Subject: Re: [Eligibility-discuss] AD Sponsorship of draft-moonesamy-recall-rev

From: "Andrew G. Malis" <[email-masked]>
Date: Fri, 26 Apr 2019 07:05:07 -0400

Ben,

Thanks for your clarification of the use of the main ietf list (I had
forgotten that detail from RFC 3005) and also note the formation of
[email-masked] the discussion.

Cheers,
Andy

On Thu, Apr 25, 2019 at 9:10 PM Benjamin Kaduk <[email-masked]> wrote:

> On Thu, Apr 25, 2019 at 10:47:42AM -0400, Andrew G. Malis wrote:
> > I agree with Stewart, I think a BOF is overkill for this particular short
>
> I'm not sure that we need to focus too much on "BoF" -- I don't see many
> people specifically pushing for a BoF, whether virtual or in Montreal, when
> work could get done on a non-WG mailing list as well.
>
> > and focused draft. Even absent current AD sponsorship, discussion and
> > refinement of the draft can continue on this list. If general community
>
> I respectfully disagree: RFC 3005 is pretty explicit that the general
> discussion list is only for "initial discussion only [...] unless the issue
> is one for which the working group needs wider input or direction".  The
> IESG is working on a place to continue this discussion and work through any
> complications and/or subtleties of this and related topics, before it
> returns to the general list for IETF LC and the wider input from the
> community.
>
> > consensus around a future revision of the draft can be shown on the list
> > (as usual, by the absence of continued commenting following a new
> > revision), it may then be more difficult for the IESG to not find at
> least
> > one member to sponsor the publication process, including IETF last call.
>
> Indeed.  I note that, per my understanding of
> https://trac.ietf.org/trac/iesg/wiki/AreasDescription, an AD sponsoring a
> draft should have personally reviewed that document and believe it ready
> for publication as-is.  Given the continued discussion regarding this
> document, I believe that a conclusion that the document is not ready for
> publication "as-is" is justified, but I'm happy to see the discussion
> progress.
>
> -Ben
>
>

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 27 Apr 2019 18:18:56 -0400

Hi,

I've changed the destination list on this.  Again, no hat.

On Sat, Apr 27, 2019 at 12:16:45PM -0700, S Moonesamy wrote:
> 
> The draft does not make any change to the section about the Internet Society
> President.

Yes, I'm aware.

> There is the following sentence in the Note Well: "By participating in the
> IETF, you agree to follow IETF processes and policies".  Signatories are
> "expected to be familiar with the IETF processes and procedures, which are
> readily learned by active participation ..."  It is the up to a signatory to
> show that he or she participated in those IETF meetings.

That does not clarify the issue of "participation" at all.  We can't
have it be a criterion of eligibility if it does not have a
well-defined public meaning.

> Please see draft-sullivan-mtgvenue-decisions-00 as it discusses about
> different types of attendees.

I don't see how that is relevant.
 
> From what I recall, it only took one appointee to negatively impact the work
> of the administrative support activity.  Russ explained why it was not
> possible for the body to exercise the recall process option.

Sure, and in the end we solved that problem and then did not actually
have a problem gettinh the signatures together, from what I recall.
In any case, the evidence is that we were in fact able to persuade the
person to leave which meant that we didn't actually need to exercise
the entire procedure.

> There are 10 random persons who choose the so-called "leadership" each year.

Actually, there are 10 randomly-chosen people from a pool of people
who have been qualified from a well-defined meaning of having
participated in the processes of the organization.  Whether that
definition is adequate might be up for debate, but it is a clear and
complete definition, which is not what's in the current draft.

> The persons  do not have to have to participate on this mailing list even
> though this is usually the place where IETF policies are discussed.  What is
> the difference between them and 10 random persons who participate remotely?

One difference is how they are qualified.  Another difference is that
their decisions are subject to confirming bodies.  A third difference
is that they are selecting among possible candidates or none in a
process that has multiple turn off points.
 
> Is an accountability mechanism a way to hold the so-called "leadership" to
> ransom?

It can be, if it is poorly suited to purpose.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: S Moonesamy <[email-masked]>
Date: Sun, 28 Apr 2019 01:27:31 -0700

Hi Andrew,
>well-defined public meaning.

There was a paper about "In-Person and Remote Participation Review at 
IETF: Collaborating Without Borders" [1].  The paper mentioned that 
"the remote participant was able to participate and interact by voice 
and text".

There was a presentation [2] by the IETF Security Area Directors in 
which the following is mentioned: "IETF-wide meetings are held three 
times a year, participation can be in person or remotely".  There is 
also an IETF Chair report [3] in which remote participation is 
mentioned.  According to the IETF Chair, "We're getting good 
participation from our remote folks".

>I don't see how that is relevant.

The current discussion is about the criterion of eligibility.  Please 
see below.

>participated in the processes of the organization.  Whether that

There is "having participated" what you wrote.  However, the 
definition used in RFC 7437 is about 
attendance.  draft-sullivan-mtgvenue-decisions-00 discusses that in 
Section 3.2.

Regards,
S. Moonesamy

1. https://arxiv.org/abs/1805.09140
2. 
https://www.itu.int/en/ITU-T/Workshops-and-Seminars/ict-sec-chaldc/Documents/Presentations/S6P2%20Kathleen%20Moriarty.pdf
3. 
https://datatracker.ietf.org/meeting/103/materials/minutes-103-ietf-201811071730-00

---

From: "Adrian Farrel" <[email-masked]>
Date: Mon, 29 Apr 2019 21:33:21 +0100

Andrew,

Apologies for a delayed response, I was working the last couple of days.

Thank you for your time and careful thought. It's really insightful and
helpful. And, of course, the care and effort you put into selecting Nomcom
chairs is really appreciated - I suspect most members of the community just
see it as "something that happens".

I wonder whether we need to break up this discussion into different topics
(threads?) so that the bleed-over doesn't get in the way of our
conversation.

I see a number of separate topics. Of course they are related, but I think
we might try to keep them distinct as much as possible. We should qualify
this with the knowledge that a recall is very-much a position of last
resort, but with the understanding that the very existence of the
possibility of a recall is an important part of the structure of the IETF.
Just like appeals, a recall is an element that allows us to trust the
operational management of the IETF. It is not the use of these mechanisms,
it is their availability.

The topics are:

1. Should members of the IESG and IAB (and other Nomcom-appointed people) be
allowed to sign recall petitions?
2. Should seated Nomcom members be allowed to sign recall petitions?
3. How do we qualify "participation" at IETF meetings?
4. Should remote participants at IETF meetings be qualified to sign recall
petitions?
5. What should be the number of signatories on a recall petition?
6. What is the right number of recall petitions?

Let's run through these in some more detail.

1. Currently serving Nomcom-appointed people are excluded from being able to
sign a recall petition. Several people have suggested that the IESG might be
in a position to police itself, and it does seem that there might be cases
where the IESG or IAB is uniquely positioned to know of issues that make a
recall a realistic option. I don't suppose that adding two dozen people to
the list of potential signatories makes a big difference to the potential of
a recall being initiated. I don't see any harm in this change and there
seems to be some small potential benefit.

2. Currently seated Nomcom members are allowed to sign recall petitions.
There seems to be general agreement that this would be a poor idea subject
to concerns about Nomcom confidentiality. It may be an oversight in the
original specification and is easy to fix. It doesn't seem that this change
would have a substantial impact on the pool of people who may sign a recall
petition, and the clarification looks like a good idea.

3. There is another thread running about how we might qualify people as
having participated in IETF meetings. Currently we judge this by looking for
those who have registered, paid and picked up badges: there is no actual
measure of participation. So there is a theoretical puppetry that could
occur, but it comes at a price.
For remote participants we have several tools available: registration and
Meetecho logs are the most obvious; physical presence at a remote hub is
also a possible.

4. I think that this whole thing started with consideration of whether we
should give more attention to the rights of remote participants. Let's set
this in a couple of contexts:
- Nomcom qualification requires physical participation in 3/5 meetings with 
  the belief that only people who have recent and full experience of the
IETF
  can properly make decisions about what the community wants/needs.
- All IETF decisions and the majority of discussions happen remotely (i.e.,
on
  mailing lists).
- The IETF (supported strongly by ISOC) has been working to extend the
  level of remote participation through increased tooling and the
  establishment of remote hubs. Part of that process is intended to enable
  new people with the appropriate skills to be as active as possible in the
  IETF. Part of it is to enable participation from parts of the world where
  the cost of physical attendance at IETF meetings may be prohibitive.
- The IETF has a strong ethos of non-discrimination: we work hard to make
  the only thing that counts be the reasoned discussion of technology. The
  IETF is well aware that it is not just the reality of fairness that
counts, but
  the appearance of fairness.
Considering these points, the current draft proposes to allow "qualified
remote participants" to sign recall petitions. Obviously the question of
qualification depends on point 3, and further discussion of that is
necessary. 
But supposing we work out the element of qualification, the proposal seems
to leave some concerns:
- It is easier to have "fake" signatories than with physical attendance.
  This is true, but we have only very slight evidence that there has ever
  been any attempt to subvert any other part of the IETF process by
  these means, and they are equally vulnerable. I conclude that the risk
  is both manageable and small. Furthermore, if this ever became a 
  problem, it could be addressed by a subsequent reversal of the 
  proposed change.
- There would be an increase in the pool of qualified signatories and 
  so an increase in the number of petitions. I don't think much effort
  has been put into working the numbers here: I think I saw a count
  of 700 Nomcom-qualified people, all of whom can currently sign a 
  petition. IIRC we have around 400 remote participants at any one
  IETF meeting, so we could *guess* that that might yield another
  200 potential signatories. Of course, given that we have never had
  a recall committee formed, it is hard to guess what impact this
  change would have 9/7 of nothing is still nothing.
- Participants who have only attended remotely don't fully
  understand the IETF and are not in a position to make requests for
  recall. This case can certainly be argued as it is for Nomcom, but it
  is also true that (unlike Nomcom) the signatory of a recall petition
  is not making any fundamental change: that change is left to the
  recall committee.
What this boils down to, then, is that there may be more work to do in terms
of more petitions to handle. That argument can be looked at several ways:
- If petitions are needed, then having them is a good thing
- Each properly formed petition requires a recall committee and
  chair: that is work to set up and administer, and a strain on the
  ISOC President
- There is a risk of attack that could be harmful although we have
  no reason to believe we will be attacked, and we do understand
  how to shut it down if it happens.

5. Once upon a time the number of signatures required for a recall petition
was 1. There were no attempts at recall, but this was increased to 20. There
may be no value in researching why that change was made and why the number
20 was selected. To me it seems that 1 was a fragile situation in a growing
organisation, but that 20 reflects an abundance of caution. We have never
had a recall and that could be because we have never needed one or because
it has been too hard to form one. I'm not sure that discussing that point
will get us anywhere but if we continue to not need any recalls, then
lowering the number will not matter, while if it has been too hard, lowering
the number of signatures needed will help.
Of course, the risk is that lowering the number makes us vulnerable to
recall petitions that have to be serviced. If they are valid, that is a
price we have to pay for good governance. I would argue that if the
petitions had a good case to answer but did not lead to a recall, that would
still be good governance. If it led to a number (any number) of frivolous,
fatuous, or otherwise spiteful petitions, then we would have empirical
evidence that increasing the number to 20 again would be wise.

6.  You said, "In order to show that you need a threshold change, you'd need
an argument that there was a case that should have caused a recall, but that
didn't because the threshold couldn't be met." I doubt that this is a
conversation that can be had on a public mailing list: we don't want to open
up the horrors of trial in the court of public opinion. And it is pretty
likely to be anecdotal in any case.
But, as I said above, the right number of actual recalls is the number we
actually have: I someone needs to be recalled then they need to be recalled.
And part of the price of getting that right is having a recall process that
can be started and executed even if it doesn't always deliver. The cost of
having no recall process or one that is hard to execute is that we lose
credibility for having sound governance.

One last point from me that might be applicable to the discussion of
fractiousness. I don't think any of this discussion comes about because
anyone is trying to form a recall petition. I don't think there is anyone
expressing such extreme discontent or agitating to remove anyone. To the
contrary: the best time to discuss and work on the backstop procedures is
precisely when they are not needed.

Could all or some of this be put into a/the draft? Unquestionably. Is the
current draft perfect? No, but it is an early revision. Should the ideas be
split into separate drafts? Well that all depends on how smoothly the
discussion goes since history teaches us that the IETF is very good at using
one issue to block progress on the resolution of other issues.

Let's move forward.

But you raised one other point. That we shouldn't look at anything that
makes the process for starting a recall easier without also looking at the
whole procedure. I think the two can be decoupled, but I also think that if
you have concerns about the recall procedure (and clearly not just limited
to your responsibility to appoint a recall committee chair) you should
document them (probably in a draft) so that we can all work on them.

Thanks,
Adrian

>> Well, doesn't the draft offer three areas of concern, and address
>> them with specific proposed changes:
>> - Eligibility of IAB and IESG members and other Nomcom appointees
>
> It simply deletes this consideration, yet it quite explicitly notes
> how unseemly it is that an appointing nomcom member could
> participate.
> So it doesn't address the issue it raises.
>
>> - Eligibility of remote participants
>
> Only sort of.  It allows registered remote participants to count
> (good) but then sets up a rule in which people "have participated
> physically or remotely" without defining that term.  If ever there
> were an opportunity for confusion and arguments over what constitutes
> "participation", I'd like to hope that its first official duty would
> not be in determining how we pick everyone else to manage the
> organization.  The existing arrangement is quite clear: you register
> for and attend the meetings.  The new proposal adds a notion of
> participation that is at least in serious need of unpacking. 
>
>>> The main thing it does is make the procedure
>>> easier to start, but it also doesn't adjust the procedure at all.
>> 
>> I think that questioning the first of these has an interesting
oppositional
>> view: do you propose making it *harder* to start the procedure? Perhaps
we
>> could say all signatories must have first names starting with the letter
A
>> :-)
>
> I think this is a false alternative: it simply doesn't admit of the
> possibility that the _status quo_ is ok.  In any case, no, I do not
> propose making it harder.  What I oppose is making it easier without
> thinking about the procedure itself.
>
>> But seriously, what in the last n years suggests that starting the
>> procedure has been "easy enough"? Have we already been overrun
>> with recall petitions?
>
> This puts the burden of proof entirely in the wrong place.  In order
> to show that you need a threshold change, you'd need an argument that
> there was a case that should have caused a recall, but that didn't
> because the threshold couldn't be met. To show _that_, you'd at least
> need a definition of "should have caused a recall" that was
> uncontroversial.  None of that argumentation has been made.  Without
> it, I don't understand why anyone argues for a change in the required
> number.
>
> In other words, we have no evidence whether the procedure is "easy
> enough", but we have exactly the same evidence that it is hard enough
> or too hard.  It seems to me that most of the IETF wants to get their
> work done, and that they'll do that under many circumstances until the
> structure is manifestly unfit for purpose, at which point finding 20
> people ought to be a trivial hurdle to clear.
>
> This is also completely unrelated to the question of equity for remote
> participants, which AIUI is what got all this going.  
>
>> That is true. And it must be weighed against the damage caused by an
>> unaddressed need for a recall.
>> We actually don't have any evidence on either side of this issue and so
must
>> aim to strike a balance letting it be "reasonably" possible to start a
>> recall process
>
> I am not sure what to make of a defence of a change in the rules that
> starts with the proposition that there is no evidence for any of it.
> I will certainly grant the proposition that there is evidence neither
> of a need to change nor of adequacy of the current arrangement.  
>
>> We have no knowledge of how this works. But if I was on a recall
committee
>> and the petitioners sent me mail to say that they had changed their mind,
I
>> might talk to them and possibly conclude that the petition can be deemed
to
>> have failed.
>
> You might do anything at all, of course, and another person might do
> something else yet again.  The point is that good organizational
> procedures intended to be triggered frequently ought to be well
> understood.  The current draft proposes that 10 random people who sign
> up for free remote participation 3 times and "participate" in some
> unspecified way can hold the entire IETF so-called "leadership" to
> ransom, and we have no idea how those demands would be processed.  It
> seems like the sort of decision that requires careful community
> deliberation.  I don't see that this document has reached that
> threshold.
>
>> I tend to believe that resistance to fractiousness is best achieved by
open
>> accountability.
>
> And yet, here we are.  We have an organization that by any measure is,
> compared to just about anything I can name, super open and
> accountable.  Yet it appears to be beset by fractiousness.  One might
> be forgiven for thinking that the effort to lower the threshold for
> recall signatures is an effort that will aid that fractiousness.
>
>> For the other points we could consult some people a little older than us.
>> Was it an abundance of caution or a deliberate attempt to make it "too
hard
>> to execute"?
>
> Experience by scholars of history suggests that asking people who did
> a thing why they did it will quite often (but unpredictably) yield
> justifications that were not made explicit (or were even contradicted)
> at the time the thing happened.  We cannot invite the testimony of
> those who were there; we can invite only the testimony of those who
> remember being one of the people there.  Memory is imperfect.
>
>> But, assume there is a real need for a recall: in that case, I guess you
>> would be more than pleased to appoint a recall committee chair.
>
> No, but I would do my duty.
>
> It is a _lot of work_ to find a nomcom chair.  I have to canvass a lot
> of people.  I have to describe what I'm looking for.  And I have to
> use such reputation as I have to cajole people into accepting.
>
> A recall chair would be more contentious without the upside of the
> nomcom chair (e.g. that one appointed the right person).  So it is not
> clear to me how easy it will be to fill this position, and that seems
> like something we ought to take into account if we are going to make
> it easier to trigger this procedure both by increasing the class of
> people who can participate in the triggering and by lowering the
> numbers needed.
>
>> And, since there is a potential for a recall petition at any time
>
> Sure.  My very point was that the draft made that situation easier to
> happen without evidence about why such a change ought to happen.
>
>> Do you have some suggestions for a vermicide? 
>
> No, but it seems to me that this is a good example of why a WG needs
> to work on this.
>
>> I think applying "the right care" is absolutely spot on.
>
> I'm glad we're in agreement.
>
>> I disagree with you about a recall petition being a nuclear option.
>
> Lots of people do.  But a one-step procedure that moves from "20
> people support this" to "committee decides to fire or not" without
> intermediate steps is the sort of thing that works well when there are
> lots of informal, functioning ways for people to come to agreement.
> The excitement among some to reduce the threshold of signatures needed
> to invoke this procedure suggests to me that the informal, functioning
> ways may be fraying under current community strain.

---

From: Loganaden Velvindron <[email-masked]>
Date: Tue, 30 Apr 2019 21:50:16 +0400

> Meetecho logs are the most obvious; physical presence at a remote hub is

I help organize an IETF hub in Mauritius. However, most of the
participants of our hub
tend to be around 16-22 years old. Their interest leans more towards
implementation
rather than contribution to working group specs. Does remote ietf
hackathon count
as participation if running code is available at the end ?

---

From: 'Andrew Sullivan' <[email-masked]>
Date: Tue, 30 Apr 2019 18:45:57 -0400

Hi,

I dropped ietf@.  No hat.

Apologies for the short post, but I'm unfortunately quite pressed for
time this week & can't devote the cycles to this it deserves.  But I
think there's one critical point I ought to make.

> (threads?) so that the bleed-over doesn't get in the way of our

We could definitely figure out a way to tease these different issues
apart.  Nevertheless, I think the overall point I was originally

> 6. What is the right number of recall petitions?

This is a list of topics of sufficient breadth and sensitivity that I
think it needs unpacking and exploration.  I am not sure I agree with
your conclusions about obvious changes, but that's the sort of
discussion that I think is best had across the community.  And that
was really the point I was originally trying to make: this requires
the kind of care this community takes when it is going to make
sensitive or fundamental changes.  The way one does that in the IETF,
usually, as I understand it, is to form a working group, so that seems
to me to be the best path for this.

> precisely when they are not needed.

I could not agree more, and I think it would be entirely correct that
now, at a time when the IETF has started to work out its new path for
administrative arrangements and with a newly-arrived IESG, the WG to
undertake this effort be formed and get to work.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]