Subject: Question? - why are IPR filing's necessary?

From: "TS Glassey" <[email-masked]>
Date: Sun, 29 Jun 2008 15:37:07 -0800

I wanted to ask a functional question, and that simply is "what is the 
purpose of the IPR filing requirement's" when the post filing processes 
don't stop the IETF or its WG's from doing anything?

TS Glassey 

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipr-wg

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Sun, 29 Jun 2008 22:16:58 -0400

On Sun, 29 Jun 2008 15:37:07 -0800
"TS Glassey" <[email-masked]> wrote:

> I wanted to ask a functional question, and that simply is "what is
> the purpose of the IPR filing requirement's" when the post filing
> processes don't stop the IETF or its WG's from doing anything?
> 
I apologize in advance for the length of this response, but I wanted to
give some examples.

See Sections 2, 4.C, and 8 of RFC 3979.  Roughly speaking, it's to
allow WG participants to (a) evaluate *on their own* the likely
validity of the patent; (b) to decide if the benefits of encumbered or
possibly encumbered technology exceed the disadvantages of the patent;
and (c) to enable the IETF Executive Director to seek a statement of
licensing terms.

To give one example I'm familiar with, one reason that RFC 2535 (DNSsec)
mandated DSA instead of RSA was that RSA was patented at the time.
(There were other reasons involving crypto export policy.)  Both have
changed, so RFC 4034 mandates RSA and lists DSA as optional.  You can't
make those sort of determinations without knowing what sorts of patents
may apply.

Let me put it in concrete terms as they may affect you.  You hold US
patent 6,370,629; you have claimed that some (all?) of the work of the
GEOPRIV working group, if implemented, infringes on these patents.
Ignoring the question of whether some of the documents you cite can
even conceptually infringe (how a threat analysis -- as opposed to
a mechanism for constructing threat analyses -- can possibly infringe a
patent is beyond me), let's go through the steps that the WG and its
participants would follow.  (Btw -- I've never analyzed whether or not
your patent does apply to any GEOPRIV protocols.  Even when I was an AD
-- and thank Ghu I'm not any more -- that wasn't my responsibility.
Analyzing patents can be difficult and time-consuming; these days, I
only do it if paid...)

First -- they should be aware of the claimed IPR.  If you feel that the
IPR claim system of the IETF doesn't adequately notify WGs of possible
patents, you're certainly welcome to suggest new mechanisms.  Others
may agree with you on that point.  You're also more than free to send a
reasonable number of messages about the IPR to the WG list -- the goal
of the IETF's IPR effort is precisely to make sure that people are
aware of IPR claims.

The next step is individual, though often discussed publicly:
participants decide if they feel the patent will affect *their
implementation* of the proposed protocol.  Let me give a somewhat (but
not completely) contrived example.  Consider the (expired) RSA patent,
and assume that Claim 1 was the only claim in it.  To summarize, claim
1 includes (A) a communications channel; (B) an encoder based on the RSA
equations, and (C) a decoder based on those equations.  To infringe, a
device must have all three elements (or their functional equivalents).

A participant in the WG may decide that the proposed WG technology
doesn't use the RSA equations, so the patent doesn't apply.  They may
feel that the patent is likely to be found invalid, because of prior
art or misbehavior by the inventors.  (I should add that I know of no
such issues with respect to the RSA patent.)  I saw prior art raised in
the IPsec working group against a patent that might have applied --
enough examples were posted that people decided the patent wouldn't
hold up.  More subtly, WG participants may decide that they don't care
about any of that, since they only want to manufacture encoders and not
decoders, and the patent requires that both exist. (The patent actually
has 40 claims; if I recall correctly, only one of the claims does not
require both an encoder and a decoder. If it weren't for that one
claim, it would have been easy for some uses to evade the patent
completely.)

Suppose, though, that a given participant feels that the patent is
likely to be held valid if challenged, that it does apply, and that
likely devices would infringe.  Then what?  That participant makes an
individual decision: are the advantages of the encumbered technology
sufficiently great that they outweigh the disadvantages?  These latter
include royalties, the difficulty of getting a license, the blocking
effect on open source software, etc.

The outcome of the WG is, in a strong sense, the sum of these
individual decisions.  The WG as a whole never makes any determination
of the validity or applicability of the patent.

Let me give a very concrete, real world example.  Again, it will be in
the security domain, because that's the one I know the best.  There's a
family of public key algorithms known as elliptic curve cryptography
(ECC).  For a given strength, ECC uses much less space; for a given key
size, ECC is much more efficient.  The NSA has endorsed ECC using
IETF protocols for protecting data up to the Top Secret level; see
http://www.nsa.gov/ia/Industry/crypto_suite_b.cfm for details.  But --
Certicom has many patents in this space; accordingly, the NSA
negotiated a very broad license and sublicense agreement with Certicom
(http://www.nsa.gov/ia/industry/crypto_elliptic_curve.cfm).  Suppose an
ECC algorithm is proposed for an IETF protocol.  What happens?

Some people will feel that Certicom's patents do not cover the proposed
protocol.  This is quite possible -- Certicom does not have any patents
on the basic concept of ECC.  These people will "vote" yes.

Others will feel that the patents do apply, and hence pose an
insurmountable obstacle to GPLed implementations of the protocol.
These people would vote "no", preferring the comparative inefficiency
of RSA.

Still others will feel that the patents apply, but not care, because
their use is building software for NSA, so they qualify for a free
sublicense.

Finally, some people will conclude that they will have to pay Certicom
royalties, but feel that despite that, they'll make more of a profit
from the more efficient algorithm than the royalties will cost.

And Certicom?  While I haven't spoken to them directly, I'm quite
certain that they want as many IETF protocols as possible to use their
technology.  Their disclosure says "It is Certicom?s desire to
facilitate the wide-scale adoption and proliferation of Elliptic Curve
Cryptography (ECC) technology in the marketplace to replace today?s
aging public key systems."  Why?  Because the more their technology is
used, the more money they make.  Trying to block an IETF WG from
standardizing something that uses ECC is very much not in their
interest.

So -- to give a brief answer to your original decision -- the purpose
of the IETF's IPR policies is to permit informed decisions by WG
participants.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb
_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipr-wg

---

From: "TS Glassey" <[email-masked]>
Date: Mon, 30 Jun 2008 08:31:28 -0800

Steven - My response's to your post's below are prefaced with TSG.

Todd Glassey

----- Original Message ----- 
From: "Steven M. Bellovin" <[email-masked]>
To: "TS Glassey" <[email-masked]>
Cc: <[email-masked]>; "Contreras, Jorge" <[email-masked]>
Sent: Sunday, June 29, 2008 6:16 PM
Subject: Re: Question? - why are IPR filing's necessary?

See Sections 2, 4.C, and 8 of RFC 3979.

TSG: Yes - you mean BCP79. Right - By the way, when exactly did that take 
effect? And did IPR Filing 201 predate that?

Roughly speaking, it's to

TSG: So then you are saying that the IETF is then set up to intentionally 
allow people to 'choose' which patents they will respect and which they 
wont??? - Cool - so you are saying then that the design of the IETF's 
standards and IPR process is intentionally set up to optionally allow anyone 
to violate the laws under which the IETF was created???  Hmmm.  Nice one 
there.

TSG: And the IESG approved it and rolled it out after being reviewed as 
"properly legal" by the IETF's counsel???  Nice move Jorge...

TSG: The problem is that you dont get to do those types of things to 
patented IP whent the IETF has been denied the rights under the IPR filing. 
What IHMO you have done here (by the design of this IPR Process) is "to have 
placed a loaded gun in your own mouth" since once informed of IP Protections 
issued properly, the failure to react becomes a direct and real liability 
for all participants involved.

TSG: We hold US, Japanese, Brazilian, South African, Canadian and EU filings 
against this IP. And in answer to your question, Yes - I claim that 
significant portions of the GeoPRIV WG's effort's 1) violate patent 
protections we have in place and which were formally disclosed to the IETF, 
and that 2) the patent covers parts of each of the works done to date and as 
such yes, they all violate the patent or its derivatives which we can no 
longer patent in Japan based on the Prior-Art now formally published through 
the IETF; and 3) that the IETF was fully informed of these filings both in 
the IPR process and in the mailing list archive itself,  meaning we now have 
damage claims against the IETF, the IPR WG, yourself, and the parties who 
filed these ID's and RFC's and their employer/sponsors. Was that what you 
intended because if the ITEF's consel didnt inform you that this was an 
obvous outcome of the IPR WG's actions?

participants would follow.

TSG: Yeah - The use of the Policy Object Controls (based on time and 
location) inside the Threat Control and Analysis (Markup Language) is one of 
the things that violates our patents. Further the failure of the IESG to 
stop this violation once it was formally notified of the issuance of 
Patent's, and when it totally approved and released this IPR Process as 
public process, made itself directly liable for any damages which its 
processes create here. The allowing of the startup-creation of the GeoPRIV 
WG for instance after the formal notice of IPR 201 means that the AD who 
allowed the creation of that WG is also liable for that damage claim. So are 
the WG Chairs and their Sponsor's which is why Cisco's General Counsel is on 
the CC Line here.

TSG: There is NOTHING that can be accomplished in a legal sense by "claiming 
something that based on a functional analysis is simply untrue" which is 
what has been done for my retorts to the IP Rights conveyance process inside 
the IETF. The way it works in the real world is that once disclosed to the 
IETF, the violation of those rights, even by the IETF or IESG itself create 
the liability that is prosecurtiable, at least once the IP area was 
disclosed to the IETF.

Once properly informed,  the IETF and IESG are also directly liable for the 
damages that are done to those parties who registered their rights with the 
IETF.

(Btw -- I've never analyzed whether or not
your patent does apply to any GEOPRIV protocols.  Even when I was an AD
-- and thank Ghu I'm not any more -- that wasn't my responsibility.
Analyzing patents can be difficult and time-consuming; these days, I
only do it if paid...)

First -- they should be aware of the claimed IPR.  If you feel that the
IPR claim system of the IETF doesn't adequately notify WGs of possible
patents, you're certainly welcome to suggest new mechanisms.

TSG: I have suggested numerous changes which have ALL been discounted as 
being part of my Patent Troll Mentality.

Others

TSG: You mean others in the form of IETF Participants or their Lawyers? it 
makes a difference because I am betting NO IETF SPONSOR has ever been told 
that the Partipant wanted to sidestep a patent which was already issued in 
an IETF Effort to violate those defined rights...

The next step is individual, though often discussed publicly:
participants decide if they feel the patent will affect *their
implementation* of the proposed protocol.

TSG: So then the Individual is also forced to practice law for their sponsor 
too. Nice move Steve...

Let me give a somewhat (but

TSG: But this isnt our Patent - the one I am claiming was infringed on. Lets 
stick with it. It controls the use and general systematic implementation of 
'matentmateically reliable communications controls based on location and 
time', and in doing that provides a secure method of controlling access to 
stored (disk/file/archive, offline, or internal objects in the form of 
policy controls)

TSG: And all of the other parties make a knowing and informed consent 
decision to intentionally violate that IP and in doing so they and the IETF 
'roll the dice there' - by the way I DO plan to litigate damages against the 
IETF and in doing so the IPR WG including your sponsor's here. I warned you 
all numerous times. So now its time to pay the piper.

TSG: Which means that their sponsor's clearly accept liabilty for their 
Agent's actions in the IETF when they violate patent protections in 
furtherance of the IETF's actions.

--------------------------------------------------------------------------------

No virus found in this incoming message.
Checked by AVG.
Version: 8.0.101 / Virus Database: 270.4.3/1525 - Release Date: 6/29/2008 
3:09 PM