Subject: recourse if our rules are violated?

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 9 Apr 2007 12:49:30 -0400

The IETF chair, Russ Housley, would like the opinion of the IPR WG on
what to do when an IPR disclosure occurs belatedly.  There are three
cases I can see:

	(a) Intentional non-disclosure

	(b) Unintentional non-disclosure (which appears to be the case
	in the situation currently under discussion on the IETF mailing
	list)

	(c) Third-party patents that were not known to the WG or the
	IETF when the document was adopted.

Our focus thus far has been on (a), and our attitude has been "let the
government(s) take action" (see, for example, the Rambus case
( http://www.law.com/jsp/article.jsp?id=1161606920964 ) and the Dell
case ( http://www.ftc.gov/opa/1995/11/dell.htm ).  We've traditionally
assumed there was nothing we could do about (c), since such patents
could appear at any time

The questions, then, are these:

	Should the IETF have a formal policy?  Alternatively, should we
	leave it to the IESG's judgment?

	If we do have a formal policy, what should it be?

	Should it be expressed in an RFC or an ION?

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: John C Klensin <[email-masked]>
Date: Mon, 09 Apr 2007 13:30:36 -0400

--On Monday, April 09, 2007 12:49 PM -0400 "Steven M. Bellovin" 
<[email-masked]> wrote:

> The IETF chair, Russ Housley, would like the opinion of the
> IPR WG on what to do when an IPR disclosure occurs belatedly.
> There are three cases I can see:
>
> 	in the situation currently under discussion on the IETF
> mailing 	list)
>
> Our focus thus far has been on (a), and our attitude has been
> "let the government(s) take action" (see, for example, the
> Rambus case (
> http://www.law.com/jsp/article.jsp?id=1161606920964 ) and the
> Dell case ( http://www.ftc.gov/opa/1995/11/dell.htm ).  We've
> traditionally assumed there was nothing we could do about (c),
> since such patents could appear at any time

Steve,

> 	Should the IETF have a formal policy?  Alternatively, should
> we 	leave it to the IESG's judgment?

I think that, if any action was taken that might have come out 
differently had the claimed encumbrances been known, those 
actions should be reviewed.  If the document is still in a WG, 
rather than having been processed into an RFC, I believe the WG 
should be required to do that review and reach an explicit 
conclusion before proceeding with the document.  If the document 
has been approved, then I think the IESG should conduct that 
review.  However the review is conducted, I believe that a 
summary of the discussion and the conclusions should be recorded 
in minutes, not just in mailing list discussions or equivalent.

Actions to be taken as the result of the review should be left 
to the judgment of the WG or IESG (and subject to the usual 
appeal mechanisms), just as the decision would have been had the 
disclosure been timely.

> 	If we do have a formal policy, what should it be?

I don't think the above is really a formal policy.  I think 
making a formal policy about the action to be taken would 
eventually result in a case arising in which our policies 
compelled us to shoot ourselves in the foot.  As long as we are 
going to permit patented technologies, we are going to need to 
make case-by-case decisions.

> 	Should it be expressed in an RFC or an ION?

I think it should be in whatever document describes our 
"contribution" procedures.

There is, however, also a fourth question.

Suppose we discovered that we were dealing with an organization 
that was acting in bad faith.  Suppose that person contributed a 
document, didn't make the necessary disclosures, had the 
document approved as a standards, and then filed the disclosure, 
claiming ignorance or ambiguity in the rules about how soon the 
disclosure needed to be filed.  As you said above, we can't do 
much about that and governments are the right remedy.  But there 
is another piece of the puzzle, which is whether we want to 
encourage that person to do it to us again.  Some standards 
bodies that have membership application processes and 
requirements kick people out for this sort of thing.  Should we 
consider bad behavior wrt disclosures grounds for initiating 
actions against WG participation, and/or posting rights, and/or 
I-D postings and authorship?   Doing so would put us into a 
complex legal environment if the bad behavior was denied by an 
individual and a small circle of supporters, but perhaps we 
should be considering our options in that area.

     john

---

From: "todd glassey" <[email-masked]>
Date: Mon, 9 Apr 2007 11:50:17 -0700

John and Russ -
YES -
The IETF needs policies and procedures for these incidents that are
predefined so there is no wiggle-room for the IESG or the IETF's Management
to make arbitrary decisions which benefit one party more than another.
The integrity of the IETF is more important than any one individuals
desires or efforts and that is what is at stake here.

But again - any controls that the IETF puts in place here will directly
effect the language and license itself of the outgoing rights since those
rights will need some form of being terminated or curtailed in IP Rule
Violation issues or in Copyright/Patent Violations as well.

Otherwise, I still think that the liability rests with those individuals
that are preventing these types of controls from being put in place...
whether they sit as IETF or IESG Management or not.

Todd Glassey

----- Original Message ----- 
From: "John C Klensin" <[email-masked]>
To: "Steven M. Bellovin" <[email-masked]>; <[email-masked]>
Sent: Monday, April 09, 2007 10:30 AM
Subject: Re: recourse if our rules are violated?

> I think that, if any action was taken that might have come out differently
> had the claimed encumbrances been known, those actions should be reviewed.
> If the document is still in a WG, rather than having been processed into
> an RFC, I believe the WG should be required to do that review and reach an
> explicit conclusion before proceeding with the document.  If the document
> has been approved, then I think the IESG should conduct that review.
> However the review is conducted, I believe that a summary of the
> discussion and the conclusions should be recorded in minutes, not just in
> mailing list discussions or equivalent.
>
> Actions to be taken as the result of the review should be left to the
> judgment of the WG or IESG (and subject to the usual appeal mechanisms),
> just as the decision would have been had the disclosure been timely.
>
> I don't think the above is really a formal policy.  I think making a
> formal policy about the action to be taken would eventually result in a
> case arising in which our policies compelled us to shoot ourselves in the
> foot.  As long as we are going to permit patented technologies, we are
> going to need to make case-by-case decisions.
>
> I think it should be in whatever document describes our "contribution"
> procedures.
>
> Suppose we discovered that we were dealing with an organization that was
> acting in bad faith.  Suppose that person contributed a document, didn't
> make the necessary disclosures, had the document approved as a standards,
> and then filed the disclosure, claiming ignorance or ambiguity in the
> rules about how soon the disclosure needed to be filed.  As you said
> above, we can't do much about that and governments are the right remedy.
> But there is another piece of the puzzle, which is whether we want to
> encourage that person to do it to us again.  Some standards bodies that
> have membership application processes and requirements kick people out for
> this sort of thing.  Should we consider bad behavior wrt disclosures
> grounds for initiating actions against WG participation, and/or posting
> rights, and/or I-D postings and authorship?   Doing so would put us into a
> complex legal environment if the bad behavior was denied by an individual
> and a small circle of supporters, but perhaps we should be considering our
> options in that area.
>
>     john
>
>

---

From: "Joel M. Halpern" <[email-masked]>
Date: Mon, 09 Apr 2007 19:04:00 -0400

It seems to me that the timing is actually more important than the cases below.
if a patent that appears to be relevant becomes known before approval 
as an RFC, then clearly the WG should go back and decide, as the 
rules indicate.
If the patent becomes known after approval, but before publication, I 
would treat it the same as above, and get teh WG to decide if they 
think it matters.
If the patent becomes known after publication as an RFC, then we can 
not unpublish the RFC.  We publish the IPR disclosure.  The question 
is whether, assuming the RFC is standards track, we need to do 
anything.  It seems to me that this can not be dealt with by a rule, 
or even an ION.  The correct response is going to depend upon a lot 
of circumsttances, and the WG may not even exist anymore to be asked.

Note for those who don't live this: determining whether a patent 
applies to the practice described in an RFC is best described as an 
art.  And probably as an indefinite art.  I have seen patents 
applied, many years after granting, in ways I would never have 
thought possible.

John raised the question of a known bad faith participant.  That 
seems a dangerous place to go.  Without an actual court ruling, I can 
not see how we could reasonably take action on a supposition of bad 
faith.  (That does not mean that folks can not be made aware of what 
happened, and that such may not influence reactions to other 
proposals from that source.  But no official sanction seems practical.)

Yours,
Joel M. Halpern

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 10 Apr 2007 11:35:08 +0200

"Joel M. Halpern" <[email-masked]> writes:

> or even an ION.  The correct response is going to depend upon a lot of
> circumsttances, and the WG may not even exist anymore to be asked.

What is possible, though, is to build consensus around moving the
patented technology off the standards track.  It should be possible to
do so.

I believe this approach can be discussed in more detail: some WGs
(e.g., DNSEXT) have consensus that they aren't interested in patented
technology for one of their problems.  If a patent came up after RFC
publication, or even after the DNSEXT WG is closed, having some
guidelines to go on how to address the situation may be useful.  Alas,
because the process is so slow, I suspect most people will not bother
doing this work, and just route around the RFC by inventing new
solutions without patent problems.  If this is true, I believe it
suggests a process failure regarding handling situations after a RFC
has been published.

> John raised the question of a known bad faith participant.  That seems
> a dangerous place to go.  Without an actual court ruling, I can not
> see how we could reasonably take action on a supposition of bad faith.
> (That does not mean that folks can not be made aware of what happened,
> and that such may not influence reactions to other proposals from that
> source.  But no official sanction seems practical.)

I agree.  Make the relevant information about who is doing what, and
things generally tend to sort themselves out in the long run.

/Simon

---

From: John C Klensin <[email-masked]>
Date: Tue, 10 Apr 2007 09:11:03 -0400

--On Tuesday, 10 April, 2007 11:35 +0200 Simon Josefsson
<[email-masked]> wrote:

> What is possible, though, is to build consensus around moving
> the patented technology off the standards track.  It should be
> possible to do so.
> 
> I believe this approach can be discussed in more detail: some
> WGs (e.g., DNSEXT) have consensus that they aren't interested
> in patented technology for one of their problems.  If a patent
> came up after RFC publication, or even after the DNSEXT WG is
> closed, having some guidelines to go on how to address the
> situation may be useful.  Alas, because the process is so
> slow, I suspect most people will not bother doing this work,
> and just route around the RFC by inventing new solutions
> without patent problems.  If this is true, I believe it
> suggests a process failure regarding handling situations after
> a RFC has been published.

This was precisely the reason I suggested making a review of the
document that is the subject of a disclosure mandatory if there
was a late filing of an IPR disclosure against it.  I hope it
was obvious that such a review might result in a recommendation
to pull something off the standards track (actually changing the
status would still require a Last Call, etc., consistent with
other procedures).

     john