Subject: RE: Options for IETF administrative restructuring

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Mon, 6 Sep 2004 10:47:06 +0200

Aaron,

I hope you had noticed that I stated that IF we were to choose
between A and B, that my preference would be for B. And indeed, 
the below argument for C would then be (one of) my reason(s) for
choosing B over A. 

I am not sure that C creates really so much more "distance" as what we 
would create with B. Some of the extra safeguards that I see we would
want with B would also create some "distance".

The benefit of C is (in my opinion) that it does not assume a default 
(strong) relationship, but that it requires both organisations to 
actively want to continue/renew the relationship every so many years. 
And such checkpoints are nice and good points where the relationship
can (and in my view will) be evaluated and if any friction has developed
then at such checkpoints the friction can (timely and naturally) be 
corrected.

Thanks, Bert

> -----Original Message-----
> From: Aaron Falk [mailto:[email-masked]]
> Sent: Monday, September 06, 2004 02:53
> To: Wijnen, Bert (Bert)
> Cc: Scott Bradner; [email-masked]
> Subject: Re: Options for IETF administrative restructuring
> 
> 
> 
> On Sep 3, 2004, at 3:06 PM, Wijnen, Bert (Bert) wrote:
> 
> > If we were to go for option C, then in my personal view, it would have the
> > serious benefit that we are ALWAYS (from day 1) responsible to make sure
> > things work well. And we need to re-negotiate every so often if we want
> > to keep the relationships that we have or if we want to change them.
> > So in my view we would run far less risk to ever get in a similar situation
> > as where we are today. Yep... initially it will cost us some more money and
> > effort I suspect. But I think it is worth the price.
> 
> Bert-
> 
> It seems to me that this is an argument for option B as well s C.  My 
> take from the history you laid out is that what was missing was a 
> clearly articulated set of relationships which defined roles and 
> responsibilities (and possibly instructions for disentangling if things 
> went bad.  AFAICT, this could just as easily be put into option B 
> without creating an (imo undesirable) increased distance between IETF 
> and ISOC.
> 
> --aaron
> 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 06 Sep 2004 15:11:11 +0200

> then at such checkpoints the friction can (timely and naturally) be 

That is true enough, but is it really enough to justify the overhead
costs and work of creating a new legal entity? Certainly the agreements
under scenario B (or even A) should include "explosive bolts" in case
the IETF becomes unsatisfied, and regular reviews are an execllent idea.

    Brian

---

From: Pete Resnick <[email-masked]>
Date: Mon, 6 Sep 2004 21:36:48 -0500

On 9/6/04 at 3:11 PM +0200, Brian E Carpenter wrote:

>>The benefit of C is (in my opinion) that it does not assume a 
>>default (strong) relationship, but that it requires both 
>>organisations to actively want to continue/renew the relationship 
>>every so many years. And such checkpoints are nice and good points 
>>where the relationship can (and in my view will) be evaluated and 
>>if any friction has developed then at such checkpoints the friction 
>>can (timely and naturally) be corrected.
>
>costs and work of creating a new legal entity? Certainly the 
>agreements under scenario B (or even A) should include "explosive 
>bolts" in case the IETF becomes unsatisfied, and regular reviews are 
>an execllent idea.

I absolutely agree with Brian (and disagree with Scott) about the 
need for "explosive bolts" in case the IETF (or ISOC for that matter) 
becomes unsatisfied under solution A or B. With such a set of 
explosive bolts, I'd more than likely be happy with solution A or B. 
The problem I have, and the reason to this point I've been leaning 
toward C along with Bert, is that nobody has even given me a hint of 
what those explosive bolts might look like. For example, in the A vs. 
B discussion that's been going on, there has been quite a bit of talk 
about an "MoU between ISOC and IETF." But as Margaret points out:

>I don't understand what legal entity would hold up the "IETF" end of 
>this MOU.  Currently when someone needs to make a contract with the 
>IETF (the RFC Editor, another standards group, a hotel, etc.) that 
>contract is signed by either ISOC or CNRI/Foretec acting on behalf 
>of the IETF.  Do you know of  some way that the IETF (by which I 
>think you mean the standards development portion) can be an MOU 
>signatory?

Down the road, if the make-up of the ISOC BoT and ISOC by-laws change 
significantly and they become dissatisfied, what is to stop them from 
simply saying, "We've decided to exit this MoU and take your support 
services with us."? Or if the IETF becomes dissatisfied with the 
relationship, what would there be to allow us to say, "We'd like our 
support services out of the control of ISOC."? As others have said, 
there's no sign of either of these things happening, but we do need 
to plan for the contingencies. If there is no legal entity on the 
other end of that MoU, I'm afraid we could end up having to repeat 
this entire process again in what will surely be (should this 
terrible scenario come to pass) another state great angst. I think it 
would be irresponsible to leave that legacy to our descendants.

In scenario C, it's easy for me to see what happens if all hell 
breaks loose: We have a legal administrative entity whose entire 
raison d'etre is "provide administrative services to the IETF 
standards body." If the relationship with (or mission of) the ISOC 
changes, that won't change a bit the relationship between the 
administrative entity and the IETF standards body. The administrative 
entity can simply say, "So long, and thanks for all the fish." Or 
ISOC could say, "Sorry, we don't like the way your spending our money 
anymore; go find your own money." However unpleasant a time that 
would be, the IETF would still have an administrative support entity 
that can continue its administrative support mission without having 
to go through yet another administrative restructuring.

(Note that even if all hell did break loose, the IETF standards body 
could even conceivably maintain its current process relationship with 
ISOC--choosing NomCom chairs, being an appeals body, etc.--at that 
point if it so desired.)

I understand that C is additional cost for an insurance policy that 
we may never need to cash in, but at this point it seems worth it. If 
someone could describe to me what the explosive bolts look like that 
would get us a similar result with scenarios A & B, I would be much 
more at ease with those choices.

pr
--
Pete Resnick <http://www.qualcomm.com/~presnick/>
QUALCOMM Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 07 Sep 2004 08:11:29 +0200

Here's a version of what the explosive bolts could look like.

Firstly, note that the IETF (*not* the ISOC) signed an MOU
with ICANN on March 1st 2000. Fred Baker signed it as IETF Chair,
I signed it as IAB Chair, and Mike Roberts signed it as ICANN
President. The IETF lawyer and the ICANN lawyer were both
consulted, and there was no suggestion that the IETF couldn't
sign an MOU. Not being a lawyer myself, I don't want to argue
that point.

Secondly, that MOU contains explosive bolts. So far, we haven't
had to explode them.

>    2. This MOU will remain in effect until either modified or cancelled
>    by mutual consent of the Internet Engineering Task Force and the
>    Internet Corporation for Assigned Names and Numbers, or cancelled by
>    either party with at least six (6) months notice.

If you're wondering what the IETF is, the MOU also defines it
for you:

>    IETF - the Internet Engineering Task Force, the unincorporated
>    association operating under such name that creates Internet Standards
>    and related documents.

These things are not hard. (See RFC 2860 for the full text.)

    Brian

Pete Resnick wrote:
>>> can (and in my view will) be evaluated and if any friction has 
>>> developed then at such checkpoints the friction can (timely and 
>>> naturally) be corrected.
>>
>>
> I absolutely agree with Brian (and disagree with Scott) about the need 
> for "explosive bolts" in case the IETF (or ISOC for that matter) becomes 
> unsatisfied under solution A or B. With such a set of explosive bolts, 
> I'd more than likely be happy with solution A or B. The problem I have, 
> and the reason to this point I've been leaning toward C along with Bert, 
> is that nobody has even given me a hint of what those explosive bolts 
> might look like. For example, in the A vs. B discussion that's been 
> going on, there has been quite a bit of talk about an "MoU between ISOC 
> and IETF." But as Margaret points out:
> 
>> contract is signed by either ISOC or CNRI/Foretec acting on behalf of 
>> the IETF.  Do you know of  some way that the IETF (by which I think 
>> you mean the standards development portion) can be an MOU signatory?
> 
> 
> there's no sign of either of these things happening, but we do need to 
> plan for the contingencies. If there is no legal entity on the other end 
> of that MoU, I'm afraid we could end up having to repeat this entire 
> process again in what will surely be (should this terrible scenario come 
> to pass) another state great angst. I think it would be irresponsible to 
> leave that legacy to our descendants.
> 
> In scenario C, it's easy for me to see what happens if all hell breaks 
> loose: We have a legal administrative entity whose entire raison d'etre 
> is "provide administrative services to the IETF standards body." If the 
> relationship with (or mission of) the ISOC changes, that won't change a 
> bit the relationship between the administrative entity and the IETF 
> standards body. The administrative entity can simply say, "So long, and 
> thanks for all the fish." Or ISOC could say, "Sorry, we don't like the 
> way your spending our money anymore; go find your own money." However 
> unpleasant a time that would be, the IETF would still have an 
> administrative support entity that can continue its administrative 
> support mission without having to go through yet another administrative 
> restructuring.
> 
> ISOC--choosing NomCom chairs, being an appeals body, etc.--at that point 
> if it so desired.)
> 
> I understand that C is additional cost for an insurance policy that we 
> may never need to cash in, but at this point it seems worth it. If 
> would get us a similar result with scenarios A & B, I would be much more 
> at ease with those choices.
> 
> pr
> --

---

From: Pete Resnick <[email-masked]>
Date: Tue, 7 Sep 2004 09:23:06 -0500

As Brian, I will leave aside the question of whether the lawyers can 
make it possible for an MoU to be effective; I'm not a lawyer either. 
However, I think we may have different definitions of "explosive 
bolts":

On 9/7/04 at 8:11 AM +0200, Brian E Carpenter wrote:

>...MOU with ICANN...
>...that MOU contains explosive bolts. So far, we haven't had to explode them.
>
>>    2. This MOU will remain in effect until either modified or 
>>cancelled by mutual consent of the Internet Engineering Task Force 
>>and the Internet Corporation for Assigned Names and Numbers, or 
>>cancelled by either party with at least six (6) months notice.

This doesn't look so much to be "explosive bolts", but rather a 
"self-destruct mechanism"; when either side decides that they don't 
want to participate, the agreement blows up and any structures 
between the two organizations evaporate. When I talk about "explosive 
bolts", I mean having some way to separate the IETF administrative 
function housed in ISOC from ISOC.

For example, let's say that scenario A or B end up having an employee 
of ISOC whose title is "IETF Administrative Czar", and she has 5 
employees working under her (an accountant, a lawyer, a secretary, 
etc.). What I'd want out of an "explosive bolts" agreement is that, 
if one side or the other wants to pull the plug, the Czar and the 5 
employees continue to act at the behest of the IETF (*not* ISOC) and 
there is some way to spin off a subsidiary of ISOC into a separate 
entity so that the IETF continues to get administrative support from 
these folks. Current contracts would have to continue to function, 
upcoming meetings would have to continue uninterrupted, and most 
importantly the IETF does not have to go through another 
administrative restructuring like we're doing now in order to have 
things continue to operate.

Perhaps I'm more interested in the administrative function having an 
"escape pod", and the whole thing is attached to ISOC with explosive 
bolts. The key, to repeat it again, is that we don't have to go 
through another administrative restructuring if a future IETF or ISOC 
decide they can't live with each other anymore.

pr

---

From: [email-masked] (scott bradner)
Date: Tue, 7 Sep 2004 10:34:30 -0400 (EDT)

> etc.).

note that the proposal on the table is to have just one employee
who manages the outsourced support services 

that is not the only model but that is what is in Carl's paper

Scott

---

From: Paul Vixie <[email-masked]>
Date: 07 Sep 2004 17:44:29 +0000

[email-masked] (Brian E Carpenter) writes:

> ...
> 
> Firstly, note that the IETF (*not* the ISOC) signed an MOU with ICANN on
> March 1st 2000. Fred Baker signed it as IETF Chair, I signed it as IAB
> Chair, and Mike Roberts signed it as ICANN President.  The IETF lawyer
> and the ICANN lawyer were both consulted, and there was no suggestion
> that the IETF couldn't sign an MOU.  Not being a lawyer myself, I don't
> want to argue that point.

i am likewise not a lawyer and so i hardly ever trust myself, or recommend
that others trust me, when i say "you don't need a lawyer."  however, in
this case, i think "you need a better lawyer" is a safe statement.  look
at <http://www.bvsc.org/content.asp?id=12112236&cat=8&parentid=0>, to wit:

        Disadvantages

        Personal responsibility of the management committee. 

        The organisation cannot enter into contracts, own land, employ
        people or do anything itself

so if fred signed this as IETF Chair, he was agreeing personally to the
terms of the MoU.  his signature could not be representative of anything,
since by the nature of an unincorporated association, there is nothing to
represent.  now that fred's not IETF Chair any more, there is no sense in
which "IETF" is in any way constrained by the content of the MoU he signed.

> If you're wondering what the IETF is, the MOU also defines it for you:
> 

like many things outside the core technical field, these things are hard,
and harder than they look, and hard enough that you need a better lawyer.
as long as IETF remains an unincorporated association, i think you need
every new IESG and IAB member to add their signature to all current MoU's
and other agreements.  but you should find a lawyer.  a better lawyer than
the one who was standing by last time this stuff was discussed or signed.
-- 
Paul Vixie

---

From: Carl Malamud <[email-masked]>
Date: Tue, 7 Sep 2004 11:26:07 -0700 (PDT)

> the one who was standing by last time this stuff was discussed or signed.

What Paul says is sort of true.  Traditionally, at common law, all members
of an unincorporated association were, in certain circumstances,
personally liable for the actions of the association.

However, under the 1996 uniform nonprofit unincorporated association act, 
which has been passed by 9 states, unincorpated associations can,
under certain circumstances, have standing, limitations of liability,
and the ability to hold and transfer property.

The -01 rev of my draft, to be released shortly, contains more details on this 
mechanism.  

Regards,

Carl

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 08 Sep 2004 09:21:11 +0200

> personally liable for the actions of the association.

And that's exactly why the liability insurance policy held by ISOC
covers IETF "officials" today.

     Brian

---

From: John C Klensin <[email-masked]>
Date: Wed, 08 Sep 2004 08:55:26 -0400

--On Wednesday, 08 September, 2004 09:21 +0200 Brian E Carpenter
<[email-masked]> wrote:

> Carl Malamud wrote:
>>> like many things outside the core technical field, these
>>> things are hard, and harder than they look, and hard enough
>>> that you need a better lawyer. as long as IETF remains an
>>> unincorporated association, i think you need every new IESG
>>> and IAB member to add their signature to all current MoU's
>>> and other agreements.  but you should find a lawyer.  a
>>> better lawyer than the one who was standing by last time
>>> this stuff was discussed or signed. -- 
>>> Paul Vixie
>>> 
>> 
>> 
>> What Paul says is sort of true.  Traditionally, at common
>> law, all members of an unincorporated association were, in
>> certain circumstances, personally liable for the actions of
>> the association.
> 

Would someone who actually knows or can find out care to comment
on whether the insurance would cover such "officials" if they
started engaging in direct, large-scale, financial management
and/or the direct supervision of those who were doing so, in
addition to standards activities?

      john

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 08 Sep 2004 15:20:38 +0200

> addition to standards activities?

it's the same policy as covers ISOC's officers and BoD, I believe.

In the "ISOC Does It" model, it's a different set of people within the 
policy that does the same job. Does the insurance agency care?

---

From: "Lynn St.Amour" <[email-masked]>
Date: Wed, 8 Sep 2004 16:54:52 -0400

At 8:55 AM -0400 9/8/04, John C Klensin wrote:
>>  And that's exactly why the liability insurance policy held by
>  > ISOC covers IETF "officials" today.
>

The ISOC Directors & Officers insurance presently covers the IETF, 
IESG, IAB, IRTF, IRSG and IANA (IETF related) "officials", and the 
RFC Editor.   It extends to the level of Working Group chairs and 
also covers the NomComm process (including Recall Committees).  This 
coverage would extend to financial management and/or direct 
supervision of those doing so in addition to standards activities, so 
long as the IETF was an unincorporated entity and was  operating 
under the "umbrella" of ISOC (as you are today).  Should the IETF 
incorporate as a separate entity, it would (obviously) no longer be 
covered under the ISOC insurance policy, but would require its own.

Regards,

Lynn

---

From: Pete Resnick <[email-masked]>
Date: Wed, 8 Sep 2004 16:49:49 -0500

On 9/8/04 at 4:54 PM -0400, Lynn St.Amour wrote:

>Should the IETF incorporate as a separate entity...

To date, there has been no proposal, in Carl's document or otherwise 
as far as I know, for *the IETF* to incorporate as a separate entity. 
There have been proposals to incorporate a body to deal with IETF 
administrative functions (like contracting for meetings, contracting 
for ISP and web service, etc.), referred to in Carl's document as 
"IETF Foundation". Incorporating that sort of entity wouldn't change 
the insurance coverage for members of the IETF, would it?

pr

---

From: Margaret Wasserman <[email-masked]>
Date: Wed, 8 Sep 2004 18:41:45 -0400

Hi Pete,

At 6:17 PM -0400 9/8/04, Margaret Wasserman wrote:
>>To date, there has been no proposal, in Carl's document or 
>>otherwise as far as I know, for *the IETF* to incorporate as a 
>>separate entity. There have been proposals to incorporate a body to 
>>deal with IETF administrative functions (like contracting for 
>>meetings, contracting for ISP and web service, etc.), referred to 
>>in Carl's document as "IETF Foundation". Incorporating that sort of 
>>entity wouldn't change

I don't think that there is a clear yes/no answer to your question.

Carl's draft makes a distinction between the "*Administrative 
Functions*" and "*Standards Process Functions*" of ISOC, where the 
administrative functions and standards process functions are defined 
as follows:

   "1.  *Administration Functions.* As discussed in subsequent sections,
        the Internet Society provides an administrative and financial
        function, managing the contract with the RFC Editor, providing
        insurance for selected IETF participants, and administering a
        discretionary fund for use by the IAB and the IETF Chairs.

    2.  *Standards Process Functions* The Internet Society plays a
        fundamental role in the IETF Standards Process, including
        appointment of the Nominating Committee chair, confirmation of
        IAB members, confirmation of documents that describe the
        standards process, and acting as the last resort in the appeals
        process.  These Standards Process Functions are defined in
        [RFC2028], [RFC2031], and [RFC3677] and are out of scope for this
        analysis.  No changes are proposed to these Standards Process
        Functions."

Carl's document explicitly states that ISOC's role in the standards 
process (in item 2 above) is "out of scope", but leaves open the 
possibility of changes to ISOC's administrative functions (item 1), 
which include insurance coverage.

A note for future versions:  This breakdown omits ISOC's fund raising 
efforts.  It also omits the fact that ISOC currently funds the RFC 
editor.

Margaret

---

From: "Lynn St.Amour" <[email-masked]>
Date: Tue, 14 Sep 2004 01:08:04 +0200

At 4:49 PM -0500 9/8/04, Pete Resnick wrote:
>as far as I know, for *the IETF* to incorporate as a separate 
>entity. There have been proposals to incorporate a body to deal with 
>IETF administrative functions (like contracting for meetings, 
>contracting for ISP and web service, etc.), referred to in Carl's 
>document as "IETF Foundation". Incorporating that sort of entity 
>wouldn't change the insurance coverage for members of the IETF, 
>would it?
>
>pr
>--

Thanks Pete,

I did mean the IETF Admin entity, despite the 'shorthand' terminology above.

I had ISOC's Director of Finance - Lynn DuVal expand upon the earlier 
response.  Her response is below.

Yes,  incorporating the administrative functions of the IETF will 
require that they obtain their own insurance policy.   Once, a 
separate entity is formed, it requires its own federal identification 
number and hence its own insurance policy.  (Doesn't matter if it is 
incorporated as a non-profit, for profit or as a foundation.)     If 
the admin. entity does only admin, then they would need coverage 
which protects the officers against errors & omissions in the admin. 
area only.   ISOC could continue to cover any Standards activities. 
We would just need to be very specific about the split of 
responsibilities between the organizations to ensure that the 
policies were properly aligned.

Regards,

Lynn