Subject: [mile] Major Issue with draft-ietf-mile-sci

From: Sean Turner <[email-masked]>
Date: Thu, 09 Feb 2012 12:40:14 -0800

Hi all,

I realize that the MITRE specifications are now normative references as 
a result of a question I asked.  They are properly marked as normative.

NOTE: This issue has nothing to do with the contents of the mile draft 
or the text in the MITRE references.  It only has to do with the TOU 
(Terms of Use) of the MITRE references.

I've reviewed the TOU for the 17 MITRE specifications, which are 
normative references in draft-ietf-mile-sci.  I firmly believe that it 
will not be possible to achieve IETF consensus with normative references 
to such documents in a standards-track RFC.  The TOU include:

   You use [insert doc title here] on the condition that you
   indemnify and hold harmless MITRE, its Board of Trustees,
   officers, agents, and employees, from any and all liability
   or damages to yourself or your hardware or software, or third
   parties, including attorneys' fees, court costs, and other
   related costs and expenses, arising out of your use of
   [insert doc title here] irrespective of the cause of said
   liability.

I also don't think that an Expert should accept the TOUs during their 
review of an IANA registration request - regardless of whether the 
draft/RFC containing the registry is bound for informational/standards 
track.  In fact, I'd advise them not to accept the registration request 
if the reference had this type of TOU.

This effective stops this draft dead in its tracks until we resolve what 
types/kinds of Structured Cybersecurity Information it will support.

spt

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 09 Feb 2012 18:05:08 -0500

Hi Sean,

I fail to understand the reaction here.  This is a simple,
straightforward indemnification provision that any major
contributing organization's counsel would insist upon.
It has no apparent collateral adverse effects on anyone.
Indeed, as a person who set up some of the protective
mechanisms for ISOC and the IETF about 20 years ago,
this is consonant with what ISOC and the IETF likely
maintain to the outside world themselves.  (The current
indemnification provisions seem buried somewhere.)

What is particularly mystifying is the last sentence of
your email that seems rather over-the-top and totally
disconnected from the indemnification provisions.

Is there something I'm missing?

--tony

On 2/9/2012 3:40 PM, Sean Turner wrote:
> will not be possible to achieve IETF consensus with normative 
> references to such documents in a standards-track RFC.  The TOU include:
>
> track.  In fact, I'd advise them not to accept the registration 
> request if the reference had this type of TOU.
>
> This effective stops this draft dead in its tracks until we resolve 
> what types/kinds of Structured Cybersecurity Information it will support.

---

From: Brian Trammell <[email-masked]>
Date: Fri, 10 Feb 2012 12:20:38 +0100

Hi, Tony, all,

IANAL, but all I can find that's current and looks like indemnity is section 7(a) of the IETF Trust Legal Provisions (rev. 4.0 of 28 December 2009, http://trustee.ietf.org/license-info/) (sorry for the yelling, this is a straight copy-paste):

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN “AS IS” BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST, THE INTERNET ENGINEERING TASK FORCE AND ANY APPLICABLE MANAGERS OF ALTERNATE STREAM DOCUMENTS, AS DEFINED IN SECTION 8 BELOW, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

The MITRE indemnity clause looks a quite a bit stronger to me than the no-warranty clause (again, merely as a native speaker of non-lawyer English), even though I could be convinced that the basic intention is the same. I could also be convinced that there is enough of a difference here that they are fundamentally incompatible. The question for this issue would them seem to be whether a disclaimer of warranty is the same thing as an indemnification.

If it isn't, one class of solutions would be to bring the referenced MITRE specifications under a licensing regime that's compatible with the Trust Legal Provisions.

Best regards,

Brian (as MILE contributor)

On Feb 10, 2012, at 12:05 AM, Tony Rutkowski wrote:

>> NOTE: This issue has nothing to do with the contents of the mile draft or the text in the MITRE references.  It only has to do with the TOU (Terms of Use) of the MITRE references.
>> 
>> I've reviewed the TOU for the 17 MITRE specifications, which are normative references in draft-ietf-mile-sci.  I firmly believe that it will not be possible to achieve IETF consensus with normative references to such documents in a standards-track RFC.  The TOU include:
>> 
>> I also don't think that an Expert should accept the TOUs during their review of an IANA registration request - regardless of whether the draft/RFC containing the registry is bound for informational/standards track.  In fact, I'd advise them not to accept the registration request if the reference had this type of TOU.
>> 
>> This effective stops this draft dead in its tracks until we resolve what types/kinds of Structured Cybersecurity Information it will support.
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 10 Feb 2012 07:39:25 -0500

Hi Brian,

Good research!  At this point, MITRE might respond why
its provisions need be stronger than those of the IETF/ISOC.
Maybe they would be willing to use the same one.

best,
tony

---

From: Sean Turner <[email-masked]>
Date: Fri, 10 Feb 2012 07:25:02 -0800

Tony,

It's the indemnification part that's the problem.  The IETF does not ask 
for indemnification for the use of its standards.  As Brian pointed out 
the IETF's TLP (Trust Legal Provisions) can be found in the Copyright 
Notice section: http://trustee.ietf.org/license-info/.  Also note that 
this link can be found in the Copyright Notice section of every draft/RFC.

I'm just providing some early steering for the WG.  The term "dead in 
its tracks" is a little melodramatic and technically the WG can ignore 
my early steer.  But, nobody should be surprised when there's a process 
delay between when the draft (with normative references to these 
documents with these TOU) is passed to me after making it through WG LC 
and when the IETF LC issued.  The WG should consider the TOU now because 
I will definitely ask later that they be expressly considered.  I see my 
email as tipping my hand early, but I feel I'd be doing a disservice to 
the WG by not speaking up as soon as I spotted the issue.  You are quite 
correct that MITRE is free to stipulate whatever TOU they want, but the 
IETF is also free to not reference their specifications.  Please don't 
get me wrong, I'd prefer to be able to reference what's already been 
developed.

spt

On 2/10/12 4:39 AM, Tony Rutkowski wrote:
>> IANAL, but all I can find that's current and looks like indemnity is
>> section 7(a) of the IETF Trust Legal Provisions (rev. 4.0 of 28
>> December 2009, http://trustee.ietf.org/license-info/) (sorry for the
>> yelling, this is a straight copy-paste):
>>
>> ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN
>> “AS IS” BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
>> OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST, THE
>> INTERNET ENGINEERING TASK FORCE AND ANY APPLICABLE MANAGERS OF
>> ALTERNATE STREAM DOCUMENTS, AS DEFINED IN SECTION 8 BELOW, DISCLAIM
>> ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY
>> WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY
>> RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A
>> PARTICULAR PURPOSE.
>>
>> The MITRE indemnity clause looks a quite a bit stronger to me than the
>> no-warranty clause (again, merely as a native speaker of non-lawyer
>> English), even though I could be convinced that the basic intention is
>> the same. I could also be convinced that there is enough of a
>> difference here that they are fundamentally incompatible. The question
>> for this issue would them seem to be whether a disclaimer of warranty
>> is the same thing as an indemnification.
>>
>> If it isn't, one class of solutions would be to bring the referenced
>> MITRE specifications under a licensing regime that's compatible with
>> the Trust Legal Provisions.
>>
>>
>
>

---

From: "Martin, Robert A." <[email-masked]>
Date: Fri, 10 Feb 2012 10:40:20 -0500

Sean,

We have had the current terms of use since we launched the Common 
Vulnerabilities and Exposures (CVE) initiative in September of 1999 and 
this is the first time to my knowledge that anyone has had issue with them.

I will say that over 200 organizations from 26 countries have found 
those terms acceptable and incorporated one or more of our 
standardization efforts into their products or services.

IANAL, but maybe the norm of these types of clauses has evolved over the 
12 years that these have been in place on our efforts and its time to 
review them.

Sean, if the terms were along the lines of those used by the IETF as 
provided by Brian and suggested by Tony would that be in the right 
direction?

MITRE's work in this area is meant to help improve security practices 
and capabilities and the terms were not meant to impede the uptake or 
leveraging of this work in any manner, but as I mentioned, this is the 
first time someone has raised an issue with them.

Regards,

Bob

P.S. Also, so we are communicating clearly, what are the 17 items you 
are referring to? My count is a bit lower.

On 2/10/12 7:39 AM, Tony Rutkowski wrote:
> .

---

From: Sean Turner <[email-masked]>
Date: Mon, 13 Feb 2012 09:34:23 -0500

> provided by Brian and suggested by Tony would that be in the right

It would help.

> are referring to? My count is a bit lower.

You're right the number is a bit lower - 7 I think.

---

From: "Martin, Robert A." <[email-masked]>
Date: Mon, 13 Feb 2012 09:42:29 -0500

Sean,

While we have had many others agree to our current terms of use and so 
are still unsure why this is an issue, in the spirit of cooperation and 
our belief in the goals of structuring cybersecurity information, we 
will accept the language of the IETF Trust Legal Provisions and revise 
our terms of use to state the following:

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN 
"AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR 
IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, 
OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR 
IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE 
INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

If you can concur that this should address your concern regarding the 
terms of use we will proceed to make the changes.

Bob

---

From: Sean Turner <[email-masked]>
Date: Tue, 14 Feb 2012 08:32:53 -0500

Bob,

I think this is much better, but I can't guarantee that others won't 
have different concerns.

spt