Subject: What the lawyers and suits think (was e: co-chair judgment of consensus related to last call period of 23-Aug-2004 to 10-Sept-2004)

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Sat, 11 Sep 2004 22:48:24 -0700

All,

This post to the list has been rolling around in the back of my mind 
for a few days.  I hope that you will find it useful, or at least 
interesting, and I hope that it is appropriate to this discussion.

I'm piggy-backing it on to this below post, because I wanted to respond 
to it, and it is related:

> It seems I made a mistake and did not notice that chairs did not say 
> that
> we should not work alternatives AT ALL but said that we should not work
> on alternatives that WOULD BE covered by patent application.
>
> The above is appropriate, however I note that chairs said that we 
> should
> not work on alernatives that "reasonably thought to be covered by the
> patent application". My objection still stands that in itself is
> meaningless because we'll know if alernative is covered when there
> would be another IPR disclosure as it relates to such possible 
> alernative
> draft. Until there is one, we can not reasonable be expected to know 
> what
> would be covered by patent application because we have not seen one!

Reading this with my lawyer, geek, and lawyer geek hats on, I take this 
to mean "reasonably given what we do know or suspect of the patent".  
To take it to the extreme for the sake of example, it would be 
reasonable to believe that an exact Sender I.D. clone would be covered 
by the patent.  It would not be reasonable to think that an elephant 
would be covered by the patent. Somewhere between the range of 
"elephant" and "exact clone" there are things on which one might focus 
which one could reasonably imagine would probably be covered by the 
undisclosed patent to the extent that we may imagine what is in it.

I want to take a moment now to explain to those of you who may not 
know, exactly how lawyers and corporate suits in general look at the 
sorts of people who take part in working groups such as these, and in 
particular how they look at their (i.e. your) concerns.  Note that I am 
*not* speaking of MS' lawyers or suits in particular (and I couldn't, 
as I have not discussed these things with them) - I am speaking from 
years of my own experience.

First, there are _very_ few lawyers who are also geeks *and* who also 
*grok* email issues on a substantive technical level in general, and 
spam issues in particular.  I am one of fewer than I can count on the 
fingers of both hands, and then *only* because Paul Vixie took me 
in-house at MAPS way back when, and took me under his wing, and so 
under his patient tutelage I came to understand way more than I even 
knew there *was* to know about the issues and inner workings of the 
processes.

For the most part, lawyers and corporate executives (most especially 
the lawyers) think of you guys as very smart, driven, but slightly 
strange and obsessed people who work down in the email boiler room - 
they want you to make the things work, but your concerns carry about as 
much weight with them as an assembly line worker's concerns carry with 
the lawyers and execs over at General Motors.   Don't believe me?  Ask 
Paul, who I think will confirm that lawyers' and corporate executives' 
world views of these issues *rarely even focus on the same things*, let 
alone come to a confluence of opinions, as those of the people who are 
actually driving the email systems.

Your concerns have almost *nothing* to do with the running of a 
corporation or the furthering of its corporate objectives.  Your 
objectives are _not_ their objectives - they rarely cross - they aren't 
even parallel -  in fact they are on completely different planes.  
Think about it - you here are focused on solving a problem - they are 
focused on creating a product, and on protecting their client's 
corporate interests.

I would posit that this is the reason that you have very dedicated 
people here like Harry Katz who are sincerely and ferverently working 
on a solution, and that isn't at all at odds with the issues coming 
from the lawyers and suits at the same company.  The people upstairs 
don't speak your language.  They don't share your concerns.  They don't 
have the same focus.  Had I been in their position, say, ten years ago, 
I'd have been the same - I'd have been saying "those email geeks want 
us to do *what*?  That's not how it works up here in the *real* world."

The irony, of course, in all of this, is that it is those very same 
email geeks on who adoption of _any_ standard relies.  Oh sure, it's 
very clever to get several major bulk email senders to agree to a 
standard - but at the end of the day it doesn't matter, because it is 
the email *receivers*, not the email senders, whose adoption will make 
or break any proposed standard.  Every email sender on the planet can 
adopt Standard X, but if no receivers are cuing on Standard X, then so 
what?

So the trick is to get the lawyers and the suits to realize that your 
concerns aren't just something they have to endure - they are something 
they have to satisfy.

Anne

---

From: "jpinkerton" <[email-masked]>
Date: Sun, 12 Sep 2004 10:26:33 +0200

I have to agree with Anne Mitchell's post here - I used to be a "suit", I
worked in international commerce for many years, and I can tell you all that
there is almost no compatability between the corporate need and the
technical need, and that the corporate need will always be satisfied first.
I diverge from Anne's analysis here by saying that the technical need has to
be the one that supplies an answer to the corporate need - therefore the
first requirement is to consider the corporate need(s).

Look at what the purported IPR holder was trying to do - I don't mean
technically, but commercially.  This WG is working on MTA-based
authenticated e-mail delivery. A corporation who does not have the market
share of MTA's that it thinks it should have, will do everything it can to
increase it's market share of MTA's.

I believe the co-chairs need to focus on a technical solution which does not
have any IPR issues.  They should steer the WG much more clearly away from
such solutions.

Kind regards,

John Pinkerton.
[email-masked]
ICQ 313355492

----- Original Message -----
From: "Anne P. Mitchell, Esq." <[email-masked]>
To: "IETF MARID WG" <[email-masked]>
Sent: Sunday, September 12, 2004 7:48 AM
Subject: What the lawyers and suits think (was e: co-chair judgment of
consensus related to last call period of 23-Aug-2004 to 10-Sept-2004)

---

From: Andrew Newton <[email-masked]>
Date: Sun, 12 Sep 2004 09:20:31 -0400

While perhaps interesting, discussion of non-intersecting subcultures 
is not relevant to this working group.

On Sep 12, 2004, at 1:48 AM, Anne P. Mitchell, Esq. wrote:

> Oh sure, it's very clever to get several major bulk email senders to 
> agree to a standard - but at the end of the day it doesn't matter

This is very inappropriate.  I don't think you would appreciate other 
participants of this group denouncing your voice.

-andy

---

From: wayne <[email-masked]>
Date: Sun, 12 Sep 2004 11:07:04 -0500

> is not relevant to this working group.

I disagree.  While Anne may require two hand count the lawyers with a
similar combination of being a geek, being a lawyer, and understanding
email, I need only one finger.

What Anne is explaining is basically what we need to do to help
deployment, which is quite relevant to this working group.  She is
explaing why people who want to stop phishing prefer the PRA over the
2821.MAILFROM even though the PRA protects the 2822.Resent-Sender:
header instead of the 2822.From: header in the critical case of actual
phishing.

> participants of this group denouncing your voice.

I don't think Anne was was denouncing anyone's voice.  She was trying
to explain what we need to take into account when we design and try to
get deployed a standard than needs buy-in non email-geeks.

I think her last paragraph is very important:

: So the trick is to get the lawyers and the suits to realize that your
: concerns aren't just something they have to endure - they are
: something they have to satisfy.

A similar concept needs to be considered by us: We need to realize
that lawyer/suit concerns aren't just something we have to endure -
they are something we have to satisfy.

In this sense, neither protecting almost invisible things like the
Return-Path: nor the Resent-From: header really satisify their
concerns.

-wayne

---

From: "Douglas Otis" <[email-masked]>
Date: Sun, 12 Sep 2004 09:57:48 -0700 (PDT)

> header instead of the 2822.From: header in the critical case of actual

The marid-mpr draft provides a method of protecting both fields without
using the PRA algorithm.  It provides solutions for the sequential DNS
lookup, open list exploits problems, and allows safe reputation services.

-Doug