Subject: Re: "RAND" IPR, IETF and Debian

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 03 Nov 2003 09:01:52 -0800

Michael,

speaking with my IETF hat tightly clamped on my head.....
it is not clear to me exactly what you want to have happen based on this 
message.

You may be saying only "we have a problem" - which is true. But it's not 
clear what we can do about it, or how much leverage the IETF as a body has 
on the issue, now that it's reconfirmed its refusal to get into the 
patent-evaluation and license-evaluation business.

If (for instance) you, other Open Source people, Cisco's lawyers, Nokia's 
lawyers and Apple's lawyers manage to come up with some single document 
that has the title "An IPR disclosure that makes the IPR usable in 
open-source implementations licensed under the GNU Public License", that 
would be one giant step forward, I think.

If that effort was made, and failed, that's another kind of information.

But I don't know what we can do in this forum at this time.

                         Harald

--On 2. november 2003 12:54 -0500 Michael Richardson 
<[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
>
>
> {Hi, the only person I'm emailing under IETF official-dome is Harald and
> Steve. Itojun and Bill just happen to have dual roles, I can't come up
>  with any other IETF/FreeBSD and IETF/NetBSD people right now}
>
> Hi, I wish that I'd thought of this last week, because maybe it would be
>     worth calling a BOF of open source operating system people at IETF.
>     Perhaps a Bar BOF can still be organized. I don't see that IPR WG
> itself     is meeting this time.
>
> I think that IPR issues, particularly the applicability (or lack) of RAND
> to open source operating systems (both GPL'ed and BSD-type) needs to be
> better understood.
>
> The recent Certicom MODP-group claim is particularly disturbing to me,
> since it has very weird effects on open source, from what I can tell.
>
>>>>>> "Martin" == Martin Michlmayr <[email-masked]> writes:
>     Martin> * Martin Michlmayr - Debian Project Leader <[email-masked]>
>     Martin> [2003-08-13 17:56]:
>     >> Bruce,
>     >>
>     >> Is this something you'd be interested in following, or should we
> look     >> for volunteer on debian-legal?
>
>     Martin> Bruce, I never got a response from you about this.  I know
> you're     Martin> busy but perhaps you have a few minutes to look at it.
> (I don't     Martin> know what the current status of this is.)
>
> Michael Richardson <[email-masked]> write on [2003-08-04
> 11:22]:
>> As far as I can tell the Debian project is probably the most careful and
>> active when it comes to determining if various licenses fit the GPL or
>> not.
>>
>> Russell has pointed out to me that even a Royalty-free, Reasonable And
>> Non-Discrimatory license that is field specific won't fit the GPL because
>> it restricts the code from being used for other things.
>>
>> So, for instance, the IPR notice about SEND's CGA from Microsoft would
>> not permit the code to be included into the Linux kernel:
>>
>>     http://www.ietf.org/ietf/IPR/microsoft-ipr-draft-ietf-send-cga.txt
>>
>> The Ericsson patent claim is not offered royalty-free either.
>>
>> Pekka, I'm sorry to bring up the IPR issue again, but I think that the
>> problem is that none of us really understand the issues as they relate to
>> open source implementations.
>
>> The reason I'm CC'ing the Debian folks, is that my impression is that
>> they are the best organized when it comes to tracking the issues wrt
>> open-source things. What I'd like to see is someone with legal clue from
>> debian regularly review the IETF IPR submissions and offer opinions to
>> the working group about whether or not the code would get implemented in
>> GNU/Linux.
>
>
> ] Collecting stories about my dad: http://www.sandelman.ca/cjr/ |
> firewalls  [ ]   Michael Richardson, Sandelman Software Works, Ottawa, ON
> |net architect[ ] [email-masked]
> http://www.sandelman.ottawa.on.ca/ |device driver[ ] panic("Just another
> Debian/notebook using, kernel hacking, security guy");  [ -----BEGIN PGP
> SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
> Comment: Finger me for keys
>
> iQCVAwUBP6VExoqHRg3pndX9AQHSAgP8CvxYS5Qn8/ugIgVBZv2pNq6Qh8hs3Vvv
> 1sd9HaaxBf0JwSOPkfZIy73eAiggSsSZPZ7DRRPOMULbo7FkBXxmT0VWy7Dv8+x2
> eZ7R0XPwGTGFQoPQNri5XrA4KQw+fnOh8Ba/oEw6ubSLYEXJJYuBAT9JK8eY50zk
> k2hGov1tkfI=
> =Etxv
> -----END PGP SIGNATURE-----
>
>

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: Russell McOrmond <[email-masked]>
Date: Sun, 2 Nov 2003 14:59:57 -0500 (EST)

On Sun, 2 Nov 2003, Michael Richardson wrote:

> I think that IPR issues, particularly the applicability (or lack) of RAND to
> open source operating systems (both GPL'ed and BSD-type) needs to be better
> understood.  

  Please keep me in the loop wherever possible.

  I am not a member of IETF, nor am I a lawyer, but I am a private citizen
involved in trying to ensure that PCT's (Patent, Copyright, Trademarks --
http://www.wsis-pct.org/ipr-disclaimer.html ) become or remain compatable
with peer production methodologies which Free/Libre and Open Source
Software is for the production of software.  I offer myself as a resource
to the IETF in any way I can.

  My most recent contribution on patent policy can be seen at
http://www.flora.ca/patent2003/ , and more recently on copyright at
http://www.flora.ca/copyright2003/ .

Thank you.

---
 Russell McOrmond, Internet Consultant: <http://www.flora.ca/> 
 Governance software that controls ICT, automates government policy, or
 electronically counts votes, shouldn't be bought any more than 
 politicians should be bought.  -- http://www.flora.ca/russell/

---

From: Michael Richardson <[email-masked]>
Date: Sun, 02 Nov 2003 12:54:16 -0500

-----BEGIN PGP SIGNED MESSAGE-----

Hi, I wish that I'd thought of this last week, because maybe it would be
    worth calling a BOF of open source operating system people at IETF. 
    Perhaps a Bar BOF can still be organized. I don't see that IPR WG itself
    is meeting this time.

The recent Certicom MODP-group claim is particularly disturbing to me, since
it has very weird effects on open source, from what I can tell.

    Martin> * Martin Michlmayr - Debian Project Leader <[email-masked]>
    Martin> [2003-08-13 17:56]: 
    >> Bruce,
    >> 
    >> Is this something you'd be interested in following, or should we look
    >> for volunteer on debian-legal?

    Martin> Bruce, I never got a response from you about this.  I know you're
    Martin> busy but perhaps you have a few minutes to look at it.   (I don't
    Martin> know what the current status of this is.)

Michael Richardson <[email-masked]> write on [2003-08-04 11:22]:
> active when it comes to determining if various licenses fit the GPL or not.
> 

> The reason I'm CC'ing the Debian folks, is that my impression is that they
> are the best organized when it comes to tracking the issues wrt open-source
> things. What I'd like to see is someone with legal clue from debian regularly
> review the IETF IPR submissions and offer opinions to the working group about
> whether or not the code would get implemented in GNU/Linux.

] Collecting stories about my dad: http://www.sandelman.ca/cjr/ |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [

---

From: Pekka Savola <[email-masked]>
Date: Mon, 3 Nov 2003 20:59:14 +0200 (EET)

On Mon, 3 Nov 2003, Jun-ichiro itojun Hagino wrote:
> 	KAME's policy is attached below.  we do not accept RAND licenses, as
> 	it will require other people to get license from the license holders
> 	(thus the redistribution of KAME code will not be very
> 	"redistributable/reusable").  i can't speak for Net/Free/OpenBSD
> 	project, but i guess basically they're in the same position.

FWIW, 

I've tried to get draft-ietf-ipr-template-07.txt modified in such a manner
that granting RF license *implies* licensing, and that getting the actual
license is must NOT be required.

This is really important for technologies which are not only implemented 
by commercial vendors.

IMHO, this really needs to change.  RF licensing every user, implementor
or distributor to negotiate a license (or a threat of that) is
unacceptable.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Bruce Perens <[email-masked]>
Date: Mon, 03 Nov 2003 11:15:46 -0800

Yes, we can tell you how to make an IPR disclosure useful to GPL 
implementors, as well as those under other Open Source licenses.

In one forum or another, we should also go over the experience of W3C in 
running through the Patent Advisory Group process in relation to the 
Eolas patent. We gained some important experience and were able to act 
decisively as an organization, and everyone involved felt that the PAG 
process was a useful one. This incident was also a good test of the 
royalty-free policy and the resolve of the membership to go forward with 
it - which was stronger than I would have thought.

    Thanks

    Bruce Perens

Harald Tveit Alvestrand wrote:

> it is not clear to me exactly what you want to have happen based on 
> this message.
>
> You may be saying only "we have a problem" - which is true. But it's 
> not clear what we can do about it, or how much leverage the IETF as a 
> body has on the issue, now that it's reconfirmed its refusal to get 
> into the patent-evaluation and license-evaluation business.
>
> If (for instance) you, other Open Source people, Cisco's lawyers, 
> Nokia's lawyers and Apple's lawyers manage to come up with some single 
> document that has the title "An IPR disclosure that makes the IPR 
> usable in open-source implementations licensed under the GNU Public 
> License", that would be one giant step forward, I think.
>

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Mon, 3 Nov 2003 23:06:39 +0900 (JST)

> it has very weird effects on open source, from what I can tell.

	<IAB hat off, KAME hat on>

	because of this KAME have pulled out our VRRP6 and ISATAP implementation
	from our distribution.  PIM-SM is also under discussion (apple has IPR
	statement on IETF webpage).  we won't implement SEND under the current
	state of the IPR claims.

itojun

9. Policy on technology with intellectual property right restriction

There are quite a few IETF documents/whatever which has intellectual property
right (IPR) restriction.  KAME's stance is stated below.

    The goal of KAME is to provide freely redistributable, BSD-licensed,
    implementation of Internet protocol technologies.
    For this purpose, we implement protocols that (1) do not need license
    contract with IPR holder, and (2) are royality-free.
    The reason for (1) is, even if KAME contracts with the IPR holder in
    question, the users of KAME stack (usually implementers of some other
    codebase) would need to make a license contract with the IPR holder.
    it would damage "freely redistributable" status of KAME codebase.

    By doing so KAME is (implicitly) trying to advocate no-license-contract,
    royality-free, release of IPRs.

Note however, as documented in README, we do not guarantee that KAME code
is free of IPR infringement, you MUST check it if you are to integrate
KAME into your product (or whatever):
    READ CAREFULLY: Several countries have legal enforcement for
    export/import/use of cryptographic software.  Check it before playing
    with the kit.  We do not intend to be your legalease clearing house
    (NO WARRANTY).  If you intend to include KAME stack into your product,
    you'll need to check if the licenses on each file fit your situations,
    and/or possible intellectual property right issues.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 03 Nov 2003 20:11:56 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Harald" == Harald Tveit Alvestrand <[email-masked]> writes:
    Harald> If (for instance) you, other Open Source people, Cisco's lawyers,
    Harald> Nokia's lawyers and Apple's lawyers manage to come up with some
    Harald> single document  
    Harald> that has the title "An IPR disclosure that makes the IPR usable in 
    Harald> open-source implementations licensed under the GNU Public
    Harald> License", that would be one giant step forward, I think.

  I would agree.  That has not occured yet, nor started yet.

  I believe that it will *NOT* occur as long as the IETF/IESG thinks that
RAND is an acceptable license for IPR that we standardize.

    Harald> If that effort was made, and failed, that's another kind of
    Harald> information. 

  It has not.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 03 Nov 2003 22:39:34 -0500

In message <[email-masked]>, Michael Richardso
>  I would agree.  That has not occured yet, nor started yet.

As I noted last spring, when the WG consensus was to stick with the 
IETF's RAND policy, I would welcome any effort to solve the open source 
problem.  Both as WG co-chair and as an AD, though, I would want to see 
a concrete proposal for a direction to go.  In particular, if you have 
any ideas on how to encourage companies to allow RF access for open 
source when they use RAND for profit-making licensees, I'd be 
interested -- but I don't think a debating society or cheerleading WG 
is useful.  On the other hand, if you have an Internet draft for a 
concrete proposal (and one that doesn't contradict the just-approved 
drafts that this wg produced), and if there are signs that some 
important IPR holders will go along, I'd be very interested indeed.

>RAND is an acceptable license for IPR that we standardize.
Let's not go there on this list...  We already had that debate.

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Tue, 4 Nov 2003 14:14:26 +0900 (JST)

> 	statement on IETF webpage).  we won't implement SEND under the current

	correction: Apple has IPR statement on SSM, not PIM-SM.

itojun