Subject: IAOC Responsibilities

From: Robert Kahn <[email-masked]>
Date: Thu, 03 Feb 2005 07:45:37 -0500

I continue to remain concerned that the BCP is not flexible enough to allow 
the IAOC to assume administrative responsibilities for acting as a trustee 
for IETF-owned IP. There needs to be a specific task added to the IAOC 
responsibilities for this purpose. Specifically, the following words should 
be added to the list of IAOC responsibilities: "Serve as Trustee for IETF 
assets including, without limitation, intellectual property and domain names."

Patrice's comment below is particularly important where licensing and other 
management tasks related to "donated patents" are concerned. Simply 
designating IASA to be responsible has too many operational problems to be 
workable in practice. In light of the interrelationship between the 
administration of IETF assets and the potential impact on IETF Standards 
activities, the IAOC should retain the primary responsibility for managing 
IETF assets in the first instance, even if the IAOC were to delegate the 
day to day administrative tasks such as sublicensing to others (e.g. to the 
IAD).

Bob
------------------

From: "Patrice Lyons" <[email-masked]>
To: "Robert Kahn" <[email-masked]>
Subject: IP matters

Bob,

There is a recent discussion on the IETF list that raises certain 
questions.  In particular, take a look at the statement:  "The IASA is 
responsible for managing all intellectual property rights (IPR) . . . that 
belong to the IETF."  Since the IETF is not incorporated, it is at best 
unclear whether the IETF is capable of owning copyrights, patents, 
trademarks or any other rights or interests. There are simple procedures 
that may be required to enable this such as filing appropriate documents 
with the Virginia state authorities.

Also, since the IASA does not appear to be a legal person, but rather an 
activity or process having two components:  IAD and IAOC, where would the 
responsibility for managing the so-called IPR reside in the first instance 
and who would decide?  For example, if the IAD is an employee of ISOC, a 
license agreement between the IETF and ISOC would be required to authorize 
the IAD to use the IETF marks and to sublicense the marks to IETF service 
providers.  Who has signature authority for this purpose?  From a CNRI 
perspective, it would appear prudent to task the IAOC with the 
responsibility for entering into such a license agreement with ISOC, and to 
oversee quality of service standards with respect to the activities of the 
IAD using the IETF marks.

Regards,

Patrice Lyons

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 03 Feb 2005 14:54:50 +0100

Bob,

neither your comment nor Patrice's comment reassure my stated concern that 
designating the IAOC as an entity that would be taking legal responsibility 
separate from ISOC would expose its members to personal liability.

I believe that letting the BCP task the IASA with this responsibility 
allows it to decide - if it concludes that this is the best course for the 
IETF - to establish a trust that may have the IAOC members as trustees, or 
may have some different group as trustees, after due consideration of the 
liability issues, and without exposing its members to any liability that is 
not covered under the D&O insurance that ISOC has contracted for, which 
covers all members of the IESG, IAB, Nomcom and WG chairs operating within 
the IETF process.

It seems precipitate to me to insist that this specific organizational form 
be mandated in this document, rather than let the IAOC decide on its own 
whether or not to create such an entity after due deliberation.

Could you explain why you think that the idea of a "trust" needs to be 
specified in the BCP, rather than assuming that the IASA will choose to 
establish one if it becomes clear that this is the best construct for the 
IETF?

I do agree that the term "belonging to the IETF" is not the best language 
to use, given the IETF's decision not to formalize its legal status at this 
time.

                         Harald

--On 3. februar 2005 07:45 -0500 Robert Kahn <[email-masked]> 
wrote:

> I continue to remain concerned that the BCP is not flexible enough to
> allow the IAOC to assume administrative responsibilities for acting as a
> trustee for IETF-owned IP. There needs to be a specific task added to the
> IAOC responsibilities for this purpose. Specifically, the following words
> should be added to the list of IAOC responsibilities: "Serve as Trustee
> for IETF assets including, without limitation, intellectual property and
> domain names."
>
> Patrice's comment below is particularly important where licensing and
> other management tasks related to "donated patents" are concerned. Simply
> designating IASA to be responsible has too many operational problems to
> be workable in practice. In light of the interrelationship between the
> activities, the IAOC should retain the primary responsibility for
> managing IETF assets in the first instance, even if the IAOC were to
> delegate the day to day administrative tasks such as sublicensing to
> others (e.g. to the IAD).
>
> Bob
> ------------------
>
> responsible for managing all intellectual property rights (IPR) . . .
> that belong to the IETF."  Since the IETF is not incorporated, it is at
> best unclear whether the IETF is capable of owning copyrights, patents,
> responsibility for managing the so-called IPR reside in the first
> instance and who would decide?  For example, if the IAD is an employee of
> ISOC, a license agreement between the IETF and ISOC would be required to
> authorize the IAD to use the IETF marks and to sublicense the marks to
> IETF service providers.  Who has signature authority for this purpose?
> From a CNRI perspective, it would appear prudent to task the IAOC with
> the responsibility for entering into such a license agreement with ISOC,
> and to oversee quality of service standards with respect to the
> activities of the IAD using the IETF marks.
>
> Regards,
>
> Patrice Lyons
>
>
>

---

From: Leslie Daigle <[email-masked]>
Date: Thu, 03 Feb 2005 10:59:25 -0500

To emphasize something that Harald said -- my read of the discussion
on this list is that the matter requires more discussion.  It also
requires more attention to detail than should go into the BCP.

For example, from the discussion on the list, it's pretty clear
that at least some people question the scope of the IPR that the
IASA might manage -- *all* IETF IPR? IPR related only to
administrative activities, what are the guidelines for managing
it, etc.

I think what this illustrates is that there is the need to start
a separate effort to propose the codification of that management
  -- perhaps the IASA's first "operational" bcp, even if we start
the discussion now.  That would entail and allow a proper review
of all proposals.

Leslie.

Harald Tveit Alvestrand wrote:
> Bob,
> 
> neither your comment nor Patrice's comment reassure my stated concern 
> that designating the IAOC as an entity that would be taking legal 
> responsibility separate from ISOC would expose its members to personal 
> liability.
> 
> allows it to decide - if it concludes that this is the best course for 
> the IETF - to establish a trust that may have the IAOC members as 
> trustees, or may have some different group as trustees, after due 
> consideration of the liability issues, and without exposing its members 
> to any liability that is not covered under the D&O insurance that ISOC 
> has contracted for, which covers all members of the IESG, IAB, Nomcom 
> and WG chairs operating within the IETF process.
> 
> It seems precipitate to me to insist that this specific organizational 
> form be mandated in this document, rather than let the IAOC decide on 
> its own whether or not to create such an entity after due deliberation.
> 
> establish one if it becomes clear that this is the best construct for 
> the IETF?
> 
> I do agree that the term "belonging to the IETF" is not the best 
> language to use, given the IETF's decision not to formalize its legal 
> status at this time.
> 
>                         Harald
> 
> 
>

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Thu, 03 Feb 2005 15:29:42 +0100

This also calls for a serious review of the related liabilities. If these 
rights are challenged who is going to pay to sustain the action and the 
possible damages? Since IASA is not incorporated will the IAOC Members, the 
ISOC be liable? The ISOC internal relations with their national Chapters 
makes that if ISOC is the legal entity, ISOC local Chapters may be 
challenged locally - in toto or in parte, depending on the local law, 
context and magnitude of the case.

There is no ISOC/personal IAOC insurance budget discussed. No insurance 
company wants to cover the snow ball Internet risks: yet the IETF 
responsibility may be deemed huge should a catastrophic situation arise due 
to its standards (or lack of, as in spam). I do not want to harp on this, 
but this total lack about risks evaluation - already just in the USA - and 
about international liability/rights of the concerned parties seems odd to 
me. I know this is a case study, but would Robert Kahn not be happy with 
the BCP and sues ISOC, he will be able to use the lack of the words he 
proposes to show he made everything to protect the IETF rights even against 
his own rights. Who will pay for the lawyers and for the damages he might 
obtain?

jfc

PS. I read Harald's question to Robert Khan about leaving IASA to decide. 
This seems OK, but very weak if not backed by some wording in the BCP 
because IASA has no legal reality. The few words I propose limit the 
responsibilities of the ISOC Chapters and remove US legal constraints, 
words of Robert with a possible "ISOC shall study and agree ..." about an 
IPR and financial responsibilities, are mandatory.

At 13:45 03/02/2005, Robert Kahn wrote:
>day to day administrative tasks such as sublicensing to others (e.g. to 
>the IAD).
>
>Bob
>------------------
>
>responsibility for entering into such a license agreement with ISOC, and 
>to oversee quality of service standards with respect to the activities of 
>the IAD using the IETF marks.
>
>Regards,
>
>Patrice Lyons
>
>
>

---

From: Sam Hartman <[email-masked]>
Date: Thu, 03 Feb 2005 18:05:58 -0500

Bob, I appreciate your interest in working with the IETF to establish
the IASA.  I also appreciate your interest in improving the BCP.

I have been disappointed that you have been sending revised comments
on the IPR issue over the last two weeks.  However you have not been
engaging in a discussion with the community.  You revise your text,
but you do not respond to our questions or engage in active
discussion.

I still do not understand what you are trying to accomplish or what
concerns you have.

Let me try and explain what I believe the BCP says.  Rather than just
telling me what you think the BCP ought to say, why not engage us all
in a dialogue about the current problems and about why you think what
we are doing is the wrong approach.

It's my understanding that the IASA is within ISOC.  As a consequence
of that when we say to the rest of the world that IASA manages the
IETF's IPR interests, we actually say that ISOC manages those
interests.

There's an obvious question: why do we not say that ISOC manages our
IPR interests?

Well in addition to telling the rest of the world how our IPR works,
we're telling ISOC how we want them to manage the IPR internally.  We
tell them we want it to be an IASA function.  That means that other
parts of ISOC would need to work with IASA if they wanted to use that
IPR.  Clearly this is purely an internal ISOC matter at a legal level.

So in other words the BCP is intended to be useful both to the world
at large and to establish some internal ISOC guidance with the
cooperation of the ISOC BOT.

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Thu, 03 Feb 2005 22:40:41 -0500

Hi, Bob.  It was pointed out to me privately that my message could be
misinterpreted and that it might come across as if I'm not interested
in listening to and evaluating proposals for change.  That's certainly
not my intent so let me take a step back and explain what I was trying
to do.

I described what I thought it meant for the IASA to manage the IETF's
IPR and how that interacted with ISOC.  I wasn't trying to say that I
was unwilling to consider changing that.  I was simply trying to point
out what I think the BCP says today and what I think that means.

If you want to propose changing that, I'm happy to listen to your
proposal and seriously consider it.  But I need to understand what you
are proposing, how you believe it differs from what we are doing in
the BCP currently and why that is a good change.

For example I don't currently know if you are proposing change because
you believe the text in the BCP has a different effect than I think it
does or because you believe that the effect I describe is undesirable.

Sorry about any confusion my earlier message caused.

--Sam

---

From: Robert Kahn <[email-masked]>
Date: Sun, 06 Feb 2005 23:57:48 -0500

Harald,

Im my view, issues of liability (whether organizational or personal) are 
not really appropriate for widespread discussion on a public list. There 
are several ways in which liability can arise and not all would derive from 
actions of the IAOC. Quite apart from any trustee role, the IAOC should 
have insurance for its own activities in any event. This should not be an 
issue here. Having said that, I understood the basic objective of 
restructuring to be to put the IETF in charge of all aspects of its future 
evolution rather than to shift responsibility from one place to another. In 
no event is it possible to shield one from all liability. When insurance 
policies are held by one organization for another party, it may be quite 
helpful, but it is not a substitute for taking steps to protect oneself. 
You should get independent legal counsel on the sufficiency of third party 
coverage for IETF activities whether or not

I did not understand that the IASA was to be a part of ISOC, but rather the 
name of an IETF activity that has two components, one of which, the IAD, is 
to be an employee of ISOC, and the other, an oversight body operating under 
the auspices of the IETF, but otherwise independent. If we are to move 
towards self-sufficiency for the IETF, that argues for the IAOC taking 
charge of its own needs. There really isn't a good structural alternative 
to the current arrangement that doesn't have that attribute, which is why I 
suggested what I did.

If a trusted oversight body like the IAOC (operating independently of the 
body providing the administrative services it is intended to oversee) does 
not exist with the power to act as a trustee, something like it would have 
to be created. Else, CNRI could continue to provide the trustee role, as it 
has in the past, but given our stated intention to work with you to move 
toward a new administrative structure, we would prefer to find an alternate 
way to proceed with the transition and have proposed one very basic way to 
facilitiate this process.

If you think there is a concern about liability for the IAOC, then you 
should have similar concerns about the IETF leaderhship, since they would 
also need coverage for their activities. If you

bob

At 08:54 AM 2/3/2005, Harald Tveit Alvestrand wrote:
>designating the IAOC as an entity that would be taking legal 
>liability issues, and without exposing its members to any liability that 
>is not covered under the D&O insurance that ISOC has contracted for, which 
>form be mandated in this document, rather than let the IAOC decide on its 
>own whether or not to create such an entity after due deliberation.
>
>establish one if it becomes clear that this is the best construct for the IETF?
>
>to use, given the IETF's decision not to formalize its legal status at 
>this time.
>
>                         Harald
>
>
>
>--On 3. februar 2005 07:45 -0500 Robert Kahn <[email-masked]> wrote:
>

---

From: Robert Kahn <[email-masked]>
Date: Sun, 06 Feb 2005 23:59:43 -0500

Leslie,

The addition of such a specific responsibility for the IAOC shouldn't 
constitute a mandate that they assume the role, but would simply enable 
them to assume that role if appropriate.

Details of the formal responsibilities could be determined at a later time, 
and an in depth discussion of this subject would definitely be appropriate. 
However, the BCP sets an outline of these responsibilities and its 
appropriate to include it there. I see no downside to delineating such a 
responsibility for the IAOC in the BCP at this time, even if they were 
never tasked by the IETF to assume such a role. However, it may turn out to 
be a very important step in facilitating the transition planning at this stage.

bob

At 10:59 AM 2/3/2005, Leslie Daigle wrote:

>>has contracted for, which covers all members of the IESG, IAB, Nomcom and 
>>WG chairs operating within the IETF process.

---

From: Fred Baker <[email-masked]>
Date: Sun, 06 Feb 2005 21:30:30 -0800

At 11:57 PM 02/06/05 -0500, Robert Kahn wrote:
>also need coverage for their activities.

Thanks for pointing that out, Bob. They have indeed had such coverage for 
some time, through ISOC. The IAOC will, I am very sure, have the same.