Subject: Re: I-D Action: draft-moonesamy-recall-rev-00.txt

From: S Moonesamy <[email-masked]>
Date: Fri, 29 Mar 2019 00:28:55 -0700

Hi Spencer,
At 12:40 AM 27-03-2019, Spencer Dawkins at IETF wrote:
>Just top-posting - I wonder if doing this process change as an 
>https://tools.ietf.org/html/rfc3933 process experiment (one-year 
>duration) would make people feel better about trying this.
>
>RFC 3933 was intended to let the community try things without having 
>to prove that nothing bad is going to happen after we make a process change.

Thanks for the suggestion. There were some comments in past 
discussions about changes in which that RFC was mentioned.  There was 
one such experiment.  It took five years to reclassify that experiment.

According to the promotional material [1], using the Internet is a 
good way to participate in an IETF meeting.  What is the IETF 
communicating to the persons who use that as a means of participation 
in its "standards process"?  It is 2019; if one of those persons is 
of the opinion that there is a justification for requesting a recall 
of an Area Director, the person is unable to sign such a 
request.  Would it make Area Directors feel better if the first step 
of the recall process is only open to the persons who are personally 
known to them?

Regards,
S. Moonesamy

1. https://www.ietf.org/how/meetings/104/remote/

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Mar 2019 11:39:51 -0400

On 3/29/19 3:28 AM, S Moonesamy wrote:

> in its "standards process"?  It is 2019; if one of those persons is of 
> the opinion that there is a justification for requesting a recall of 
> an Area Director, the person is unable to sign such a request.

Your concern is valid and should be addressed somehow.  But I can't help 
but have the impression that this is the least of the issues facing 
someone who wishes or needs to participate remotely.

I see the recall process as a stopgap measure in case the less drastic 
and disruptive measures for ensuring fairness have failed.  If recalls 
have to be considered more than once every several years, something else 
is likely to be wrong.

So I guess I'm curious - what problems are we having that cause people 
to think we need to make recalls easier, and could those problems be 
addressed in less disruptive ways?

Keith

---

From: John C Klensin <[email-masked]>
Date: Fri, 29 Mar 2019 15:20:04 -0400

--On Friday, March 29, 2019 11:39 -0400 Keith Moore
<[email-masked]> wrote:

>> According to the promotional material [1], using the Internet
>> is a  good way to participate in an IETF meeting.  What is
>> the IETF  communicating to the persons who use that as a
>> means of participation  in its "standards process"?  It is
>> 2019; if one of those persons is of  the opinion that there
>> is a justification for requesting a recall of  an Area
>> Director, the person is unable to sign such a request.
> 
> Your concern is valid and should be addressed somehow.  But I
> can't help but have the impression that this is the least of
> the issues facing someone who wishes or needs to participate
> remotely.
> 
> I see the recall process as a stopgap measure in case the less
> drastic and disruptive measures for ensuring fairness have
> failed.  If recalls have to be considered more than once
> every several years, something else is likely to be wrong.
> 
> So I guess I'm curious - what problems are we having that
> cause people to think we need to make recalls easier, and
> could those problems be addressed in less disruptive ways?

Keith,

Let me respond to your question with the understanding that my
answer may be very different from Subramanian's (or maybe not).
First, and most important, if one wants participation in the
IETF and for the results of IETF work to be seen as credible,
the processes have to be perceived of as fair and anything that
is offered as evidence of enabling people to effectively has to
have the appearance of being workable.  From that standpoint, if
we need a recall process at all, it must be available to all
participants in the IETF.  If the definition of "participant"
for initiating recalls is different from the definition for,
e.g., making a comment on a mailing list or submitting an I-D,
we'd better have a good explanation for the difference.  If we
don't, the odds of someone concluding that the IETF is biased
toward people with high levels of travel and related support and
with sufficient time on their hands to be away from the
workplace for three or more weeks a year to attend meetings are
very high.  That perception of unfairness may discourage
participation as well as the perceived value of IETF consensus.
That is the case whether we actually use the recall procedure
every year, every several years, or, in practice, not at all. 

Comparing recall initiation to, e.g., serving on a nomcom or
recall committee, if is possible to see unfairness in those
elements of our leadership selection process as well.    For
example, in an ideal world, we would almost certainly want to
have people who participate only remotely included in the
volunteer pool for the nomcom.   We don't do that.  However, we
can explain, in terms of the way the nomcom works in practice,
why f2f participation is important.  Do I, as a mostly-remote
participant like it?  Nope.  The the argument is plausible
enough that I don't feel it is an unfair procedure that both
unreasonable and easily corrected.

Beyond that, there are several potential sorts of problems for
which we have no "less drastic and disruptive measures for
ensuring fairness".   Let me give two examples.

We've seen the first in the form of a situation in which someone
stops performing in their roles and either will not resign or
will not or cannot respond to requests that they resign.  Recall
is then the only mechanism we have for getting them out of the
position and getting someone who have the time and resources to
do the job into it.  Maybe we should have some other procedure,
e.g., one in which certain types of repeated non-response create
an implicit resignation but, at the moment (and when we nearly
had to use it) recall is the only mechanism we have.

For the second, borrowing a bit from an off-list discussion, and
with the understanding that this example is completely
hypothetical, suppose someone in an AD position started
expressing very strong opinions about choices of technical
outcomes, perhaps even as the relevant AD (for which that person
was responsible) was just starting its work and being repeated
when alternate approaches were advocated by others.  Also
suppose that type of presentation appeared to be turning into a
regular patter of behavior by that individual.  Now, perhaps
people who found themselves on the other side could wait until
the work in question made it to the IESG and into IETF LC, see
if the decisions made there included that AD's taking a
position, and then appeal a decision that aligned with the view
expressed earlier and keep repeating that for every other
decision in which there had been a strong AD intervention early
one.   However, especially if there is a pattern and other than
trying to have a conversation with the individual and/or
encouraging the IETF Chair or other members of the IESG to do
so, I suggest that a recall would be the right answer, if only
because waiting for the WG's results to reach the IESG and IETF
Last Call is the wrong way --and much too late-- to handle the
problem without damage to the IETF's technical work and
consensus processes.

In either of those examples, "something else" is clearly wrong.
In the former, one might suspect illness or personal issues well
beyond the ability of the IETF to intervene in a positive way
other than letting the recall process run its course.  In the
latter, a situation like that would probably indicate a failure
on the Nomcom's part in making the appointment in the first
place, but, assuming informal conversations failed, the recall
process would likely be our only effective mechanism for getting
the relevant person's attention or, if that was not successful,
in getting the behavior stopped.

best,
    john

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 30 Mar 2019 08:37:47 +1300

On 30-Mar-19 04:39, Keith Moore wrote:
...
> addressed in less disruptive ways?

I'm not sure that everybody appreciates the proven power of the normal
appeal mechanism, which really does get all four levels' attention:
first the WG Chairs, then the AD, and then the IESG (and, sometimes,
the IAB). In my experience appeals are taken seriously and are
reasonably effective. But this isn't apparent to newer participants.
Also, appeals that are handled satisfactorily at WG Chair and AD
level are not logged on the web site and may not even be public.

However, it's noticeable that we have had quite a lot of appeals
(about 40 IESG appeals since 2002 when the log started, and about
20 IAB appeals since 1995), but (iirc) only one recall petition
in the 22 years since RFC2027. That does seems a little unbalanced.
So I think that lowering the bar for recalls, especially in favour
of non-travelling participants, is reasonable.

   Brian

---

From: S Moonesamy <[email-masked]>
Date: Fri, 29 Mar 2019 15:31:10 -0700

Hi Keith,
At 08:39 AM 29-03-2019, Keith Moore wrote:
>Your concern is valid and should be addressed somehow.  But I can't 
>help but have the impression that this is the least of the issues 
>facing someone who wishes or needs to participate remotely.

Thanks for the feedback.  The issue is about fairness.

>failed.  If recalls have to be considered more than once every 
>several years, something else is likely to be wrong.

I did not suggest that recalls have to be considered every year or 
every several years.

>So I guess I'm curious - what problems are we having that cause 
>people to think we need to make recalls easier, and could those 
>problems be addressed in less disruptive ways?

The I-D is not about an immediate problem.

Is an appeal disruptive?  Is the first step of a recall 
disruptive?  I would not describe them as such.  Those procedures are 
usually part of a process so that the process is fair and viewed as fair.

The current recall process does not describe the problems for which a 
recall is applicable.  The I-D doesn't do that either.  I don't view 
the matter as being about those problems for which a recall may be 
the better approach.  It is about whether a remote participant, who 
satisfies the requirements, is allowed to be a signatory if the case 
arises.   It has been pointed out in the discussion that a remote 
participant could rely on a participant who fulfills the existing 
requirements if there is a need for a recall petition to be 
signed.  Some people might find that approach acceptable.  I beg to 
differ; that doesn't mean that those people are wrong.

Regards,
S. Moonesamy

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Mar 2019 22:10:44 -0400

Just to clarify, by asking "So I guess I'm curious - what problems are 
we having that cause people to think we need to make recalls easier, and 
could those problems be addressed in less disruptive ways?" what I was 
really wondering was whether the interest in fixing the recall process 
was indicative of actual problems with certain individuals (presumably 
toward remote participants) that aren't being addressed.

In other words, are people interested in trying to use the recall 
process to fix problems that are better addressed in other ways?

I do agree that it should be fair to remote participants.

On 3/29/19 6:31 PM, S Moonesamy wrote:

> Is an appeal disruptive?  Is the first step of a recall disruptive?  I 
> would not describe them as such.  Those procedures are usually part of 
> a process so that the process is fair and viewed as fair.

I have no direct experience with recalls, but I do have experience with 
appeals.   They are, in my experience, tremendously time consuming.   
They take away time and energy, that could otherwise be applied to doing 
technical work, from people who are already over-burdened.   Everyone 
understands that they're necessary, and that it's necessary to take them 
seriously, so that the process is fair and viewed as fair.   That's part 
of why those handling the appeal spend so much time and energy - people 
handling them are aware that the trust of the community is at stake, so 
they want to do a good job.   Even though an appeal can significantly 
impede progress of unrelated IETF work.

But having seen how much work of many busy and talented people are 
required to handle an appeal, it's also easy to see how the appeals 
process could effectively be used as a denial-of-service attack on 
various parts of IETF.   I expect the same could be said of the recall 
process.

Of course, an appeal can be a threat in other ways.  If a working group 
has spent years polishing a document, only to see an appeal threaten to 
make that work irrelevant, that's a different kind of disruption.   A 
recall can be a threat also, both to the reputation and career of the 
person who is facing it, and also to the community if the recall 
threatens to displace a good leader. (Sometimes there are differences of 
opinion about that.)

So there is a need to strike a balance.    It's reasonable to require 
substantial community support for a recall, to demonstrate that several 
people think there's a problem with someone before significant time and 
energy are invested in reviewing the recall request.  And it's 
reasonable to require that the people lending support to such a recall 
are actually real people, who have participated in IETF, who have 
experience with the individual in question, again to thwart 
denial-of-service attacks.

If all someone has to do to initiate a recall, is get some number of 
people sign up for a meeting at ietf.org (paying no money), it's fairly 
easy to find enough people out of the billions of people on the Internet 
who are willing to do that.    So the threat of denial-of-service attack 
is quite credible.   So I believe the bar should be higher than that, 
while not inherently favoring people who can get to IETF in person.  I'm 
just quite sure what the bar should be.

Keith

---

From: S Moonesamy <[email-masked]>
Date: Sat, 30 Mar 2019 14:15:23 -0700

Hi Keith,
At 07:10 PM 29-03-2019, Keith Moore wrote:
>Just to clarify, by asking "So I guess I'm curious - what problems 
>are we having that cause people to think we need to make recalls 
>easier, and could those problems be addressed in less disruptive 
>ways?" what I was really wondering was whether the interest in 
>fixing the recall process was indicative of actual problems with 
>certain individuals (presumably toward remote participants) that 
>aren't being addressed.
>

Thanks for the clarification.  It is not possible to determine 
whether remote participants encountered actual problems with some 
individuals or whether the problems, if any, are better addressed in 
other ways.

>I have no direct experience with recalls, but I do have experience 
>with appeals.   They are, in my experience, tremendously time 
>consuming.   They take away time and energy, that could otherwise be 
>applied to doing technical work, from people who are already 
>over-burdened.   Everyone understands that they're necessary, and 
>that it's necessary to take them seriously, so that the process is 
>fair and viewed as fair.   That's part of why those handling the 
>appeal spend so much time and energy - people handling them are 
>aware that the trust of the community is at stake, so they want to 
>do a good job.   Even though an appeal can significantly impede 
>progress of unrelated IETF work.

Do appeals have a negative connotation?  Some participants might view 
it as such.  Should the success rate of appeals be used to determine 
that?  The probability of success depends on several 
factors.  Anyway, the technical work is carried out within the IETF 
and there are rules, as part of standardization, which comes with it.

Regards,
S. Moonesamy

---

From: Keith Moore <[email-masked]>
Date: Sat, 30 Mar 2019 17:35:24 -0400

> that?  The probability of success depends on several factors.  Anyway, 
> the technical work is carried out within the IETF and there are rules, 
> as part of standardization, which comes with it.

Right, but the rules for appeals, and recalls, need to be designed with 
due regard for both the need for fairness and the potential for those 
rules to be used for denial-of-service attacks.

Keith

---

From: "John Levine" <[email-masked]>
Date: 31 Mar 2019 14:59:29 -0400

>> could those problems be addressed in less disruptive ways?

Just as a point of reference, how many recalls have we had?

I can only think of one, in which we had to use the recall process to
replace someone who had just disappeared and we have no other way to
fill a seat of someone who is absent but not dead.

---

From: John C Klensin <[email-masked]>
Date: Sun, 31 Mar 2019 16:14:21 -0400

--On Sunday, March 31, 2019 14:59 -0400 John Levine
<[email-masked]> wrote:

> I can only think of one, in which we had to use the recall
> process to replace someone who had just disappeared and we
> have no other way to fill a seat of someone who is absent but
> not dead.

That is actually one more than the number we have actually had
because that one got as far as collecting signatures but not as
far as getting a recall committee appointed, much less removing
someone.  What happened that that efforts to contact the
individual had proceeded in parallel with the
signature-collecting effort.  The informal contacts worked, and
the person resigned, before the recall process ran to conclusion
or even a call for volunteers for the recall committee.

I don't believe that it is useful to go down the path of
counting recalls but, if one looks at the statistics alone, one
could reasonably conclude that:

* The number of recall efforts that got as far as selection of a
recall committee between 1996 (RFC 2027) and 2004 (RFC 3777) was
zero and hence the change from "anyone can initiate" to nomcom
eligibility and 20 signatures was not justified by any actual
experience of denial of service attacks, only speculation (and,
IIR, a near-miss or two) that they might occur.

* The number of recall efforts that got to that same point
between the time the rules were tightened in 2004 and the
present was also zero.  From that, if we can conclude anything
at all, it would be that, with the possible exception of people
who disappear without resigning, either the procedure is too
hard or we have never had a leader who have misbehaved
sufficiently to justify removal from office.   

If one believes that latter, and that one can extrapolate from
22 years of no recalls into the future, then we either don't
need the mechanism at all or we should got back to "anyone can".
On the other hand, should one believe that people might end up
on leadership bodies in the future (especially given that we
keep generating more of them) who might then behave in ways that
would justify recall actions _or_ if one believes that the
appearance of fairness toward all who participate actively in
the IETF is important, then changes of the sort proposed in
draft-moonesamy-recall-rev are worth making and the number of
past recalls is really not particularly relevant.

   best,
    john

---

From: Keith Moore <[email-masked]>
Date: Sun, 31 Mar 2019 16:44:23 -0400

> sufficiently to justify removal from office.
It's also possible that the mere existence of a recall procedure has 
served as an effective incentive to "behave"

(Note that one might still expose oneself to a recall attack, with the 
associated risk of hassles and threat to one's reputation, even while 
arguably doing the right thing.   So "behave" might not be the right 
term here, but it will do for now).
> past recalls is really not particularly relevant.

If I'm looking at how to defend a computer system or network, I don't 
care whether an attack has been exploited in the past, what I care about 
is how easy it is to make such an attack effective and how much damage 
it could do.  Zero-day exploits are still exploits and in some sense are 
more of a risk than well-known exploits  I don't immediately see why 
IETF should consider potential attacks on its operation any differently.

That said, some countermeasures are better than others.   I prefer 
"fair" countermeasures against network-based attacks on systems - e.g. 
countermeasures that do not discriminate against legitimate traffic, or 
do not presume a priori that certain kinds of traffic are illegitimate 
without reason.   (Many spam filtering mechanisms are notorious for 
blocking legitimate traffic, which is why I tend to consider such 
mechanisms as much of an attack on the email system as anything else.)

I also prefer "fair" countermeasures against attacks on IETF - which I 
would define to mean countermeasures that don't discriminate in favor or 
against one kind of contributor over another, /while still allowing IETF 
to function effectively/.

Note that even though IETF derives much of its apparent legitimacy from 
the perception of fairness, an absolute notion of fairness must not be 
considered more important than effectiveness of the organization.   IETF 
could be made "fair" by any of several silly means:

 1. becoming so dysfunctional that it could never produce anything, thus
    giving every contributor an equal chance of producing nothing;
 2. approving every draft (perhaps after a lengthy waiting period)
    without benefit of adequate review;
 3. approving or disapproving drafts at random;
 4. allowing anyone at all to veto any proposal

all of which would defeat the very reason for IETF's existence. (These 
might seem like strawmen, but sometimes I think we're getting 
dangerously close to b.)

Keith  (with some help from Harrison Bergeron)

p.s. I very much appreciate the massive efforts that have been made, by 
very many parties, to make remote participation as effective as it is 
now.   (The NOC teams get a special mention as do the Meetecho folks and 
also meeting sponsors, and I'm sure I'm leaving a lot of people out.)

---

From: John C Klensin <[email-masked]>
Date: Sun, 31 Mar 2019 19:14:32 -0400

--On Sunday, March 31, 2019 16:44 -0400 Keith Moore
<[email-masked]> wrote:

>> counting recalls but, if one looks at the statistics alone,
>> one could reasonably conclude that:
>...

> It's also possible that the mere existence of a recall
> procedure has served as an effective incentive to "behave"

Yes.  No way to know, of course.  On the other hand, I'm aware
of several cases in which threats to trigger the procedure were
made if behavioral changes did not occur.  To be effective, both
the incentive you cite and such threats need to be credible.
One view of the argument behind draft-moonesamy-recall-rev (in
additional to the appearance of fairness) is that the needed
credibility is decreasing and that some small amount of tuning
would help restore it.

> (Note that one might still expose oneself to a recall attack,
> with the associated risk of hassles and threat to one's
> reputation, even while arguably doing the right thing.   So
> "behave" might not be the right term here, but it will do for
> now).

Ack.

>> need the mechanism at all or we should got back to "anyone
>> can". On the other hand, should one believe that people might
>> end up on leadership bodies in the future (especially given
>> that we keep generating more of them) who might then behave
>> in ways that would justify recall actions _or_ if one
>> believes that the appearance of fairness toward all who
>> participate actively in the IETF is important, then changes
>> of the sort proposed in draft-moonesamy-recall-rev are worth
>> making and the number of past recalls is really not
>> particularly relevant.
> 
> If I'm looking at how to defend a computer system or network,
> I don't care whether an attack has been exploited in the past,
> what I care about is how easy it is to make such an attack
> effective and how much damage it could do.  Zero-day exploits
> are still exploits and in some sense are more of a risk than
> well-known exploits  I don't immediately see why IETF should
> consider potential attacks on its operation any differently.

No disagreement there.  But there are two possible kinds of
attacks on the IETF and its operation to be considered here.
One involves someone behaving in an outrageously bad way that
may, itself, be a threat to the IETF if allowed to continue.
The other is the one I think you are concerned about, e.g., the
recall procedure itself being used as an attack.  The
combination suggests that we need a recall procedure (or some
complete replacement for it) that is credible and usable if ever
actually needed while striking the best balance possible with
the possibility of its being used as an attack vector.  
 
>...
> I also prefer "fair" countermeasures against attacks on IETF -
> which I would define to mean countermeasures that don't
> discriminate in favor or against one kind of contributor over
> another, /while still allowing IETF to function effectively/.

And, again, the main argument for draft-moonesamy-recall-rev is
that the recall procedure is no longer fair and credible (if it
ever was or has been after the RFC 3777 changes) and that some
adjustments (IMO, fairly minor ones) are needed to restore both
fairness and credibility.

> Note that even though IETF derives much of its apparent
> legitimacy from the perception of fairness, an absolute notion
> of fairness must not be considered more important than
> effectiveness of the organization.   IETF could be made
> "fair" by any of several silly means:
> 
> all of which would defeat the very reason for IETF's
> existence. (These might seem like strawmen, but sometimes I
> think we're getting dangerously close to b.)

No disagreement from me.

> p.s. I very much appreciate the massive efforts that have been
> made, by very many parties, to make remote participation as
> effective as it is now.   (The NOC teams get a special
> mention as do the Meetecho folks and also meeting sponsors,
> and I'm sure I'm leaving a lot of people out.)

Me too.   But, in a way, we need to accept that the success of
those efforts, moving remote participation from something a
regular f2f participant might use occasionally to get by to an
effective way to actively participate while coming physically to
few or no meetings, require other adjustments.  A lot of that
work has fallen on the tools team, especially Henrik, because
of, e.g., the need to adjust the way agendas are handled, and on
various educational efforts.  The IETF does not, IMO, appreciate
those efforts often enough and clearly enough.   The need to
look at IETF procedures that were originally developed in and
just after the POISED effort of the first half of the 1990s and
occasionally tuned since and address the question of whether
they are appropriate to 2019 reality is also on that list.  From
that standpoint, this effort to tune the recall procedure is
just one such measure.

 best,
    john

---

From: Keith Moore <[email-masked]>
Date: Sun, 31 Mar 2019 19:17:25 -0400

> that standpoint, this effort to tune the recall procedure is

very much agree.

Keith