Subject: Re: [TLS] [Ietf-honest] Last Call: draft-ietf-tls-extractor (Keying

From: Erick O <[email-masked]>
Date: Fri, 18 Sep 2009 07:42:38 -0700 (PDT)

________________________________
From: Dean Anderson <[email-masked]>
To: Martin Rex <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]
Sent: Thursday, July 23, 2009 3:40:32 PM
Subject: Re: [TLS] [Ietf-honest] Last Call: draft-ietf-tls-extractor (Keying

On Thu, 23 Jul 2009, Martin Rex wrote:

> Dean Anderson wrote:
> > 
> > On Thu, 23 Jul 2009, Matthew Campagna wrote:
> > > 
> > >  The official statement is the linked document, we update it from time to time. 
> > 
> > This is a problem. The official statement is the IPR disclosure, which
> > should contain the terms used by the IETF in its decision to approve the
> > document. Certicom should not be able to alter the terms after the fact,
> > which it seems to have just admitted doing.
> 
> The IETF is NOT asking for an irrevocable "Grant" in an IPR disclosure.

Of course not.  The IETF just wants to know what the terms are. We take
those terms into consideration in our decision to approve or reject the
document.

But if the terms of license are variable or indefinite, then there
really are no terms. The patented technology is not free and we don't
have any idea what it will cost--it will probably be expensive.  We
often reject such documents as being unfavorable.

> The problem here is that submitting an URL for the real IPR disclosure
> in the IETF disclosure form is subverting to idea that the IETF
> can archive the IPR disclosures in their original form.

I agree

> > I think that we have to consider rejecting documents where the terms are
> > not definite and/or can be altered at the whim of the patent holder.
> 
> Copyright terms stick to the published text or code when they're
> published (under the condition they're rightfully issued).

I don't know what copyrights have to do with anything, here. They have
nothing to do with what I said.  

My point above is that the disclosures required by RFC 3979 enable us to
make informed decisions regarding the patent-encumbered document, which
includes any licensing terms.  If a patent-holder offers unspecific or
variable terms that it can change them at whim, that fact by itself is a
good reason to reject the document.

> AFAIK, License grants for patents are rarely issued as "irrevocable",
> which means that the terms can be cancelled/terminated.

Well, actually, just the opposite is true. Rarely do patent licenses
have terms of revocation.  Most commercial patent holders just want the
money and don't care what you do after that. But free universal licenses
usually contain revocation terms that revoke the license if you use a
patent non-defensively. But at present, those licenses are
(unfortunately) the exception, not the rule.

In any case, if the license is revocable, one has to state the
conditions on which the licence can be revoked.  We can consider the
license terms in our decision, and I think we should reject documents
where the patent holder can subsequently refuse licenses in the future,
or alter the terms at its whim. Such patents can be expected to be
expensive in the future when the patent is part of a standard, and users 
have no choice but to pay whatever is demanded.

        --Dean

-- 
Av8 Internet  Prepared to pay a premium for better service?
www.av8.net        faster, more reliable, better service
617 344 9000  

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Dean Anderson <[email-masked]>
Date: Fri, 18 Sep 2009 14:49:53 -0400 (EDT)

Hi Todd,

I not sure why extractor is being brought up again. But many of your 
points are more general than just extractor.

Inline.

On Fri, 18 Sep 2009, Todd Glassey wrote:

> Dan - the IPR notice is a statement of the ownership of the IP and 
> NOTHING MORE. It is NOT a contractual grant of anything. 

In the case of TLS-extractor, that's correct; there is nothing more,
unfortunately.  However the section VI "Licensing Declaration" can
include terms of licencing.

> It is not authenticated and the process doesnt meet any legal
> requirements in the real world for transferring commercial rights to
> anyone for anything.

You make a good point; the submission process not authenticated. The
IETF hasn't adequately addressed that issue, and you are correct that we
do assume some risk assuming the document is genuine.  Of course, a
false or fraudulent document can still probably be traced by other logs,
so there are probably means of holding fraudsters accountable. And of
course, in this case we know that people from Certicom are participating
and they haven't repudiated the document, so we do have some indications
that its genuine.  But I would absolutely support improved
authentication of digital documents submitted to the IETF.

> > Certicom should not be able to alter the terms after the fact, which
> > it seems to have just admitted doing.
>
> Wrong - Certichron can alter anything it wants after informing the
> IETF of its (Certichron's) ownership of those technologies.

The distinction is between "can" and "should not be able to" is the
point. The terms of license _ought_ to be stable and _known_ to the IETF
members when they decide on standardization. If one doesn't know the
patent terms, most people would probably reject all patented standards.
That may be OK from my point of view, but I think others take a more
moderate position that I might call "informed consent", arguing each
patented standard on its own merits. While I have (graciously I think)
accepted to argue each patented standard individually on its own merits,
I must strenuously object to losing "informed consent" altogether. Loss
of "informed consent" is precisely what would happen if patent holders
were allowed to change the terms arbitrarilly anytime they chose to so.  
Patent holders would simply offer acceptable terms during
standardization, and then change the terms to unacceptably after the
standard was approved.  The court in Qualcomm v. Broadcomm came down
pretty strongly on my side.

> The IETF's decision to allow a standard or not based on whether the
> IETF is given ownership of the IP implementing that standard in the
> real world in the standard is a form of blackmail and needs to be
> formally prosecuted as tortuous interference and antitrust IMHO.

The IETF need not be given ownership; in no case has that been demanded
that I know of.

It is not blackmail to require disclosure of the terms on which business
will be conducted, nor to require terms be acceptable before being
accepted.  The IETF has the right to reject and not approve any
standards proposal. Those who submit standards proposals have no right
that their standards proposal be approved as a standard.

As you know, extortion requires that the one being extorted give up some
right that they have, while the extorter exercises a right they don't
have.  When I rent an apartment, I don't have to rent it, and applicants
have no right that I rent to them, and so demanding a price in rent is
not extortion.  By contrast, I have a right to democratic participation,
and the IETF has no right to prevent my democratic participation without
of a vote of more than half the members to suspend or strip membership.  
Taking away my rights to participate unless I drop objections to the way
things are run and who is running them is extortion.

> > The problem here is that submitting an URL for the real IPR
> > disclosure in the IETF disclosure form is subverting to idea that
> > the IETF can archive the IPR disclosures in their original form.
>
> Yes but that's the flaw in the IETF's system.

I think not. The IETF system cannot be expected to exclude URLs in a
block of text because Urls to _fixed_ longer documents are probably
good. Most such forms might run out of space and require additional
longer documents.  However, the IETF could and _should_ administratively
require by rules that the documents so referenced in the URLs be in
fixed form and that the submitter cannot change them arbitrarilly.

Thanks,

		--Dean

617 256 5494

---

From: Dean Anderson <[email-masked]>
Date: Fri, 18 Sep 2009 17:28:26 -0400 (EDT)

On Fri, 18 Sep 2009, Todd Glassey wrote:

> > I think not. 
> Then we should agree to disagree.

Ok.

> > The IETF system cannot be expected to exclude URLs in a
> > longer documents. 
> Why not - there should be an option to a Technologies Licensing Page on 
> a IPR filers website. That's cool and goes a way farther to insure that 
> parties that file IPR notices are contactable.

There is already contact information in Section VII.

> >  However, the IETF could and _should_ administratively
> No again - the grant statement's or lack thereof are contained in 
> documents outside of the IETF and that's the way it is. The IETF cannot 
> take property and relicense it under terms it doesnt own so it cannot 
> license use of property for which external IPR is claimed or for which 
> IPR denying IETF use is filed.

No one is asking the IETF to "take" property. We are asking the IETF to 
enforce the rule that there should be a definite and stable license 
terms before approving a standand.

> The IETF system needs to embrace technology and stop interfering with
> people who want to do things that the people in the IETF dont seem to
> think 'are good for their Internet' and that is the issue.  The IETF
> needs to not be the keeper of what the Internet is or what's done on
> it.  The IETF is a technology forum for creating standards for how
> networking over inter-networked systems is like. Its not a political
> platform. Its not a weapon to be wielded its a Standards Practice and
> Platform for that, and it needs to both embrace that limitation and
> become accountable for damages that actions of parties inside the IETF
> create.

I agree that the above are problems, but I think the causes of these
problems are found in the "who is running the IETF", and their failure
to follow the IETF's own rules.  Democracy works except when people
prevent it from working by breaking the rules. And of course, only those
in control can actually break the rules in any serious way that affects
the operation of the organization.  But they have a duty, and
ultimately, they are the ones held accountable to their duty to comply
with the rules and the law.

> Its all about transparency.

I agree, it is all about transparency.  But transparency would seem to
require stable and definite licencing terms before we approve patented
standards proposals.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 22 Sep 2009 15:27:02 -0400 (EDT)

On Sat, 19 Sep 2009, Todd Glassey wrote:
> No NO NO - that is NOT what the IETF is about and the people who try to 
> use the IETF Standards Process to extort a license need to be dealt with 
> in US Courts IMHO. 

As I pointed out, there is nothing wrong with demanding to know the 
terms of the standard. That is not extortion.

> The IETF is a standards process NOT a IP Management Practice or
> Licensing Agency.

I agree. But the IETF doesn't issue licenses. However, the licencing
terms are relevant to making standardization decisions.

> The Purpose of the IETF was and should still be to create and prove
> interoperability between networking protocols used in
> Inter-networking, i.e. usable on that thing we refer to as "the
> Internet"

It is adherence to a protocol definition that enables interoperability.  
Groups like Interop, etc exist to prove interoperability. The IETF does
not perform that function. It merely decides what proposals to approve
as standards.

> ANYTHING else is antitrust IMHO and should be properly dealt with in
> Courts as what it is - an attempt by a group of standards mongers to
> determine the make up and company's that will and WILL NOT be
> successful by blocking their commercial efforts.

The IETF rules (when followed) do not block any commercial efforts; no
one is _entitled_ to have the IETF approve their proposal as a standard.
IF a proposal is properly (thru honest democratic process) rejected for
standardization, the proposer can still promote the protocol as a
proprietary standard.  There are hundreds of successful proprietary
protocols.

> It for instance is NOT the IETF's responsibility to stop or make any
> value judgments as to the use of a protocol.

Actually, that is precisely what the IETF and all standards
organizations do: They make value judgements on proposals, based on a
democratic process.

> The IETF has no formal responsibility or authorization to act 'in the
> defense of the Internet' by stopping various parties initiatives to
> build interoperability into their products.

I agree. But I point out that the IETF has never stopped any party
except for myself, JFC Morphin, yourself, and perhaps some few others
from participating.  All of these were unfair and dishonest in terms of
democratic process.  In a number of other instances there were unfair
and undemocratic quashing's of proposals.

But of course, the IETF has no obligation to approve our initiatives,
either.

_All_ that we or anyone else are entitled to is an honest, fair, and
democratic decision process.  But we have no right to a specific outcome
(approval) of the democratic decision.

The anti-trust, extortion, and racketeering issues are found in the
interlocking control of boards by certain group, the extortion of
individual rights to democratic participation, and the violation of the
IETF's own rules for the economic benefit of this certain group.

> When it does it causes serious damage to the world and the commerce
> which sustains the world as a whole.

I agree.  But lets be clear on what we can dispute.  I suspect that your
proposals are being quashed dishonestly. One can dispute the dishonesty,
but not the naked fact of rejection. Its perfectly possible to honestly
reject proposals, and its perfectly possible to honestly reject
proposals because of unfavorable license terms.

> Sorry - just my 2 cents

I certainly value your opinion. You have no reason to apologize for it.

		--Dean