> meeting. a list of the meeting attendees is required by 2418.

Again, this is a different level of information. On the streets, Legally I don't have an expectation of privacy. The police, or anyone who cares to, may follow me around, and see where I'm going. There is, however, a huge const involved in this, and that's why 20 years ago, people did have an expectation of privacy on the streets. Having surveillance cameras at street corners like they have in too much of the western world right now does not change what the police can or cannot do to an individual. There is a huge change, though, because now they can afford to track everyone all the time. 

Connect those cameras to the Internet as publicly accessible webcams, and our society turns into a whole new kind of surveillance society. Publishing blue sheets is not as bad as that, but it's a step in the wrong direction.

Yoav

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 23 Apr 2012 07:59:39 +0100

> publish this data with the proceedings.

Transparency with respect to IPR disclosures, or missing IPR disclosures,
seems to me more important than the privacy issue. I take Randy's point
that the information can be trawled for unwanted purposes, but IETF
participation always carries that risk.

Tim raised a valid point: more people might decline to sign. We already
have some of that, and I don't have a socially acceptable solution
to that.

Actually we already systematically break our rules in RFC 2418 (BCP 25):
   All working group sessions (including those held outside of the IETF
   meetings) shall be reported by making minutes available.  These
   minutes should include the agenda for the session, an account of the
   discussion including any decisions made, and a list of attendees.
It's only a "should" but when did you last see WG minutes with a list
of attendees? In the old days of hard copy proceedings, I seem to
remember the blue sheets being included sometimes as the lazy way
of satisfying this rule.

    Brian

---

From: Joel jaeggli <[email-masked]>
Date: Mon, 23 Apr 2012 00:04:52 -0700

On 4/22/12 23:54 , Yoav Nir wrote:
>>> Nothing more helpful for recruiters to get hold of such list and
>>> start spamming with job offers in given area of technology.
>> 
> Effort matters. If getting that data requires a subpoena, or if it
> requires a formal letter from a lawyer, or if it's available on the
> website, these are different things. I'm with Tobias on this.
> 
> It says where I was, and at what time, and it's nobody's business.

in the context of the meeting it is in fact the purpose of the blue sheet.

http://tools.ietf.org/html/rfc2418#section-3.1

   All working group actions shall be taken in a public forum, and wide
   participation is encouraged. A working group will conduct much of its
   business via electronic mail distribution lists but may meet
   periodically to discuss and review task status and progress, to
   resolve specific issues and to direct future activities.  IETF
   Plenary meetings are the primary venue for these face-to-face working
   group sessions, and it is common (though not required) that active
   "interim" face-to-face meetings, telephone conferences, or video
   conferences may also be held.  Interim meetings are subject to the
   same rules for advance notification, reporting, open participation,
   and process, which apply to other working group meetings.

> It's information that does not need to be disclosed to the public,
> and therefore shouldn't. We don't have to come up with an attack
> vector first.
> 
>> Every person who has registered since at least the publication of
>> 3979 if not before has consented to the public disclosure of
>> records of the meeting. a list of the meeting attendees is required
>> by 2418.
> 
> Again, this is a different level of information. On the streets,
> Legally I don't have an expectation of privacy. The police, or anyone
> who cares to, may follow me around, and see where I'm going. There
> is, however, a huge const involved in this, and that's why 20 years
> ago, people did have an expectation of privacy on the streets. Having
> surveillance cameras at street corners like they have in too much of
> the western world right now does not change what the police can or
> cannot do to an individual. There is a huge change, though, because
> now they can afford to track everyone all the time.
> 
> Connect those cameras to the Internet as publicly accessible webcams,
> and our society turns into a whole new kind of surveillance society.
> Publishing blue sheets is not as bad as that, but it's a step in the
> wrong direction.
> 
> Yoav
>

---

From: Kireeti Kompella <[email-masked]>
Date: Mon, 23 Apr 2012 01:13:49 -0700

On Apr 23, 2012, at 0:05, "EXT - [email-masked]" <[email-masked]> wrote:

(quoting from RFC 2418)

> discussion including any decisions made, and a list of attendees.

RFCs are not gospel. They can, and, in this instance, should, be changed: either remove that last item, or stately explicitly that there is no expectation of privacy at IETF meetings.  (I have a sinking feeling I know which way that will go.)

Why shouldn't getting the list of a meeting's attendees require a subpoena?  The cost argument is bogus; equally, there are those who think going to a judge for permission to wiretap is a waste of time and money.

Put the money you save on NOT installing RFID kit into a fund for handling subpoenas (only half joking). 

Kireeti

PS: Yoav, regarding your remarks on street surveillance, from the IETF Note Well:

"A participant in any IETF activity acknowledges that written, audio and video records of meetings may be made and may be available to the public."

A camera over meeting room doorways is next.

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 Apr 2012 12:09:51 +0300

> A camera over meeting room doorways is next.

Why over the meeting room doorway. Inside, and pointing at the crowd!  This is already being discussed as a requirement in VMEET.

Yoav

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Mon, 23 Apr 2012 09:26:08 +0000

Joel jaeggli
> What property of the blue sheet makes it personal data.

There was an invited presentation that discussed what personal data is, and other matters, at the Security Area open meeting in Paris. The speaker referred to a paper he'd written that sounds like it would be useful reading; I haven't looked for it yet (if anyone has, a pointer would be useful).

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

---

From: Tobias Gondrom <[email-masked]>
Date: Mon, 23 Apr 2012 18:00:01 +0800

Brian,

> participation always carries that risk.

Actually this is not a question of what is more important:
I agree that we should have the blue sheets for the IPR reasons (and 
also so the secretariat can determine room sizes based on previous 
numbers).
All this is already achieved as it is today without always publishing 
the blue sheets to public.
So my proposal is to keep blue sheets (be it in paper or electronic 
document form) access limited to the IETF secretariat for administrative 
purposes (meeting room size) and make them available in case of 
subpoenas on a per request basis.
This will be a balanced solution to both, our intended use cases and the 
privacy of the attendees.

Best regards, Tobias

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 23 Apr 2012 11:33:33 +0100

> RFCs are not gospel. They can, and, in this instance, should, be changed: either remove that last item, or stately explicitly that there is no expectation of privacy at IETF meetings.  (I have a si…

I disagree. On the contrary, I think the practice of listing attendees
in the minutes should be enforced. I don't think it's in the IETF's
interests for our meetings to be anything other than completely
transparent to the world.

> Why shouldn't getting the list of a meeting's attendees require a subpoena?  The cost argument is bogus; equally, there are those who think going to a judge for permission to wiretap is a waste of…

Because if the attendee list is public, it becomes much easier for third
parties to detect cases where an IPR disclosure requirement has been
evaded. Also, it reduces the work of responding when a subpoena does
arrive: simply send the URL of the meeting minutes, instead of pulling
archive boxes out of off-site storage and searching them. In practice,
it would likely prevent the subpoena ever being generated.

> "A participant in any IETF activity acknowledges that written, audio and video records of meetings may be made and may be available to the public."

Exactly. Your attendance at an IETF session is a matter of public record (as
is your contribution to any IETF mailing list). This is an *open* standards
process, I'm glad to say.

    Brian

---

From: Randy Bush <[email-masked]>
Date: Mon, 23 Apr 2012 12:53:07 +0200

> There was an invited presentation that discussed what personal data
> is, and other matters, at the Security Area open meeting in Paris. The
> speaker referred to a paper he'd written that sounds like it would be
> useful reading; I haven't looked for it yet (if anyone has, a pointer
> would be useful).
> 

the juxtaposition cracks me up

randy

---

From: Thomas Nadeau <[email-masked]>
Date: Mon, 23 Apr 2012 06:06:57 -0700

I agree with you. I've always been puzzled as to why anyone needs to know who specifically attended a meeting. What is that information used for later?  As far as I can, no one ever has gone back to associate email addresses with speakers at the mic, actual attendee lists or presentations or something.  Isn't the point just to gauge how full the room was so that we can book an appropriately sized room for the next meeting?  If that is the case, then just having the chairs take a rough estimate of how many people attended (or even just state a percentage of occupied seats) should suffice, right?

	--Tom

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 Apr 2012 16:36:51 +0300

On Apr 23, 2012, at 4:06 PM, Thomas Nadeau wrote:

> 
> 	I agree with you. I've always been puzzled as to why anyone needs to know who specifically attended a meeting. What is that information used for later?  

The ACWG working group is considering proposals for a higher-bandwidth alternative to RFC 1149. One proposal is to attach flash chips to the birds' legs. This proposal gets accepted, and eventually makes it to RFC. Company A implements this new standard, and then gets sued by Company B, because they have a patent for attaching flash chips to bird legs. When asked why they're only mentioning it now, they claim they had never followed the ACWG. The blue sheets can prove that Bob from Company B was actually at the meeting.

Of course if it comes to this, Company A can subpoena the blue sheets for all ACWG meetings where this proposal had been discussed. I also don't think that public bluesheets would eliminate the subpoena. I think you would usually need to get an official copy from the IETF through a subpoena, rather printing it out from the website for a court filing.

In any case, just scanning them and keeping them on disk makes replying to the subpoena just as easy. There's no significant difference between sending a link and sending a PDF file.

> As far as I can, no one ever has gone back to associate email addresses with speakers at the mic, actual attendee lists or presentations or something.  Isn't the point just to gauge how full the room was so that we can book an appropriately sized room for the next meeting?  If that is the case, then just having the chairs take a rough estimate of how many people attended (or even just state a percentage of occupied seats) should suffice, right?

Yes, but that's not the only reason.

---

From: "George, Wes" <[email-masked]>
Date: Mon, 23 Apr 2012 10:04:26 -0400

> From: [email-masked] [mailto:[email-masked]] On Behalf Of IETF
> Chair
> Sent: Sunday, April 22, 2012 10:31 AM
> To: IETF
> Subject: Future Handling of Blue Sheets
>

[WEG] Based on some other messages in this thread, there seems to be a lack of clarity as to the full, official purpose of the blue sheets. Are they simply to track generic participation levels for room sizing, or are they also meant as a historical record of attendees to a given WG? It seems that if they are being subpoenaed, and they are archived today, I tend to think that they're meant to officially track attendees. I'd appreciate someone correcting me if I'm wrong.

If blue sheets are meant to be an official record, then technically we should document handling/scanning/storage procedures for WG chairs and the secretariat such that this scan will be admissible in lieu of a paper copy for any subpoena or other court proceeding. But if we're honest, I'm not sure that they're of much use as an official record either way. Do we have procedures today that would prevent tampering before the paper copy ends up in an archive box? And even then, blue sheets and jabber logs (for remote participants) are still ultimately a best-effort honor system, and therefore there is no guarantee of their validity. I can remotely participate without registering for the meeting, and can sign into Jabber as "Mickey Mouse" just as easily as I can sign the blue sheet that way. I can also sign as "Randy Bush" or sign my own name completely illegibly.

Could we simply do a headcount for room sizing, and treat the matter of official attendee record for WG meetings as a separate problem? IMO, it's not currently solved by the blue sheets, and I don't see that changing just because we dispense with the paper copies in a box in a warehouse.

Thanks
Wes George

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

---

From: "George, Wes" <[email-masked]>
Date: Mon, 23 Apr 2012 10:07:35 -0400

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Yoav
> Nir
> Sent: Monday, April 23, 2012 2:54 AM
> To: Joel jaeggli
> Cc: [email-masked]
> Subject: Re: Future Handling of Blue Sheets
>
> Effort matters. If getting that data requires a subpoena, or if it requires a
> formal letter from a lawyer, or if it's available on the website, these are
> different things.
[WEG] and I'd counter by saying that anyone who cares enough about the whereabouts of a specific IETF attendee to bother tracking them via online blue sheets will not be stymied much by their unavailability.

> It says where I was, and at what time, and it's nobody's business. It's
> information that does not need to be disclosed to the public, and therefore
> shouldn't. We don't have to come up with an attack vector first.
[WEG] While generally I understand the concept of "need to know" as a reason not to publish, that doesn't answer the question, especially since this information isn't available in real-time. What problem does it create as a matter of historical record of a public forum with a publicly-available attendee list? I think that what we're really talking about here is burden of proof: Is it incumbent upon the IETF to prove that there is material benefit to publishing this information publicly, or upon the attendees to prove that there is material harm in doing so? Given the terms of things like the note well, I tend to believe that it's the latter. Therefore, yes an attack vector would be helpful.

For that matter, shall we also start anonymizing the names of those who speak at the mic when they appear in the minutes? What about the mailing lists? Are you certain that no one with access to public mailing list records might see an email post by you, or a WG draft with your name on it and correctly infer that you may have attended a meeting of that WG during an IETF meeting where your name is on the public meeting attendee list? That would seem to have a similar problem where a low amount of effort would net similar information.

> Again, this is a different level of information. On the streets, Legally I
> don't have an expectation of privacy. The police, or anyone who cares to, may
> follow me around, and see where I'm going.
[WEG] The only meeting in recent memory where there were people actually checking badges to permit entry to the meeting areas (in Beijing), was roundly criticized for doing so, yet somehow IETF meetings are less public than the street? When was the last time that anyone challenged someone not wearing their name badge for simply being in the IETF meeting area?

I think it comes back to the difference between knowing this information in near-real-time (as with a physical tail or camera surveillance) vs. knowing it weeks or months after the fact when the proceedings are published. To participate in the IETF is to have your name publicly associated with it, and allow reasonably intelligent people to infer details about your whereabouts. I still don't understand how the blue sheets have much impact on that fact.

Wes George

---

From: David Morris <[email-masked]>
Date: Mon, 23 Apr 2012 08:04:14 -0700 (PDT)

On Mon, 23 Apr 2012, Yoav Nir wrote:

> Again, this is a different level of information. On the streets, Legally
> I don't have an expectation of privacy. The police, or anyone who cares
> to, may follow me around, and see where I'm going. There is, however, a
> huge const involved in this, and that's why 20 years ago, people did
> have an expectation of privacy on the streets. Having surveillance
> cameras at street corners like they have in too much of the western
> world right now does not change what the police can or cannot do to an
> individual. There is a huge change, though, because now they can afford
> to track everyone all the time.
> 

+1

The ease today with which nominally public information can be aggragated 
is very concerning. Not only does the publication of blue sheet (or RFID
based location information) make it easy to determine where someone was,
it also makes it possible to determine where they weren't.

---

From: Scott O Bradner <[email-masked]>
Date: Mon, 23 Apr 2012 10:58:44 -0400

see rfc 2418 - they are to keep a record as who is taking part in a WG's activities 

keeping track of attendees is a basic part of any standards development organization's process

Scott

---

From: Melinda Shore <[email-masked]>
Date: Mon, 23 Apr 2012 08:22:43 -0800

> keeping track of attendees is a basic part of any standards development organization's process

The tension here appears to be between transparency of process and an
individual right to privacy.  I think that the IETF has a considerable
stake in the former, not just because of the frequency with which some
little pisher or other threatens to sue over what they perceive to be
trust/collusion issues, but because openness is an IETF institutional
value.  I think it should continue to be.  I understand the privacy
issues (although I won't necessary lump them as an instance of revealing
PII) but tend to think that the information being revealed is pretty
sparse and the privacy concerns here probably aren't substantial enough
to counterbalance the organizational interest in keeping processes as
open as possible.

Melinda

---

From: Ted Hardie <[email-masked]>
Date: Mon, 23 Apr 2012 09:54:38 -0700

On Sun, Apr 22, 2012 at 11:59 PM, Brian E Carpenter
> remember the blue sheets being included sometimes as the lazy way

We included the attendees in the minutes for the RTCWEB interim, held
in January of this year:

http://www.ietf.org/proceedings/interim/2012/01/31/rtcweb/minutes/rtcweb.txt

We do not do it for the plenary meetings, because I believed (and I
believe others believed) that the attendee list and blue sheets
together took care of this requirement.  If these need to be
aggregated, then I would personally go back to the "lazy way" you
describe--a scan of the blue sheets included as part of the
proceedings associated with the plenary.  I see no reason for more
state than that.

regards,

Ted Hardie

---

From: Michael StJohns <[email-masked]>
Date: Mon, 23 Apr 2012 13:13:02 -0400

>to counterbalance the organizational interest in keeping processes as

And to put a further point on it - the last sentence of the "NOTE WELL" notice (http://www.ietf.org/about/note-well.html) that applies to each and every IETF meeting and working group session and IETF activity is very clear that written, audio and video records can and will be kept.  A person attending an IETF meeting has no reasonable expectation of privacy for those things we define as "IETF activities".

So if someone demands "privacy", the price is non-participation in the IETF.

Mike

---

From: Samuel Weiler <[email-masked]>
Date: Mon, 23 Apr 2012 13:23:37 -0400 (EDT)

On Mon, 23 Apr 2012, Randy Bush wrote:

> whether X was in the room during which parts of the discussion.  do 
> not like.

+1

I am very sympathetic to the desire to minimize the work of responding 
to subpoenas.  A very effective way to do that is to not have the 
data.

I would strongly prefer to see the blue sheets disappear entirely. 
Let's quit collecting data that we don't need.  The collection of 
attendee lists does not directly support our technical work.  To the 
extent that we need a headcount for meeting planning, a count (without 
names) is sufficient.

-- Sam

---

From: Andy Bierman <[email-masked]>
Date: Mon, 23 Apr 2012 10:26:09 -0700

> So if someone demands "privacy", the price is non-participation in the IETF.

Not exactly -- the NOTE WELL applies to contributions.
Is just showing up and observing the meeting considered a contribution?

Personally, I don't think the blue sheets should even be filled out,
let alone published.  The WG chairs can convey the meeting room size requirements
without passing around clipboards and (hopefully) everybody writing down their name.

There is no correlation between the blue sheets and IETF contributions.
I don't see what purpose they serve anymore.

> Mike

Andy

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 23 Apr 2012 13:56:28 -0400

> I don't see what purpose they serve anymore.

The blue sheets are not just to figure out how many people to plan for
a room (as several people have, I think, already pointed out).
They're also there in order to show whether people were in fact at a
meeting.  This is important in a standards development organization,
particularly one, like the IETF, that maintains official agnosticism
about IPR claims.

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Michael StJohns <[email-masked]>
Date: Mon, 23 Apr 2012 14:31:14 -0400

>Is just showing up and observing the meeting considered a contribution?

The NOTE WELL implicates any "statements", oral, written or electronic as well as "submissions".

The last sentence of the NOTE WELL says "A participant in any IETF activity acknowledges that written, audio and video records of meetings may be made and may be available to the public." - and that puts paid to the concept that an attendee has a "privacy" expectation during the meeting.

>I don't see what purpose they serve anymore.

AFAIK, you're not a patent troll.  I have met them during IETF meetings.  One of my RFC's was patented - without my knowledge or consent.  (cf  RFC2786 vs US Patent No. 7290142)  Fortunately, the record was clear that the RFC and the drafts preceded the applicants "spark".  However, it might have been more interesting had there been need to a) prove when the first public disclosure was made and b) implicate a specific person, company or entity in being present when that disclosure was made.  Hence the blue sheets.

So they do serve a purpose.

Mike

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 23 Apr 2012 14:32:45 -0400

On Apr 23, 2012, at 1:23 PM, Samuel Weiler wrote:
> 
> I would strongly prefer to see the blue sheets disappear entirely. Let's quit collecting data that we don't need.  The collection of attendee lists does not directly support our technical work.  To the extent that we need a headcount for meeting planning, a count (without names) is sufficient.

+1

Margaret

---

From: "James M. Polk" <[email-masked]>
Date: Mon, 23 Apr 2012 14:23:41 -0500

At 01:31 PM 4/23/2012, Michael StJohns wrote:
> >>And to put a further point on it - the last sentence of the "NOTE 
> WELL" notice (http://www.ietf.org/about/note-well.html) that 
> applies to each and every IETF meeting and working group session 
> and IETF activity is very clear that written, audio and video 
> records can and will be kept.  A person attending an IETF meeting 
> has no reasonable expectation of privacy for those things we define 
> as "IETF activities".
> >>
>The last sentence of the NOTE WELL says "A participant in any IETF 
>activity acknowledges that written, audio and video records of 
>meetings may be made and may be available to the public." - and that 
>puts paid to the concept that an attendee has a "privacy" 
>expectation during the meeting.

How can anyone have the expectations for privacy to a meeting they 
have already publicly signed up and paid for - likely with a credit 
card that can also be tracked. To then be concerned about individual 
meeting attendance tied to a certain room during a certain time 
*after the fact* (sometimes by weeks or more) is just silly, and a 
waste of time.

Scan the bluesheets, keep the email addresses for a better record of 
who is who at a certain meeting, destroy the blue sheets after the scan.

James

>AFAIK, you're not a patent troll.  I have met them during IETF 
>meetings.  One of my RFC's was patented - without my knowledge or 
>consent.  (cf  RFC2786 vs US Patent No. 7290142)  Fortunately, the 
>record was clear that the RFC and the drafts preceded the applicants 
>"spark".  However, it might have been more interesting had there 
>been need to a) prove when the first public disclosure was made and 
>b) implicate a specific person, company or entity in being present 
>when that disclosure was made.  Hence the blue sheets.
>

---

From: Stephan Wenger <[email-masked]>
Date: Mon, 23 Apr 2012 19:40:18 +0000

Hi,
According to the proposal, the (scanned and proceedings-attached) blue
sheets contain non machine-interpretable data (handwritten names).
Assuming this, I think our desire for transparency ought to outweigh our
desire for privacy.  It will still require a lot of manual work to
generate a maechine-interpretable version of the bluesheets suitable for
automatic processing, alleviating at least some of the privacy concerns.
OTOH, I consider it rather helpful to be able to go back a few years and
see who was attending a certain WG at a certain time, and who was not.
(Can be helpful for all kinds of things beyond facilities planning and
litigation, for example verifying statements found in resumes, refreshing
one's memory of the who-is-who in a certain WG at a certain time, and so
on.)
My view would probably be different with respect to blue sheet publication
if the content were machine-interpretable.
Email addresses so meaningless nowadays in the sense that everyone who is
careful, or already has bad intentions, can get his/her own use-once email
with only minimal planning and effort.  So let's save some time to
participants when filling out the blue sheet, and remove them from the
blue sheets as proposed.
Stephan

---

From: Peter Sylvester <[email-masked]>
Date: Mon, 23 Apr 2012 23:40:13 +0200

On 04/23/2012 07:23 PM, Samuel Weiler wrote:
>> i see ourselves some years from now having electronic tracking of whether X was in the room 
>> during which parts of the discussion.  do not like.
>
> +1
>
> I am very sympathetic to the desire to minimize the work of responding to subpoenas.  A very 
> effective way to do that is to not have the data.
>
> I would strongly prefer to see the blue sheets disappear entirely. Let's quit collecting data that 
> we don't need.  The collection of attendee lists does not directly support our technical work.  To 
> the extent that we need a headcount for meeting planning, a count (without names) is sufficient.
>
> -- Sam
+1

---

From: Donald Eastlake <[email-masked]>
Date: Mon, 23 Apr 2012 19:19:51 -0400

email addresses have the virtual of uniqueness so I believe they
should be retained.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

---

From: Fernando Gont <[email-masked]>
Date: Mon, 23 Apr 2012 12:51:43 -0300

On 04/23/2012 10:36 AM, Yoav Nir wrote:
> The ACWG working group is considering proposals for a
> higher-bandwidth alternative to RFC 1149. One proposal is to attach
> flash chips to the birds' legs. This proposal gets accepted, and
> eventually makes it to RFC. Company A implements this new standard,
> and then gets sued by Company B, because they have a patent for
> attaching flash chips to bird legs. When asked why they're only
> mentioning it now, they claim they had never followed the ACWG. The
> blue sheets can prove that Bob from Company B was actually at the
> meeting.

That's assuming Bob signed the blue shit in the first place (which need
not be the case). Even then, Company A would need to prove that whoever
signed the blue sheet as Bob was really Bob. Also,

* Do companies skim through the attendee list double-checking that
people claiming to be affiliated with Company B, really work for company
B, and complain to the meeting organizers if that's not the case?

* Does signing the blue sheet really mean that you're paying attention
to whatever is being discussed? (rather than, e.g. doing e-mail)

* What about the case in which the same person must be in two meetings
that overlap? (e.g., I've *presented* at overlapping meeting) What
should they do in that that case? Sign all the corresponding blue
sheets? Sign none?

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Fernando Gont <[email-masked]>
Date: Mon, 23 Apr 2012 12:57:32 -0300

On 04/23/2012 11:07 AM, George, Wes wrote:
[....]
> meetings are less public than the street? When was the last time that
> anyone challenged someone not wearing their name badge for simply
> being in the IETF meeting area?

During the last IETF.

A security guy asked a folk sitting in the tables in front of the
registration desk about his (missing) badge, and told him next day he
wouldn't be allowed in without a badge.

And this folk ended up leaving the meeting area.

Thanks,

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 02:00:07 -0400

--On Monday, 23 April, 2012 13:13 -0400 Michael StJohns
<[email-masked]> wrote:

> And to put a further point on it - the last sentence of the
> "NOTE WELL" notice (http://www.ietf.org/about/note-well.html)
> that applies to each and every IETF meeting and working group
> session and IETF activity is very clear that written, audio
> and video records can and will be kept.  A person attending an
> IETF meeting has no reasonable expectation of privacy for
> those things we define as "IETF activities".
> 
 
+1

+1 also to the notion that one just can't operate an open
standards process in the dark with secret participants, even
those who lurk in the virtual shadows in the back of the room.
Remember that we take hums, listen for virtual and actual
silences, etc.  If a chair stays "does anyone have anything else
to say about this", those who say nothing are still
participating, not just watching quietly from afar.  If some
people don't want their participation in the meeting noted, they
need to stay out of the meeting.

I should also mention that I introduced a micro-innovation into
a WG meeting a few IETF's back.   We had asked who was going to
read specific documents.  Some hands went up, some didn't.   In
order to have a record of both, I took pictures and we put the
pictures in the minutes.   I believe that doing that was
completely within the boundaries set by the provision Mike cites
above... and that no one can say "oh, I get to be private,
please block my face out of the picture even though you can
retain my raised hand"

    john

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 24 Apr 2012 07:35:19 +0100

On 2012-04-23 22:40, Peter Sylvester wrote:
>> to subpoenas.  A very effective way to do that is to not have the data.
>>

A headcount is clearly sufficient for room size allocation, but the
primary purpose of the blue sheets is not, and never has been, the
head count.

   Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 24 Apr 2012 07:40:23 +0100

On 2012-04-23 16:51, Fernando Gont wrote:
...
> should they do in that that case? Sign all the corresponding blue

I think you should sign both; however, your name will be in the minutes as
a presenter, so your presence is part of the public record.

   Brian

---

From: Dave Crocker <[email-masked]>
Date: Mon, 23 Apr 2012 12:05:22 -0700

> RFCs are not gospel. They can, and, in this instance, should, be changed: either remove that last item, or stately explicitly that there is no expectation of privacy at IETF meetings.  (I have a si…

Actually, an RFC like this /is/ gospel, for this topic.  Gospel can be 
changed, as you note, according to IETF consensus.

However as much as I appreciate the benefits of privacy and the 
detriments of eroding it, I think there is an odd conceptual confusion 
taking place here:  This is an entirely public event.  It makes no sense 
to participate in a formal portion of that event and expect privacy.

That said, I've certainly no objection to adding to the bloat of 
warnings and declarations that we already have, in the humorous belief 
that listing this disclaimer will somehow change people's expectations...

d/
-- 
  Dave Crocker
  Brandenburg InternetWorking
  bbiw.net

---

From: Fernando Gont <[email-masked]>
Date: Tue, 24 Apr 2012 04:12:49 -0300

> a presenter, so your presence is part of the public record.

What about folks that are interested in being present in the discussion
of documents in overlapping meetings? (e.g., one document being
rpesented by some folks at the beginning of one meeting, and some other
doc being presented at the end of some other meeting?).

Thanks,

---

From: Bob Hinden <[email-masked]>
Date: Tue, 24 Apr 2012 09:38:10 +0200

On Apr 23, 2012, at 9:05 PM, Dave Crocker wrote:

> Actually, an RFC like this /is/ gospel, for this topic.  Gospel can be changed, as you note, according to IETF consensus.
> 
> However as much as I appreciate the benefits of privacy and the detriments of eroding it, I think there is an odd conceptual confusion taking place here:  This is an entirely public event.  It makes no sense to participate in a formal portion of that event and expect privacy.

+1

The work we do in the IETF is done in public.  It is a basic element of our open standards process.

Bob

> 
> That said, I've certainly no objection to adding to the bloat of warnings and declarations that we already have, in the humorous belief that listing this disclaimer will somehow change people's expectations...
> 
> d/
> -- 
> Dave Crocker

---

From: Avri Doria <[email-masked]>
Date: Tue, 24 Apr 2012 10:22:31 +0200

Hi,

In reading this thread several thoughts have come to mind:

- for several years I have not been able to attend an IETF mtg in person, yet always join in some of the sessions remotely. Is our remote attendance recorded as well, or its it only in the chat archive?  I have noticed that not all of us give our real names when we sign in (I generally do but that is beside the point.) This would also apply to those who are at the physical mtg but who time share between sessions.

- when I used to come to the physical meetings, I often noticed people who came to the mtg who did not sign the blue / pink sheets. And does everyone who comes in late actually find the sheet and sign it?

- does everyone sign their real name?  do we know if anyone has ever signed the name of someone else? How often has Minnie Mouse attended an IETF WG mtg.

- I thought the comment about taking pictures to record the identities of those who read documents was interesting. For those who are recognizable this its indeed a good record, but what about for others? Also a statement was made that no one could complain about this because of the note well - but that only references "written, audio and video records of meetings may be made and may be available to the public" - nothing about still photography. Perhaps the video feature of the phone should be used in the future.

So it seems that the records are probably partial, and unreliable. They are also not verified. Are they really useful?

In thinking about why such records are kept, I sort of understand the various IPR reasons, but wonder, whether given the unreliability of the information, it really would be accepted as evidence. Has ever ever been a case where these blue sheet records were accepted as evidence?

If not, are there other good reasons for the blue sheets? I mean they are a quaint historical relic and that has value for any organization, but is there a function they reliably serve?

avri

---

From: Yoav Nir <[email-masked]>
Date: Tue, 24 Apr 2012 12:01:57 +0300

> - for several years I have not been able to attend an IETF mtg in person, yet always join in some of the sessions remotely. Is our remote attendance recorded as well, or its it only in the chat arc…

The handles usually map somehow to names, but only people who know them well would know who "PHB", "MCR", "SM", and "fluffy" are. This also extends to the minutes. You often see things like "Paul said this, Phil said that, Yoav agreed with Paul, Peter said to take it to the list". Within the old boys' club of the working group, most people know who these people are. Looking at the attendee list, you can pretty much determine who Yoav is (there's only one), but there's plenty of Pauls, Phils and Peters.

> - when I used to come to the physical meetings, I often noticed people who came to the mtg who did not sign the blue / pink sheets. And does everyone who comes in late actually find the sheet and s…

I would say that usually they don't sign them

> - does everyone sign their real name?  do we know if anyone has ever signed the name of someone else? How often has Minnie Mouse attended an IETF WG mtg.

I've seen at least "PHB" on a blue sheet. I also see a lot of scribbles, that may or may not have been an honest attempt at writing the name legibly.

> So it seems that the records are probably partial, and unreliable. They are also not verified. Are they really useful?

They are not reliable, and they provide as much accountability as those signatures at the end of emails ("the contents are confidential…") provide confidentiality. 

> If not, are there other good reasons for the blue sheets? I mean they are a quaint historical relic and that has value for any organization, but is there a function they reliably serve?

I think not, but then again, I don't have an objection to this data being collected, only to it being made public without a good reason. Stephan has provided an example for misuse, in "for example verifying statements found in resumes". It is not the job of the IETF to keep its participants honest to future employers.

Yoav

---

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Tue, 24 Apr 2012 11:06:06 +0200

> I don't have an objection to this data being collected, only
> to it being made public without a good reason.

+1

Mehmet 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of ext Yoav Nir
> Sent: Tuesday, April 24, 2012 11:02 AM
> To: Avri Doria
> Cc: [email-masked]
> > - for several years I have not been able to attend an IETF mtg in
person, yet always
> join in some of the sessions remotely. Is our remote attendance
recorded as well, or
> its it only in the chat archive?  I have noticed that not all of us
give our real names
> when we sign in (I generally do but that is beside the point.) This
would also apply to
> those who are at the physical mtg but who time share between sessions.
> 
> The handles usually map somehow to names, but only people who know
them well
> would know who "PHB", "MCR", "SM", and "fluffy" are. This also extends
to the
> minutes. You often see things like "Paul said this, Phil said that,
Yoav agreed with Paul,
> Peter said to take it to the list". Within the old boys' club of the
working group, most
> people know who these people are. Looking at the attendee list, you
can pretty much
> determine who Yoav is (there's only one), but there's plenty of Pauls,
Phils and Peters.
> 
> > - when I used to come to the physical meetings, I often noticed
people who came to
> the mtg who did not sign the blue / pink sheets. And does everyone who
comes in late
> actually find the sheet and sign it?
> 
> > - does everyone sign their real name?  do we know if anyone has ever
signed the
> name of someone else? How often has Minnie Mouse attended an IETF WG
mtg.
> 
> I've seen at least "PHB" on a blue sheet. I also see a lot of
scribbles, that may or may
> not have been an honest attempt at writing the name legibly.
> 
> > - I thought the comment about taking pictures to record the
identities of those who
> read documents was interesting. For those who are recognizable this
its indeed a good
> record, but what about for others? Also a statement was made that no
one could
> complain about this because of the note well - but that only
references "written, audio
> and video records of meetings may be made and may be available to the
public" -
> nothing about still photography. Perhaps the video feature of the
phone should be used
> in the future.
> >
> > So it seems that the records are probably partial, and unreliable.
They are also not
> verified. Are they really useful?
> 
> They are not reliable, and they provide as much accountability as
those signatures at
> the end of emails ("the contents are confidential...") provide
confidentiality.
> 
> > In thinking about why such records are kept, I sort of understand
the various IPR
> reasons, but wonder, whether given the unreliability of the
information, it really would
> be accepted as evidence. Has ever ever been a case where these blue
sheet records
> were accepted as evidence?
> >
> > If not, are there other good reasons for the blue sheets? I mean
they are a quaint
> historical relic and that has value for any organization, but is there
a function they
> reliably serve?
> 
> I think not, but then again, I don't have an objection to this data
being collected, only
> to it being made public without a good reason. Stephan has provided an
example for
> misuse, in "for example verifying statements found in resumes". It is
not the job of
> the IETF to keep its participants honest to future employers.
> 
> Yoav

---

From: SM <[email-masked]>
Date: Tue, 24 Apr 2012 03:17:34 -0700

+1

The long threads are at:

   http://www.ietf.org/mail-archive/web/ietf/current/msg51053.html
   http://www.ietf.org/mail-archive/web/ietf/current/msg51362.html
   http://www.ietf.org/mail-archive/web/ietf/current/msg57829.html

There is even an I-D: draft-cooper-privacy-policy-01

Adding a name and/or an email address to the blue sheet is a 
MAY.  Given that this will remain optional and it is a mechanical 
process, the chance of data aggregation is minimal.

Regards,
-sm

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 24 Apr 2012 11:22:42 +0100

>> to it being made public without a good reason.

IMNSHO, having the IETF process not only open but also clearly
*seen* to be open is a very good reason. I assume that's why
RFC 2026 recommends publishing the list of attendees in the minutes.

As for the problem of people who refuse to sign the blue sheet
or who sign with a false name, I think we have to accept that
as the price of avoiding draconian measures that nobody would
like. The same goes for remote participants who use nicknames.

BTW, I don't think that anyone trying to evade IPR rules would
sign in as "Minnie Mouse" because there is IPR all over that name.

    Brian

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 24 Apr 2012 08:50:47 -0400

> doc being presented at the end of some other meeting?).

Your question was already answered. Sign both.

Thanks,
Donald

---

From: David Morris <[email-masked]>
Date: Tue, 24 Apr 2012 07:30:27 -0700 (PDT)

On Mon, 23 Apr 2012, Dave Crocker wrote:

> However as much as I appreciate the benefits of privacy and the detriments of
> eroding it, I think there is an odd conceptual confusion taking place here:
> This is an entirely public event.  It makes no sense to participate in a
> formal portion of that event and expect privacy.

The IETF meetings are actually not totally public. You must purchase a
'ticket' to attend. We would not allow someone to walk in off the street
and photograph the functions, or even sit in a meeting and take notes.

The hugh amount of publically available data being presented on-line which 
becomes significantly less private by creating ease of access. My home
phone number is published w/o an address. I consider it a breach of my
privacy to have some data mining operation match my address with my
phone number just because my name and address are correlated in
public property titles. Etc.

I don't have an objection to the existance of blue sheets and I think
I have long understood the multiple justifications for their use. My
objection is to the making of the content more readily available
than previous procedures. That changes the level of privacy associated
with blue sheets, in my mind significantly. I don't care if scanning
and storing the scans is used, if our legal staff has determined
that scanning is equivalent to having the original document, but
I don't want to see the time to content availablity change
(well, perhaps in response to a supoena). That means no public
online access. And perhaps an artifical delay matching the time
it takes now. Surely there is now a defacto access policy and
the admin folks wouldn't dig out the sheets just because I
wanted to see them. I suspect that they wouldn't provide
access to all sheets for all meetings in a single year.
There might also be a copy charge, etc.

All of that creates a legitimate expection of more privacy
than making the sheets available without restriction on-line.

I also don't think we should make assumptions about how
well future software will do at recognition of sloppy
hand writing on blue paper written with ink of almost
the same color.

Public and transparent have been implemented in a certain
fashion in the past which included a degree of interference
with ease of access. I don't see a written policy that
states we shall make all records as readily available
as future technology allows. 

The IETF has traditionally been in favor of encouraging
on-line privacy. (think cookies) We need to lead by
example by not following the lemmings and contributing
to less privacy.

If scans are legally sufficient, then capture the data
to CD/DVD media and stick the data in a warehouse, etc.
That solves the bulk storage issue but doesn't make
the content much easier to access.

---

From: Avri Doria <[email-masked]>
Date: Tue, 24 Apr 2012 10:18:05 +0200

Hi,

avri

---

From: Martin Rex <[email-masked]>
Date: Tue, 24 Apr 2012 18:21:33 +0200 (MEST)

> please block my face out of the picture even though you can

You better don't publish any photos taken in Germany (maybe even
all of Europe) _without_ permission of every single person who is
clearly identifiable on that photo, because it would be illegal.

-Martin

---

From: Michael StJohns <[email-masked]>
Date: Tue, 24 Apr 2012 12:48:13 -0400

>and photograph the functions, or even sit in a meeting and take notes.

Actually, with the exception of the Beijing meeting where the hotel - not us - posted guards to keep non-badge holders out (and apparently to check id against badges), we don't actually enforce this much.  I can think of a number of recent IETFs where "guests" have sat in for a short while in various conversations and WG meetings without being officially registered.  

Even if we did enforce the badging requirement - the payment of the registration fee does not make this a non-public meeting.  ANYONE can attend.

---

From: Michael StJohns <[email-masked]>
Date: Tue, 24 Apr 2012 12:50:02 -0400

>clearly identifiable on that photo, because it would be illegal.

Martin - you and everyone else in the room gave permission by being in the room.  That's what the NOTE WELL is all about.  So no, not illegal. 

"A participant in any IETF activity is deemed to accept all IETF rules of process, as documented in Best Current Practices RFCs and IESG Statements.

A participant in any IETF activity acknowledges that written, audio and video records of meetings may be made and may be available to the public. "

---

From: Joel jaeggli <[email-masked]>
Date: Tue, 24 Apr 2012 10:05:32 -0700

> Martin - you and everyone else in the room gave permission by being in the room.  That's what the NOTE WELL is all about.  So no, not illegal. 

Specifically every registered attendee has accepted during the
registration process the note-well.

---

From: Martin Rex <[email-masked]>
Date: Tue, 24 Apr 2012 20:10:01 +0200 (MEST)

Joel jaeggli wrote:
> 
> Michael StJohns wrote:
> >
> > Martin - you and everyone else in the room gave permission by being in
> > the room.  That's what the NOTE WELL is all about.  So no, not illegal. 
> 

You're completely misled.

In Germany (and probably all over Europe) that part of note well
will not apply to the rights about your own picture/portrait.

To obtain such a right, a seperate explicit and voluntary consent
is required.  That is a privilege guaranteed by law.

-Martin

---

From: Michael StJohns <[email-masked]>
Date: Tue, 24 Apr 2012 14:33:29 -0400

While Wikipedia is sometimes wrong, it does tend to have useful information. Specifically http://commons.wikimedia.org/wiki/Commons:Country_specific_consent_requirements#Germany

> Publishing or propagating the image does not normally require consent:
> If the person is an irrelevant or merely accidental part (Beiwerk) of a landscape or locality shown in the picture.
> If the person took part in a public meeting or event and is depicted on this occasion.
> If distribution or exhibition serves a higher artistic interest.

http://www.gesetze-im-internet.de/kunsturhg/__23.html

So - not misled.  

Sent from my iPad

---

From: Stephan Wenger <[email-masked]>
Date: Tue, 24 Apr 2012 18:33:59 +0000

I believe Martin is correct, at least with respect to Germany.
OTOH, "wo kein Kläger, da kein Richter" (no plaintiff, no judge).  And:
where is the damage?  In short, I wouldn't worry too much.
Stephan

---

From: Sam Hartman <[email-masked]>
Date: Tue, 24 Apr 2012 14:46:56 -0400

>>>>> "Martin" == Martin Rex <[email-masked]> writes:

    Martin> Joel jaeggli wrote:
    >> 
> Michael StJohns wrote:
> >
> > Martin - you and everyone else in the room gave permission by being
    >> in > the room.  That's what the NOTE WELL is all about.  So no,
    >> not illegal.
    >> 

    Martin> You're completely misled.

    Martin> In Germany (and probably all over Europe) that part of note
    Martin> well will not apply to the rights about your own
    Martin> picture/portrait.

    Martin> To obtain such a right, a seperate explicit and voluntary
    Martin> consent is required.  That is a privilege guaranteed by law.

There may be additional legal issues.  However, for at least one issue,
the European data Protection law comes into play in significant ways.  I
recommend the presentation from last SAAG.  In particular I recommend
focusing on the part of that presentation about consent. There are
significant limitations to consent especially when someone must consent
to do their job.

So, from what I know about European law, I'd have significant concerns
about whether   the note-well is sufficient for John's purpose.

---

From: Martin Rex <[email-masked]>
Date: Tue, 24 Apr 2012 21:34:53 +0200 (MEST)

Michael StJohns wrote:
> 
> While Wikipedia is sometimes wrong, it does tend to have useful information.=
>  Specifically http://commons.wikimedia.org/wiki/Commons:Country_specific_con=
> sent_requirements#Germany
> 
> > If the person is an irrelevant or merely accidental part (Beiwerk)
> > of a landscape or locality shown in the picture.

That information in an incorrect translation, and it is quoting only
part (1) of the article and missing part (2).

§22 (1) 2.+ 3. KunstUrhG  are quite related in the intent

the translation of (2) captures the original meaning correctly:

  2. Bilder, auf denen die Personen nur als Beiwerk neben einer
     Landschaft oder sonstigen Örtlichkeit erscheinen;

> > If the person is an irrelevant or merely accidental part (Beiwerk)
> > of a landscape or locality shown in the picture.

The translation of (3) is not quite correct:

  3. Bilder von Versammlungen, Aufzügen und ähnlichen Vorgängen,
     an denen die dargestellten Personen teilgenommen haben;

> > If the person took part in a public meeting or event and is depicted

This is about pictures of an (public) assembly, parade or similar event
which the pictured peoples participated, and NOT the other way round!

The translation you quoted is flawed logic.

from the rules:
    1.  all men are mortals
    2.  socrates was a man
you can infer  "socrates was mortal",

But infering the reverse "all mortals are men", "all men are socrates"
or "all mortals are socrates" amounts to flawed logic.

When making a photo of the audience(!) with a small number of people
prominently in the foreground, then the exclusion no longer applies
and you will need consent of the folks in order to _publish_ such a photo,
similar for taking pictures of the _spectators_ of a parade.

For people doing presentations in front, or speaking at the podium
of a public assembly or convention, the exception may apply to a
singular depicted person if it is still a "picture of the event"
(i.e. a picture in context).

Just because someone participates an assembly, convention or is
the spectator of a parade does NOT result in a general loss of
control over pictures&portraits of that person.

-Martin

---

From: Christian Huitema <[email-masked]>
Date: Tue, 24 Apr 2012 19:55:25 +0000

We see here a tension between two goals, engineering the Internet and making standards for the Internet. In most cases, the two goals are easily reconciled , as open standards are an essential part of an open Internet. But here we have a conflict. On one hand, good engineering would mean, setting the best possible example in matters such as security and privacy. On the other hand, public standard making seem to require a very controlled participation process, in which participants have effectively no privacy. Of the two goals, I think we would be much better off emphasizing engineering and downsizing process. The Internet did not develop because the IETF had better processes than the ITU. It developed because we cared about making the best possible network!

-- Christian Huitema

---

From: Martin Rex <[email-masked]>
Date: Tue, 24 Apr 2012 22:02:32 +0200 (MEST)

> about whether   the note-well is sufficient for John's purpose.

The issue with John's purpose is that he is taking a picture of the
audience(!), and if you take such a picture from the front in a
small meeting room, there might a small number of folks end up
_prominently_ in the foreground of that picture, at which point
their consent will be required.

The Solution to John's problem would be, that he asks before taking
the picture:

"I want to take a picture of the room for the purpose of _publishing_
 (e.g. including in the WG minutes) it from where I stand right now,
 and the folks in the front may end up prominently on that photo.
 If anyone has a problem with this, please move the the rear or
 temporarily leave the room."

That is vaguely similar to the orca/Shamu and dolphin shows in SeaWorld,
where folks are explicitly reminded about the "splash" that is going
to soak the frontmost seating row(s).

IMHO this is not so much different about the audio "policy" in the
Note Well.  It does _not_ universally apply to each and every word
that is said while participating an IETF Meeting.  Private (hallway)
conversations are _not_ subject to the Note Well either.

-Martin

---

From: Martin Rex <[email-masked]>
Date: Tue, 24 Apr 2012 22:41:08 +0200 (MEST)

John,

> clearly identifiable on that photo, because it would be illegal.

I'm sorry for my blunt, overly broad and unexplained original reply.

I did not adequately account of existing exceptions (KunstUrhG)
and the situation to which they would apply, and neither did I
describe practical remedies for the situations where the exception
do not apply, in order to put the real issue into perspective.

-Martin

https://www.ietf.org/ibin/c5i?mid=6&rid=49&gid=0&k1=933&k2=62976&tid=1335299957
https://www.ietf.org/ibin/c5i?mid=6&rid=49&gid=0&k1=933&k2=62978&tid=1335299957

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 17:16:42 -0400

I think I completely agree with that.
    john

--On Tuesday, 24 April, 2012 19:55 +0000 Christian Huitema
<[email-masked]> wrote:

> We see here a tension between two goals, engineering the
> Internet and making standards for the Internet. In most cases,
> the two goals are easily reconciled , as open standards are an
> essential part of an open Internet. But here we have a
> conflict. On one hand, good engineering would mean, setting
> the best possible example in matters such as security and
> privacy. On the other hand, public standard making seem to
> require a very controlled participation process, in which
> participants have effectively no privacy. Of the two goals, I
> think we would be much better off emphasizing engineering and
> downsizing process. The Internet did not develop because the
> IETF had better processes than the ITU. It developed because
> we cared about making the best possible network!
> 
> -- Christian Huitema
> 
> 
>

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 17:27:44 -0400

Martin,

I invite you to post a copy of your law degree, license, and
credentials for the edification of this group.  In the interim
and in the event that you are correct, I strongly encourage the
IASA to avoid ever holding an IETF meeting in Germany again
without first obtaining appropriate legal advice that it is
acceptable given our existing conditions to record the names and
identities of anyone participating in any IETF activity, whether
they are explicitly sign something, are photographed, are
identified by RFID, have their names written down after they
stay something at a microphone or on Jabber, raise their hands
(presumably in the expectation of being identified), or can be
identified in some other way.  Of course, an acceptable
alternative to "no meetings in Germany or any other country with
the rules you suggest apply" would be explicit permission on
registration forms as a condition of attendance.  Or,
presumably, a Chair could make an announcement that anyone who
continues to sit in a particular room is giving permission for
such identification.

As Christian suggests, we simply have to be able to identify
participants in WG sessions, even silent ones, to have an open
standards process.

Again, I will strongly defend your right to privacy, absence of
identifying photography, etc.  Just do not simultaneously claim
that right and the right to participate in the IETF.

    john

--On Tuesday, 24 April, 2012 21:34 +0200 Martin Rex
<[email-masked]> wrote:

> Michael StJohns wrote:
>> 
>> While Wikipedia is sometimes wrong, it does tend to have
>> useful information.= Specifically
>>  http://commons.wikimedia.org/wiki/Commons:Country_specific_c
>>  on= sent_requirements#Germany
>> 
>> > Publishing or propagating the image does not normally
>> > require consent: If the person is an irrelevant or merely
>> > accidental part (Beiwerk) of a landscape or locality shown
>> > in the picture.
> That information in an incorrect translation, and it is
> quoting only part (1) of the article and missing part (2).
> 
> 
>> > If the person is an irrelevant or merely accidental part
>> > (Beiwerk) of a landscape or locality shown in the picture.
> 
> 
>   3. Bilder von Versammlungen, Aufzügen und ähnlichen
> Vorgängen,      an denen die dargestellten Personen
> teilgenommen haben;
> 
> This is about pictures of an (public) assembly, parade or
> similar event which the pictured peoples participated, and NOT
> the other way round!
> 
> But infering the reverse "all mortals are men", "all men are
> socrates" or "all mortals are socrates" amounts to flawed
> logic.
> 
> 
> When making a photo of the audience(!) with a small number of
> people prominently in the foreground, then the exclusion no
> longer applies and you will need consent of the folks in order
> to _publish_ such a photo, similar for taking pictures of the
> _spectators_ of a parade.
> 
> For people doing presentations in front, or speaking at the
> podium of a public assembly or convention, the exception may
> apply to a singular depicted person if it is still a "picture
> of the event" (i.e. a picture in context).
>

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 17:33:07 -0400

--On Tuesday, 24 April, 2012 14:46 -0400 Sam Hartman
<[email-masked]> wrote:

> So, from what I know about European law, I'd have significant
> concerns about whether   the note-well is sufficient for
> John's purpose.

The pictures were not, iir, taken in Europe.  And I repeat my
belief/ request that we not hold any more meetings in any
country in which such provisions might apply without expanding
the registration notices and provisions sufficiently to require/
constitute explicitly permission to identify participants and
their participating activities in any way that meets the IETF's
purposes and/or requirements.

   john

---

From: Martin Rex <[email-masked]>
Date: Tue, 24 Apr 2012 23:48:03 +0200 (MEST)

> purposes and/or requirements.

Identifying contributors or participants and publishing persons
photos or portaits are two very distinct things, and the former
does not require the latter at all.

-Martin

---

From: "Robin Uyeshiro" <[email-masked]>
Date: Tue, 24 Apr 2012 11:52:11 -1000

<snip>
<unsnip>

Hopefully, IETF working group meeting participants would be described as
more like a jury or legislators than an audience.  The purpose of the
meeting should be participation and dialog, not presentation.

---

From: Lixia Zhang <[email-masked]>
Date: Tue, 24 Apr 2012 15:12:28 -0700

> I think I completely agree with that.

+ 1

---

From: Martin Rex <[email-masked]>
Date: Wed, 25 Apr 2012 00:17:12 +0200 (MEST)

John C Klensin wrote:
>                                      I strongly encourage the
> identities of anyone participating in any IETF activity,

That does _not_ require a photo.

>
> whether they are explicitly sign something,
> are photographed, are identified by RFID,

Keep in mind that if it isn't _voluntary_ consent, it will be legally
void, even with a signature on it.

>
> have their names written down after they say something at a microphone
> or on Jabber, raise their hands (presumably in the expectation of being
> identified), or can be identified in some other way.

What is wrong about simply archiving the information that participants
are providing voluntarily, such as it has been the last 20 years?

In Germany, an employer is not entitled to have and use a photo or picture
of an employee without explicit, voluntary and anytime revocable
consent of that employee (with very few and very narrow exceptions
carefully scoped by the legislator).  Writing something to a
different effect into the employment contract will be legally void,
because the consent to use the picture MUST be voluntary and
anytime revocable.

>
> Of course, an acceptable alternative to "no meetings in Germany
> or any other country with the rules you suggest apply" would be
> explicit permission on registration forms as a condition of
> attendance.  Or, presumably, a Chair could make an announcement
> that anyone who continues to sit in a particular room is giving
> permission for such identification.

Please do not confuse any necessity to identify an originator of a
contribution (which is where data protection laws would apply)
and the personal privacy rights of individuals about photos&portraits
of themselves.

-Martin

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 19:16:53 -0400

Martin,

Let me try to restate this with the understanding that I'm
talking about what is convenient and/or necessary for carrying
on the work of the IETF and not trying to interpret German law.
I will accept your interpretation as stated but, if that
interpretation is correct, I believe the IETF should not meet
there while those provisions are in effect unless at least one
of the following conditions arises:

(i) the IETF can reasonably require that people give permission
--irrevocable for the length of time they are at the meeting --
as needed to permit the IETF to do things that are considered
convenient of necessary.  That is still voluntary in the sense
that attending the meeting is voluntary and still revocable by
leaving the meeting and not coming back-- one can just decide
that, if one doesn't want to volunteer to permit one's picture
to be taken, one can't attend the meeting.  If you are saying
that it is illegal to impose a condition that binds the two
together, that is fine: unless the other condition applies, we
shouldn't be meeting in Germany.  I presume, by asserting that
such a binding is not permitted, you are also asserting that
corporate ID badges with pictures on them have disappeared from
Germany or are discretionary on a per-employee basis because a
corporate requirement that, in order to remain employed, one
must wear such a badge wouldn't be voluntary either.

(ii) The IETF concludes that it doesn't need what I think is
reasonable and, in particular, that if I need to record who has
his or her hands up in a WG poll, it is better for me to take
the time to send people through the room asking for and writing
down names than to take pictures.  Note that an extra checkmark
on the blue sheets or an RFID walk-by doesn't work, because part
of my goal is to have everyone in attendance at the WG meeting
able to see who (else) has her hand up.

I have almost no preference between the two.  I do care that, as
WG Chair, I'm not expected to manage things in an environment in
which I can ask for volunteers or commitments without being able
to establish who made them.  And, if the second choice above is
the choice of the community, I believe I have the reasonable
right to expect that I can ask for WG slots a half-hour longer
than I would otherwise need and expect to get it, even if that
means an extra half-day or day of meetings.

   john

--On Wednesday, 25 April, 2012 00:17 +0200 Martin Rex
<[email-masked]> wrote:

>> acceptable given our existing conditions to record the names
>> and identities of anyone participating in any IETF activity,
> 
> Keep in mind that if it isn't _voluntary_ consent, it will be
> legally void, even with a signature on it.
> 
> 
>> 
>> have their names written down after they say something at a
>> microphone or on Jabber, raise their hands (presumably in the
>> expectation of being identified), or can be identified in
>> some other way.
> 
> What is wrong about simply archiving the information that
> participants are providing voluntarily, such as it has been
> the last 20 years?
> 
> 
> In Germany, an employer is not entitled to have and use a
> photo or picture of an employee without explicit, voluntary
> and anytime revocable consent of that employee (with very few
> and very narrow exceptions carefully scoped by the
> legislator).  Writing something to a different effect into the
> employment contract will be legally void, because the consent
> to use the picture MUST be voluntary and anytime revocable.
> 
> 
>> 
>> Of course, an acceptable alternative to "no meetings in
>> Germany or any other country with the rules you suggest
>> apply" would be explicit permission on registration forms as
>> a condition of attendance.  Or, presumably, a Chair could
>> make an announcement that anyone who continues to sit in a
>> particular room is giving permission for such identification.
> 
> Please do not confuse any necessity to identify an originator
> of a contribution (which is where data protection laws would
> apply) and the personal privacy rights of individuals about
> photos&portraits of themselves.
> 
> -Martin

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 24 Apr 2012 18:19:14 -0500

>void, even with a signature on it.

IETF 87 is in Germany (15 months from now), so we'd better solve this 
issue soon, I should think.

james

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 19:19:37 -0400

--On Tuesday, 24 April, 2012 11:52 -1000 Robin Uyeshiro
<[email-masked]> wrote:
 
> <snip>
> The issue with John's purpose is that he is taking a picture
> of the audience(!), and if you take such a picture from the
> front in a small meeting room, there might a small number of
> folks end up _prominently_ in the foreground of that picture,
> at which point their consent will be required.

Again, IANAL and I don't think you are either, so I don't want
to argue "prominently" versus "non-prominently".  I can assure
that, when pictures were used, the clear intent was the everyone
with his or her hand up was individually identifiable and almost
everyone else was too.

   john

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 19:25:39 -0400

> does not require the latter at all.

In principle, I could keep the pictures to myself and put a list
of names of volunteers in the minutes.  Now suppose Joe Bloggs
is listed but announces on the mailing list after not doing
anything that he really didn't volunteer.  I've now got a choice
among accepting his assertion that he didn't volunteer, letting
him retroactively un-volunteer, or publishing the picture to
prove my case (and you claim the latter is illegal).  For a
number of reasons, generating peer pressure among them, I prefer
to just publish the picture.

    john

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 25 Apr 2012 00:27:22 +0100

> issue soon, I should think.

Sure, I can do that.

Its a non-issue, possibly caused by typing being just that bit
easier than it ought be, for almost all of us, some of the time,
same as many other issues of similar ilk.

There, now we can go to Berlin again:-)

S.

---

From: John C Klensin <[email-masked]>
Date: Tue, 24 Apr 2012 19:30:51 -0400

--On Tuesday, 24 April, 2012 18:19 -0500 "James M. Polk"
<[email-masked]> wrote:

> 
> IETF 87 is in Germany (15 months from now), so we'd better
> solve this issue soon, I should think.

The IESG and IAOC are invited to take my comments on the
situation as an appeal against the decision to hold that meeting
unless either the situation can be clarified with counsel to the
degree that we understand that Martin's concerns are not
applicable, that appropriate permission language and permissions
can be clarified with Counsel so that a binding between
registration and permission is possible and used, or that a
community consensus call demonstrates that the community
believes that the "just make lists" plan is preferable to having
the option to take pictures.

And that is my last comment on the subject unless I have to
formalize such an appeal.

   john

---

From: Stephan Wenger <[email-masked]>
Date: Tue, 24 Apr 2012 23:31:01 +0000

Remember, this whole discussion is about a) taking pictures, and b)
publishing them.  Avoid either, and we should be completely save.  Do
both, and it still takes at least one person to take offense to the point
where he calls police or runs to a lawyer, proof, a judge finding that the
privacy rights of the person have been violated, and so on.
People take pictures in meetings all the time, in Germany and elsewhere.
Folks exceed the speed limit (yes, even in Germany large stretches of the
freeway system and all other roads have a speed limit :-).  In either
case, many say that the risk is in an acceptable relationship with the
benefits.
Stephan

---

From: SM <[email-masked]>
Date: Tue, 24 Apr 2012 16:48:57 -0700

Hi John,
>The pictures were not, iir, taken in Europe.  And I repeat my

:-)

Working group participants could be prone to 
amnesia.  The hand raising might be viewed as a 
commitment to perform the reviews.  It was 
clearly stated that photos would be taken, why 
they were taken and what would be done with them.  Nobody objected.

Regards,
-sm

P.S. I read the following some time back:

  - Insist on doing everything through "channels".  Never permit short-cuts
    to be taken in order to expedite decisions.

  - When possible, refer all matters to committees, for "further study and
    consideration".  Attempt to make the committees as large as possible 
    never less than five.

  - Bring up irrelevant issues as frequently as possible.

  - Haggle over precise wordings.

  - Refer back to matters decided upon at the last meeting and attempt to
    reopen the question of the advisability of that decision.

  - Advocate "caution".  Be "reasonable" and urge your fellow participants
    to be "reasonable" and avoid haste which might result in embarrassments
    or difficulties later on.

  - Be worried about the propriety of any decision  raise the question of
    whether such action as is contemplated lies within the jurisdiction of
    the group or whether it might conflict with the policy of some higher
    echelon.

  - Never pass on your skill and experience to a new or less skillful worker.

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 24 Apr 2012 18:59:00 -0500

At 06:31 PM 4/24/2012, Stephan Wenger wrote:
>publishing them.

incorrect, this discussion started with Russ proposing copying each 
WG meeting's attendees list - from the blue sheet - into the meeting minutes.

It has gone on from there.

James

>Avoid either, and we should be completely save.  Do

---

From: Martin Rex <[email-masked]>
Date: Wed, 25 Apr 2012 02:05:39 +0200 (MEST)

> of the following conditions arises:

The overview that Michael StJohns (thanks!) pointed to on wikimedia
seems to be a rough approximation of the situation.  The situation
described for France (location of the last IETF Meeting) matches
the real/effective Situation much better than the brief citation
of §22 KunstUrhG did for Germany.

> convenient of necessary.

That would be the end of "openness" in the IETF.

Why would you want to "punish" folks who come to IETF meetings and
pay the meeting fee, but primarily sit in the back of the room
compared to IETF participants that listen to the audio streams
(or its archives) or folks that have only subscribed to IETF mailing
list or browse the archives.

Do you want to require folks to first send photographs of themselves
before they can listen to IETF Meeting audio streams, subscribe to
IETF mailing lists, or browser the archives?

>
>                            That is still voluntary in the sense
> to be taken, one can't attend the meeting.
>
> If you are saying that it is illegal to impose a condition that
> binds the two together, that is fine: unless the other condition
> applies, we shouldn't be meeting in Germany.

Yup, that is not voluntary, that meets the definition of compulsory.

For the IETF as an organization, the EU data protection directive
applies, so the situation will be similar _all_over_Europe_.

>
> I presume, by asserting
> that such a binding is not permitted, you are also asserting that

You're confusing things.  It will be OK to have a picture on the ID badge
that the employee is _carrying_.  After all that is a low-resolution
1x1.5" 2-D picture.  There is a high-res 3-D picture of your face
attached to the upper end of the body from which the ID badge is supposed
to be dangling, so that faximile on the badge is not really encroaching
on your privacy, is it?

But the employer is not allowed to retain copies of the photo that
was imprinted on the badge beyond production of the badge itself,
and neither of duplicate/backup badges with your picture on it
_without_ voluntary consent.

-Martin

---

From: Martin Rex <[email-masked]>
Date: Wed, 25 Apr 2012 02:19:32 +0200 (MEST)

John C Klensin wrote:
> 
> Martin Rex <[email-masked]> wrote:
> >

I had assumed there is a difference between "volunteering in an IETF WG"
to do some work and "volunteering in Uncle Sam's recruiting buero".
When did this change?

I would also assume that "volunteering" should be scoped to what the
volunteer personally commits by explicit vocal or written communication,
rather than a "show of hand" volunteering to an unspecified amount
of work on the mind of a WG chair.  And any such personal commitment
may be vitally dependent on several constraints that are not explicitly
communicated along with it, and those may change.

I really do not see any need for a "photo proof" in that area, and much less
of a _publication_ of a photo.  Does this mean that IETF participants,
who do not attend IETF meetings in person, can no longer volunteer to
contribute to the IETF?

-Martin

---

From: Martin Rex <[email-masked]>
Date: Wed, 25 Apr 2012 09:38:41 +0200 (MEST)

Is it really so completely out of this world to expect the decency
to ask whether it is OK to take a photo for the purpose of _publication_?
Leaving it up to the individual subjects whether they prefer to
relocate further to the background first or prefer to temporarily
leave the room?  Especially when you believe that the vast majority
is going to provide that consent?

The folks I would have least expected to be offended by the
concept of "consent" are IETFers.

John C Klensin wrote:
> I don't want to argue "prominently" versus "non-prominently".

There is nothing to argue about.  The exemption you'd have to
qualify for is clearly scoped (in the German §23 KunstUrhG/KUG)
to "pictures of a _public_events_ depicting (identifiable) persons"
and _not_ "pictures of persons at public events", which means that
the fewer people are predominantly shown on the picture, the
more central those people and the setting will have to be to that event
in order for the picture to still fall in scope of the
"pictures of a public_event" definition.  But this is just a
necessary prerequiste for the exemption to be in scope at all.
By itself, it is not a sufficient criteria.

The procedure how to determine whether an exemption from explicit
consent requirement for publication of a persons picture is applicable,
has been established by the german constitutional court quite a while ago.
The decision BVerfGE 35, 202 from 1973 contains a fairly comprehensive
description (paragraphs 50-53 -- sorry, all german):

   http://www.servat.unibe.ch/dfr/bv035202.html#Rn050
 
Comments of the European Court of Human Rights (ECHR) on the German Federal
court applying that principle to the exceptions in §23 KunstUrhG (KUG)
in its decisions.

  section 23(2) of the KUG gives the courts adequate opportunity to
  apply the protective provisions of section 2(1) read in conjunction with
  section 1(1) of the Basic Law ... .

  (bb) In theory the criteria established by the Federal Court of Justice
  for interpreting the concept of legitimate interest used in section 23(2)
  of the KUG are irreproachable from the point of view of constitutional law.

  [...]

  66.  In these conditions freedom of expression calls for a narrower
  interpretation (see Prisma Presse, cited above, and, by converse
  implication, Krone Verlag, cited above, § 37).

  67.  In that connection the Court also takes account of the resolution
  of the Parliamentary Assembly of the Council of Europe on the right to
  privacy, which stresses the one-sided interpretation of the right to
  freedom of expression by certain media which attempt to justify an
  infringement of the rights protected by Article 8 of the Convention
  by claiming that their readers are entitled to know everything about
  public figures (see paragraph 42 above, and Prisma Presse, cited above).

While that one particular (2005 EHCR) decision was about the 1. exemption
(public figure), the evaluation rules established by the german constitutional
court rules that a narrow interpretation applies to all exceptions alike.
  "Dabei kommt es verfassungsrechtlich nicht darauf an, bei welchem
   Tatbestandselement des § 23 KUG die Abwägung vorgenommen wird"

The final criteria established by the german constiutional court is pretty
clear, if the intended objective can be sufficiently achieved by other
means (not encroaching on a persons privacy rights), then this precludes
the exemption from voluntary consent to apply.

  "zu bewerten und zu prüfen, ob und wieweit dieses Interesse auch ohne
   eine Beeinträchtigung - oder eine so weitgehende Beeinträchtigung -
   des Persönlichkeitsschutzes befriedigt werden kann."

-Martin

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 25 Apr 2012 08:42:34 +0100

Dear IAOC,

I suggest that your standard dealings with local hosts should
include requiring them to perform a local check on whether the
standard "Note Well" takes account of all local legal requirements,
including for example consent to publication of images. If it doesn't,
the host should provide an augmented "Note Well" for use during
meeting registration.

>From the recent discussion, this needs to be done for sure for
IETF 87.

Regards
   Brian Carpenter

On 2012-04-25 00:30, John C Klensin wrote:
> .

---

From: Christian Huitema <[email-masked]>
Date: Wed, 25 Apr 2012 07:57:25 +0000

Brian,

> I suggest that your standard dealings with local hosts should include requiring them to perform a local check on
> whether the standard "Note Well" takes account of all local legal requirements, including for example 
> consent to publication of images. If it doesn't, the host should provide an augmented "Note Well" for use 
> during meeting registration.

Rather than going this route, we might consider some better balance between privacy and standard-settings. Taking and publishing a person's image is a step above listing their names. Do we really need that for the purpose of standard making, let alone Internet Engineering? How about answering the classic privacy checklist:

1) How much personal information do we collect, and for what purpose? The rule here should be to collect the strict minimum necessary for the purpose. Pictures don't appear to meet that bar.
2) How do we process that information? Who in the IETF has access to it?
3) Do we make that information available to third parties? Under which guidelines? Again, there is a big difference between answering a subpoena and publishing on a web page.
4) How do we safeguard that information? Is it available to any hacker who sneaks his way into our database?
5) How long do we keep the information? Why?
6) How do we dispose of the expired information?

These look like the right questions to the IAOC.

-- Christian Huitema

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 25 Apr 2012 11:35:42 +0100

Christian,

> Rather than going this route, we might consider some better balance between privacy and standard-settings. Taking and publishing a person's image is a step above listing their names. Do we really n…

These are excellent questions, and I support them being studied (perhaps
initially by a small group), but I think they are orthogonal to my
suggestion. Since privacy laws vary widely, I really think this issue
needs to be checked on a per-host-country basis, regardless of our general
policy.

    Brian

---

From: Marshall Eubanks <[email-masked]>
Date: Wed, 25 Apr 2012 08:40:04 -0400

Dear Brian;

> From the recent discussion, this needs to be done for sure for

The legal subcommittee (which includes the IETF counsel) is actively
researching this issue.

Regards
Marshall

---

From: Samuel Weiler <[email-masked]>
Date: Wed, 25 Apr 2012 10:43:52 -0400 (EDT)

> and photograph the functions, or even sit in a meeting and take notes.

Without commenting specifically about photographs, as MSJ pointed out, 
this is not true.  It may not be socially acceptable to crash working 
group meetings, but we do not use force to prevent it.  And as Scott 
Bradner pointed out on this list some time ago:

    Back when the IETF decided to charge for meetings ($100/meeting
    sometime in the early 1990s) Steve Coya said that the IETF would
    never check badges to block people from meetings.

The Beijing meeting was a notable exception.  There were guards 
looking for badges and at least one attendee's partner was restrained 
by the guards when she attempted to enter the meeting space to find 
her partner.  Even then, it the IETF was not the party doing the 
checking.  As the IAOC chair later explained:

    The IAOC was not aware that badge checking was going to happen
    prior to this meeting. It was implemented by the meeting host in
    conjunction with the hotel.

I imagine we would respond differently to something truly disruptive. 
Happily, we tend to be a civilized enough crowd that we don't need 
bouncers.

-- Sam

---

From: Eric Burger <[email-masked]>
Date: Wed, 25 Apr 2012 18:06:31 -0400

I would strongly support what Wes is talking about here.  I see two (other) reasons for keeping blue sheets.  The first is it is a recognized method of showing we have an open standards process.  The second is to support those who are trying to defend themselves in patent suits.  Frankly, I hope the IETF makes it hard for those who want to abuse the IETF process to get patents or ignore prior art and then come after the industry for undeserved royalties.

For the former purpose, just having a list is sufficient. However, for the latter purpose, one needs records that would be admissible in court. Without eating our dog food and having some sort of audited digital signature technology, a simple scan will not do.

---

From: SM <[email-masked]>
Date: Wed, 25 Apr 2012 16:11:30 -0700

Hi Eric,
At 15:06 25-04-2012, Eric Burger wrote:
>For the former purpose, just having a list is sufficient. However, 
>for the latter purpose, one needs records that would be admissible 
>in court. Without eating our dog food and having some sort of 
>audited digital signature technology, a simple scan will not do.

I assumed that the IAOC considered the legal implications of 
discarding the blue sheets before the IETF was asked for 
feedback.  The IAOC is supposed to be working on a statement of 
privacy since mid-2011.  There is a document about retention policy.

I haven't seen any of the above mentioned in this long thread.

Regards,
-sm

---

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 30 Apr 2012 16:47:19 -0400

+1

We could have a bonfire of the blue sheets as a Friday-afternoon social event.