Subject: Re: Proposal to revise ISOC's mission statement

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 01 Nov 2017 09:13:02 +0100

We aren’t talking here about leaders suppressing speech, if the country has split power, what I’m talking is about courts acting independently of the government to apply laws. In this specific case, it was that way: Court order not Government.

Again, take the example of the child pornography. A court order bans it. Is that against freedom of speech? Is ISOC going to say that?

Here we have a similar case. Let me copy the text I responded in private to someone else:

“No, what I’m arguing is that ISOC trust .CAT folks and not having talked with the other Spanish ISOC chapters to verify it, instead of going to read the court order.

My point here is not the Catalonia problem, is a general statement to make in the ISOC “rules” that ISOC MUST not interfere with court orders, unless they can verify what is being said at the court order.

In this case, the court order indicated a list of very specific unlawful sites, but ISOC published that it was a global order to .cat to ban any political sites. It is a big difference. Our constitution doesn’t enable splitting the country and consequently a voting on that, was declared against law by our constitutional court, which ordered the police to avoid it (same way the police must avoid any other criminal or unlawful act, is their duty). Our constitution allows to be amended, but Catalonia Government don’t want that, they want to make sure they split and do at their own way, regardless only 25% of the Catalonian want that (which is only 5% of the total country population!).

Not sure if that's clearer.”

Regards,
Jordi

-----Mensaje original-----
De: ietf <[email-masked]> en nombre de Ted Lemon <[email-masked]>
Responder a: <[email-masked]>
Fecha: miércoles, 1 de noviembre de 2017, 2:18
Para: S Moonesamy <[email-masked]>
CC: <[email-masked]>, <[email-masked]>
Asunto: Re: Proposal to revise ISOC's mission statement

    On Oct 31, 2017, at 8:47 PM, S Moonesamy <[email-masked]> wrote:
    In other words, the society will only comment on law orders in "undemocratic countries".  Isn't it up to the society's Board of Trustees to decide about that?

    No, as I said earlier (perhaps it's futile to repeat, but wth), democracy depends on the ability of the electorate to speak about and understand the issues being decided.   So when a nominally democratic country attempts to censor the internet, it makes sense to protest.   This is the whole point of having laws, and particularly laws that protect freedom of speech.   It's quite commonplace for democratically elected leaders to attempt to suppress speech, because it is often inconvenient for them.   This is normal.   If we were to not protest when such attempts at suppression occurred, it would be normal for them to succeed.   That is why it makes sense to protest.
    
    Protesting an attempt to suppress speech is not something that only needs to be done un non-democratic countries; indeed, in non-democratic countries, it's somewhat futile.

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.consulintel.es
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 01 Nov 2017 09:19:52 +0100

I missed this email a few days ago … Very short answer:

Agree that ISOC should not take political sides: That’s what they did here, unfortunately.

What ISOC is missing here, in my opinion, is a very clear apologize for the first post. I will love the ISOC board to take a position here to mandate that apologize. 45 million citizens have been insulted by ISOC staff by publishing false accusations, instead of having waited to read the court order and consulted the rest of the Spanish chapters BEFORE the post.

Regards,
Jordi

-----Mensaje original-----
De: ietf <[email-masked]> en nombre de Gonzalo Camarillo <[email-masked]>
Responder a: Gonzalo Camarillo <[email-masked]>
Fecha: viernes, 27 de octubre de 2017, 9:34
Para: <[email-masked]>, <[email-masked]>
Asunto: Re: Proposal to revise ISOC's mission statement

    Hi Jordi,
    
    thanks for all the input!
    
    With respect to ISOC commenting on political issues, Frederic's
    clarifying statement (which was issued after the first one) said:
    
    > There are many other stakeholders who are much better positioned
    > than the Internet Society to deal with and comment on these
    > political aspects.
    
    So, yes, ISOC's role in those cases is not to take political sides but
    to comment on technical issues.
    
    With respect to your other comments, as you point out they are more
    about concrete activities than mission-level comments. I will relay
    them to those in ISOC dealing with those areas. In any case, you can
    find my brief initial comments below:
    
    1) ISOC has programs that bring "technical" and "policy" people to the
    IETF. In addition, we have received requests from the chapters
    community to have ISOC provide grants to support more-experienced IETF
    participants. One example given was, indeed, to have ISOC cover the
    registration fee for a few participants who meet some given criteria.
    
    As I mentioned in a previous email, we are going to also
    get the opinion of the IETF leadership about what is the best way to
    help the IETF in that area. So, in short, we are currently looking
    into this.
    
    2) How to have IoT deployments with better  security and resilience
    was discussed in a plenary a few IETF meetings ago, IIRC. In addition
    to having governments regulate such deployments, self-regulation by
    the industry is another alternative that is often discussed. ISOC's
    policy people are looking into that as well.
    
    Again, thanks for the comments, Jordi!
    
    Cheers,
    
    Gonzalo

    On 26/10/2017 4:30 PM, JORDI PALET MARTINEZ wrote:
    > Hi Gonzalo,
    > 
    > I will suggest that we have a clear text (may be in the mission statement) that avoids ISOC (and staff) to get involved into courts decisions in democratic countries and even comment them unless they have documents that demonstrate what they are saying. The recent happenings in Catalonia and the lies that ISOC staff has communicated, are not only illegal but also lies, and can bring legal consequences to ISOC & staff as a Spanish prosecutor is already looking into that. I’m not going to repeat myself on this, this is explained at:
    > 
    > http://www.circleid.com/posts/20170926_catalonian_matter_law_order_democracy_freedom_of_speech_censorship/
    > and the continuation at:
    > https://jordipalet.blogspot.co.uk/2017/09/isoc-against-its-own-principles-acting.html
    > 
    > Also, after reading your email, and according to the highlighted activities I will like to bring a couple of possible more concrete actions.
    > 
    > 1) As one of the proposed activities is “Facilitates open development of standards, protocols, administration, and the technical infrastructure of the Internet”, and this is clearly referring, at least in part, to IETF, considering increase in the revenue that you mention, I think it will be very relevant to understand that many frequent and active participants are contributing from their own pockets, which our own personal time. So, I think we should consider that those not backed by big companies, could get some funding at least to cover their registration fee. I’m not sure if also traveling expenses, but I guess increasing the ISOC contribution to IETF, to make the registration fee free for those that need that support, will not mean a very high cost for ISOC and for many of us it is over 2.000 USD per year.
    > 2) I’m missing highlighting very concrete activities regarding “globally-connected, and secure”. Let me explain what I think are relevant actions that can be taken here in the next paragraphs.
    > 
    > I’ve been tracking personally the problem of spam for several years, and precisely we had a discussion with some folks on this yesterday night. I’m clear that it requires some investigators, and I’m not talking only about “network” research, but also lawyers. I’m convinced that whois privacy is a big problem, as it hides criminals, and we should get involved in making sure that ICANN understands it.
    > 
    > My few resources to investigate this, brought me to the conviction (I’m not saying that it was not clear for me before, but now I’ve evidences) that there are some criminal organizations using spam for many other criminal actions. They create user databases (at least with emails, but possibly other personal data), and they are at the minimum, selling or hiring those databases to another kind of “legal” but in my personal view, also criminal organizations which call themselves “email marketing companies”. Nobody, in general provides his/her email for receiving spam, and in many countries, this is forbidden, and is even against the law, to have registered you email (despite what the “form” said), and use it for a different “ad campaign”. In many countries every spam sender, requires a previous and explicit acceptance from the email owner, but this is never respected.
    > 
    > I’ve got threatened by several of those organizations when I’ve tried to act against them, and unfortunately, I don’t see data protection agencies and governments taking a strong position/action on this, so Internet citizens are not protected.
    > 
    > I think ISOC could invest in doing a good investigation on this (I’m happy to help, I’ve even a law proposal for governments to be able to fine/punish organizations hiring those illegal “spam” services), bring this data to lawyers, and start a few suites against those criminal organizations, so governments actually see the problem, make strong rules and enforce them.
    > 
    > In summary, in my opinion “email marketing” should be only used for a company to advertise their *own* products to their *own* customers or interested ones that have explicitly agreed on that (which is what the law say in many countries, but is not getting enforced).
    > 
    > I’m talking about spam, but the implications of what I explained above are related to security in general in the network, intrusion in our “own” devices and apps, and all kind of related cybercrimes, and in the near future, if we don’t act now, it will also have very serious implications in IoT and new developments.
    > 
    > This week, during the RIPE meeting in Dubai, I learnt from ISOC staff about the OTA (https://otalliance.org/), which is now an ISOC activity. This is one of the topics I believe ISOC should invest. My view has two sides:
    > a) The use of clouds is good (I don’t think is technically necessary with IPv6), but it requires SDOs, governments and industry to agree in ways to protect consumers. Short explanation. You by a device, it works only (or many of the best features) thru a cloud. Vendor goes to bankrupt, you throw away the device, even if it costed several hundred dollars. Possible solution, governments have laws (as in any other field, FCC, EC, UL, etc.), that mandate that every device being imported in a territory, either is not using cloud, or it has open and standard APIs so instead of using only the vendor “free” cloud can be attached/used to other ones without losing functionalities.
    > b) Security of those devices. Any Internet or IoT device, must pass (the same as FCC, EC, etc.), minimum security testing to allow to be upgraded when security bugs are found, to avoid easily being hacked, etc. I recall when we had modems, that need to pass specific regulations, and you can’t bring them to your country is they don’t have got the certification number. Nothing new here, just a different way to “connect” (it was RJ45 before, now is IP).
    > 
    > A possible path for both areas is having the same organizations doing those FCC, EC, UL, etc., testing, increasing their test, with the support from IETF or other SDOs when applicable, and making sure that governments and industry get together in supporting it and not allowing non-compliance devices to be in the market. I believe that having the same “certification” authorities, will not increase the “testing” cost, neither the “enforcement” cost (same border controls in customs when importing products), and vendors will have an “easy” way to follow those specs if we work together.
    > 
    > In my opinion ISOC has the power and budget to do that, and again, I’m happy to work on this area and specially contribute to the discussion of possible paths.
    > 
    > Regards,
    > Jordi
    >  
    > 
    > De: ietf <[email-masked]> en nombre de Gonzalo Camarillo <[email-masked]>
    > Responder a: Gonzalo Camarillo <[email-masked]>
    > Fecha: jueves, 26 de octubre de 2017, 11:21
    > Para: <[email-masked]>
    > Asunto: Proposal to revise ISOC's mission statement
    > 
    >     Hi,
    >     
    >     the board of trustees of the Internet Society (ISOC) plans to revise
    >     ISOC's mission statement. We would like to get your comments on the
    >     proposal we include below. This email discusses the reasons for the
    >     proposed change, the process we have followed so far to put together
    >     the current proposal, and the next steps in the process.
    >     
    >     ISOC's current vision and mission statements were developed around
    >     2005 and are available at ISOC's web page:
    >     
    >     https://www.internetsociety.org/mission/
    >     
    >     These statements have provided ISOC with a clear direction for many
    >     years and have been a useful tool for the community.
    >     
    >     What ISOC does in practice to fulfill its vision has evolved over
    >     time.  Looking at the environment in which ISOC operates, there have
    >     been important changes (some external and some internal to ISOC) that
    >     make it desirable to revise those statements at this point.
    >     
    >     Externally, the current Internet environment is different from what it
    >     was when the current statements were developed: regional needs are
    >     different, communication patterns are different, and the
    >     standardization landscape is different. Internet users and, thus, also
    >     ISOC's chapters and members are more international and many of them
    >     come from developing countries.
    >     
    >     Internally, ISOC's revenue sources have increased significantly from
    >     2005 until present. This means that ISOC's potential to realize its
    >     vision through activities has increased substantially and may still
    >     continue to increase in the near term. The board considers that simply
    >     increasing linearly everything ISOC does today would not be a viable
    >     or desirable approach. Building a large reserve without further
    >     advancing ISOC's social goals is not a good option either. Instead,
    >     ISOC will strengthen some of its current areas of engagement and, when
    >     appropriate, engage in new impactful activities in new areas.
    >     
    >     Our goal is to bring more focus into the organization. The idea is to
    >     avoid spreading ourselves too thin and, instead, increase ISOC's focus
    >     on activities that make a difference.
    >     
    >     In order to make those key decisions, staff, the board, and the
    >     community need to be on the same page regarding ISOC's vision and
    >     mission, and their underlying meaning. Given that many members of
    >     staff, the board, and the community were not around when the current
    >     statements were developed back in 2005, revising them with their
    >     involvement was considered to be a necessary exercise so that
    >     everybody feels them as their own. Getting a common sense of ownership
    >     is one of our main goals.
    >     
    >     In order to have a fresh look at our vision and mission, a set of
    >     workshops involving the whole staff were organized.  Using an
    >     iterative process and taking the input from those workshops into
    >     consideration, further workshops involving the board and ISOC's senior
    >     management were organized with the help of a facilitator. Some of the
    >     workshops were virtual and some of them were face-to-face.
    >     
    >     The board had a face-to-face retreat where, based on all the work
    >     above, revised draft statements were generated. Those draft statements
    >     were sent to parts of the community (including IETF leadership, ISOC's
    >     emeriti trustees, and chapter and org members) to get initial
    >     comments. After gathering a good amount of initial community feedback,
    >     the board generated new proposed statements addressing the comments
    >     received. With the process above the board aimed to ensure that the
    >     revised statements take into account the perspectives of staff as well
    >     as our wider community.
    >     
    >     The resulting proposed statements (included below) are now ready to be
    >     sent to our whole community.
    >     
    >     During the process above, we agreed that ISOC's current vision and
    >     mission are still as valid as ever. With respect to the *statements*
    >     that capture the spirit of the vision and mission, we do not propose
    >     any changes to the vision statement.
    >     
    >     With respect to the mission statement, we propose to update it.  One
    >     of the goals with the new statement is that it is both concise and
    >     memorable.  Consequently, the mission is stated at a higher
    >     abstraction level and contains fewer points.
    >     
    >     The current mission statement included a list of activities ISOC
    >     performs to help achieve our mission. While it seems that list was not
    >     approved as part of the mission statement back in the day, the initial
    >     feedback we have gotten from the community clearly indicates that many
    >     consider capturing the list in an official way important. Therefore,
    >     we propose to keep those bullets as highlights of activities.
    >     
    >     It is worthwhile noting that, regardless of the outcome in the form of
    >     a revised mission statement, this process is being very useful in
    >     itself. It has clearly helped getting a better understanding about
    >     ISOC's purpose among everybody involved.
    >     
    >     Please, find the proposed statements below and share your comments
    >     with us on this list. Thanks!
    >     
    >     Cheers,
    >     
    >     Gonzalo Camarillo (for the board)
    >     Chair - ISOC Board of Trustees
    >     
    >     
    >     --- Proposal ---
    >     
    >     Vision:
    >     -------
    >     
    >       The Internet is for everyone.
    >     
    >     Mission:
    >     --------
    >     
    >       The Internet Society champions the development of the Internet as a
    >       global technical infrastructure, a resource to enrich people's
    >       lives, and a force for good in society.
    >     
    >       We work with the worldwide Internet community for an Internet that
    >       is open, globally-connected, and secure.
    >     
    >       Together, we focus on:
    >     
    >       - Building and supporting the communities that make the Internet work;
    >     
    >       - Advancing the development of Internet infrastructure,
    >         technologies, and open standards; and
    >     
    >       - Advocating for sound Internet policy around the world.
    >     
    >     Highlights of Activities:
    >     -------------------------
    >     
    >       To help achieve our mission, the Internet Society:
    >     
    >       - Facilitates open development of standards, protocols,
    >         administration, and the technical infrastructure of the Internet.
    >     
    >       - Supports education in developing countries specifically, and
    >         wherever the need exists.
    >     
    >       - Promotes professional development and builds community to foster
    >         participation and leadership in areas important to the evolution
    >         of the Internet.
    >     
    >       - Provides reliable information about the Internet.
    >     
    >       - Provides forums for discussion of issues that affect Internet
    >         evolution, development and use in technical, commercial, societal,
    >         and other contexts.
    >     
    >       - Fosters an environment for international cooperation, community,
    >         and a culture that enables self-governance to work.
    >     
    >       - Serves as a focal point for cooperative efforts to promote the
    >         Internet as a positive tool to benefit all people throughout the
    >         world.
    >     
    >       - Provides management and coordination for on-strategy initiatives
    >         and outreach efforts in humanitarian, educational, societal, and
    >         other contexts.
    >     
    >     --- End of Proposal ---
    >     
    >     
    > 
    > 
    >

---

From: S Moonesamy <[email-masked]>
Date: Wed, 01 Nov 2017 02:20:36 -0700

Hi Jordi,
At 01:13 AM 01-11-2017, JORDI PALET MARTINEZ wrote:
>No, what I'm arguing is that ISOC trust .CAT folks and not having 
>talked with the other Spanish ISOC chapters to verify it, instead of 
>going to read the court order.
>
>My point here is not the Catalonia problem, is a general statement 
>to make in the ISOC "rules" that ISOC MUST not interfere with court 
>orders, unless they can verify what is being said at the court order.
>
>In this case, the court order indicated a list of very specific 
>unlawful sites, but ISOC published that it was a global order to 
>.cat to ban any political sites. It is a big difference. Our 
>constitution doesn't enable splitting the country and consequently

As I see it, something went wrong [1].  What you are asking is for 
the Internet Society's Board of Trustee to set a policy so that the 
Internet Society does not make any statement related to a country 
without verifying the facts.

Regards,
S. Moonesamy

1. The word "wrong" is used for simplicity instead of accuracy.

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Wed, 01 Nov 2017 12:14:57 +0100

Exactly!

Regards,
Jordi

-----Mensaje original-----
De: ietf <[email-masked]> en nombre de S Moonesamy <[email-masked]>
Responder a: <[email-masked]>
Fecha: miércoles, 1 de noviembre de 2017, 10:35
Para: <[email-masked]>, <[email-masked]>
Asunto: Re: Proposal to revise ISOC's mission statement

    Hi Jordi,

    Regards,
    S. Moonesamy

---

From: Ted Lemon <[email-masked]>
Date: Wed, 1 Nov 2017 16:26:21 -0400

> In this case, the court order indicated a list of very specific unlawful sites, but ISOC published that it was a global order to .cat to ban any political sites. It is a big difference. Our constit…

I haven't seen the court order, but I agree that it's important to get the facts straight before making a statement, and this is a good example of a set of facts that, had they been gotten straight, would have resulted in a clearer and more effective message.

---

From: Gonzalo Camarillo <[email-masked]>
Date: Mon, 6 Nov 2017 10:14:01 +0200

Hi Charles,

> Overall I think the new mission statement is quite good.

Thanks!

> Rather than add more specific examples to the existing set of
> highlighted activities, how about adding something in the mission
> statement about implementation and application in addition to the
> development of open standards. This would leave it to the IETF
> community to decide on methods to achieve this, e.g. more emphasis
> on running code, reference implementations, protocol validation,
> workshops on enabling new standards and functionality, etc.

Good point! In fact, ISOC is *already* supporting the implementation
and deployment of some technologies. I agree we should not be only
talking about development. I will discuss with the board how to
address this comment. Thanks!

Cheers,

Gonzalo

---

From: Gonzalo Camarillo <[email-masked]>
Date: Mon, 6 Nov 2017 10:16:29 +0200

Hi Marc,

> Sure, but it would be a good start to have something in the ISOC
> mission statement about promoting protocol checking (hackathon,
> testing) and formal verifications of the IETF standards.

Per my response to Charles's message a minute ago, capturing at a high
level the fact that ISOC supports some technologies beyond their
development seems like a good idea to me.

Cheers,

Gonzalo

---

From: Gonzalo Camarillo <[email-masked]>
Date: Mon, 6 Nov 2017 10:43:15 +0200

Hi Richard,

thanks for your comments. I am very much aware of the activities of
the SIP Forum ;-) Thanks for your work during all these years.

A couple of comments inline:

> Stephen Farrell is spot on in having some skepticism about mission
> statements.

FWIW, I myself am not a big fan of mission statements
either. Nevertheless, getting staff, the board, and the different
communities to think of what ISOC should stand for has been useful,
IMHO. As I mentioned elsewhere, in addition to the work on the mission
statement, we are also working on defining the scope of ISOC's
activities at a more detailed level. In fact, we are working on the
three pillars (communities, technology, and policy) and discussing
what should be the scope of engagement in each of those areas.

>  I’m not saying ISOC shouldn’t be involved in implementation and
> compliance issues. It could be very useful in kickstarting efforts
> by specific protocol communities in self organizing if there is
> sufficient consensus to do so, but acting as an overall umbrella for
> such efforts IMHO is not the best use of ISOC resources.

I personally agree with you that ISOC can be most useful when involved
in kickstarting efforts. Currently, we always look into the
sustainability of any effort we choose to initially support.

Cheers,

Gonzalo

---

From: Gonzalo Camarillo <[email-masked]>
Date: Mon, 6 Nov 2017 12:34:33 +0200

Hi Keith,

thanks for your comments.

> In the context of ISOC it's important to understand that the Internet
> can be used for good or ill, but it's in danger of becoming more of the
> latter.   Promoting the Internet as if it were a universal good, while
> ignoring the various ways it can be used to exploit or harm its users,
> does not seem either responsible or consistent with ISOC's history.  
> There are of course limits to what ISOC can do about it, but I don't
> think ISOC should be silent and/or pretend that it's not a problem.

I agree with you. In fact, this is a topic I also brought up in my
closing talk at ISOC's 25th anniversary event a few weeks ago. In the
past, it was assumed that more connectivity was always good. Nowadays,
as you point out, ubiquitous and constant connectivity has clear
downsides as well. In addition to the examples you discussed, Internet
addiction and the social problems it is already causing in some parts of
the world (e.g., increases in car accidents, social isolation, etc.) is
an important concern as well.

I also agree with you that there are clear limits to what ISOC can or
should do about it. As I mentioned in previous emails, in addition to
the work on the mission statement we are working on defining ISOC's
scope in more detail in different areas, "policy" being one of them. We
are currently working on identifying particular areas where, based on
ISOC's capabilities, we should engage. We are also identifying areas
where ISOC should not get involved.

With respect to capturing this in the mission statement, the proposed
text reads as follows: The Internet as "a force for good in society".
That sentence tries to capture the social benefits we are after (as
opposed to just wanting connectivity for the sake of it, without any
"higher" purpose).

Cheers,

Gonzalo

---

From: Gonzalo Camarillo <[email-masked]>
Date: Mon, 6 Nov 2017 12:48:17 +0200

Hi Toerless,

> I suggest ISOC sits down, takes those 8 bullet points and converts
> them into 8 sections for the ISOC wikipedia entry, where each section
> could be lets say 1/2 ... 1 page long, highlighting the core historic
> achievements, current challenges and ongoing activies for each of
> these bullet points.

As I have discussed elsewhere, based on the preliminary feedback
we received, we have decided to keep the list you are referring to
*unmodified* for the time being. We may want to revise it at some point
in the future, but the plan is not to do that now. When we (eventually)
get to revise it, I fully agree with you such a highlights of activities
list should contain the most relevant *current* activities. I also agree
that having explicit explanations about ISOC's activities is useful.
ISOC's new web page will hopefully address that.

> ISOC is not only the Internet (surprise). I am totally missing a
> statement about supporting proliferation of open technologies, 
> development, operations and management practices of the Internet to
> infinity and beyond. Is that not what IoT will be all about ? That is
> not going to be the Internet. That is going to be many internets
> totalling much more than the Internet will ever be.

So, you do not think the *Internet* Society is about the "Internet" ;-)
And you do not think the *Internet* of Things is part of the Internet? :-)

Seriously though, the term Internet in this context is used in general
and includes IoT deployments that are connected to the public Internet.

Cheers,

Gonzalo

---

From: Keith Moore <[email-masked]>
Date: Mon, 6 Nov 2017 19:00:57 -0500

Hi Gonzalo,

Thanks your your reply.  I understand that it's necessary to word things 
carefully, but I hope ISOC can find a way to specifically call out both 
mining of personal data (whether or not traceable to individual 
identities) and mass surveillance (whether or not by state-supported 
actors) as significant threats to the public welfare.

Keith

---

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 7 Nov 2017 09:30:46 +0200

Hi Keith,

yes, ISOC has activities on that front. For instance, a couple of weeks
ago ISOC organized the following Chatham House Roundtable on Encryption
and Lawful Access:

https://www.chathamhouse.org/event/encryption-and-lawful-access

Cheers,

Gonzalo

---

From: Keith Moore <[email-masked]>
Date: Tue, 7 Nov 2017 02:38:03 -0500

Having "activities", and prominently taking a stand for what's right, are very different things.

---

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 7 Nov 2017 09:49:36 +0200

Hi Keith,

ah, now I see where you are coming from. Yes, we are also discussing
whether ISOC should be closer to a neutral "convener" or, instead,
"advocate" more strongly in certain areas... and the ideal role may
depend on the particular area, actually.

In summary, yes, we are thinking about it... and, FWIW, based on my
discussions many IETFers share your view.

Cheers,

Gonzalo

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 7 Nov 2017 08:59:36 +0000

Hiya,

> discussions many IETFers share your view.

As an input there, (not that you'll be short of them:-),,, I
hope that ISOC don't differentiate too much between government
surveillance and corporate surveillance. While the latter
may have some fig-leaf of so-called "consent" or clicked-EULA,
it's the same information being gathered/centralised etc. (And
of course the latter form of surveillance can nicely feed the
former when companies are compelled.)

I realise that commenting on corporate surveillance might be
harder for ISOC and IETFers as we end up criticising basically
ourselves/our-employers, but ISTM that logic and consistency
call for doing just that.

Cheers,
S.

---

From: Keith Moore <[email-masked]>
Date: Tue, 7 Nov 2017 04:14:27 -0500

> call for doing just that.

+1

---

From: Lee Howard <[email-masked]>
Date: Tue, 07 Nov 2017 10:59:57 -0400

>former when companies are compelled.)

Another form of corporate surveillance is monitoring your employees’ use
of your corporate resources. I hope we don’t collectively object to that.
Similarly, parents may surveill their childrens’ use of family resources.

Lee

---

From: Keith Moore <[email-masked]>
Date: Tue, 7 Nov 2017 11:10:58 -0500

Sent from my iPhone

> On Nov 7, 2017, at 9:59 AM, Lee Howard <[email-masked]> wrote:
> 

That's also a heinous practice, along with drug testing, demanding employees' social media credentials, etc.

---

From: Lee Howard <[email-masked]>
Date: Tue, 07 Nov 2017 12:04:15 -0400

On 11/7/17, 12:10 PM, "Keith Moore" <[email-masked]> wrote:

>That's also a heinous practice, along with drug testing, demanding
>employees' social media credentials, etc.

I disagree. If I’m paying someone to use my computer to communicate my
data on my network, it’s mine. You don’t get a say in it.

More to the point: I don’t recall an ISOC opinion on this topic, or the
identical situation of parental supervision. Also, I’d appreciate a
pointer to the IETF consensus statement on the topic, if there is one.

Even more to the point: nuanced position statements don’t belong in the
mission statement. 

Lee

---

From: Keith Moore <[email-masked]>
Date: Tue, 7 Nov 2017 12:08:17 -0500

Sent from my iPhone

> On Nov 7, 2017, at 11:04 AM, Lee Howard <[email-masked]> wrote:
> 
> 
> 

I suppose you have their houses searched too?

Keith

---

From: henry <[email-masked]>
Date: Tue, 07 Nov 2017 12:41:22 -0500

Your employee is best viewed as a contracted sovereign labor, with right to liberty to engage in private and protected communications over the contractual equipment and service allocation to support your labor. Just as if it were an automobile, she will stop to get groceries and drive her kids to soccer, in the company car.

Same difference without nuance. Yes, allegorical category...

Sent from ProtonMail Mobile

On Tue, Nov 7, 2017 at 11:04, Lee Howard <[email-masked]> wrote:

> On 11/7/17, 12:10 PM, "Keith Moore" wrote: > > >Sent from my iPhone > >> On Nov 7, 2017, at 9:59 AM, Lee Howard wrote: >> >> Another form of corporate surveillance is monitoring your employees’ use >> of your corporate resources. I hope we don’t collectively object to >>that. > >That's also a heinous practice, along with drug testing, demanding >employees' social media credentials, etc. I disagree. If I’m paying someone to use my computer to communicate my data on my network, it’s mine. You don’t get a say in it. More to the point: I don’t recall an ISOC opinion on this topic, or the identical situation of parental supervision. Also, I’d appreciate a pointer to the IETF consensus statement on the topic, if there is one. Even more to the point: nuanced position statements don’t belong in the mission statement. Lee @asgard.org> @network-heretics.com>

---

From: Lee Howard <[email-masked]>
Date: Tue, 07 Nov 2017 13:19:44 -0400

>I suppose you have their houses searched too?

Well, in my child’s case, I most certainly do.

In the business case, not unless I paid for the house, the network, the
work they’re doing there, and the devices they’re doing it on.

If you walk out of my office carrying a large box, I certainly have the
right to check what’s inside it. If you send email out of my office
servers with a large attachment, I have the right to check what’s inside.

What’s confusing about this concept? How is this even contentious? And how
can we bring it back around to the actual topic of conversation?

Lee

---

From: Keith Moore <[email-masked]>
Date: Tue, 7 Nov 2017 13:51:31 -0500

You're the one arguing for spying on your employees.

Sent from my iPhone

> On Nov 7, 2017, at 12:19 PM, Lee Howard <[email-masked]> wrote:
> 
> 
>

---

From: james woodyatt <[email-masked]>
Date: Tue, 7 Nov 2017 10:56:34 -0800

On Nov 7, 2017, at 06:59, Lee Howard <[email-masked]> wrote:
> On 11/7/17, 4:59 AM, Stephen Farrell <[email-masked] <mailto:[email-masked]>> wrote:
>> […] While the latter may have some fig-leaf of so-called "consent" or clicked-EULA, it's the same information being gathered/centralised etc. (And of course the latter form of surveillance can nicely feed the former when companies are compelled.)
> 
> 
> Another form of corporate surveillance is monitoring your employees’ use of your corporate resources. I hope we don’t collectively object to that. Similarly, parents may surveill their childrens’ use of family resources.

Those are dissimilar with respect to the issue of consent. It’s one thing to use surveillance technologies in the role of legal guardian for dependents without capacity for consent, and it’s an entirely different thing to use a contract of adhesion to coerce subordinates into “consenting” to give up their rights to intimate privacy.

And there’s a lot of dirty business hiding under that phrase “monitoring your employees’ use of your corporate resources” when you consider that your employees have personal identities in social media that can, at any moment, become involved in a viral public relations disaster. When corporations regard the personal online activity of their employees, using personal resources at home on their own time, as bearing on the public brand identity, using that to justify surveilling their employees private social activity, and further insist on employees “consenting” to this surveillance as terms of their employment, that’s hardly similar to a parent monitoring their kids’ porn habits.

--james woodyatt <[email-masked] <mailto:[email-masked]>>

---

From: S Moonesamy <[email-masked]>
Date: Tue, 07 Nov 2017 11:56:22 -0800

Hi Lee,
At 08:04 AM 07-11-2017, Lee Howard wrote:
>More to the point: I don't recall an ISOC opinion on this topic, or the
>identical situation of parental supervision. Also, I'd appreciate a

I don't recall seeing an IETF consensus statement about an ISOC 
opinion.  The topic of child protection has been discussed in 
internet governance forums.

Regards,
S. Moonesamy

---

From: Lee Howard <[email-masked]>
Date: Tue, 07 Nov 2017 15:06:32 -0400

From:  james woodyatt <[email-masked]>
Date:  Tuesday, November 7, 2017 at 2:56 PM
To:  Lee Howard <[email-masked]>
Cc:  IETF Discussion Mailing List <[email-masked]>
Subject:  Re: Proposal to revise ISOC's mission statement

>> On 11/7/17, 4:59 AM, Stephen Farrell <[email-masked]> wrote:
>>> […] While the latter may have some fig-leaf of so-called "consent" or
>>> clicked-EULA, it's the same information being gathered/centralised etc. (And
>>> of course the latter form of surveillance can nicely feed the former when
>>> companies are compelled.)
>> 
>> Another form of corporate surveillance is monitoring your employees’ use of
>> your corporate resources. I hope we don’t collectively object to that.
> Those are dissimilar with respect to the issue of consent. It’s one thing to
> use surveillance technologies in the role of legal guardian for dependents
> without capacity for consent, and it’s an entirely different thing to use a
> contract of adhesion to coerce subordinates into “consenting” to give up their
> rights to intimate privacy.

You have no right to “intimate privacy” at work on your company-owned
computer on the company network on company time.

> 
> And there’s a lot of dirty business hiding under that phrase “monitoring your
> employees’ use of your corporate resources” when you consider that your
> employees have personal identities in social media that can, at any moment,
> become involved in a viral public relations disaster. When corporations regard
> the personal online activity of their employees, using personal resources at
> home on their own time, as bearing on the public brand identity, using that to
> justify surveilling their employees private social activity, and further
> insist on employees “consenting” to this surveillance as terms of their
> employment, that’s hardly similar to a parent monitoring their kids’ porn
> habits.

Who said anything about “personal resources at home on their own time”?
Trying to expand my statement to include that is more than simply
disingenuously building a straw man to throw down a slippery slope, it’s
dishonest.

Lee

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 7 Nov 2017 20:23:56 +0000

Hi Lee,

On 07/11/17 19:06, Lee Howard wrote:
> You have no right to â€œintimate privacyâ€ at work on your company-owned

First, I don't think there's any need to (nor liklihood of)
reaching consensus as to the above. FWIW, I don't agree
with you, and nor would various court judgements in some
places in the world. I fully accept that your position is
one shared by a bunch of folks though.

But in any case, there are many other forms of corporate
surveillance (e.g. kid's toys calling home to the manuf
for dodgy reasons) so I hope you'd agree that we don't
have to have 100% agreement about all of that to agree
that surveillance is not an issue that always involves a
government actor.

S.

---

From: Christian Huitema <[email-masked]>
Date: Tue, 7 Nov 2017 12:46:16 -0800

On 11/7/2017 11:06 AM, Lee Howard wrote:
 (Responding to James Woodyatt)
>
>     Those are dissimilar with respect to the issue of consent. It’s
>     one thing to use surveillance technologies in the role of legal
>     guardian for dependents without capacity for consent, and it’s an
>     entirely different thing to use a contract of adhesion to coerce
>     subordinates into “consenting” to give up their rights to intimate
>     privacy.
>
>

Lee, you are making here a legal statement, "you have no right". As a
matter of fact, that statement depends on which laws apply in the place
of business. I understand that most US courts will consider that
employers have a right to monitor employees' communications, although
there are gray areas when employers allow private use of corporate
email. But then, German courts will take the opposite view.

The opinion of the European Court of Human Rights, as reported here by
the
NYT(https://www.nytimes.com/2017/09/05/business/european-court-employers-workers-email.html),
is rather nuanced. The very high level summary of that opinion is that
expectations should be set clearly, so that employees understand what is
monitored and what is not. The opinion also states that enterprises
should be reasonable, and limit their monitoring to work relevant issues.

Bottom line, the situation is much more nuanced than "you have no
right". Although of course I always advise my friends to not conduct
private conversations using corporate email, and use their own personal
account instead.

-- Christian Huitema

---

From: james woodyatt <[email-masked]>
Date: Tue, 7 Nov 2017 13:16:57 -0800

On Nov 7, 2017, at 12:46, Christian Huitema <[email-masked]> wrote:
> [I wrote:]
>> ...it’s an entirely different thing to use a contract of adhesion to coerce subordinates...
> 
> Bottom line, the situation is much more nuanced than "you have no right"

Yes, and the reason I used that technical phrase “contract of adhesion” there is to set down a marker observing that various arguments about the unconscionability (and therefore the unenforceability) of various standard form contract provisions commonly observed in the wild remain basically untested. I contend it would be within the ambit of ISOC to take public positions on some of those questions.

---

From: Lee Howard <[email-masked]>
Date: Tue, 07 Nov 2017 23:36:42 -0400

>one shared by a bunch of folks though.

Great summary: I am in the minority here, but it is not clear that there
is consensus.
Out of curiosity, can you point me to courts that have found a right to
privacy where all three conditions existed (company device, company
network, company time)?

>that surveillance is not an issue that always involves a

Yes, that’s where we started. I was pointing out an additional vector of
surveillance, which might not be as easily dismissed. Your example is
another one (whether the reasons are dodgy or noble). Surveillance does
not always involve a government actor, and I think there’s consensus on
that. I further assert that there are conditions under which surveillance
is not evil, but that statement does not have consensus support.

Lee

---

From: Lee Howard <[email-masked]>
Date: Tue, 07 Nov 2017 23:58:55 -0400

From:  Christian Huitema <[email-masked]>
Date:  Tuesday, November 7, 2017 at 4:46 PM
To:  Lee Howard <[email-masked]>, james woodyatt <[email-masked]>
Cc:  IETF Discussion Mailing List <[email-masked]>
Subject:  Re: Proposal to revise ISOC's mission statement

>>> contract of adhesion to coerce subordinates into “consenting” to give up
>>> their rights to intimate privacy.
>>>  
>>>  
>>>  
>>   
>> 
>>  
>>  
>  Lee, you are making here a legal statement, "you have no right". As a matter
> of fact, that statement depends on which laws apply in the place of business.
> I understand that most US courts will consider that employers have a right to
> monitor employees' communications, although there are gray areas when
> employers allow private use of corporate email. But then, German courts will
> take the opposite view.
>  
>  The opinion of the European Court of Human Rights, as reported here by the
> NYT(https://www.nytimes.com/2017/09/05/business/european-court-employers-worke
> rs-email.html), is rather nuanced. The very high level summary of that opinion
> is that expectations should be set clearly, so that employees understand what
> is monitored and what is not. The opinion also states that enterprises should
> be reasonable, and limit their monitoring to work relevant issues.

Thanks for that link; that article was interesting and illuminating. The
nuance is that in affected jurisdictions, employers must disclose the extent
to which they might inspect employees’ communication. That seems like a
reasonable constraint (although one that would have been better articulated
before the fact, rather than inferring the requirement).

I think rights, though, are not just a legal matter, but a philosophical
one. And when examining rights, it’s always interesting to examine the
inverse, and look at who is compelled to safeguard those rights.

> 
>  
>  Bottom line, the situation is much more nuanced than "you have no right".
> Although of course I always advise my friends to not conduct private
> conversations using corporate email, and use their own personal account
> instead.

That’s prudent advice. Even if they weren’t permitted to produce your email
in court, trusting that your employer isn’t monitoring your activity is
asking for trouble. Firewalls can’t tell the difference between mSexChange
and MSExchange (real example), and employee can do many things short of
legal action.

Practical example: I was firewall administrator at a previous employer. So
when they asked about employee activity, and I did some analysis, I could
say, “This person is spending 4-6 hours a day on Local University site, and
this person spends 40 minutes around lunch time on porn sites.” Rumor was
(though I was not privy to personnel records) that the first person had been
billing that time to clients, and was fired for fraud. Second person’s
activity suddenly stopped appearing in logs a couple weeks later.
Even if the employer didn’t have the ability to produce those logs in court,
management might have suddenly been a lot more visible with those employees.

Lee

---

From: "Brian Trammell (IETF)" <[email-masked]>
Date: Wed, 8 Nov 2017 10:16:46 +0100

hi Stephen, Lee,

> On 7 Nov 2017, at 21:23, Stephen Farrell <[email-masked]> wrote:
> 
> 
> Hi Lee,
> 

Yeah, (IANAL but) ISTM surveillance on corporate networks is a pretty well settled point of disagreement between US and EU legal precedent, which is a tiny little branch of a great big fork in the way each jurisdiction approaches labor law and labor relations, and is at his point probably just one of those things organizations doing business on both sides of the pond have to tolerate. Know you rights and responsibilities in the jurisdictions in which you operate, same as it ever was...

> that surveillance is not an issue that always involves a

This is something we *absolutely* need to engage with as a community. There's a very clear line between "I have copies of emails you send and receive on the corporate account" and "there's a camera in your bedroom sharing on-demand video with our marketing affiliates", and we can discuss how bad the second is without ratholing on the first.

Indeed, I've been disappointed and perplexed that so much of the rhetoric around encryption post-Snowden (as epitomized by 7258) has focused exclusively on a nation-state or co-opted/evil large-network-operator attacker model, which is certainly a point of concern but not really where the biggest threat to collective privacy lies these days. I'm concerned that in our drive to Encrypt All The Things, absolutely the correct response when your only concern is a nation-state on the wire, we risk making it difficult to understand and defend against (what I'll call) the corporate-data-hording attacker model. To date, most of the evil toys phoning home and other such nastiness that I've heard of has been discoverable in part because said evil toys were using circumventable, crap, or no crypto.

If we do our job well against attackers on the wire, we make the job of those "attackers" on the wire whose goal it is to discover and document corporate-data-hoarding attacks more difficult. In a world where all client endpoints are using exclusively signed binaries on locked down systems with pinned certificates, it could become practically impossible.

But that's probably a different thread on a different mailing list, and I'm not sure how to (or whether it's a good idea to) phrase that at ISOC mission statement level.

Cheers,

Brian

---

From: Ted Lemon <[email-masked]>
Date: Wed, 8 Nov 2017 04:20:21 -0500

Making the packets on the wire unprotected in order to foil corporate data
gathering doesn't help, though. I agree that this is a problem, but the
solution has to be secure.

On Nov 8, 2017 10:17, "Brian Trammell (IETF)" <[email-masked]> wrote:

> Yeah, (IANAL but) ISTM surveillance on corporate networks is a pretty well
> settled point of disagreement between US and EU legal precedent, which is a
> tiny little branch of a great big fork in the way each jurisdiction
> approaches labor law and labor relations, and is at his point probably just
> one of those things organizations doing business on both sides of the pond
> have to tolerate. Know you rights and responsibilities in the jurisdictions
> in which you operate, same as it ever was...
>
> This is something we *absolutely* need to engage with as a community.
> There's a very clear line between "I have copies of emails you send and
> receive on the corporate account" and "there's a camera in your bedroom
> sharing on-demand video with our marketing affiliates", and we can discuss
> how bad the second is without ratholing on the first.
>
> Indeed, I've been disappointed and perplexed that so much of the rhetoric
> around encryption post-Snowden (as epitomized by 7258) has focused
> exclusively on a nation-state or co-opted/evil large-network-operator
> attacker model, which is certainly a point of concern but not really where
> the biggest threat to collective privacy lies these days. I'm concerned
> that in our drive to Encrypt All The Things, absolutely the correct
> response when your only concern is a nation-state on the wire, we risk
> making it difficult to understand and defend against (what I'll call) the
> corporate-data-hording attacker model. To date, most of the evil toys
> phoning home and other such nastiness that I've heard of has been
> discoverable in part because said evil toys were using circumventable,
> crap, or no crypto.
>
> If we do our job well against attackers on the wire, we make the job of
> those "attackers" on the wire whose goal it is to discover and document
> corporate-data-hoarding attacks more difficult. In a world where all client
> endpoints are using exclusively signed binaries on locked down systems with
> pinned certificates, it could become practically impossible.
>
> But that's probably a different thread on a different mailing list, and
> I'm not sure how to (or whether it's a good idea to) phrase that at ISOC
> mission statement level.
>
> Cheers,
>
> Brian
>

---

From: "Brian Trammell (IETF)" <[email-masked]>
Date: Wed, 8 Nov 2017 10:27:32 +0100

> On 8 Nov 2017, at 10:20, Ted Lemon <[email-masked]> wrote:
> 
> Making the packets on the wire unprotected in order to foil corporate data gathering doesn't help, though. I agree that this is a problem, but the solution has to be secure.

Agree completely. If I had a *solution* for this that I thought would work, I'd be proposing it. I'm simply raising the point that there's a tradeoff that the current discussions around the applicability and role of encryption in our protocols seem to me to be obscuring, and a threat model we're not paying adequate attention to.

Cheers,

Brian

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 8 Nov 2017 09:36:43 +0000

On 08/11/17 09:16, Brian Trammell (IETF) wrote:
> Indeed, I've been disappointed and perplexed that so much of the
> rhetoric around encryption post-Snowden (as epitomized by 7258) has
> focused exclusively on a nation-state 

Ahem:-) 7258 says:

  "The
   motivation for PM can range from non-targeted nation-state
   surveillance, to legal but privacy-unfriendly purposes by commercial
   enterprises, to illegal actions by criminals. "

I think we got that right. I agree that there has been too little
focus put on the non-state actor cases.

> or co-opted/evil
> large-network-operator attacker model, which is certainly a point of
> concern but not really where the biggest threat to collective privacy
> lies these days. I'm concerned that in our drive to Encrypt All The
> Things, absolutely the correct response when your only concern is a
> nation-state on the wire, we risk making it difficult to understand
> and defend against (what I'll call) the corporate-data-hording
> attacker model. To date, most of the evil toys phoning home and other
> such nastiness that I've heard of has been discoverable in part
> because said evil toys were using circumventable, crap, or no
> crypto.

Yea, a different thread. I agree with Ted though, our job is partly
to ensure that the bits on the wire don't give the game away in all
cases. I'd also note that those exfiltrating data have plenty of
standard and non-standard tools available to try hide their actions
so us making standards such that exfiltration seems easier to spot
doesn't change the problem much for the exfiltrator.

So I don't agree that the tension here is between standard crypto
protocols and spotting exfiltration as the latter can be done via
stego or covert channels or other non crypto ways of hiding data.

The following may well work regardless of crypto: "I'll send you
the marketing slides, in one of which will be an image that you
can zoom until you can read the paper the actor is holding and on
that you'll find the secret formula":-)

I do however think it could be worthwhile someone documenting
the myriad ways in which exfiltration can be done or has been done
(esp. from home/enterprise networks) but I don't recall one of
those. Anyone know of a good survey that is not aiming to sell
some specific product/service?

But yes,

S.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 8 Nov 2017 10:45:51 +0000

> privacy where all three conditions existed (company device, company

First, IANAL etc. but I had a quick look.

There's the recent ECHR case, [1,2] (which I assume is the same as the
story behind the NYT paywall that Christian sent:-) On that one, I'd
not be surprised if advance notice is insufficient to allow employers
to try snarf everything - there's also a requirement for proportionality
that I'd bet will come back into play as we go along. There's a similar
sounding article about a Canadian case [3] as well. Our local data
protection commission guidance [4] also says similar things about not
being covert etc. And Germany as usual seems more protective of worker's
rights [5] saying a "concrete suspicion" is needed, for at least some
forms of monitoring, though that case involved a keylogger.

If I'm reading those right I think they all involve all 3 of your
conditions being satisfied and also all place further constraints on
what it's ok for employers to do.

Cheers,
S.

[1]
https://www.helpnetsecurity.com/2017/09/06/workplace-surveillance-privacy/
[2]
https://medium.com/@privacyint/privacy-international-response-to-grand-chamber-of-the-european-court-for-human-rights-barbulescu-v-cc722b73086b
[3]
http://www.mondaq.com/canada/x/226944/Data+Protection+Privacy/Courts+Recognize+Employee+Privacy+Rights+In+Workplace
[4]
https://www.dataprotection.ie/docs/Guidance-Notes-Monitoring-of-Staff/m/208.htm
[5]
https://www.hldataprotection.com/2017/08/articles/international-eu-privacy/new-case-law-on-restrictions-for-employee-monitoring-in-the-workplace-in-germany/

---

From: Randy Bush <[email-masked]>
Date: Wed, 08 Nov 2017 19:19:29 +0800

> Ahem:-) 7258 says:
> 
>   "The motivation for PM can range from non-targeted nation-state
>    surveillance, to legal but privacy-unfriendly purposes by
>    commercial enterprises, to illegal actions by criminals. "
> 

it is costing money/jobs.  the state actors are often costing lives.
e.g. for many, the tls 1.3 discussion is about people with guns at your
door at 3am.  we sell them both the guns and the spyware; a real market
opportunity.

bill's bait and sushi often controlls the employee's laptops, ... bill
has the hire and fire authority over the facility use.  this is a false
flag.

randy

---

From: Brian Trammell (IETF) <[email-masked]>
Date: Wed, 8 Nov 2017 17:22:28 +0100

hi Stephen,

trimming CC, proposing we move this to privsec-discuss to stop accumulating Narten points... :)

> On 8 Nov 2017, at 10:36, Stephen Farrell <[email-masked]> wrote:
> 
> 
> 

7258-the-document is fine. It's the simplification of the discussion following 7258 that I'm disappointed with.

> Yea, a different thread.

...here is that thread...

> I agree with Ted though, our job is partly

There are two and a half exfiltration models here which are technically similar but operationally distinct, and it might make sense to tease them apart to see if that sheds some light on ways to approach this problem:

(1) Corporate exfil (your "marketing slides" example below). Here, in most cases, the data exfiltrated is stored on systems owned by the data owner, and is accessed using credentials issued by the data owner, usually by an employee, contractor, or other natural person intentionally given access to some of those systems, if not to the specific data owned. A lot of the "we need to see content" argument is based on this model. In any case, best practices in enterprise IT prescribe a defense-in-depth approach, with a network perimeter (currently with cleartext inspection, in the future hopefully without) as well as endpoint security on servers and clients, and there is an IT security department/organization with a clear responsibility to detect and prevent exfiltration. In this envrionment, we're probably already down the stego rathole, and as in most things human intelligence, though expensive and difficult, is the best way to prevent the insider threat.

From a technical standpoint, in almost all of these cases, the exfiltration can *could* be detected on the endpoint, before it's sent, though to my knowledge most of the systems research in this space (doing things like trying to taint RAM, files, and sockets that *could have seen* information content derived from a given object) has results that cannot currently be made to apply to most practically usable systems. Trying to close the gap between theoretical and applicable in terms of endpoint exfil detection is certainly worth effort here.

(2) IoT exfil (a lazy characterization, but let's run with it for the headline potential). Here, the data exfiltrated is generated by a device owned by the data owner, but the data owner has no access to that data without exceptional means -- for these purposes I'm going to go ahead and make a stretch that the law hasn't universally yet, and say that pictures of you taken in your house by a teddybear you bought belong to you.

Most consumers don't have a corporate IT department behind them, so the defense now is some researcher notices that teddybear X is sending a *whole lot* of data to some AWS instance somewhere, hacks the crap crypto and figures out that, yeah, that's video of what the teddybear sees. There might be stego here already, too, but we wouldn't know about it without treating all IoT firmware as malware and analyzing it as such. Come to think of it, that might be a promising (if high-risk) career direction for young malware researchers.

(2.5) Platform/app exfil: stuff like apps keeping full mobility traces, even when the app isn't focused or the trace isn't necessary for the app's function. Here, you have a lot of the same properties as IoT exfil, with the caveat that the platform owner steps into the IT security management role. It can restrict apps' access to information through app store restrictions, API restrictions, and a system of permissions (though we all know how well that works in practice on Android) and user prompts ("do you want TrackMeEverywhere to see your location even when you aren't using it?"). This works better than (2) above as long as you have absolute trust in the platform, and decays to (2) above when you don't.

I think that (1) and (2/2.5) are fundamentally different beasts, in terms of who's doing the detecting and maybe in terms of how.

> some specific product/service?

Argh, no. Adding it to my list of things I'd like to have time to think more about.

Cheers,

Brian

---

From: S Moonesamy <[email-masked]>
Date: Thu, 09 Nov 2017 01:27:07 -0800

Hi Gonzalo,
>opposed to just wanting connectivity for the sake of it, without any

The first four words in the second line also appear in the title of a 
book written by a spiritual leader.  What social benefits are being 
sought?  What about societal issues which are attributed to the Internet?

Regards,
S. Moonesamy

---

From: Gonzalo Camarillo <[email-masked]>
Date: Thu, 9 Nov 2017 17:36:34 +0800

Hi,

ISOC does a lot of so-called development work in different communities.
In our last board meeting in Kenya, for instance, we saw a few examples
of improvements in communities as a result of getting connected.

Cheers,

Gonzalo

---

From: S Moonesamy <[email-masked]>
Date: Fri, 10 Nov 2017 01:51:39 -0800

Hi Gonzallo,
>of improvements in communities as a result of getting connected.

The only information in the above is that ISOC had a board meeting in Kenya.

I'll make an off-topic comment about "connectivity".  I used "Zoom" 
for a conference call with a few persons located in Africa.  The 
audio quality was bad.  To avoid any misunderstanding I'll mention 
that I do not expect ISOC to fix the problem.  Is that acceptable 
given that it has been like that in the past?

I see Internet stuff which is a copy and paste of what is done in 
developed countries without any understanding of the local 
context.  What are the results of the so-called development work?

Regards,
S. Moonesamy

---

From: Gonzalo Camarillo <[email-masked]>
Date: Fri, 10 Nov 2017 20:07:52 +0800

Hi,

to provide a different point of view, although this does not seem to be
the right mailing list to discuss tools used by ISOC, the ISOC board
uses zoom extensively and have been very happy with the audio and video
quality so far. Obviously, YMMV depending on local network issues.

Cheers,

Gonzalo

On 10/11/2017 5:51 PM, S Moonesamy wrote:
> I'll make an off-topic comment about "connectivity".  I used "Zoom" for
> a conference call with a few persons located in Africa.  The audio
> quality was bad.  To avoid any misunderstanding I'll mention that I do
> not expect ISOC to fix the problem.  Is that acceptable given that it
> has been like that in the past?
> 
> developed countries without any understanding of the local context. 
> What are the results of the so-called development work?
> 
> Regards,
> S. Moonesamy
>

---

From: Gonzalo Camarillo <[email-masked]>
Date: Fri, 24 Nov 2017 16:06:32 +0200

Hi,

in my initial email, which started this thread, I discussed the
process we were following to gather feedback on the proposal to revise
ISOC's mission statement. The iterative process we used resulted in
the involvement of the board, emeriti trustees, staff, and the
community at large. We want to thank all of you for all the
constructive comments and suggestions. We have updated the proposed
mission statement in order to address all that feedback.

We just concluded a meeting of the Internet Society Board of Trustees
in Singapore.  As part of that meeting, the ISOC board approved the
new mission statement. The agreed-upon text is our best effort at
incorporating the dialogue that we have had with all parts of our
community. You can find the result on our new web page:

Obviously not every single piece of feedback has made it explicitly
into the final version of the mission statement. Nevertheless, the
board has processed all the comments received and will be taking them
into account when working on strategies, targets, and action plans for
ISOC.

As I noted in my initial email, in addition to resulting in the final
revised mission statement, the whole process has been useful in
itself. The process has helped both the board get a better
understanding of ISOC's purpose and the community to get a healthy
sense of ownership.

In our meeting in Singapore the Board also approved ISOC's 2018 Action
Plan:

https://www.internetsociety.org/action-plan/2018/

This plan provides the foundation for the work of the organization
both next year and in the years that follow. Our statement at the end
of the board meeting, where we also recognized the success of this
eventful 25th year for the organization, is at:

https://www.internetsociety.org/news/statements/2017/internet-society-board-updated-mission-and-2018-action-plan/

Cheers,

Gonzalo

---

From: "Scott O. Bradner" <[email-masked]>
Date: Fri, 24 Nov 2017 09:44:15 -0500

IMO - it will be harder to raise funds from some parties since there is no mention of the IETF on 
https://www.internetsociety.org/mission/

I was talking with the CEO of a major Internet-related company a week or so ago
and he brought up the ISOC seeming to soft sell its support of the IETF - his
company has made significant donations in the past but he is now rethinking that

I find it irresponsible, at the least, that there is no mention of the IETF at least under 
“Highlights of Activities” if one knows about ISOC’s support for IETF and squints just right one can read the IETF into a bullet - but why not just say it - is the ISOC ashamed of the IETF?  if so, why?

Scott

> On Nov 24, 2017, at 9:06 AM, Gonzalo Camarillo <[email-masked]> wrote:
> 
> Hi,
>

---

From: Gonzalo Camarillo <[email-masked]>
Date: Fri, 24 Nov 2017 17:20:47 +0200

Hi Scott,

as you know, based on (among other things) your input, we have *not*
modified or removed the existing list of highlighted activities.
Additionally, the old mission statement did not mention the IETF
explicitly either. In short, nobody has removed the IETF from the
statements.

In any case, at some point we can think of updating the highlights of
activities in order to include the IETF explicitly and to update some of
the bullets.

With respect to raising funds for the IETF, I assume you are following
the IASA 2.0 discussions?

Cheers,

Gonzalo

---

From: Miles Fidelman <[email-masked]>
Date: Fri, 24 Nov 2017 09:30:49 -0700

Particularly odd, in that ISOC's original raison d'etre was to provide a 
non-government umbrella for IETF.  And arguably, there's really very 
little else that ISOC does that has serious substance.  It's never 
really grown into a serious, broad-based professional organization, 
policy organization or even a serious membership organization.  It just 
hacks at the edges.

Miles Fidelman

-- 
In theory, there is no difference between theory and practice.
In practice, there is.  .... Yogi Berra

---

From: Gonzalo Camarillo <[email-masked]>
Date: Fri, 24 Nov 2017 20:47:09 +0200

Hi again, Scott,

to be clear, since I did not address the main point of your email in my
response below; I agree with you the IETF should appear more prominently
on ISOC's web page. ISOC's comms team is looking into how to make that
happen on the new web page.

Cheers,

Gonzalo

---

From: "Scott O. Bradner" <[email-masked]>
Date: Fri, 24 Nov 2017 13:48:48 -0500

thanks

Scott

> On Nov 24, 2017, at 1:47 PM, Gonzalo Camarillo <[email-masked]> wrote:
> 
> Hi again, Scott,
>

---

From: Miles Fidelman <[email-masked]>
Date: Fri, 24 Nov 2017 12:10:11 -0700

On 11/24/17 11:31 AM, John R. Levine wrote:

>> Particularly odd, in that ISOC's original raison d'etre was to 
>> provide a non-government umbrella for IETF.  And arguably, there's 
>> really very little else that ISOC does that has serious substance.  
>> It's never really grown into a serious, broad-based professional 
>> organization, policy organization or even a serious membership 
>> organization.  It just hacks at the edges.
>
> I think I know a lot of people who would disagree with you.  ISOC does 
> a great deal of quiet policy stuff in DC and Brussels, and a lot of 
> development work in Africa and Asia.  If you haven't heard about it, 
> that's probably because you (and I) are not the target audience.
>

Well... quoting from 
https://www.internetsociety.org/internet/history-of-the-internet/ietf-internet-society/ 

"The Internet Society was formed by a number of people with long-term 
involvement in the Internet Engineering Task Force (IETF). As a result, 
one of its principal rationales was to provide an institutional home for 
and financial support for the Internet Standards process."
(though I heard this directly from Vint's mouth, back in the day)

At the time, ISOC was presented as a membership association representing 
the "Internet community," and I still carry my original membership card, 
dated 1992, and stamped "Pioneer" (and, somewhere, I also have the lapel 
pin that came with it) . I'm not sure ISOC was ever actually organized 
as a membership organization - I can't recall ever being called to vote 
on trustees, and the organizational documents no longer seem to be on 
the web site.  And over the years the notion of individual membership 
seems to have come & gone several times, along with individual dues.

The organization is certainly not a professional group, in the sense of 
IEEE or ACM.

And when it comes to policy involvement, it's not at all clear who ISOC 
represents or speaks for.  I've served on policy bodies for both IEEE & 
ACM, and ISOC certainly does not approach policy engagement in anything 
like the way those professional bodies do. Nor does it speak as an 
industry association (though it does seem to have the notion of 
corporate members).  Nor is it anywhere near as visible as EFF – which 
might well be the most effective policy group working in the Internet 
space (at least in the US).

Which brings us back to the one clear role that ISOC plays - "an 
institutional home for and financial support for the Internet Standards 
process."

Miles Fidelman

---

From: "Joel M. Halpern" <[email-masked]>
Date: Fri, 24 Nov 2017 15:03:13 -0500

I think you are under-valuing in your analysis the positive impact on 
the goals of the IETF that ISOC's other activities have had in the past 
and are likely to have in the future.
For example, their experience and skill in working with governments was 
critical in preventing previous rounds of efforts by governments to 
significantly change the core governance of the Internet.  Which would 
have significantly harmed the IETF's efforts.

Yours,
Joel

---

From: "John R. Levine" <[email-masked]>
Date: 24 Nov 2017 15:09:45 -0500

> Please don't send private responses to public comments.

Well, OK.

> Is it a membership organization?  It purported to be, at the beginning - but 
> individual membership has come and gone, doesn't carry a vote, or dues.  It's 
> a non-profit with a self-perpetuating board of trustees.  So it's not really 
> clear what is.

As is trivial to find out by looking at ISOC's web site, there are 
individual members, and the board is selected by a complex process, not by 
the existing trustees.

Since we seem to be arguing about easily checked facts, I'll stop here.

R's,
John

---

From: Miles Fidelman <[email-masked]>
Date: Fri, 24 Nov 2017 13:21:07 -0700

I think it's the other way around.

ISOC's "experience and skill in working with governments" stems 
primarily from the work of key individuals, many of them associated with 
IETF (and ARIN, and ICANN), who have both credibility and direct 
involvement in Internet governance.  ISOC, as an organization & a 
community has simply been along for the ride.

At the same time, I've been a longtime critic of the limited involvement 
that the bulk of the IETF community has had in the broader area of 
Internet governance and policy.  (E.g., this whole circle-jerk around 
"network neutrality" - because the community has long had a libertarian 
attitude when it comes to regulatory matters, and a knee-jerk negative 
reaction to such long-standing regulatory principles such as common 
carriage & anti-trust.)

Now, ISOC could be an effective stakeholder organization, if it got its 
act together in terms of its own organizational model, membership model, 
policy formation process.  But right now, it's a joke.

At least let's not devalue or compromise its critically important role 
as the organizational home for IETF - which remains (IMHO) ISOC's 
primary value to the world.

Miles Fidelman (note: spoken as a "pioneer member" of ISOC, who worked 
on building the early Internet while at BBN, built a policy shop for a 
while at The Center for Civic Networking, and served on policy groups 
for both IEEE & ACM)

On 11/24/17 1:03 PM, Joel M. Halpern wrote:
> the goals of the IETF that ISOC's other activities have had in the 
> past and are likely to have in the future.
> For example, their experience and skill in working with governments 
> was critical in preventing previous rounds of efforts by governments 
> to significantly change the core governance of the Internet.  Which 
> would have significantly harmed the IETF's efforts.
>
> Yours,
> Joel
>
>>> I think I know a lot of people who would disagree with you. ISOC 
>>> does a great deal of quiet policy stuff in DC and Brussels, and a 
>>> lot of development work in Africa and Asia. If you haven't heard 
>>> about it, that's probably because you (and I) are not the target 
>>> audience.
>>>
>>
>> Well... quoting from 
>> involvement in the Internet Engineering Task Force (IETF). As a 
>> result, one of its principal rationales was to provide an 
>> institutional home for and financial support for the Internet 
>> Standards process."
>> At the time, ISOC was presented as a membership association 
>> representing the "Internet community," and I still carry my original 
>> membership card, dated 1992, and stamped "Pioneer" (and, somewhere, I 
>> also have the lapel pin that came with it) . I'm not sure ISOC was 
>> ever actually organized as a membership organization - I can't recall 
>> ever being called to vote on trustees, and the organizational 
>> documents no longer seem to be on the web site.  And over the years 
>> the notion of individual membership seems to have come & gone several 
>> times, along with individual dues.
>>
>> The organization is certainly not a professional group, in the sense 
>> of IEEE or ACM.
>>
>> And when it comes to policy involvement, it's not at all clear who 
>> ISOC represents or speaks for.  I've served on policy bodies for both 
>> IEEE & ACM, and ISOC certainly does not approach policy engagement in 
>> anything like the way those professional bodies do. Nor does it speak 
>> as an industry association (though it does seem to have the notion of 
>> corporate members).  Nor is it anywhere near as visible as EFF – 
>> which might well be the most effective policy group working in the 
>> Internet space (at least in the US).
>>
>> institutional home for and financial support for the Internet 
>> Standards process."
>>
>> Miles Fidelman
>>
>>
>>

---

From: Miles Fidelman <[email-masked]>
Date: Fri, 24 Nov 2017 15:07:57 -0700

On 11/24/17 1:09 PM, John R. Levine wrote:

>> Is it a membership organization?  It purported to be, at the 
>> beginning - but individual membership has come and gone, doesn't 
>> carry a vote, or dues.  It's a non-profit with a self-perpetuating 
>> board of trustees.  So it's not really clear what is.
>
> individual members, and the board is selected by a complex process, 
> not by the existing trustees.
>
Well, yes, the articles of incorporation state:

"The corporation shall have classes of members, and the qualifications 
and rights of the members, including any right to vote, shall be as 
provided in the by-laws."

And the current by-laws state that "Individual members shall not have 
any voting rights with respect to the Society."  (To my recollection, 
they never have.)  At the beginning, there were dues levied on 
individual members, but no longer.

I also note that individual "membership" is equivalent to registering 
for the ISOC web site.

Given that the only folks who actually have a vote on anything are 
organizational members - which include carriers who might be subject to 
government action – ISOC starts to look a lot like an industry 
association, and does not really have a particularly legitimate standing 
to talk about policy in the public interest.  (I also note that the 
by-laws, which specify how Trustees are selected, can be amended by a 
vote of the Trustees.)

That bothers me, a lot (speaking as someone who carries a "pioneer" 
membership card, dated 1992.

Scott's original comment, about the IETF seeming to get lost in the 
mission statement bothers me more - as I remember, hearing directly from 
Vint, that (as now stated on ISOC's web site) "The Internet Society was 
formed by a number of people with long-term involvement in the Internet 
Engineering Task Force (IETF). As a result, one of its principal 
rationales was to provide an institutional home for and financial 
support for the Internet Standards process. This rationale still exists 
today."  And to my mind, it's the only place that ISOC is actually 
making a substantive impact.

Miles Fidelman

---

From: Ole Jacobsen <[email-masked]>
Date: Fri, 24 Nov 2017 14:17:42 -0800 (PST)

Miles,

Individual members of chapters have voting rights in their
respective chapter and the chapters are represented on the
board. You can look up the details just as easy as I can.

Ole J. Jacobsen
Editor and Publisher
The Internet Protocol Journal
Office: +1 415-550-9433
Cell:   +1 415-370-4628
Docomo: +81 090 3337-9311
E-mail: [email-masked]
Skype: organdemo

---

From: Olivier MJ Crépin-Leblond <[email-masked]>
Date: Fri, 24 Nov 2017 23:26:39 +0100

Dear Miles,

two quick responses from two of your emails - that I have treated in one
email.

On 24/11/2017 21:21, Miles Fidelman wrote:
> primarily from the work of key individuals, many of them associated
> with IETF (and ARIN, and ICANN), who have both credibility and direct

Having been at ground zero at WCIT12 I can tell you that was not the
case at all. ISOC staff-developed white papers were key to many of the
arguments that governments which ended up not signing were reading to
develop their arguments. ISOC was a great fact resource. Key individuals
were indeed there too, but everything did not rest on their shoulders.
My understanding, although I have not had time to be on the ground at
ITU F2F meetings since then, whether Plenipot, WTSA, WTDC, is that ISOC
still fulfils that role well.

On 24/11/2017 23:07, Miles Fidelman wrote:
> organizational members - which include carriers who might be subject
> to government action – ISOC starts to look a lot like an industry
> association, and does not really have a particularly legitimate
> standing to talk about policy in the public interest.  (I also note
> that the by-laws, which specify how Trustees are selected, can be
> amended by a vote of the Trustees.) 

The Chapters vote too. Part of the BoT is chosen by Chapters.
Kindest regards,

Olivier

-- 
Olivier MJ Crépin-Leblond, PhD
http://www.gih.com/ocl.html

---

From: Miles Fidelman <[email-masked]>
Date: Fri, 24 Nov 2017 15:44:40 -0700

Ole,

With all due respect,

> board. You can look up the details just as easy as I can.
First off, that doesn't make one a voting member of ISOC, just of a 
chapter, nor does it make ISOC anything like a traditional membership 
association.

Second, there aren't, and as far as I recall never have been, any 
chapters in New England.  (A couple of time folks have tried to start 
one in Boston, and given up for lack of any reason to.)

---

From: Ole Jacobsen <[email-masked]>
Date: Fri, 24 Nov 2017 15:47:36 -0800 (PST)

On Fri, 24 Nov 2017, Miles Fidelman wrote:

> > respective chapter and the chapters are represented on the board. 
> > You can look up the details just as easy as I can.
> >

> First off, that doesn't make one a voting member of ISOC, just of a chapter,
> nor does it make ISOC anything like a traditional membership association.

Did I say it was? 

You said: "It's a non-profit with a self-perpetuating board of 
trustees." 

> 
> Second, there aren't, and as far as I recall never have been, any chapters in
> New England.  (A couple of time folks have tried to start one in Boston, and
> given up for lack of any reason to.)

Residency may or may not be a requirement for voting. I am member of 
the Japan Chapter, their rules say that only folks living in Japan can
vote (and I don't), but that's probably not a general case rule. In 
other words: If you wanted to get involved in voting I am certain 
there are ways you could do it.

Ole

---

From: Randy Bush <[email-masked]>
Date: Sat, 25 Nov 2017 12:37:28 +0900

> IMO - it will be harder to raise funds from some parties since there
> is no mention of the IETF on https://www.internetsociety.org/mission/

this tells us a lot about isoc and its utter lack of clue and integrity.

future actions of ietf and those who support the ietf should be based
on this.

randy

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 25 Nov 2017 16:52:55 +1300

> chapter, nor does it make ISOC anything like a traditional membership 

That's correct. As ISOC Board Chair at the time when the current
constitutional arrangements were put in place, I could tell you a
lot about the whys and wherefores over a couple of beers.

But whoever said that the *Internet* Society should work like a
*traditional* membership association? We had to find something that
would work at world scale, allow for multiple types of stakeholder,
and not be subject to capture by special interests or populist
politics.

> one in Boston, and given up for lack of any reason to.)

Local chapters wax and wane, and are very subject to the personalities
and motivations of their founders. Some work, some don't. (The Geneva
chapter, of which I was the first President in ~1995 iirc, crashed
and burned by 2009 due to lack of activity, but was followed by the
current active Swiss chpater. But most of the chapters today are in
the developing world, which is great.)

    Brian

---

From: Miles Fidelman <[email-masked]>
Date: Fri, 24 Nov 2017 21:39:14 -0700

Hi Brian,

> lot about the whys and wherefores over a couple of beers.

Love to take you up on those beers at some point.  Though I do know some 
of the reasons - and they had more to do with the techno-politics of why 
ISOC was created in the first place.
> and not be subject to capture by special interests or populist

Well true, but for a very short time it presented as such (you know, 
membership cards & levels, dues, and so forth.

Personally, I would have gone for either the self-perpetuating board of 
trustees model, or a professional association model.  (IMHO, IEEE does 
pretty well as both a standards body and as a policy shop; though the 
IETF does better in terms of standards process.)

> the developing world, which is great.)

I've never quite figured out the logic of chapters, absent operating as 
a true professional association.  There's certainly room for a true 
professional association in the networking space - but absent one, IEEE 
& ACM (plus more specialized groups like AFCEA) fill the gap quite 
nicely when it comes to talks, conferences, professional networking.  
Perhaps there's more of a vacuum to fill in the developing world?

Regards,

Miles

---

From: John C Klensin <[email-masked]>
Date: Sat, 25 Nov 2017 08:49:23 -0500

(Trying to change the subject line because this really isn't
about the mission statement)

--On Saturday, November 25, 2017 4:52 PM +1300 Brian E Carpenter
<[email-masked]> wrote:

>> Second, there aren't, and as far as I recall never have been,
>> any  chapters in New England.  (A couple of time folks have
>> tried to start  one in Boston, and given up for lack of any
>> reason to.)

Miles, I think "no reason" is a mis-characterization.  At least
from my perspective, a very significant part of the problem was
that the folks who would have needed to be the core of an ISOC
chapter (or, if you prefer, without whom an ISOC chapter would
not be credible) have been too busy with other things, notably,
as the IETF has been putting it, "Making the Internet work
better" in technical and substantive ways.  Speaking for myself
only, although I suspect some who are even more active
contributors to the technical work of the IETF may share my
view, I'd rather have no ISOC chapter than one that would be of
very high risk of being captured by folks who wanted to pursue
specific social or political causes in the name of such a
chapter and whose take on those issues might be very different
than mine, and to do so in an environment in which I wouldn't
have time or energy to make counterarguments.   Normally, I
ignore such things, or on the assumption that diversity of
opinions is a good thing, encourage them, but I have been
confident that a Boston chapter would be taken (or promoted) as
speaking for me whether or not I had anything to do with it.
The success of the IETF Boston Hub (or whatever it is called
these days) may or may not reinforce that view of the
appropriateness of an ISOC Chapter and that, along with the GBC
ACM-IEEE collaboration may, further cut into available cycles.

Is that fair from an ISOC voting standpoint to those of us for
whom an active chapter structure does not seem appropriate?   I
don't think so either.  But, as Brian and others have pointed
out, no one has come up with a better suggested arrangement yet.

> Local chapters wax and wane, and are very subject to the
> personalities and motivations of their founders. Some work,
> some don't. (The Geneva chapter, of which I was the first
> President in ~1995 iirc, crashed and burned by 2009 due to
> lack of activity, but was followed by the current active Swiss
> chpater. But most of the chapters today are in the developing
> world, which is great.)

Great except for one thing, which is that, AFAICT, several,
perhaps many, of those chapters have been captured by a small
number of people who, judging from appearances, have found them
very useful as personal platforms or career-boosters.  Maybe
that is ok (or the best that can be done in the short term) for
a given chapter, but, to the extent to which is gives a
relatively small number of people with a focus on very local
concerns (even if they have global ambitions) disproportionate
representation on the Board, it is something that should at
least be monitored as we go forward.

best,
   john

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 25 Nov 2017 15:24:04 +0100

On Nov 25, 2017, at 14:49, John C Klensin <[email-masked]> wrote:
> […]
> I'd rather have no ISOC chapter than one that would be of
> have time or energy to make counterarguments.

That is a nice summary of the core problem that those who actually do, tend to have with attempts to organize/getting organized [sic!].

In the end, we all have to recognize that we have to speak if we don’t want others to speak for us.

But, amazingly, we often have been able to find people who did want to run an organization without too many ulterior motives.
Finding those people, and finding the structures that enable us to protect them, is key.
(As is giving them the leeway that allows them to justify the effort.)

Grüße, Carsten

---

From: Dmitry Burkov <[email-masked]>
Date: Sat, 25 Nov 2017 17:24:54 +0300

This is a good example how to manipulate the world.

Dima

---

From: Christian de Larrinaga <[email-masked]>
Date: Sat, 25 Nov 2017 15:04:17 +0000

Would you not agree that the main way for people to ensure integrity (of
ISOC and its chapters) is by participating actively? Chapters need IETF
participants to take an active interest and not be shy of taking leading
roles in setting up working activities and joining local boards.
Political perceptions of the Internet get swayed much higher up the
stack than the IP layer. Particularly if a policy wonk sniffs a low
hanging fruit to solve a pet political agenda. It takes considerable
perseverance and patience as well as clue to engage the political sphere
with the implications of the underpinnings of an open network
infrastructure in face of these snake oil salesmen in the application
spaces.

I agree with Scott that ISOC ought to keep the principles that
distinguish the IETF front and centre of its own mission and actively
encourage participation of IETF people in ISOC, particularly in the
chapters which are volunteer led and barely supported by ISOC (although
changes to this are starting to happen I understand).  Just because IETF
votes for three or so trustees in ISOC should not be the end or even the
beginning of engagement by those in IETF in their local technical
community. An ISOC chapter can become a useful focal point. But only if
the technical community deigns to join in locally and participate that way.

Christian

-- 
Christian de Larrinaga  FBCS, CITP,
-------------------------
@ FirstHand
-------------------------
+44 7989 386778
[email-masked]
-------------------------

---

From: Miles Fidelman <[email-masked]>
Date: Sat, 25 Nov 2017 10:26:00 -0700

> ACM-IEEE collaboration may, further cut into available cycles.

I tend to agree with you on that.

 From a sample of one, my observations of the last attempt to form a 
Boston chapter - which managed to have a few rather uninspired meetings 
(I think I went to an attempt at an organizational meeting, and one 
other):  The organizers were a combination of some rather poor 
technologists (you know, the folks who "left" technical management jobs 
to form consulting shops - and saw involvement as a way to drum up 
business) and folks who had more of a social policy interest.  The real 
technologists were too busy working (Boston/Cambridge is kind of ground 
zero for a lot of the community - who needs an ISOC chapter when you've 
got MIT, BBN, et. al.).  And the real social policy types were involved 
in things like CPSR.  As you say, a Boston ISOC chapter certainly would 
not have been speaking for me.
> out, no one has come up with a better suggested arrangement yet.

As I commented separately - I'd personally rather have seen ISOC start 
with a self-perpetuating Board or organize as a true professional 
association (akin to IEEE).  From both a governance standpoint and as a 
standards body & policy shop, it seems to "work" (I do think the IETF 
standards process is far better than IEEEs, but in terms of governance & 
administration, IEEE is a good model).

> least be monitored as we go forward.
Agreed completely.

Which makes me think that the critical issues in ISOC governance really 
should  be:

1. Stewardship of the IETF as the Internet standards body (the original 
and still critical role of ISOC).

2. Providing a reputable policy voice regarding Internet issues.

Regarding 1:  I understand why IETF was not explicitly mentioned in the 
Articles of Incorporation - flying under the radar and all that, but in 
2017, when IETF isn't even mentioned in the mission statement, and only 
peripherally mentioned in the latest (2016) bylaws, it concerns me that 
the whole purpose of ISOC is getting lost.  Yes, IETF gets to fill a few 
board seats, but it still has become the tail, instead of the dog.  
(And, I note that this discussion is happening on the ietf e-list - 
where I would expect more people to be concerned.)

Regarding 2:  When votes only go to organizational members, and 
"Platinum Members," with a weighted vote, include Comcast and 
NBCUniversal, one gets a bit leery of ISOCs ability to give unbiased 
advise on things like Network Neutrality (excuse me, Common Carriage and 
Anti-Trust, to use regulatory language that has more of a clearly 
understood history & grounding).  One might also question the influence 
of groups like ICANN and ARIN, when IETF has a contractual relationship 
with them and sets standards to be implemented & managed (and enforced?) 
by them.  It's all just a bit to rife with conflict of interest.

Somehow, I see all of this getting lost in the discussion of the new 
mission statement.  It kind of suggests a lack of transparency 
surrounding the real issues of ISOC governance (which might be 
intentional, or not; and it might even be desirable, or not).

Miles

Miles

---

From: Gonzalo Camarillo <[email-masked]>
Date: Sat, 25 Nov 2017 19:41:22 +0200

Hi John,

> out, no one has come up with a better suggested arrangement yet.

Per our conversation in L.A., I am looking into how to enable ISOC
individual members to be more involved in ISOC's activities. It is clear
that some individual members cannot (or for whatever reason do not want
to) be part of a chapter (or a SIG) but are interested in some of ISOC's
activities nevertheless.

For example, I also sent the proposed mission statement to the Open
Forum mailing list (on the Connect platform) to get comments from
individual members as well.

Cheers,

Gonzalo

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 26 Nov 2017 08:55:13 +1300

On 26/11/2017 06:26, Miles Fidelman wrote:
...
> NBCUniversal, 

To be clear, the weighted voting applies only to the election of
the four Board members from the organizational members, i.e. at
most to one third of the Board. I don't see this as unduly susceptible
to vested interests.

> one gets a bit leery of ISOCs ability to give unbiased 

Exactly why the Board is set up with the checks and balances of having
three separate constituencies. Do you have any evidence that actual
conflicts have arisen without being declared? (The Board members have to
sign a conflict of interest declaration, of course.)

   Brian

---

From: Miles Fidelman <[email-masked]>
Date: Sat, 25 Nov 2017 13:18:24 -0700

> sign a conflict of interest declaration, of course.)
No.  But the appearance of one is a concern.  Given the current 
"membership" structure (and membership), it is not at all clear who ISOC 
represents or speaks for when commenting on policy matters. Certainly it 
is not speaking for me, as an individual member, or as a member of the 
"Internet community."  When IEEE-USA, or US-ACM comments on policy, or 
advocate - the entire process is very transparent, as are how members 
sit on policy boards (been there, done that), and form policy 
statements.  Not so, when it comes to ISOC.

Now, personally, I'd be perfectly happy for ISOC to have a sole mission 
of providing an organizational home for IETF, and weighing in only on 
policy issues that specifically relate to IETF's role in Internet 
Governance.  We would still need a governance structure that ensures 
proper stewardship of the IETF.  There would still need to be some 
governance & transparency for a process by which IETF weighs in on 
policy matters - though that kind of worked pretty well when we were 
going through the whole bit about changes to the ICANN contract.

Miles