Subject: RE: Options for IETF administrative restructuring

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 01 Sep 2004 10:20:48 +0200

Christian,

apologies for the slow response - my mailbox has been out of commission 
since Monday (crashed disk and informal recovery procedures).

--On 30. august 2004 12:26 +0100 Christian de Larrinaga 
<[email-masked]> wrote:

> Firstly congratulations to all those involved in compiling this work.
>
> I have three questions before being able to comment in more detail.
>
> 1/ Has a decision been made not to sub contract out (under formal
> agreements) the tasks currently being managed fairly informally by
> Foretec/CNRI to professional adminstration organisations?

No decisions have been made - this document lays out options for the IETF 
community, and the IESG and IAB has not made its recommendation yet.
However, I believe that everything we have seen so far indicates that the 
tasks currently being managed by Foretec/CNRI should be managed under 
formal arrangements, and that we should choose the provider of such 
services that is best for the IETF.
Staying with Foretec has the advantage that transition costs can be 
minimized; we don't have information on other possible providers yet.

That's a long way of answering "no" to your question.....

> 2/ What funding requirement is expected from ISOC and ISOC members to
> manage the IETF functions outlined?

We do not know yet. The minimum extra cost to be covered is the cost of the 
administrative director (section 3.1). There is a transition cost, and a 
cost (which may be higher or lower than the existing cost) of the new mode 
of operation. ISOC has put aside a significant chunk of money in its 2004 
budget (see the report annex B.2) to cover the cost of transition.

> 3/ Do we have an analysis of the policy implications in bringing
> responsibility for the administration of Internet Standards negotiation
> into the same body that is responsible for their oversight (via
> appointment of IAB and Trustee appeal role)?

That's what the discussion in section 4.2.3 (Scenario B) is intended to 
cover. See also the comment in section 4.5 (Scenario D).
So there has been thought applied to this topic. I don't know whether you 
consider that an "analysis" or not - this is one topic where I would like 
to get feedback from the community.

                     Harald

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 02 Sep 2004 12:01:35 +0200

> Christian,
...
> So there has been thought applied to this topic. I don't know whether 
> you consider that an "analysis" or not - this is one topic where I would 
> like to get feedback from the community.
> 
>                     Harald

I think Christian is actually raising a point that *isn't* covered explicitly
in 4.2.3 and that applies equally to scenarios A and B. By making IETF
administration a specific function of ISOC, would we introduce any
*new* potential conflict of interest for ISOC trustees in their roles
as the confirming body for the IAB slate (RFC 3777) and as the final step
in the appeals process (section 6.5.3 of RFC 2026)?

I don't see why. ISOC trustees have a fiduciary duty to ISOC, but given
how narrowly their two IETF roles are drawn, I can't see where there is any
significant new potential for conflict because of the administration
being on the ISOC budget.

Christian also implies the converse question: would scenarios C & D
reduce a hypothetical existing conflict of interest for the ISOC
trusteees? Again, I don't see why. Firstly, I don't think there is
an existing conflict of interest. Secondly, changing the IETF from
an unincorporated association to an incorporated entity really
cannot affect the ISOC trustees' fiduciary duty to ISOC, so any
hypothetical conflict would not be changed.

So I think this issue is neutral with respect to the choice
between (A or B) versus (C or D).

The usual "I am not a lawyer" disclaimers apply.

    Brian

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 02 Sep 2004 12:16:19 +0200

> hypothetical conflict would not be changed.

one note, since this has been a repeated source of much confusion and 
miscommunication....

scenarios C and D envision incorporating the *support function* for the 
IETF. The IETF would remain an undefined entity under these scenarios.

I've had another suggestion that the IETF (the real technical process 
entity) should become a formally recognizable entity of some sort (possibly 
an unincorporated organization). But that's distinct from the idea of 
incorporating the support function, and is NOT described in the current 
document.

If people want that possibility described, please speak up - Carl has the 
pen ready....

                             Harald

---

From: "Christian de Larrinaga" <[email-masked]>
Date: Thu, 2 Sep 2004 11:52:59 +0100

> Harald Tveit Alvestrand  Sent: 02 September 2004 11:16

Yes that would be helpful.

Christian

Christian de Larrinaga
tel:+44-844-484-9197
m:+44-7989-386778

------------------------------------------------------------------
Deploying Internet services?
You need to participate in the UK IPv6 Deployment Conference
Manchester September 24th 2004
www.uk.ipv6tf.org
alongside RIPE  49, 21st to 24th Sept 2004
------------------------------------------------------------------

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 02 Sep 2004 13:11:55 +0200

>>incorporating the support function, and is NOT described in the current

Correct, and I wrote carelessly.

> Yes that would be helpful.

Well, I don't agree. I think it would defocus the discussion (which
is about putting the IETF's administration onto a business-like
basis). IMHO the only case in which we should discuss the wider
option is if the newtrk WG proposes changes in the standards process
that would make such a thing necessary.

    Brian

---

From: Susan Harris <[email-masked]>
Date: Thu, 2 Sep 2004 09:34:12 -0400 (EDT)

> that would make such a thing necessary.

What he said.

---

From: Carl Malamud <[email-masked]>
Date: Thu, 2 Sep 2004 07:17:17 -0700 (PDT)

Hi Susan -

Just so we're clear, that was my going-in assumption and I've kept
that throughout the analysis.  Any of the structures I've outlined
can be focused strictly on administrative support (just like
any of the structures could be corrupted to reach beyond that
focus).  That's why I suggested that we do this in two steps:

1. agree on the general direction to take
2. task people to write the specific chartering documents and
   publish them as a bcp, including a last call 

Since the devil is in the details, this lets us focus in
on making sure the details are correct and the community has
seen those details and agreed to them before they become policy.
First step, though, is some feeling from the community on which
path to pursue.

Make sense?  (BTW, I'm more than happy to answer questions
about these various mechanisms, processes, functions, and
other buzzwords in the report ... I tried to keep things
clear, but the legal world isn't always perfectly clear. :)

Regards,

Carl

---

From: Susan Harris <[email-masked]>
Date: Thu, 2 Sep 2004 10:31:47 -0400 (EDT)

> that throughout the analysis.  Any of the structures I've outlined

Understood.

> Make sense?  (BTW, I'm more than happy to answer questions

Absolutely.  I thought your report was excellent - very clear and concise.
(Long though - how'd you manage it it such a short time :)

---

From: Leslie Daigle <[email-masked]>
Date: Thu, 02 Sep 2004 13:33:40 -0400

Let me underscore this.  We've spent months being explicit that we
were focusing on the administrative aspect of our activities, and
*not* the whole IETF (in any of its many possible values).

We *can* (and will!) expand the scope if needed, but for practical
purposes, that can't be undertaken lightly, and I'm going to say it'll
require an explicit decision to do so.

Leslie.

-- 

-------------------------------------------------------------------
"Reality:
      Yours to discover."
                                 -- ThinkingCat
Leslie Daigle
[email-masked]
-------------------------------------------------------------------

---

From: Dean Anderson <[email-masked]>
Date: Thu, 2 Sep 2004 13:41:52 -0400 (EDT)

On Thu, 2 Sep 2004, Harald Tveit Alvestrand wrote:

> an unincorporated organization). 

The IETF is already describted as an activity of the ISOC, which is
incorprated.

I think the IETF also has paid employees. Aren't these people paid by the
ISOC?  If not, please correct this information.

> But that's distinct from the idea of incorporating the support function,
> and is NOT described in the current document.

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 02 Sep 2004 19:44:01 +0200

--On torsdag, september 02, 2004 13:41:52 -0400 Dean Anderson 
<[email-masked]> wrote:

>> entity) should become a formally recognizable entity of some sort
>> (possibly  an unincorporated organization).
>

The IETF does not have paid employees.
ISOC has paid employees, but they do not work for the IETF.
Foretec has paid employees doing the secretariat job. ISI has paid 
employees doing the RFC Editor job. ICANN has paid employees doing the IANA 
job.

The IETF has none.

---

From: [email-masked] (scott bradner)
Date: Thu, 2 Sep 2004 13:56:53 -0400 (EDT)

> I think the IETF also has paid employees

the IETF currently has no employees (paid or otherwise)

Scott

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 3 Sep 2004 13:08:49 +0100

Harald wrote...
> Foretec has paid employees doing the secretariat job.

One of the transparency problems can be seen at

https://www1.ietf.org/secretariat.html

      The Secretariat is hosted by the Corporation for National Research Initiatives. 
      It can be reached at: 
      IETF Secretariat 
      c/o Corporation for National Research Initiatives 
      1895 Preston White Drive, Suite 100 
      Reston, VA 20191-5434 
      USA 
      +1 703 620 8990 (voice) 
      +1 703 620 9071 (fax) 

Closer examination shows that Foretec are resident at the same (postal) address.

and on the Foretec Web site http://www.foretec.com

      Currently, Foretec's association management and event services contribute
      to the ongoing operation and success of the Internet Engineering Task Force
      - hosted by the Corporation for National Research Initiatives. Foretec has 
      also provided targeted specialty services to the the Corporation for National
      Research Initiatives

If I cared, I would find this impossibly opaque.

Cheers,
Adrian

---

From: [email-masked]
Date: Fri, 3 Sep 2004 11:54:57 -0400

> that would make such a thing necessary.

I guess I don't understand this comment.

As I see it, one reason for another option would have to do with the 
independence of the IETF to change its processes, should it want to.  
Not necessarily because it has a plan today to do so.

One of the concerns I have over the ISOC dependent mechanisms, which I 
guess is all of the presented options, is the link between budgeting 
and process.  If a process change requires a different form of 
budgeting support, would the IETF need the approval of ISOC to make 
that change?  Often what seems like a purely technical decision has 
policy and budgetary implications.  Assuming that we don't want to have 
reconsider the organizational relationship again in the near future, I 
believe we need to take such possibilities into account.

I think another consideration in making these administrative decisions 
has to do with the IETF's voice in the general standards and Internet 
governance arena.  Will ISOC, as a 'parent' organization - my 
interpretation of the options that are offered, be the responsible 
party for such activities?  E.g. currently for a liaison to the ITU, it 
is ISOC that is the liaison association.  Should ISOC disagree with the 
IETF position on a liaison matter who has the final say?  Likewise with 
the ongoing governance debate in the international arena, will ISOC or 
the IETF be the negotiating body?  And before we decide that this is 
just policy and does not relate to protocol issues, we should not 
ignore the intimate link between policy and technical - while it is not 
always direct, there generally is a technical implication in policy 
decisions and, generally,  also a policy impact in technical decisions. 
Basically I am concerned about the real independence of the IETF as a 
technical standards body when ISOC, which the IETF does not control, 
has the governing policy and financial voice.

I would be interested in seeing an analysis of an option which has the 
IETF as a independent nonprofit corporate entity.  This could be either 
as a wholly owned subsidiary of ISOC, thus keeping the fiduciary 
relationship, or as completely independent organization.

a.

---

From: Dean Anderson <[email-masked]>
Date: Sat, 4 Sep 2004 04:16:11 -0400 (EDT)

> employees doing the RFC Editor job. ICANN has paid employees doing the IANA 

The 2003 budget includes this section:
http://www.ietf.org/u/ietfchair/financials-2003.html
==============================================================================
Funding from the Internet Society. This is accounted for in Internet 
Society financial reports. 
      This supports: 
            The RFC Editor - $516,460 
            The IETF Chair's discretionary funds - $47,276 
            The expenses related to the IAB - $37,270 
            Insurance - $13,685
[...]        
Secretariat Labor Expense                    $532 936

==============================================================================

So all labor is either outsourced or volunteer work?

What is the insurance for?

What do the IETF Chair's discretionary funds cover?

I notice that the IETF lists revenue of about $2 million.  Into whose bank
accounts is this money deposited, and what federal tax classification is
used for reporting this revenue?  I don't think its possible to be both
unincorporated and non-profit.

>From http://www.isoc.org/isoc/
==============================================================================
The Internet SOCiety (ISOC) is a professional membership society with more
than 150 organization and 16,000 individual members in over 180 countries.
It provides leadership in addressing issues that confront the future of
the Internet, and is the organization home for the groups responsible for
                         ^^^^^^^^^^^^^^^^^
Internet infrastructure standards, including the Internet Engineering Task
Force (IETF) and the Internet Architecture Board (IAB).
==============================================================================

>From RFC 2031:
==============================================================================

The legal umbrella

   To avoid the fact that the IETF has to construct its own legal
   structure to protect the standards and the standards process, ISOC
   should provide a legal umbrella. The legal umbrella will at least
   cover:
   - legal insurance for all IETF officers (IAB, IESG, Nomcom and WG
      chairs);
   - legal protection of the RFC series of documents; In such a way
     that these documents can be freely (i.e. no restrictions
     financially or otherwise) distributed, copied etc. but cannot
     be altered or misused. And that the right to change the document
     lies with the IETF.
   - legal protection in case of Intellectual property rights disputes
     over Internet Standards or parts thereof.

The standards process role

   ISOC will assist the standards process by
     - appointing the nomcom chair
     - approving IAB candidates
     - reviewing and approving the documents that describe the standards
       process (i.e. the formal Poised documents).
     - acting as the last resort in the appeals process

==============================================================================

So it would appear that the ISOC supervises what goes on.

I note that both RFC 2031 and Vint Cerf's History indicates that the 
POISED group recommended that the IETF should be split from the ISOC into 
a separate legal entity.  8 years later, this still hasn't been done.  

		--Dean

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sat, 04 Sep 2004 11:00:38 +0200

Thanks for asking questions that I can answer, Dean!

--On lørdag, september 04, 2004 04:16:11 -0400 Dean Anderson <[email-masked]> 
wrote:

>> > I think the IETF also has paid employees. Aren't these people paid by
>> > the ISOC?  If not, please correct this information.
>>
>> employees doing the RFC Editor job. ICANN has paid employees doing the
>> IANA  job.
>
>
> =========================================================================
> ===== Funding from the Internet Society. This is accounted for in
> Internet  Society financial reports.
>       This supports:

You snipped the line here that said "The numbers below are the financial 
numbers from Foretec for fiscal 2003.".
The numbers above that line are ISOC numbers; the numbers below that line 
are Foretec numbers. Two different accounts, where one is controlled by the 
ISOC Board and one is controlled by the CNRI Board - something I think we 
should fix.

> Secretariat Labor Expense                    $532 936

Liability insurance for the IESG, the IAB, working group chairs and 
document editors.

> What do the IETF Chair's discretionary funds cover?

Mainly travel expenses for the multicast team to IETF meetings, and travel 
expenses for people who the IETF wants to have at meetigns where they can't 
get other funding to get there. WG chairs who are between jobs have 
occasionally come into that category; John Levine at the ITU meeting on 
spam was another.

> unincorporated and non-profit.

The revenue goes into a bank account at CNRI. CNRI pays Foretec according 
to a contract between CNRI and Foretec for the secretariat work.
I have not seen that contract.

                        Harald

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sat, 04 Sep 2004 11:03:44 +0200

> So it would appear that the ISOC supervises what goes on.

ISOC does have a role in the process. "Supervise" is not a word I would use 
to describe it.

> a separate legal entity.  8 years later, this still hasn't been done.

I can't see where RFC 2031 says that (I can see the document saying that 
the two are different, but not where it says that IETF should be a legal 
entity). Can you quote, please?

---

From: Dean Anderson <[email-masked]>
Date: Sun, 5 Sep 2004 04:10:46 -0400 (EDT)

> entity). Can you quote, please?

I may have misread the draft, and on second read, I think I should mute my 
somewhat critical tone, a bit. I was focusing too much on this:

======================================================================

   One of the more obvious recommendations that came out of the Poised
   WG was to move all non technical issues that can be moved safely, to
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   another related organization. The Poised WG finds that the Internet
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Huizer                       Informational                      [Page 1]

RFC 2031                 IETF-ISOC Relationship             October 1996

   Society (ISOC) is the obvious choice for this task. A straw poll at
   the open plenary session of the IETF in december 1995 in Dallas
   clearly confirmed this notion.

======================================================================

And missing the part on the next page (above) that says the ISOC is the
"obvious choice for this task".

But overall, we still have essentially the same alternatives as 
before:

======================================================================

  There are three alternatives:

   - Do nothing and ignore the increasing responsibility and growth; the
     risk here is that the IETF either becomes insignificant, or will be
     suffocated by US law suits.

Huizer                       Informational                      [Page 3]

RFC 2031                 IETF-ISOC Relationship             October 1996

   - The IETF does everything itself; this keeps the IETf in control,
     but it would distract enormously from the technical work the IETF
     is trying to get done.

   - The IETF finds another organization than ISOC to take on the role
     described above. But why would another organization be better than
     ISOC?

======================================================================

I note that one alternative to being "suffocated by US law suits" is to be
scrupulously law abiding, and scrupulously honest, and scrupulously
ethical, and scrupulously cognizant of an organization's legal obligations
and responsibilities, including its responsibilities for the actions of
voluteers.  I found that the LPF could organize boycotts, protest rally's
and other potentially risky and legally controversial activities while
similarly using much volunteer labor, yet avoid 'suffocating legal
entanglement' by being scrupulously responsible and honest, and being very
careful to make sure that volunters understood what was required of them
and what could and couldn't be allowed.  I also found that reading books
on tort and business law is a good supplement to college coursework on
Business Law. Beyond that, having access to sympathetic Law Professors who
will patiently explain both sides of a question is also a great benefit.  
Of course, this same benefit can be obtained by hiring a competent
attorney and asking them tough questions and providing them with brutally
honest information about both sides of a question.

There is no way to avoid 'suffocating legal entanglement' yet act contrary
to one's legal responspibilities.  The task of an organizations executive
is to make sure that the organization performs its responsibilities,
legal, finanical, social, and otherwise.

I am always reminded of this excerpt from a news report about Alan Brown 
of ORBS.ORG:
======================================================================
The judge in the case disagreed entirely and said the Mr Brown had failed
to show his comments came from an honestly held belief that they were
true. Instead he said they were more of a personal attack. Mr Brown also
claimed the legal defence of fair comment, but the judge said that fair
comment was based on an informed argument but Mr Brown has made no attempt
to separate fact and opinion.

The judge was also unimpressed by the fact that when Mr Brown was offered
the chance to apologise, he reacted by making further defamatory
allegations. The judge also said that a key motivator behind Mr Brown was
the financial welfare of his ISP.

The judge said of comments made on the Internet: "I must say I know of no
forum in which an individual citizen has the freedom to say what he likes
and in any manner he wishes about another individual citizen with immunity
from suit for all consequences." And so he made sure there wasn't.
======================================================================

A telling and significant problem with the POISED WG and RFC 2031 is also
revealed by the acknowledgement section:

======================================================================
Acknowledgement and disclaimer

   The author is chair of the Poised 95 WG. The author has tried to
   summarise e-mail and face to face discussions in the WG. All the good
   ideas in this paper are the result of the WG, all the mistakes and
   errors are probably due to the author or his lack of command of the
                                                ^^^^^^^^^^^^^^^^^^^^^^
   American language as well as the American legal system.
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  The author is a member of the Internet Society.

Author's Address

   Erik Huizer
   SURFnet ExpertiseCentrum bv
   P.O. Box 19115
   3501 DC  Utrecht
   The Netherlands
   Tel: +31 302 305 305
   Fax: +31 302 305 329
   E-mail: [email-masked]

======================================================================

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 05 Sep 2004 11:12:39 +0200

Avri,

> Not necessarily because it has a plan today to do so.

I see no respect in which the creation of a new non-profit organization,
which for the sake of argument we can call ISOC2, would affect this.
ISOC was to a very large extent created for the benefit of the IETF (and
created by people quite heavily involved in the IETF at that time).
Apart from its direct support and legal umbrella function for the IETF,
it also offloaded from the IETF a lot of "outreach" functions (otherwise
known as Layers 8 and 9). We mustn't forget that if ISOC hadn't existed,
the IETF would have been much more distracted by Layers 8 and 9 over
the last ten years.

> guess is all of the presented options, is the link between budgeting and 
> process.  If a process change requires a different form of budgeting 
> support, would the IETF need the approval of ISOC to make that change?  

Not if we establish the appropriate MOU and (I would suggest to ISOC)
make appropriate amendments to the ISOC by-laws to guarantee the
decoupling needed.

> Often what seems like a purely technical decision has policy and 
> budgetary implications.  

Absolutely. That is the fundamental reason we need clarity in all
these relationships.

> Assuming that we don't want to have reconsider 
> the organizational relationship again in the near future, I believe we 
> need to take such possibilities into account.

Absolutetly. That's why in any case, we need the MOU and by-laws that
I mentioned -and we need them whichever scenario is adopted.

> interpretation of the options that are offered, be the responsible party 
> for such activities?  

It is today. That's why it has a VP for Public Policy. [Disclosure: that
person happens to be my day job manager.] Are you (not just Avri) an
active ISOC member? It's free...

> E.g. currently for a liaison to the ITU, it is 
> ISOC that is the liaison association.  Should ISOC disagree with the 
> IETF position on a liaison matter who has the final say?  

Good question, and a point not to be forgotten in the MOU, in every
scenario.

> Likewise with 
> the IETF be the negotiating body?  

Today, it's ISOC. ISOC has been working to position itself in that
debate for years; having ISOC's European office in Geneva was not a
random choice. Put bluntly, if we threw that away and started again
with ISOC2, it would take 5 to 10 years to build up the momentum again.
I just don't see why we would want to do that.

> And before we decide that this is 
> just policy and does not relate to protocol issues, we should not ignore 
> the intimate link between policy and technical - while it is not always 
> direct, there generally is a technical implication in policy decisions 
> and, generally,  also a policy impact in technical decisions. 

Indeed. A good example was the recent ITU/WSIS meeting on spam -
John Levine attended and spoke for the IRTF, funded as Harald mentioned
by his budget from ISOC; I attended (because I live locally) wearing
an ISOC hat for the occasion. ISOC's reputation got us in, but
the representation and impact was basically IRTF/IETF. It works today,
with ISOC1. I just don't see why it would work better with ISOC2.

> Basically 
> I am concerned about the real independence of the IETF as a technical 
> standards body when ISOC, which the IETF does not control, has the 
> governing policy and financial voice.

The IETF, as a bunch of people who choose to meet and send email,
will have that concern with *any* legal entity that acts for it.
It all depends on the rules of that entity, not on the desires
of the IETF population - the trick is to make those rules
right, and I deeply believe that can be done soonest and cheapest
by recycling ISOC.

> relationship, or as completely independent organization.

The subsidiary model was actually taken out of Carl's scenarios
before publication, but apart from that I thought this was exactly
what scenarios C and D are.

The objection I heard to the subsidiary model was that it really
couldn't give the IETF community any more guarantee of control
than scenarios A and B, but would create the overhead costs of
scenarios C and D anyway.

    Brian