Subject: The Death of the IETF - SOX compliance and its effect on the IETF

From: "todd glassey" <[email-masked]>
Date: Wed, 12 Jul 2006 17:57:16 -0700

Joel - some time ago you made a comment about something that I suggested
would "kill the IETF community"... and I wanted to acknowledge that comment
and tell you that the IETF community is dead already and will likely
be shoveled into a coffin before the close of this calendar year...
Want to know what will do it?

SOX-year 3... the year of SOX 406 Compliance. So let me ask - anyone
have any ideas on the effect of SOX on the IETF?

There are solutions - but they are not any of what is on the board from
the IPR core team today.

---

The effects of SOX Ethics Compliance are simple. The people sending 95% of
those participants to the IETF may suddenly and I mean within a period of a
few weeks of each other, tell their workforce that the IETF is a forbidden
organization because being involved with it is a liability to their SOX
reporting status, and they don't want to take the risk anymore. In fact they
may turn to their staff and say:

The IETF is a place where potentially:

(1) You as our staff may expose confidential IP and we cannot take that
chance and likewise you are not authorized to speak for the corporation in
any form per its "Corporate Representation Policy" as part of its SOX
compliance, and/or

(2) someone else may expose you to IP  that prevents our working in areas
and that would be very detrimental to  the Stockholders and likewise that
cannot be tolerated. Likewise,

(3) Further since the IETF refuses to adopt DMCA practices, and it also
refuses to put a basic standard of care in identifying participants and IP
submitters, the IETF's process methods for securing IP equally unreliable  &
since there is no oversight as in all the other standards entities on this
planet it makes it a legal risk to rely on anything the IETF does.

(4) And finally for EU and other impacted entities, the failure and refusal
of the IETF to meet the same Safe Harbor and Data Security hurdles  that
they do means reliance on them is something that may be a legal problem  for
EU constrained entities.

Poof - membership gone...

Further - if 'they' cannot send anyone to the meetings then by the same
token 'they' cannot rely on a IETF standard because there is no
oversight or otherwise. Likewise since the IETF is involved in IP
development which may impact the IP being developed internally to
them, then in order to protect their stockholders interests ...

Poof - reliance of American Business prevented by SOX regulatory
requirements.

I suppose the IETF could put oversight in place and make things transparent
as they have to be with SOX impacted entities, or it could get a third-party
SAS70 for its processes, except that NO auditor would put anything but a
series of Significant Defects and Material Weakness ratings of the IETF's
current processes. Further, once that happens it's over. No SOX impacted
company can risk being involved in the IETF because of what could
happen to them.

You say this will never happen... Take a deep breath, its happening right
now.

Todd Glassey, Auditor.

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg