Subject: Re: Future Handling of Blue Sheets

From: IETF Chair <[email-masked]>
Date: Thu, 14 Jun 2012 17:26:56 -0400

Two things have occurred since the message below as sent to the IETF mail list.  First, we got a lawyer in Europe to do some investigation, and the inclusion of the email address on the blue sheet will lead to trouble with the European privacy laws.  Second, Ted Hardie suggested that we could require a password to access the scanned blue sheet.

Based on the European privacy law information, the use of email will result in a major burden.  If the email address is used, then we must provide a way for people to ask for their email address to be remove at any time in the future, even if we got prior approval to include it.  Therefore, I suggest that we collect organization affiliation to discriminate between multiple people with the same name instead of email address.

Based on Ted's suggestion, I checked with the Secretariat about using a datatracker login to download the scanned blue sheet.  This is fairly easy to do, once the community tracking tools are deployed.  However, with the removal of the email addresses from the blue sheets, it is unclear that there is any further need for password protection of these images.  Therefore, I suggest that we proceed without password protection for the blue sheet images.

Here is a summary of the suggested way forward:

- Stop collecting email addresses on blue sheets;

- Collect organization affiliation to discriminate between multiple people with the same name;

- Scan the blue sheets and include the images in the proceedings for the WG session;

- Add indication to top of the blue sheet so people know it will be part of the proceedings; and

- Discard paper blue sheets after scanning.

Russ

On May 6, 2012, at 12:46 PM, IETF Chair wrote:

> We have heard from many community participants, and consensus is quite rough on this topic.  The IESG discussed this thread and reached two conclusions:
> 
> (1) Rough consensus: an open and transparent standards process is more important to the IETF than privacy of blue sheet information.
> 
> (2) Rough consensus: inclusion of email addresses is a good way to distinguish participants with the same or similar names.
> 
> 
> Based on these conclusions, the plan is to handle blue sheets as follows:
> 
> - Continue to collect email addresses on blue sheets;
> 
> - Scan the blue sheet and include the image in the proceedings for the WG session;
> 
> - Add indication to top of the blue sheet so people know it will be part of the proceedings; and
> 
> - Discard paper blue sheets after scanning.
> 
> 
> On behalf of the IESG,
> Russ
>

---

From: Eric Burger <[email-masked]>
Date: Fri, 15 Jun 2012 17:37:50 -0400

Do we have guidelines as to what is an "organization affiliation"?

---

From: [email-masked]
Date: Fri, 15 Jun 2012 21:42:34 +0000

I presume it is the same data that people input into the "Organization" field when they register for the meeting.

Regards,

Ed  J.

---

From: "Adrian Farrel" <[email-masked]>
Date: Sat, 16 Jun 2012 02:59:29 +0100

I've always found that term in that context highly presumptuous and slightly
offensive.

Adrian

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> [email-masked]
> Sent: 15 June 2012 22:43
> To: Eric Burger; [email-masked]; IETF Chair
> Cc: IETF
> I presume it is the same data that people input into the "Organization" field
when
> they register for the meeting.
> 
> Regards,
> 
> Ed  J.
> 
> > Two things have occurred since the message below as sent to the IETF mail
list.
> First, we got a lawyer in Europe to do some investigation, and the inclusion
of the
> email address on the blue sheet will lead to trouble with the European privacy
> laws.  Second, Ted Hardie suggested that we could require a password to access
> the scanned blue sheet.
> >
> > Based on the European privacy law information, the use of email will result
in a
> major burden.  If the email address is used, then we must provide a way for
> people to ask for their email address to be remove at any time in the future,
> even if we got prior approval to include it.  Therefore, I suggest that we
collect
> organization affiliation to discriminate between multiple people with the same
> name instead of email address.
> >
> > Based on Ted's suggestion, I checked with the Secretariat about using a
> datatracker login to download the scanned blue sheet.  This is fairly easy to
do,
> once the community tracking tools are deployed.  However, with the removal of
> the email addresses from the blue sheets, it is unclear that there is any
further
> need for password protection of these images.  Therefore, I suggest that we
> proceed without password protection for the blue sheet images.
> >
> > - Collect organization affiliation to discriminate between multiple people
with
> the same name;
> > - Add indication to top of the blue sheet so people know it will be part of
the
> proceedings; and
> >> We have heard from many community participants, and consensus is quite
> rough on this topic.  The IESG discussed this thread and reached two
conclusions:
> >>
> >> (1) Rough consensus: an open and transparent standards process is more
> important to the IETF than privacy of blue sheet information.
> >>
> >> (2) Rough consensus: inclusion of email addresses is a good way to
distinguish
> participants with the same or similar names.
> >>
> >>
> >> - Add indication to top of the blue sheet so people know it will be part of
the
> proceedings; and

---

From: Joel jaeggli <[email-masked]>
Date: Fri, 15 Jun 2012 20:50:24 -0700

> I presume it is the same data that people input into the "Organization" field when they register for the meeting.

I do change mine based on what capacity I'm attending a particular
meeting in. That goes for email address on existing blue sheets as well...

The nice people who send me a check every two weeks don't generally fund
my attendance.

---

From: Tim Chown <[email-masked]>
Date: Sat, 16 Jun 2012 11:53:35 +0100

If the purpose is simply differentiation of people with the same names, could we not ask people to enter the last four digits of their IETF registration number, which would presumably be unique, while being easy to remember?  The number could even be on your badge to always be easy to look up.

Unless there's some reason to keep registration numbers private?

That would also allow poorly handwritten names to more readily be checked/corrected by OCR when the sheets are scanned.

Tim

---

From: Yoav Nir <[email-masked]>
Date: Sun, 17 Jun 2012 10:36:56 +0300

This creates a distinguished identity, so if two "Fei Zhang"s attended in Paris (only case I found in the attendee list), this would distinguish which of them attended a particular meeting. It would not, however, tie them to an identity on the mailing list, or to the "Fei Zhang" who attends the Vancouver meeting, so I'm not sure what purpose it serves.

Yoav

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Tim Chown
Sent: 16 June 2012 13:54
To: Joel jaeggli
Cc: IETF Chair; IETF; [email-masked]
Subject: Re: Future Handling of Blue Sheets

Tim

On 16 Jun 2012, at 04:50, Joel jaeggli wrote:

> The nice people who send me a check every two weeks don't generally 
> fund my attendance.
> 
>> Regards,
>> 
>> Ed  J.
>> 

Scanned by Check Point Total Security Gateway.

---

From: Tim Chown <[email-masked]>
Date: Sun, 17 Jun 2012 13:38:13 +0100

The registration number links to a registration that includes an email address, should that need to be looked up for some reason later.

Holding minimal information for the purpose, and keeping that information as non-identifiable to the holder as possible, would be nice properties?

Tim

---

From: IETF Chair <[email-masked]>
Date: Mon, 18 Jun 2012 12:25:18 -0400

Some SDOs have gone to great lengths to specify this in detail.  I am hoping that we can avoid that path.  Instead, as Ed already pointed out, each person already provides an organizational affiliation when they register.  Consistency would be helpful.

Russ