Subject: RE: last call -- again

From: "Contreras, Jorge" <[email-masked]>
Date: Wed, 25 Jun 2003 14:57:39 -0400

>Steve - I want to point out that what your are crafting here DOES form a
>contract with the people that submit their materials under these terms. 

I don't think there is any intent to form a contract here.  Instead, 
IETF is asking participants in IETF processes to comply with published 
IETF rules.  The manner of seeking this compliance is by notifying 
participants, through the "Note Well" document and in other ways, that
these rules exist, and by informing them that they must comply with them
in order to participate.

>With
>that said, I do not believe that these are best kept as three separate
>documents, because it will be more difficult to manage the workflows and
>contingency, as well as to demonstrating that anyone could have possibly
>made anything close to a competent Informed Consent decision here.

>In fact BEFORE anyone can submit anything there needs to be a document on
>file that shows that they understand the process. That they HAVE ALREADY
>READ and UNDERSTAND and moreover that they AGREE TO THE TERMS AND CONDITIONS
>of the publication of their works and to the implied licensing therein.

>This is VERY VERY serious contract law here, and it needs to be done right.

Clearly, IETF participants need to understand the rules that apply to them.
I think that having 3 separate documents is actually clearer than
one consolidated document, which is how RFC 2026 was structured.  The current
organization is, I think, an improvement over the prior version.

The language of these rules has now been disputed and revised, with input
from lots of different people: lawyers, technologists and others, over the
last year and a half.  Admittedly, there are probably areas that could continue to be
improved in terms of language or style.  However, the basic point about
disclosure of IPR is made many times, in many places, and generally in a 
consistent way.  I would be surprised if anyone who read the "Rights in
Technology" and "Rights in Submissions" documents did not understand that 
IPR disclosures are required, that a contributor is required to represent 
that he/she has the right to license his/her contribution to the IETF for
reproduction and modification, and that he/she is not violating any laws or
other known IPR rights in doing so.

So, while it would be nice to improve the IETF's legal position through
signed release forms for each contribution, I suspect (and have been told) that 
the burden of imposing such a process on contributors would
outweigh the benefit of the process.  Thus, I agree with your point that
greater protection is available to IETF (if you really wanted protection, one could
require all contributions to be submitted under oath).  But I disagree
that the rules, as they are proposed to be implemented, provide inadequate
notice to IETF participants.

As far as verification, I am not aware of any standards body that attempts
formally to verify the identity or rights of its contributors.  Doing so
would create a significant financial and administrative burden, even with
the technological solutions you have suggested.  IETF has attempted to
shift the burden of "authentication" to the contributors themselves, by
requiring the representations and warranties that we have discussed before.
From a practical standpoint, this may be the best compromise that can be
achieved in this area.

There is a separate issue, which is implied by
your comments, about how effective the IETF rules will be in "binding"
companies whose individual employees participate in IETF (given that
IETF does not have corporate members).   This issue has been discussed on 
this list before, and I think it's the general view that, while this
is a legitimate issue, it really relates to a fundamental restructuring
of the organization, and is thus beyond the scope of the current WG.
I'd be happy to participate in that discussion and make suggestions 
when and if it is started through the IETF process.

I hope this helps,

Jorge

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: John Morris <[email-masked]>
Date: Wed, 25 Jun 2003 17:33:49 -0400

FWIW, let me add my 2 cents (as another attorney who has been 
following this discussion closely), and agree with what Jorge has 
said (and state it even more strongly).

At 2:57 PM -0400 6/25/03, Contreras, Jorge wrote:
><snip>
>I don't think there is any intent to form a contract here.

I think that the chance that a court would find that a contract has 
been formed in this scenario is extremely low.

><snip>
>But I disagree

I think the various notices are more than adequate.  The concern is 
not whether anyone will not notice the IETF's IPR rules, but whether 
having noticed those rules they will look for cracks to try to 
squeeze through them.   On that point, the current drafts represent 
major steps forward in terms of clarity.

>the technological solutions you have suggested.

There is also a risk that such a formal process would reduce the 
number of constructive participants in the IETF process, and my guess 
is that the net loss of brain/people power would outweigh the net 
gain in terms of increased certainty that everyone has looked at the 
IPR rules (or at least certainty that everyone is willing to sign a 
document saying that they have looked at the IPR rules).

John

---

From: "todd glassey" <[email-masked]>
Date: Wed, 25 Jun 2003 14:53:49 -0700

Jorge - I had completed this and failed to send it out before the last
response. My apologies.

---

In response to your retort below, I disagree Jorge. I believe that the IETF
clearly forms a contract to process an initiative through its defined
vetting and community exposure process and to then deliver a standard when
all the criteria are met. Otherwise there is no reason to be here at all.

And as to the damages that can be levied for unauthorized copyright
disclosure, see the included excerpt from the
http://chillingeffects.org/piracy/notice.cgi?NoticeID=523#FAQID3649 URL:

what you will find there is this:
---
Question: What are the penalties for copyright infringement, such as making
infringing copies of software?

Answer: In a civil suit, an infringer may be liable for a copyright owner's
actual damages plus any profits made from the infringement. Alternatively,
the copyright owner may avoid proving actual damage by electing a statutory
damage recovery of up to $30,000 or, where the court determines that the
infringement occurred willfully, up to $150,000. The actual amount will be
based upon what the court in its discretion considers just. (17 U.S.C. 504)

Violation of copyright law is also considered a federal crime when done
willfully with an intent to profit. Criminal penalties include up to ten
years imprisonment depending on the nature of the violation. (No Electronic
Theft Act, 18 U.S.C. 2319)

---

In response to this I would also point out that "profit" can be measured in
any number of ways too! including eliminating the competitions ability to
seek protection for their IP's in certain jurisdictions.

My additional inline responses below are prefaced by an "TSG:"

----- Original Message ----- 
From: "Contreras, Jorge" <[email-masked]>
To: "todd glassey" <[email-masked]>; "Steve Bellovin"
<[email-masked]>; <[email-masked]>
Sent: Wednesday, June 25, 2003 11:57 AM
Subject: RE: last call -- again

IETF rules.

TSG: Which I still assert establishes a formal framework defining the terms
and conditions for participating... And for which the submitter MUST accede
otherwise their submissions are to be returned. How is that not a contract
to publish the materials?

The manner of seeking this compliance is by notifying
participants, through the "Note Well" document and in other ways, that
these rules exist, and by informing them that they must comply with them
in order to participate.

TSG: Which further assumes that they are competent or actually own or have
release to disclose the IP's. All of which are part and parcel to the IETF's
submission process establishing a contractual relationship between the
submitter and the IETF. It also assumes that they have read and understand
this material which means that they must be competent if English which is
another hurdle to understanding the processes.

>This is VERY serious contract law here, and it needs to be done right.

Clearly, IETF participants need to understand the rules that apply to them.
I think that having 3 separate documents is actually clearer than
one consolidated document, which is how RFC 2026 was structured.

TSG: Its not three documents, its more like six plus, not  including down
rev'd or superseded documents. Do the math - there are the three IPR drafts
now and likely more coming, then there is the RFC2026 Document, and also
there is the RFC2418 document,  which brings us to the  "Tao of the IETF
Document" to start with...

The current

TSG: My response to that is because you know how large and intertwined
contracts that aptly deal with IP issues are and you know how painful that
would be to enforce on the IETF. The problem is that there is really not a
reasonable choice IMHO to say that these issues are ones that we will
address when they pop up.

I think that this is also especially true since they need remedy and dispute
resolution and maybe even real arbitratition clauses. The problem is also
with a comment that you make. You also use the phrase "well informed
participant in the IETF's process" and this is I think the flaw in the
logic. My feeling is that very few of the IETF's participants have any ideas
regarding its process or the totality of the infrastructure. In fact I put
forth that most people have no idea on the governance process or any of what
we are discussing here, and that they generally silo themselves into a
vertical WG which is why this governance model is broken since it claims to
openly and fairly operate and without everyone being on a similar playing
field, let alone the same one, they cannot get any real semblance of
equality.

last year and a half.

TSG: All working off of different agendas and that also is a problem here -
We see mission creep in virtually everything that is submitted. And this is
just not a one-size fits all technologies world.

 Admittedly, there are probably areas that could continue to be
improved in terms of language or style.  However, the basic point about
disclosure of IPR is made many times, in many places, and generally in a
consistent way.

TSG: that is what specifically is unacceptable - The use of the phrase
"generally in a consistent way." since it is this consistancy that provides
equality and some of the fairness that we claim is so prevelat here.

I would be surprised if anyone who read the "Rights in Technology"
and "Rights in Submissions" documents did not understand that
IPR disclosures are required, that a contributor is required to represent
that he/she has the right to license his/her contribution to the IETF for
reproduction and modification, and that he/she is not violating any laws or
other known IPR rights in doing so.

TSG: *I agree totally. But this again assumes that the participants know
that they are supposed to be competent on the policies and processes BEFORE
they submit anything.

So, while it would be nice to improve the IETF's legal position through
signed release forms for each contribution, I suspect (and have been told)
that
the burden of imposing such a process on contributors would
outweigh the benefit of the process.

TSG: Counselor - I don't think you or any of us have a choice here really.
This becomes an issue of professional ethics in the operations of a
standards practice, not just the bending the rules as much as we can to
flaunt our Organization's intentional disregard for private IP and its
protection.  If the IETF's process is broken and the changing IP landscape
mandates that formal release processes are needed to protect the players,
then that is what is needed.

Thus, I agree with your point that
greater protection is available to IETF (if you really wanted protection,
one could
require all contributions to be submitted under oath).  But I disagree
that the rules, as they are proposed to be implemented, provide inadequate
notice to IETF participants.

TSG: - Jorge - as an attorney you are bound to a higher cannon of ethical
performance than the rest of us, so in response to the statement you made
above, if  your legal credential on the line for this comment, would you
still make it?

As far as verification, I am not aware of any standards body that attempts
formally to verify the identity or rights of its contributors.

TSG: Jorge - They don't have to because they have formal constituencies and
memberships. But also it is further reinforced since most of those cost
money too join too, so they have a financial transaction as part of their
membership process to identify their submitters. All of this further cements
that they have some formal working knowledge of who their participants are.
By contrasting comparison, the IETF has none of this.

Doing so

TSG: Yeah. Ok, So what? Is this the pauper's standards organization? or
what? You mean that you cant afford to have your organization produce a
filing affidavit because that will cost too much in employee labor, and the
IETF would have to file it??? - Again I say "so what" - this is the cost of
being an open standards practice and the sole keeper of Internet Standards.

IETF has attempted to

TSG: No - The IETF and to a greater extent, POISED/POISSON and the IPR WG
have IMHO attempted to shove the entire issue of release processing into a
deep hole and bury it because as you have correctly noted there is likely to
be a significant increase in the Secretariat's operations costs if anything
other than the existing passive system is ever mandated.

TSG: I agree that it means that there needs to be a fundamental
restructuring of the submissions and release process too.

I hope this helps,

Jorge

---

From: "todd glassey" <[email-masked]>
Date: Wed, 25 Jun 2003 16:11:04 -0700

I will respond off list John.

T