Subject: IETF standards incorporated in laws ?

From: "John R. Levine" <[email-masked]>
Date: 22 Jul 2018 21:43:49 -0400

Laws often use standards published by private organizations.  For example, 
most state building codes in the US require that construction comply with 
the National Electrical Code published by the private National Fire 
Protection Association.  This has caused some interesting situations when 
you have to buy a copy of the standard to find out what the law is.  (Blog 
post coming soon.)

Our standards don't have that problem since we long ago decided to give 
them away for free.  Are there laws in the US or elsewhere that use IETF 
standards?

I took the direct approach of searching the Cornell LII's US law archive 
for "RFC".  There were about a dozen RFC references in the Code of Federal 
Regulations, and a lot court cases about the depression-era Reconstruction 
Finance Corp., but nothing in a statute.

R's,
John

---

From: Kurt Andersen <[email-masked]>
Date: Mon, 23 Jul 2018 05:37:14 -0700

What about DHS's BOD 18-01 which cites DMARC? I know that's probably a mere
statute but it's close.

--Kurt (apologies for the top post, but microscreen MUAs are limited)

---

From: Rob Evans <[email-masked]>
Date: Mon, 23 Jul 2018 14:30:26 +0100

> I took the direct approach of searching the Cornell LII's US law archive for
> "RFC".  There were about a dozen RFC references in the Code of Federal

I did a similar search on http://www.legislation.gov.uk/ and nothing
turned up, but searching for (e.g.) "domain name system" does return a
hit on the Network and Information Systems Regulations 2018, when it's
defining the size of operator that is covered by the legislation.

<http://www.legislation.gov.uk/uksi/2018/506/schedule/2/paragraph/10/made>

Rob

---

From: "Andrew G. Malis" <[email-masked]>
Date: Mon, 23 Jul 2018 10:29:12 -0400

The original FCC net neutrality regulation (15-24, Feb. 26 2015) references
three RFCs - 1122, 791, and 7020. If you’re interested, you can find the
text at https://assets.documentcloud.org/documents/1686026/fcc-15-24a1.pdf
. Other FCC regulations may cite them as well. I didn’t do a search, I just
went directly to this one as I figured there would be a high probability.
OFCOM regulations in the UK would be another likely place to look.

Cheers,
Andy

On Mon, Jul 23, 2018 at 9:30 AM, Rob Evans <[email-masked]>
wrote:

> for

---

From: John C Klensin <[email-masked]>
Date: Mon, 23 Jul 2018 11:47:42 -0400

--On Sunday, July 22, 2018 21:43 -0400 "John R. Levine"
<[email-masked]> wrote:

> Laws often use standards published by private organizations.
> For example, most state building codes in the US require that
> construction comply with the National Electrical Code
> published by the private National Fire Protection Association.
> This has caused some interesting situations when you have to
> buy a copy of the standard to find out what the law is.  (Blog
> post coming soon.)
> 
> Our standards don't have that problem since we long ago
> decided to give them away for free.  Are there laws in the US
> or elsewhere that use IETF standards?

John,

I think you are missing, or at least risking creating confusion
about, part of the issue...

(Apologies to those outside the USA -- while there are analogies
to what I'm about to say in many (but not all) other countries,
I'm going to use US practices in my explanation.)

ANSI itself is private sector, as are almost all of the
ABSI-accredited Standards Developers.  That list includes NFPA
(although it is one of the few "Audited Designators", a
distinction best left for another discussion).   For that
matter, ISO is private sector as well.

None of that has anything to do with whether standards are free
or not.  Some of those standards bodies have selling standards
as a primary element of their business models and some make some
or all of their documents available for free.  

ANSI does make a distinction between "health and safety"
standards and the rest which the former much more likely to end
up in regulations (think motorcycle and bicycle helmets, not
just electrical codes), but I don't know whether that is
relevant to the distinction you are trying to make or not.

Nor do I think "we long ago decided to give them away for free"
is quite right.   RFCs were "unlimited distribution" and without
charge since long before there was an IETF, much less when some
RFCs started being identified as standards.  I don't know if
there was ever an explicit decision but I assume that, when the
IETF decided to publish its documents (and standards) in the RFC
series there had been any discussion about charging, that would
have been the end of the "in the RFC series" idea.

best,
   john

---

From: Richard Shockey <[email-masked]>
Date: Mon, 23 Jul 2018 12:56:46 -0400

FCC CRTC (Canada) and OFCOM (UK) all incorporate IETF standards into regulation or recommendations.  The latest are the STIR standards. 

— 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

richard<at>shockey.us

Skype-Linkedin-Facebook –Twitter  rshockey101

PSTN +1 703-593-2683

From: ietf <[email-masked]> on behalf of "Andrew G. Malis" <[email-masked]>
Date: Monday, July 23, 2018 at 10:29 AM
To: Rob Evans <[email-masked]>
Cc: "John R. Levine" <[email-masked]>, IETF general list <[email-masked]>
Subject: Re: IETF standards incorporated in laws ?

The original FCC net neutrality regulation (15-24, Feb. 26 2015) references three RFCs - 1122, 791, and 7020. If you’re interested, you can find the text at https://assets.documentcloud.org/documents/1686026/fcc-15-24a1.pdf . Other FCC regulations may cite them as well. I didn’t do a search, I just went directly to this one as I figured there would be a high probability. OFCOM regulations in the UK would be another likely place to look.

Cheers,

Andy

Rob

---

From: "John Levine" <[email-masked]>
Date: 23 Jul 2018 13:36:50 -0400

>> buy a copy of the standard to find out what the law is.  (Blog

Here's the blog post, about the latest round in American Society for
Testing and Materials et al. vs. Carl Malamud's public.resource.org.

https://jl.ly/Copyright_Law/publicstandard.html

R's,
John

---

From: Edwin Cordeiro <[email-masked]>
Date: Mon, 23 Jul 2018 21:32:52 +0200

Brazilian laws mention "Internet Protocol addresses" and domain name
service, but they try to keep it as open as possible and don't direct
mention IETF or RFCs in the laws.

Edwin Cordeiro

---

From: Alexander Mayrhofer <[email-masked]>
Date: Wed, 25 Jul 2018 13:16:53 +0200

Hello,

Out of pure interest, i went to the search engine for Austrian Laws,
and simply entered "RFC" as the search string (The search engine is
available here: https://www.ris.bka.gv.at/Gesamtabfrage/ - only in
German, unfortunately). That triggered some interesting results
(besides false positives)

- "Glückspielautomatenverordnung" (Gambling machine regulation act) -
https://www.ris.bka.gv.at/Dokumente/Bundesnormen/NOR40194147/NOR40194147.html
- requiring RFC 1918 addressing for reporting.
- "Signaturverordnung" (signature regulation act) -
https://www.ris.bka.gv.at/Dokumente/Bundesnormen/NOR40003809/NOR40003809.html,
mentioning a few RFCs related to certificate revocation - though that
one was replaced by a newer act in 2004.

So, there are at least 2 documents which make use of RFC, and there
are probably more (i'm not an expert in understanding the law search
engine)

best,
Alex

On Mon, Jul 23, 2018 at 3:43 AM, John R. Levine <[email-masked]> wrote:
> Our standards don't have that problem since we long ago decided to give them
> away for free.  Are there laws in the US or elsewhere that use IETF
> standards?
>