Subject: Re: OTP, OECD and tax collection

From: John Messing <[email-masked]>
Date: Mon, 5 Oct 1998 07:33:28 -0700

For starters, the group might consider deciding whether to give a warning to
potential users of the software that use of the software with the options
you have identified could result in certain legal consequences, in order to
shield OTP from potential liability, in case a court disagreed with your own
personal beliefs. Ancillary to that decision, you might consider obtaining
qualified legal advice as to the potential liability of OTP and/or its
active members with respect to such issues.

-----Original Message-----
From: Donald E. Eastlake 3rd <[email-masked]>
To: John Messing <[email-masked]>
Cc: [email-masked] <[email-masked]>; Steve Schear
<[email-masked]>
Date: Sunday, October 04, 1998 7:34 PM
Subject: Re: OTP, OECD and tax collection

>
>It is up to the consensus of this working group as to what it wants to
>include, exclude, ignore, or consider in future versions of IOTP.  I
>do not believe that the operation of software that permits certain
>options to be activated at the operator's discretion, such as the
>collection of taxes or the automatic copying of all messages to a law
>enforcement authority, constitutes consent to the actual activation of
>such options.
>
>I'd be interested in any concrete and specific suggestions you might
>have to improve the IOTP protocol.
>
>From:  John Messing <[email-masked]>
>Message-ID:  <000801bdefb9$bfdd9500$7825c5a9@www..azstarnet.com>
>To:  [email-masked], Steve Schear <[email-masked]>
>Date:  Sun, 4 Oct 1998 10:09:27 -0700
>
>>This is one of those issues which is not as straightforward as it may
first
>>appear. Apart from merchants whose businesses are physically located
within
>>the borders of an EEC state, the power of the state to tax may depend upon
>>notions of extraterritorial application of the tax laws. Thus, if an
>
>My understanding is that there is some motion towards an agreement
>within the OECD nations which would eliminate problems of
>extraterritorial application of law for those countries.
>
>>American corporation sells goods to a German citizen and has no office or
>>outlet in Germany, then in a non-virtual transaction, there is little
legal
>>basis for Germany to claim the right to tax the transaction. The German
>
>It is my understanding that many places, such as Massachusetts, where
>I reside, have "sales and use" taxes which tax not just items sold
>within their territory, but also items imported into and used within
>their territory.
>
>>citizen had to have been physically located in another jurisdiction to
have
>>completed the purchase. But in a virtual transaction where the Internet
>>server and the seller are located physically outside of Germany, the
>>situation may be less clear. If Germany claims the right to tax any
>>transaction involving a buyer whose computer or delivery address is
located
>>within its borders, a question will arise about the basis in international
>>law of the power to tax. To the extent that consent to tax is one such
>>basis, then inclusion of software at the Internet server used by the
seller
>>which permits German taxation through OTP could arguably be implied
consent
>       ^^^^^^^
>
>>to tax -- a result perhaps never intended by OTP or the buyer. It is quite
>>conceivable that Germany would hire an American attorney to collect such
>>taxes as postulated by this example through the American courts, which an
>>American corporation could not ignore. Apart from the issue of taxation,
>>there are other questions about extraterritorial applicable of laws, such
as
>>digital signature legislation, which involve similar considerations. In
>>order to avoid such questions, OTP refused to consider them in earlier
>>drafts. Taking a position or refusing to take a position on such issues in
>>light of the German request probably will result practically in a
>>substantive decision one way or the other, like it or not, which means
that
>>such questions can no longer continue to be ignored as either a
theoretical
>>or practical matter.
>
>Thanks,
>Donald
>
>>-----Original Message-----
>>From: Steve Schear <[email-masked]>
>>To: [email-masked] <[email-masked]>
>>Date: Saturday, October 03, 1998 10:23 PM
>>Subject: RE: OTP, OECD and tax collection
>>
>>
>>>David Burdett <[email-masked]> wrote:
>>>>Tax evasion is as old as the centuries. I doubt that OTP if its used for
>>>>tax collection by the governments will change peoples inclination to pay
>>>>(or not pay) one bit. The point is, if governments want to collect taxes
>>>>then they will find a way to do it and most merchants who have a
>>>>reputation to protect will follow it.
>>>
>>>This is really a rear-view outlook.  If we were in the 16th century, its
>>>like saying that because the Church has all this authority we're not
going
>>>to use the press to print anything secular.
>>>
>>>While it may be true that in the short run merchants with reputation may
go
>>>along with this foolishness, as long as their risks are low consumers
will
>>>shop wherever the price is lowest. 10% or more tax is enough separate
most
>>>consumers from their guilt and place the loyal merchants at a
considerable
>>>disadvantage. The complaint merchants will pressure the governments to
get
>>>tough (regulation always favors the regulated). If governments are not
able
>>>to pressure the non-complaint merchants, as I believe they will not (as
>>>they were unable to stem the Eurodollar trading), this is the beginning
of
>>>the end game for such taxes on the Net and perhaps in a broader sense as
>>>more commerce moves to the Net and places local merchants at an
increasing
>>>disadvantage.
>>>
>>>--Steve
>>>
>>>
>>>-----------------------------------------------------------------------
>>>Message addressed to: [email-masked]
>>>Archive available at: http://www.elistx.com/archives/ietf-trade/
>>>To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
>>>body to: [email-masked]
>>>
>>
>>-----------------------------------------------------------------------
>>Message addressed to: [email-masked]
>>Archive available at: http://www.elistx.com/archives/ietf-trade/
>>To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
>>body to: [email-masked]
>-----------------------------------------------------------------------
>Message addressed to: [email-masked]
>Archive available at: http://www.elistx.com/archives/ietf-trade/
>To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
>body to: [email-masked]
>

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]

---

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Mon, 05 Oct 1998 12:24:35 -0400

Dear John,

From:  "John Messing" <[email-masked]>
Message-ID:  <001b01bdf06d$20522dc0$2126c5a9@www..azstarnet.com>
To:  "Donald E. Eastlake 3rd" <[email-masked]>
Cc:  <[email-masked]>, "Steve Schear" <[email-masked]>
Date:  Mon, 5 Oct 1998 07:33:28 -0700

>personal beliefs.

The primary consideration within the IETF is the "bits on the wire" so
as to achieve interoperability.  We are engineering a protocol, not a
particular piece of software.  In fact, the IETF shies away from
specifying things about the user interface, although that is sometimes
necessary.  As for legal warnings, none are given, that I am aware of,
except for notice if anyone has advised the IETF of possible patent
infringement and to disclaim warranty.

To give a legal warning as you suggest seems, to me, to be to start
down a slippery slope resulting in increased rather than decreased
liability.  All human activities "could result in certain legal
consequences" to use your almost meaningless phrase.  Notice of
possibile legal consequences in one case would just lead to pressure
for more and more notices on more and more documents about
increasingly tenuous and unlikely contingencies.  Other than filling
the world with legalese, it is not clear to me that this would
accomplish anything but place an ever greater burden on the producers
of such documents to include detailed warnings and by implication
assume liable if they were ever found incomplete, inaccurate,
misleading, etc.

Much better to disclaim all warranties and include NO such notices
thus putting the burden on the implementors and users of the protocol
design to conform to legal strictures.

>                  Ancillary to that decision, you might consider obtaining

The protocol acryonym in the IETF is IOTP, not OTP. (Within the IETF,
OTP stands for One Time Password, a diffeent working group.  See
<http://www.ietf.org/html.charters/otp-charter.html>.)  I don't quite
understand your repeated references to (I)OTP as if it were an
organization.  This working group is a part of the IETF which
currently operates under the legal umbrella of the Internet Society
(ISOC).  Neither this working group nor the IETF have a defined
membership but consist of individual volunteers, not companies or
other organizations.  Perhaps you are confusing this IETF working
group with the OTP Consortium.  The OTP Consortium is a separate group
of companies that seek to promote the IOTP protocol.

Thanks,
Donald

---

From: Hannu Nikkanen <[email-masked]>
Date: Tue, 06 Oct 1998 08:44:43 +0300

>active members with respect to such issues.

Now we are working with a RFC, so maybe things are simpler. IOTP is kind of
non-binding standard, not a legal person, which would have legal liability.

In some places in the world, there probably will be places, where tax
collection will be mandatory and some law-obeying merchants, which will do
it also in electronic trade, even if that is based on reporting sales to an
authority. 

Merchants and users are legal persons, which must fulfil the requirements
of local requirements of law. IOTP should allow them to configure their
systems accordingly, if we want it to be used. 

However, I wonder, must everything be enbedded inside IOTP or could we
support the cretion a parallel path e.g. for user authentification. 

We might also consider some related points.

- tax. I would quess, that tax can be part of the purchase, a separate
payment (maybe with different time limits) to the authority or some later
procedures triggered by announcement to authority. I guess, that the
merchant should be able to decide, what payments are mandatory before the
merchandise can be delivered.
- user privacy. The user should know, what information is distributed and
to which authority. 
- estimate of total cost. The user should know the expected total cost,
including later taxes.

Hannu