Subject: [Iasa20] Some comments on draft-haberman-iasa20dt-recs-01

From: Andrew Sullivan <[email-masked]>
Date: Wed, 8 Nov 2017 16:40:11 -0500

Dear colleagues,

I have read draft-haberman-iasa20dt-recs-01.  I have some comments.
These focus mainly on the "three alternatives" questions for now,
mostly because that seems to be the most pressing set of questions.

TL;DR: I do not think that IASA++ delivers what we need, and I don't
think it's good for ISOC either.  Given the ways in which the IETF and
ISOC have both grown, it is not obvious to me that the historic close
link is one that needs to be maintained, and the cleanest approach
would obviously be to set up a new separate organization.  For
practical reasons (including the lack of obvious organizational
expertise and the reality of available funds for the IETF), I don't
think that is a good idea, and so I am left with the subsidiary
organization choice by default.  Finally, I think that in tackling all
of this there remain some internal IETF-only organizational knots that
have never been unwound, and I think they need to be as well.

Supporting arguments below.

5.1.1 describes IASA++.  There is a critical sentence in that
subsection that describes a central issue: "The IETF needs to be able
to make its own administrative decisions independent of ISOC."  If we
take this to be true, then IASA++ is simply not an option.  As the
draft illustrates, the present IASA structure (and therefore any
IASA++ approach) has the automatic problem that, structurally, the
IETF simply cannot possibly be in control of what it is doing.  This
is not to cast aspersions on the good work, positive effects, or
correct intentions of anyone who has been involved in IASA for the
past 10 years.  But ISOC employees are going to be measured according
to ISOC requirements, not those of the IETF.  ISOC contractual terms
are going to be determined by ISCO requirements, not those of the
IETF.  And so on.  We put both ISOC and the IETF in an awkward
position when we try to pretend that one of them doesn't exist and
doesn't have independent needs.

I am particularly concerned about the staffing issue.  The IAOC's
current job is oversight of the IAD and under IASA++ it might get more
such oversight responsibilities.  But the difficulty is that the IAOC
is not ultimately able to make the normal decisions a supervisor can:
hiring and firing, promotion and pay.  For many years the IETF was
fortunate to have a dedicated person filling that staff role, but
there's nothing guaranteed about that and the resulting chain of
responsibility does not meet the community need for transparency --
particularly when IAOC terms may be only two years long.

I also don't see how this model serves ISOC well.  ISOC has to face
its own pressures to evolve, and it has legal and policy imperatives
that the IETF (which in this model doesn't have them) will likely fail
to comprehend.

There may be one advantage of that legal fiction, however, that is
worth attending to.  Effectively, because the IETF is just "an
activity" rather than an organisation of ISOC, the lack of independent
legal existence means that legal issues tend to entangle the IETF less
directly than they otherwise might.  

If the above reasoning stands, then it seems obvious that in a perfect
world the IETF would set up its own organization and carry on from
there.  There would be no bar to collaboration with ISOC wherever it
was appropriate, and indeed such collaboration could well be more
effective than the state of affairs today.  (In my experience dealing
with "the outside world" as IAB chair during the IANA stewardship
changes, way too many conversations ended up in a ditch trying to
explain the organizational boundaries.  The distinctions might well be
plain to us, but they are foreign and strange to others; in the worst
cases, our views were dismissed as just another iteration of the same
ISOC positions people had already heard.  But more on this below.)  At
the same time, the sometimes awkward ties that exist because of the
administrative arrangements could be done away with, freeing both
organizations to work in ways that are best for each.

But it would be perverse to imagine that the IETF is in any way
prepared to undertake that sort of task. First, it's a lot of work,
and that's work that we would not spend on pressing technical and
architecutral issues also facing the network.  (Not to put too fine a
point on it, I did not want to spend most of my time on the IAB
thinking about the dark corners of inter-organizational theory in the
face of some unco-operative community or constituency. That was the
straw I drew, but I wouldn't wish it on others.)  Second, it requires
a realistic and long-term plan for financing the effort, and we are
nowhere near a position to do that.  Finally, we would need evidence
that we have the people required to make it work.  I don't think we
do: filling the IAOC positions has not been easy for some years now,
and several of them are filled automatically by virtue of some stuckee
being in another seat.

I am therefore persuaded that an ISOC subsidiary would be better.  A
subsidiary can conclude agreements with the parent organization pretty
easily, which means that some of the transition could be undertaken
relatively painlessly (by contracting explicitly for services the IETF
already gets implictly through its relationship with ISOC).  Such an
approach allows the two organizations also to formalize a number of
the improvements that would be required for IASA++ anyway; and by
formalizing them, we get additional transparency into how that part of
the relationship works.  It also allows the two organizations to
develop the policies and procedures necessary for each, thereby
permitting continued evolution in appropriate directions.  And it sets
up clear boundaries of responsibility, so that the next time we need
to analyze our administrative arrangements our first problem isn't to
pick apart which arrangements are ours and which are someone else's:
the definition will be in contracts.

The challenges of governance of this new subsidiary remain a problem,
but again the appointment of a board gets a certain amount of benefit
from being a subsidiary: I'd expect any subsidiary to get some board
members appointed directly by the parent, and I should imagine the
same would happen here.  It's the parent's money, after all.

Finally, I think it is important in tackling this work to note that
there are some blurry lines entirely under our own control, and if
we're going to fix the administrative arrangements we're going to have
to clean those up too.  Some of these are referred to in
draft-daigle-iasa-retrospective-01.  In general, I think there is a
problem of responsibility and authority between IASA and the IESG (or
on a couple issues the IAB), and it would be nice if we made those
interfaces a little cleaner while we're in there.  (For instance, I
can think of at least once where IASA was blamed for meeting
imperatives that were not its own creation: IASA gets the
responsibility, but it doesn't always have the authority to act
independently.)  If we are going to set up a corporation with a board,
we are not going to be able to allow that to persist without having
some nasty fights.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Bob Hinden <[email-masked]>
Date: Wed, 8 Nov 2017 14:07:27 -0800

Andrew,

> hiring and firing, promotion and pay.  For many years the IETF was

I don’t think that is correct.  When I was the IAOC chair I wrote the IADs performance reviews, goals for the next year, and compensation changes.  The IAOC approved these.  It had to fit into ISOC personal structure, but the decisions were made in the IAOC.

I assume that is still the case.

Bob

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 9 Nov 2017 11:07:55 +1300

Andrew,
On 09/11/2017 10:40, Andrew Sullivan wrote:
...
> take this to be true, then IASA++ is simply not an option. 

To me that's simply a non sequitur. IASA++ != IASA. It's IASA with
the observed bugs fixed. Clear separation of the accounts and of
decision making concerning those accounts is one of the fixes.
That's an ISOC executive decision; I don't even see why it would
need an ISOC Board motion.

The same applies to correctly charging all ISOC staff time
concerned to the IETF cost centre. That sort of cross-charging
is standard procedure in every organization of any size.

Doing it via a subsidiary is just a complicated way of achieving
the same result.

    Brian

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 8 Nov 2017 17:12:48 -0500

> I assume that is still the case.

When I was on the IAOC, we also write the performance reviews.  But
the plain fact is that the decision is not actually the IAOC's.  It's
ISOC's.  ISOC is the employer, and that creates legal facts that we
ought to be attentive to.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 8 Nov 2017 17:16:00 -0500

> That's an ISOC executive decision; I don't even see why it would

What you are describing is a friendly agreement that the ISOC
executive will do what we say, not an actual legal state of affairs in
which we make those decisions.  Or, to put it another way, under
IASA++ if we are dissatisfied then we have to set everything up _de
novo_ under duress.

This is exactly the same set of arguments that went around during the
IANA is-PTI-a-separate-legal-entity debate.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Richard Barnes <[email-masked]>
Date: Wed, 8 Nov 2017 17:18:06 -0500

> IANA is-PTI-a-separate-legal-entity debate.

I'm sitting back and letting Andrew do the arguing right now, because he's
saying exactly what I would say, and better.

It seems tautological -- if the IETF is to have control over anything, then
it needs to have control, not ISOC.

--Richard

>
> Best regards,
>
> A
>
> --
> Andrew Sullivan
> [email-masked]
>
> _______________________________________________
> iasa20 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/iasa20
>

---

From: Bob Hinden <[email-masked]>
Date: Wed, 8 Nov 2017 14:18:50 -0800

Andrew,

> On Nov 8, 2017, at 2:12 PM, Andrew Sullivan <[email-masked]> wrote:
> 

True, but in practice the IETF had control over the IADs performance evaluation.  To me that seems like the important thing.

Bob

---

From: Richard Barnes <[email-masked]>
Date: Wed, 8 Nov 2017 17:23:26 -0500

On Nov 8, 2017 17:18, "Bob Hinden" <[email-masked]> wrote:

Andrew,

>> I don’t think that is correct.  When I was the IAOC chair I wrote the
IADs performance reviews, goals for the next year, and compensation
changes.  The IAOC approved these.  It had to fit into ISOC personal
structure, but the decisions were made in the IAOC.
> ought to be attentive to.

True, but in practice the IETF had control over the IADs performance
evaluation.  To me that seems like the important thing.

"In practice" is not really what matters here.  Legal roles matter.  If for
some reason the IAD were to become totally unacceptable to the IETF, it
would still be ISOC's sole discretion whether to retain, reassign, or fire
that person.  With today or IASA++, IETF can only cajole.

That does not seem like it meets the autonomy and accountability goals we
have here.

--Richard

Bob

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 9 Nov 2017 11:26:46 +1300

> IANA is-PTI-a-separate-legal-entity debate.

Correct. And guess what I thought and wrote about that ;-).

We disagree. Let's hear from everybody else instead of repeating
ourselves.

     Brian

---

From: Bob Hinden <[email-masked]>
Date: Wed, 8 Nov 2017 14:33:48 -0800

Richard,

> On Nov 8, 2017, at 2:23 PM, Richard Barnes <[email-masked]> wrote:
> 
> 
> 
> "In practice" is not really what matters here.  Legal roles matter.  If for some reason the IAD were to become totally unacceptable to the IETF, it would still be ISOC's sole discretion whether to retain, reassign, or fire that person.  With today or IASA++, IETF can only cajole.

I disagree, the IAOC could fire an IAD if they thought he/she was not doing their job.  ISOC would not stop this.

> 
> That does not seem like it meets the autonomy and accountability goals we have here.

To clarify, you mean the goals the design team has defined in the draft.

Bob

---

From: Ted Hardie <[email-masked]>
Date: Wed, 8 Nov 2017 14:47:43 -0800

On Wed, Nov 8, 2017 at 2:18 PM, Richard Barnes <[email-masked]> wrote:

>
> It seems tautological -- if the IETF is to have control over anything,
> then it needs to have control, not ISOC.
>
> --Richard
>
>
>
So, permit me to gently point out that this formulation is a touch wrong in
our current circumstances.  The IETF is an activity of ISOC.  If the IETF
has control over anything, ISOC has control over it.  We are part of ISOC.

A mental model I find useful here is that of the "business unit".  In one
corporate structure, you may have a bunch of different lines of business,
each constructed as its own business unit, but all part of a single
corporation and reporting up to a single board.  In a different  structure,
you may have each of those lines of business constructed as subsidiaries,
each with its own P & L, corporate structures, and related to the parent
primarily by the ownership stake the parent has.  In a different structure
yet, each of those is independent businesses without a single corporate
parent but with a substantial commonality of individual stockholders.

In our current situation, I think folks believe that we need  the "IETF
line of business" to operate in a way that is different from other work
done by ISOC.  We need to be transparent in specific ways, and we need to
take into account the specific needs of developing our standards.   This
document lays out three ways to accomplish it:

IASA++: Reorganize ISOC so that the IETF line of business can operate
differently within ISOC, in line with the needs identified.

Subsidiary: Reorganize ISOC so that the IETF line of business is in a
distinct subsidiary that can operate differently, much as PIR operates
differently from ISOC's core operations.

Independent:  Spin the IETF line of business out, such that it operates
without reference to the way ISOC operates.  We would remain closely tied
in purpose and membership, but absolutely distinct from a legal perspective.

This mental model may not work for everyone, of course, but it helps me
remember the options simply and relate them to other experiences.

Ted

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 8 Nov 2017 17:54:04 -0500

> We disagree. Let's hear from everybody else instead of repeating

As long as we've figured out that we just disagree about this, yes :)

A

-- 
Andrew Sullivan
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 8 Nov 2017 18:02:49 -0500

> has control over anything, ISOC has control over it.  We are part of ISOC.

Correct for certain today, and possibly correct for the potential
subsidiary arrangement of the future.

> differently within ISOC, in line with the needs identified.

Yes, but as I noted in what I wrote originally upthread, this is at
odds with the sentence in the draft about the IETF needing to make
decisions independent of ISOC.  We might not accept that claim, in
which case the argument I made does not follow.  But if we accept it,
I cannot see how this approach meets the goals.

> differently from ISOC's core operations.

I think the key thing about a subsidiary relationship, however, is
that it does have an independent legal existence and therefore
slightly different fiuciary duties.  There is a nasty threat here, of
course, which is the case where the subsidiary does not want to do
what the parent organization wants.  In commercial arrangements, of
course, the parent board has the ability to replace the subsidiary
board and therefore to fix the conflict.  I was assuming that such an
arrangement would not be acceptable to the IETF community, but I might
be wrong about that, so I ought to make the assumption explicit.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 9 Nov 2017 14:05:23 +1300

On 09/11/2017 11:23, Richard Barnes wrote:

> "In practice" is not really what matters here.  

It's all that matters. ISOC has the money, so if we don't trust
them we are sunk anyway.

   Brian

---

From: Jari Arkko <[email-masked]>
Date: Sat, 11 Nov 2017 17:39:39 +0800

> A mental model I find useful here is that of the "business unit".  In one corporate structure ...

Thanks, Ted, I found the analogy quite useful.

Jari