Subject: Re: All IETF posted email addresses MUST be real.

From: Fred Baker <[email-masked]>
Date: Fri, 22 Jan 2010 09:29:56 -0800

I'm not sure why you are copying me on this; in the IETF I am a  
working group chair, a liaison to the Smart Grid effort, and one of  
the Trustees of the IETF Trust. If you are addressing me in any of  
those contexts, I would expect you to use [email-masked]  
or copy my co-chair (and have the message be relevant to the IPv6  
Operations Working Group), copy [email-masked] (and have the  
message be relevant to the Smart Grid), or be sent to the chair of the  
Trustees and/or copy [email-masked].

I debated replying to this for that reason, and because your email  
contains no specific call to action. Let me engage giving my view of  
this, and request your proposed call to action. I removed the IPR  
working group as this is not obviously on-topic for that list, and  
removed Russ as I believe he is on the IETF list.

The ramifications of this for the IETF are either minimal or massive;  
I suspect the former. If you are referring to the addresses that  
people use on blue sheets, it is the people who sign them that are  
responsible for the efficacy of their addresses. Email addresses are  
known to be temporary; if I go to work for another company, Cisco will  
invalidate [email-masked] and several other addresses. Several of my  
older addresses ([email-masked] and [email-masked] for example)  
have been invalid for many years - I no longer work there and the  
company (and its domain name) no longer exist. If you are saying that  
the IETF is responsible to rev RFCs to maintain those addresses (eg,  
RFC 1381 should be revved to change [email-masked] to [email-masked]  
or the IETF should maintain a way to contact authors/editors that  
transcends such issues), that has far-reaching consequences; at best I  
can suggest that the RFC Editor remove author/editor contact  
information (snail mail address, email address, and telephone number)  
from future RFCs as it is all ephemeral. If known-ephemeral  
information can be left that way, then this has minimal impact.

My understanding of the court decision, however, doesn't affect people  
that are working in the IETF context. Email addresses used in IETF  
mailing lists are verified in the course of signing up, and for lists  
@ietf.org, bouncing addresses are removed from the lists. In addition,  
moderation rules on IETF lists force manual processing of mail that  
has not been through that verification process - only registered  
recipients are permitted to post. Hence, addresses found on IETF lists  
should by that process be known to be working addresses. I seriously  
doubt that a mailing list operating in the IETF context (a "recipient"  
address) is covered under the CAN-SPAM act, which regards the address  
of the originator of an email.

What specifically are you calling for the IETF to do in response to  
this decision, and what classes of addresses does your proposal cover?

On Jan 21, 2010, at 7:26 PM, tglassey wrote:

> So Fred and Russ - we talked about this once before - Now there is a  
> court ruling on using fraudulent email addresses in any public  
> process. So this also means that all IETF posted email addresses  
> MUST be real and functional so responses can be sent to those  
> parties directly according to the 9th Circuit's interpretation...
>
> Bummer that eh? Think what this means to the IETF and its policies.
>
>
> Todd
> --------------------------------------------------------
>
> Jan/12/10| WHOIS Privacy Considered “Material Falsification” A  
> recent decision by the Court of Appeals for the 9th Circuit By Ryan  
> Sadler, Legal Team
>
> A recent decision by the Court of Appeals for the 9th Circuit has  
> determined that using WHOIS privacy on domains may be considered  
> “material falsification” under federal law. The defendants in US v.  
> Kilbride (9th Cir., 2009) were convicted under the CAN-SPAM Act in a  
> case that involved criminal charges of intentional email spamming.  
> Enacted by the US Congress in 2003, the CAN-SPAM Act prohibits false  
> or misleading transmission information, deceptive headers, and  
> requires email solicitations to give an easy opt-out method and be  
> labeled as an advertisement, including the senders physical post  
> address. Commercial emails that use false or misleading headers, or  
> violate other CAN-SPAM provisions, such as falsified registration  
> information, are subject to fines of up to $11,000 for each  
> unsolicited email sent.
>
> The CAN-SPAM act states that “registration information is materially  
> falsified if it is altered or concealed in a manner that would  
> impair the ability of a recipient of the message…to identify,  
> locate, or respond to a person who initiated the electronic mail  
> message…” The defendants argued that since the terms “impair”,  
> “materially falsify” and “conceal” are not defined in the statute  
> they should be considered unconstitutionally vague. The court  
> responded to the defendants’ assertion by clarifying that “when  
> Congress does not define a term in a statute, we construe that term  
> according to its ordinary, contemporary, common meaning.” The court  
> then made it clear in their ruling that the defendants’ use of  
> private WHOIS information in this case materially falsified the  
> registration information. The court declared that “It should have  
> been clear to the defendants that intentionally falsifying the  
> identity of the contact person and phone number [through WHOIS  
> privacy] for the actual registrant information constitutes  
> intentionally decreasing the ability of a recipient to locate and  
> contact the actual registrant, regardless of whether a recipient may  
> still be left some avenue to do so. We therefore conclude defendants  
> had notice that their conduct violated the CAN-SPAM act.”
>
> Although the ruling does not make use of WHOIS privacy illegal, it  
> does serve as a clear message from the court that coupling the use  
> of privacy services with intentional spamming will likely result in  
> a violation of the CAN-SPAM act. This is an important decision that  
> members of the domain community should refer to prior to utilizing a  
> privacy shield.
>
> -----------------------------------------------------------

http://www.ipinc.net/IPv4.GIF

---

From: Jorge Amodio <[email-masked]>
Date: Fri, 22 Jan 2010 12:10:21 -0600

>> "Now there is a court ruling on using fraudulent email addresses in any public process"

I've seen this in other lists and even on some discussions at ICANN.

I'm amazed how some people are twisting around the decision of the
court of appeals to come up with this type of generic and blank
statements, including the one saying that now keeping your WHOIS data
private is illegal.

It's despicable

---

From: Fred Baker <[email-masked]>
Date: Fri, 22 Jan 2010 10:52:20 -0800

OK, based on this, I think we can bring this discussion to an  
immediate close.

If I send an email
       From: [email-masked]
       To: [email-masked]
       Reply-To: [email-masked]

(a) [email-masked] is demonstrably a workable address; the mailing  
software verified that when I subscribed and will remove it if it  
starts getting bounces.
(b) If I supply a reply-to address, that means that your MUA will  
populate the "to" line with that information. You can override your  
MUA and enter [email-masked].
(c) therefore, IETF has verified my "from address" (the ruling), and  
the reply-to is in your control.

We're in compliance with the law and its interpretation.

On Jan 22, 2010, at 10:17 AM, tglassey wrote:

> On 1/22/2010 9:51 AM, [email-masked] wrote:
>>
>> Todd,
>>
>> Question - would this interpretation still count if the emails  
>> specified they were from the ietf and gave the recipient the  
>> ability to unsubscribe? I can think of tons of instances where a  
>> nonresponding address would need to be used.
>>
> Great question and no - the problem is that the sender has to be  
> physically identifiable. from my reading of the law and this ruling  
> it means we MUST have a functional return address for everything and  
> many people in the IETF use addresses like "[email-masked]"  
> as their RETURN TO addresses and the FROM address is equally toast.  
> That makes the IETF responsible for formally certifying and ensuring  
> the positive service of any notice. Also there has to be a legally  
> created point of contact available so IP Notices can be sent to the  
> parties. The IETF fails this miserably and bluntly its probably the  
> ISOC managements fault they they have operated under these failings  
> for so long IMHO. Now its time to do something about this and fix  
> these processes so that all parties are properly defined and all  
> points of contact properly enumerated so that things like Cease and  
> Desist or Patent Infringement Notices can be sent. The IETF's direct  
> intent to hide that contact information makes it and its management  
> liable as well in my opinion, something that is a real issue and  
> that will cause litigation at some point if the IETF doesnt get its  
> act together.
>> I'm not a lawyer, but when I read this it seemed to say that the  
>> court felt it was a violation when you (a) concealed your identity  
>> using a private registration and (b) used a shadow email address  
>> with no option for self-removal. I might be wrong on that, just  
>> trying to understand how that ruling relates to ietf practices.
>>
> It means ANY cooperative contractually controlled group process   
> (like the donation of IP to the IETF through NoteWell or other  
> submission models) needs full disclosure on the IP Owners and their  
> commitment to the use of that IP in the IETF. It also means that the  
> refusal to actually disclose the true sponsor is also a 'hiding of  
> contact information' as well. All parties to any contractual process  
> MUST be properly identified in  order for the contract's provisions  
> to be enforceable IMHO...
>
> Todd
>> Endre
>>
>> Sent via BlackBerry from T-Mobile
>>
>> -----Original Message-----
>> From: tglassey <[email-masked]>
>> Date: Thu, 21 Jan 2010 19:26:01
>> To: Russ Housley - IETF<[email-masked]>; [email-masked]<[email-masked] 
>> >; Fred Baker<[email-masked]>; IETF Discussion<[email-masked]>; [email-masked] 
>> <[email-masked]>
>> Subject: All IETF posted email addresses MUST be real.
>>
>> _______________________________________________
>> Ipr-wg mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/ipr-wg
>>
>>
>>
>>
>> No virus found in this incoming message.
>> Checked by AVG - www.avg.com
>> Version: 8.5.432 / Virus Database: 271.1.1/2638 - Release Date:  
>> 01/22/10 07:34:00
>>
>>
>

---

From: John Levine <[email-masked]>
Date: 22 Jan 2010 19:01:09 -0000

>that are working in the IETF context.

No kidding.  It referred to the registration information for domain
names used in an illegal porn spamming scheme.  No sane person would
claim that it has any relevance at all to IETF mailing lists.

R's,
John

---

From: tglassey <[email-masked]>
Date: Fri, 22 Jan 2010 10:17:05 -0800

On 1/22/2010 9:51 AM, [email-masked] wrote:
> Todd,
>
> Question - would this interpretation still count if the emails specified they were from the ietf and gave the recipient the ability to unsubscribe? I can think of tons of instances where a nonresponding address would need to be used.
>    
Great question and no - the problem is that the sender has to be 
physically identifiable. from my reading of the law and this ruling it 
means we MUST have a functional return address for everything and many 
people in the IETF use addresses like "[email-masked]" as their 
RETURN TO addresses and the FROM address is equally toast. That makes 
the IETF responsible for formally certifying and ensuring the positive 
service of any notice. Also there has to be a legally created point of 
contact available so IP Notices can be sent to the parties. The IETF 
fails this miserably and bluntly its probably the ISOC managements fault 
they they have operated under these failings for so long IMHO. Now its 
time to do something about this and fix these processes so that all 
parties are properly defined and all points of contact properly 
enumerated so that things like Cease and Desist or Patent Infringement 
Notices can be sent. The IETF's direct intent to hide that contact 
information makes it and its management liable as well in my opinion, 
something that is a real issue and that will cause litigation at some 
point if the IETF doesnt get its act together.
> I'm not a lawyer, but when I read this it seemed to say that the court felt it was a violation when you (a) concealed your identity using a private registration and (b) used a shadow email address with no option for self-removal. I might be wrong on that, just trying to understand how that ruling relates to ietf practices.
>    
It means ANY cooperative contractually controlled group process  (like 
the donation of IP to the IETF through NoteWell or other submission 
models) needs full disclosure on the IP Owners and their commitment to 
the use of that IP in the IETF. It also means that the refusal to 
actually disclose the true sponsor is also a 'hiding of contact 
information' as well. All parties to any contractual process MUST be 
properly identified in  order for the contract's provisions to be 
enforceable IMHO...

Todd
> From: tglassey<[email-masked]>
> To: Russ Housley - IETF<[email-masked]>; [email-masked]<[email-masked]>; Fred Baker<[email-masked]>; IETF Discussion<[email-masked]>; [email-masked]<[email-masked]>
> Version: 8.5.432 / Virus Database: 271.1.1/2638 - Release Date: 01/22/10 07:34:00
>
>

---

From: tglassey <[email-masked]>
Date: Fri, 22 Jan 2010 11:12:49 -0800

On 1/22/2010 10:52 AM, Fred Baker wrote:
>       From: [email-masked] <mailto:[email-masked]>
>       To: [email-masked] <mailto:[email-masked]>
>       Reply-To: [email-masked] <mailto:[email-masked]>

How about we get Chandler involved in this discussion...

Todd
>
> (a) [email-masked] <mailto:[email-masked]> is demonstrably a workable 
> address; the mailing software verified that when I subscribed and will 
> remove it if it starts getting bounces.
> MUA and enter [email-masked] <mailto:[email-masked]>.
>> many people in the IETF use addresses like "[email-masked]" as 
>> their RETURN TO addresses and the FROM address is equally toast. That 
>> makes the IETF responsible for formally certifying and ensuring the 
>> positive service of any notice. Also there has to be a legally 
>> liable as well in my opinion, something that is a real issue and that 
>> will cause litigation at some point if the IETF doesnt get its act 
>> together.
>>> To: Russ Housley - IETF<[email-masked]>;[email-masked]<[email-masked]>; Fred Baker<[email-masked]>; IETF Discussion<[email-masked]>;[email-masked]<[email-masked]>
>>> Checked by AVG -www.avg.com