Subject: [Eligibility-discuss] Handling the fear of "bogus" recall petitions

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 24 Oct 2019 19:39:08 +0100

Hi,

Something that is not in draft-moonesamy-recall-rev but which I floated
before, was that the list of signatures should not be exclusively remote
participants. That is, the petitioners would need to persuade some physical
participants to co-sign.

You might note, we already apply this today, but the threshold is 100%
physical participants.

I think that would help mitigate the risk of any attack.

I'd also note that the draft doesn't just allow any old remote participant,
but still requires the 3-of-5 threshold. That means that anyone wanting to
DoS has to spend at least eight months preparing.

Lastly (and we did discuss this on the list, before) should we find
ourselves attacked in this way, it is very, very quick to shut off the
vector: you simply change the rules again.

And I would like to contrast this with the enfranchisement issue which is
that two fifths of our meeting attendees are now remote. That means that the
IETF is (as it has always billed itself) an organisation where the work is
done on the mailing lists and through Internet-Drafts. Hooray for that!
Hooray also for the fact that our systems and tools are becoming useable by
remote participants. But this does mean that we have to take seriously this
changing demographic and send a clear message that we support remote
participants as real players not "second class" citizens. Yes, this might
mean changing NomCom eligibility as well, and that should be looked at, but
I don't see why the two things would be tied.

Thanks for an instructive call today.

Best,
Adrian

---

From: Eliot Lear <[email-masked]>
Date: Thu, 24 Oct 2019 22:24:58 +0200

Hi Adrian,

> DoS has to spend at least eight months preparing.

That is a fair point.  But I liked Barry’s groupings:

a.  Those who have attended in person 3/5 (status quo)
b.  Those who have previously attended attended in person but are now remote.
c.  Those who have never attended.

I don’t think many people could seriously object to group (b) being added.  The concern is primarily with group (c).  There is also a certain amount of skin in the game that may be of value.  The skin in the game could take the form of meeting attendance or having written an RFC or having had a draft adopted by a WG.  These are all pretty good indicators and there may be others (open source authors having implemented a spec, for instance).  The idea is not to set the bar too high for people who are using our stuff, but high enough still that gaming would be unlikely.

Thoughts?

Eliot

---

From: S Moonesamy <[email-masked]>
Date: Thu, 24 Oct 2019 15:15:18 -0700

Hi Eliot,
At 01:24 PM 24-10-2019, Eliot Lear wrote:
>That is a fair point.  But I liked Barry's groupings:
>
>I don't think many people could seriously object to group (b) being 
>added.  The concern is primarily with group (c).  There is also a 
>certain amount of skin in the game that may be of value.  The skin 
>in the game could take the form of meeting attendance or having 
>written an RFC or having had a draft adopted by a WG.  These are all 
>pretty good indicators and there may be others (open source authors 
>having implemented a spec, for instance).  The idea is not to set 
>the bar too high for people who are using our stuff, but high enough 
>still that gaming would be unlikely.

I met Cisco and Huawei employees who encouraged people from Africa to 
participate in the IETF.  I'll disclose that I am affiliated with one 
of the organizations which provided support for those efforts.  Would 
those persons be classified under (c)?

There are Area Directors and other participants who made an argument 
about "good faith".  Is that applicable to a person classified in (c)?

I received a question from a few of those persons about regular 
participation in the IETF.  I doubt that they would understand the 
meaning of "skin in the game".  Would an Area Director tell them that 
they have to pay US $3,000 to be eligible?

I attended a conference in a Southern African country 
recently.  There was a session about regulations.  IETF RFCs were 
mentioned in the presentation and as part of the session 
discussion.  Has anyone on this mailing list been to that region?  If 
so, what is the risk of those persons "gaming" the recall process?

Regards,
S. Moonesamy

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 25 Oct 2019 00:21:23 +0100

Hey Eliot,

> But I liked Barry’s groupings:
>
> I don’t think many people could seriously object to group (b) being
> added.  The concern is primarily with group (c).  There is also a certain
> amount of skin in the game that may be of value.  The skin in the game
> could take the form of meeting attendance or having written an RFC or
> having had a draft adopted by a WG.  These are all pretty good indicators
> and there may be others (open source authors having implemented a
> spec, for instance).  The idea is not to set the bar too high for people who
> are using our stuff, but high enough still that gaming would be unlikely.
>
> Thoughts?

I fear the wheel may come off your Gedankenexperiment as you introduce ever more subcategories of participant.
c.i. Never attended but been a remote participant for 7 years
c.ii. Never attended and no RFC published, but 3 WG drafts
c.iii. Never attended but made significant contributions to mailing list discussions in more than 4 WGs
c.iv. Never attended and never had an RFC published, but chaired a WG

And so on. I am pretty sure you can't parameterise this successfully and, while you might know it when you see it, that means that you cannot properly write down what it would mean to be "a participant in good standing."

But let's take a leaf out of Ekr's book and try to understand what problem you are solving.

I think you are worried about "gaming the system". So, what is the real risk?
Presumably that a number (G.T. 0) of recalls petitions are filed without due cause, and that those petitions would do enough harm to the IETF that it would merit making a statement that some people are not considered of sufficient standing to have their concerns addressed by a recall petition. And what is that potential harm?
- Reputational damage to the "accused"? That was suggested 
  as a reason against the ombudsteam, and I cannot see why 
  anyone considers being falsely accused and then found not
  guilty to be harmful to their reputation. 
- Cost to the IETF in terms of wasted effort. Yes, a small number
  of hours of a few people could be wasted reading the petition
  and supporting material. But that doesn't sound like a big cost.
- The ISOC chief has to find a recall panel chair. I hear him when 
   he says this is a big deal, but I don't think it is such a challenge.
   It is certainly nothing compared to finding a NomCom chair
   since the recall panel has a fixed and focused short-duration
   task.
Are there other costs/harms? Maybe there could be if there was a flurry of recalls. But surely that would show up.

But I will still maintain that the 3-of-5 rule, or something similar (since 3-of-5 is required for physical, we might require 5-of-5 by remote when no more than 2-of-5 has been physical), is enough to handle any gaming of the system. And should gaming show up (which it would, I think, although I caution against anyone saying that a recall that fails is anything other than a legitimate concern correctly expressed) then we could easily revisit this. That is, we can use DevOps principles to refine as necessary, yet make incremental and beneficial changes.

To make clear my reverse problem statement. I am only somewhat concerned that remote participants might at some future time have grounds for requesting a recall. Frankly, I think there are probably other ways of addressing the issues that arise (although I will confess that I only feel confident in those other ways after 20 years participating and 6 years on the IESG, so perhaps remote participants might feel the need of a more blunt instrument). No, what worries me is what we say to the 850 or so people who register and participate remotely at IETF meetings when we state that they do not have the right of any involvement in a procedure designed to rectify iniquity.

Best,
Adrian

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 25 Oct 2019 15:55:50 +1300

Adrian,

> I think you are worried about "gaming the system"

> c.  Those who have never attended.

also seems to me to be a proxy for "Those who have very limited personal
knowledge of the person being recalled, so may not be capable of fair
assessment of their conduct."

Personally I'm more worried about that than the risk of gaming or DOSsing
the system. Now while it's true that a non-attendee might have frequently
met the recallee at (say) ITU-T meetings, it's still probably the best proxy
we've got for "very limited personal knowledge". Assuming, of course, that
we think such personal knowledge is needed.

Regards
   Brian

---

From: John C Klensin <[email-masked]>
Date: Fri, 25 Oct 2019 02:48:32 -0400

--On Friday, October 25, 2019 15:55 +1300 Brian E Carpenter
<[email-masked]> wrote:

> also seems to me to be a proxy for "Those who have very
> limited personal knowledge of the person being recalled, so
> may not be capable of fair assessment of their conduct."
> 
> Personally I'm more worried about that than the risk of gaming
> or DOSsing the system. Now while it's true that a non-attendee
> might have frequently met the recallee at (say) ITU-T
> meetings, it's still probably the best proxy we've got for
> "very limited personal knowledge". Assuming, of course, that

Brian, keep in mind that we are talking about petitioners here,
not the recall committee.  While I think there are strong
arguments for considering different rules for its composition
than for the Nomcom, no one has proposed anything specific along
those lines and the "small steps" principle suggests not
touching it right now.

People who sign recall petitions without knowledge of the person
being targeted are a different problem, but I don't think any
evidence has been offered that would suggest remote participants
would be more likely to exhibit that particular form of bad
behavior than those who attend in person.  Borrowing from an
unrelated thread, to suggest that remote participants would be
more prone to such behavior would constitute making a vague
accusation against unspecified parties and doing so with no
specific evidence.

Beyond that, I want to repeat what I've said on the call and
earlier.  In that nearly eight years between October 1996 (RFC
2027) and June 2004 (RFC 3777, which introduced the 20
signatures and nomcom eligibility requirements), our rule about
petitions for initiating the process was that "anyone" could do
it.  No requirement for IETF participation, attending meetings,
or writing things;  no multiple signatures as a cross-check or
barrier; no requirement for proof of humanity or even proof of
life.  Many of us will recall that the number of IETF
participants who were accused of being or recruiting sock
puppets or engaging in long-term troll-like behavior was larger
than it is in these kinder and gentler times.  It would have
taken exactly one such troll or other bad actor to initiate a
recall process.  It would have taken exactly one such bad actor
with the ability to manufacture bots or sock puppets to generate
recalls against every single Nomcom appointee.   And yet the
number of recall attempts (filed petitions) during that period
was zero.  

THere are many possible ways to mount a DoS attack against the
IETF.  The easiest and probably most destructive would be to
create a large number of fake identities, sign them up for the
IETF list, and then attack one IETF Last Call after another, a
process that would not only prevent us from getting any work
done but that would prevent our changing procedures to work
around the problem.  That has also happened zero times.

The evidence that remote participants are being deprived of the
ability to use the recall process to protect themselves against
abusing behavior in the leadership is clear and obvious.  Not
doing something about that because of fears of a problem that
has never occurred despite many opportunities strikes me as, at
best, having our priorities wrong.  Of course, one can argues
that the recall process is unusable in practice and therefore
creating a more fair initiate process is irrelevant, but I
really hope we don't need to go there, if only because it would
invite appeals that go more or less directly to the ISOC BoT.

best,
   john

---

From: Eliot Lear <[email-masked]>
Date: Fri, 25 Oct 2019 11:25:27 +0200

Hi Adrian,

> On 25 Oct 2019, at 01:21, Adrian Farrel <[email-masked]> wrote:
> 

Fair question.  To me it’s not just a matter of gaming the system, but a matter of acculturation or having a stake in the organization’s proper function.  Someone who has shown up relatively consistently demonstrates that interest.  People who have had work accepted at some level by the organization are similar examples.

Eliot

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 25 Oct 2019 11:18:58 +0100

> Fair question.  To me it’s not just a matter of gaming the system, 
> but a matter of acculturation or having a stake in the organization’s
> proper function.  Someone who has shown up relatively consistently
> demonstrates that interest.  People who have had work accepted at
> some level by the organization are similar examples.

Hmmm. I think I start to see your point, but when you talk about acculturation you are not talking about the effect/risk you want to avoid, but about the possible cause.

So, if I might rephrase, you are worried about:
- gaming the system (as previously noted)
- not understanding the IETF culture and attempting
  to make it that which it is not.

I hope I have that right.

Asides from the fact that that leads to perpetuation and ossification, I think we are agreed that "some level" of established participation is required.

Now, I would argue that physically attending three IETF meetings does not do much more than show financial support from a sponsor organisation. I might even suggest that there are a few people who have attended a number of IETF meetings who really have no clue how the IETF works: they "vote" on mailing lists; they post individual drafts and are upset that no one converted them to RFCs; they don't read the drafts. So let's not make the barriers for remote participants such that we embarrass ourselves.

On the other hand, I do agree that we need to see remote participants as, in some sense, full participants before considering that they can start a recall. So we are just arguing about the detail.

You (it seems to me) are suggesting a large number of potential criteria against which we can measure "involvement". I am looking for a more simple measure just like the 3-of-5 that we apply for physical presence where we don't additionally require co-authoring of I-Ds or some such. 

I think we could arrive at an easy bar such as 5-of-6 when less than 3 have been physical. And I'm happy to talk about that. But the question of "culture" comes down to this: what is the IETF culture and where is it documented? Do I understand the IETF culture? Do you? 

Best,
Adrian

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 25 Oct 2019 11:30:25 +0100

Hi Brian,

I think I disagree quite strongly.

> limited personal knowledge of the person being recalled,
> so may not be capable of fair assessment of their conduct."
>
> might have frequently met the recallee at (say) ITU-T meetings,
> it's still probably the best proxy we've got for "very limited personal
> knowledge". Assuming, of course, that we think such personal
> knowledge is needed.

Or, at least, I did agree until the last sentence.

Struggling to circumvent Godwin's Law here, but you don't have to have personal acquaintance with someone to know that they are not doing their job well. It is not material that they are going through a hard time and need help and counselling: hopefully they have friends who can see this and help them. If is not relevant that they are really a nice person: they can be a great socialite with a GSOH, but if they have only ever done harmful things in their position, that is what is being looked at.

But, contrarywise, the exact point, the substance, of a recall petition is based on "personal knowledge" of the recallee. That is, they have done something sufficiently egregious and notable to the petitioners that a recall is deemed appropriate.

Best,
Adrian

---

From: Eliot Lear <[email-masked]>
Date: Fri, 25 Oct 2019 12:50:48 +0200

Hi Adrian,

> On 25 Oct 2019, at 12:18, Adrian Farrel <[email-masked]> wrote:
> 

That’s close enough wording to what I am thinking.

> Now, I would argue that physically attending three IETF meetings does not do much more than show financial support from a sponsor organisation. I might even suggest that there are a few people who…

Yes, we have had all of that.  None of this guarantees clue, and quite honestly, to address your other point, the culture sometimes does have to change. So long as that is a conscious change, that’s fine, but not knowing the culture means it would not be.

> I think we could arrive at an easy bar such as 5-of-6 when less than 3 have been physical.

I would be happy if someone attended so much as once, such that the 3/5 would apply. The lengthy criteria was just meant to lower the bar as far as possible, but one can certainly at least start simple.

> And I'm happy to talk about that. But the question of "culture" comes down to this: what is the IETF culture and where is it documented?

Oh I don’t even think we have to go that far.  So long as someone has an educated perspective, their entitled to decide that for themselves.

> Do I understand the IETF culture? Do you?

Yes, we both do.  But our understandings may differ ;-)

Eliot

---

From: S Moonesamy <[email-masked]>
Date: Fri, 25 Oct 2019 04:24:20 -0700

Hi Brian,
>we think such personal knowledge is needed.

The Ombudsteam can decide that a person is no longer permitted to 
participate in IETF activities.  Given that the Ombusteam can make 
such a decision, should there be a requirement that the Ombusteam 
have personal knowledge of the person?  I looked up 7776 and I could 
not find such a requirement.

If there is a significant risk that the system can be bring the IETF 
to a halt, it means that the system is not well designed.  As Adrian 
pointed out in an email, it is possible to make a timely change to 
the system if there is an evidence that it is being misused.  It may 
be possible to add a clause to curtail misused.  However, that 
increases the complexity of the system.  It also opens the door to 
creating a system which might not work when it is actually needed.

Regards,
S. Moonesamy

---

From: Richard Barnes <[email-masked]>
Date: Fri, 25 Oct 2019 08:52:04 -0400

I'm puzzled by the focus on meeting attendance and acculturation here.  The
former is at best an obsolete metric; the latter is so vague as to be
useless.

Let me try to articulate propose a different operating principle here, one
effectively of self-determination: A person should have a say in a decision
if and only if they are affected by the outcome.  I think this principle
leads to the right result in the base case, and provides helpful insights
in the recall/NOMCOM case.

By "the base case", I mean: Who gets to participate in the development of
IETF specifications?  While some are affected more than others, IETF
technologies have impacts for the whole Internet, so it makes sense that
anyone involved in the Internet should have a say -- and nowadays, that's
basically anyone.

With regard to NOMCOM and recall, this raises the question of who is
affected by the choice of who is on the leadership bodies.  Clearly not
everyone; your average user of the Internet has no reason to care who's on
the IESG.  Meeting attendees are affected to a degree, since the
NOMCOM-appointed leadership is in charge of setting the agenda and the
norms for participation.  The people who are much more affected by the
leadership are those who are actively participating in document production
-- people who have authored documents, participated in discussions in
meetings, contributed to last calls, chaired WGs, etc.

--Richard

On Fri, Oct 25, 2019 at 6:51 AM Eliot Lear <[email-masked]> wrote:

> > Asides from the fact that that leads to perpetuation and ossification, I
> think we are agreed that "some level" of established participation is
> required.
> >
> > Now, I would argue that physically attending three IETF meetings does
> not do much more than show financial support from a sponsor organisation. I
> might even suggest that there are a few people who have attended a number
> of IETF meetings who really have no clue how the IETF works: they "vote" on
> mailing lists; they post individual drafts and are upset that no one
> converted them to RFCs; they don't read the drafts. So let's not make the
> barriers for remote participants such that we embarrass ourselves.
> >
>
> Yes, we have had all of that.  None of this guarantees clue, and quite
> honestly, to address your other point, the culture sometimes does have to
> change. So long as that is a conscious change, that’s fine, but not knowing
> the culture means it would not be.
>
>
> > On the other hand, I do agree that we need to see remote participants
> as, in some sense, full participants before considering that they can start
> a recall. So we are just arguing about the detail.
> >
> > You (it seems to me) are suggesting a large number of potential criteria
> against which we can measure "involvement". I am looking for a more simple
> measure just like the 3-of-5 that we apply for physical presence where we
> don't additionally require co-authoring of I-Ds or some such.
> >
> I would be happy if someone attended so much as once, such that the 3/5
> would apply. The lengthy criteria was just meant to lower the bar as far as
> possible, but one can certainly at least start simple.
>
>
> > And I'm happy to talk about that. But the question of "culture" comes
> down to this: what is the IETF culture and where is it documented?
>
> Oh I don’t even think we have to go that far.  So long as someone has an
> educated perspective, their entitled to decide that for themselves.
>
> --
> Eligibility-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/eligibility-discuss
>

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 25 Oct 2019 14:46:56 +0100

Nicely said, Richard. And to be fair to Eliot, he started off trying to qualify a number of ways of counting participation.

And that just leaves us trying to measure who is “much more affected” in a relatively simplistic way so that we avoid complex evaluations and appeals and such like.

The current system tried to summarise all of these aspects through the raw measure of attendance. That is, it wasn’t using attendance for its own sake (although, obviously, as you note, one of classes of people who are affected), but as a crude measure of who was contributing in all of the various ways.

So, what is going on here is to recognise that the existing measure is excluding a group of people who contribute just as much in various ways, and to try to find a simple way of including them. Obviously, there is no intention to open us up to harm, but a strong feeling that we need to attempt to be fairer.

Thus, the proposal was to use repeated remote attendance over a period as a measure. There may be other measures and discussing them would be good. But those I have heard so far tend to get complicated quickly.

Best,

Adrian

From: Richard Barnes <[email-masked]> 
Sent: 25 October 2019 13:52
To: Eliot Lear <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [Eligibility-discuss] Handling the fear of "bogus" recall petitions

I'm puzzled by the focus on meeting attendance and acculturation here.  The former is at best an obsolete metric; the latter is so vague as to be useless.

Let me try to articulate propose a different operating principle here, one effectively of self-determination: A person should have a say in a decision if and only if they are affected by the outcome.  I think this principle leads to the right result in the base case, and provides helpful insights in the recall/NOMCOM case.

By "the base case", I mean: Who gets to participate in the development of IETF specifications?  While some are affected more than others, IETF technologies have impacts for the whole Internet, so it makes sense that anyone involved in the Internet should have a say -- and nowadays, that's basically anyone.

With regard to NOMCOM and recall, this raises the question of who is affected by the choice of who is on the leadership bodies.  Clearly not everyone; your average user of the Internet has no reason to care who's on the IESG.  Meeting attendees are affected to a degree, since the NOMCOM-appointed leadership is in charge of setting the agenda and the norms for participation.  The people who are much more affected by the leadership are those who are actively participating in document production -- people who have authored documents, participated in discussions in meetings, contributed to last calls, chaired WGs, etc.

--Richard

On Fri, Oct 25, 2019 at 6:51 AM Eliot Lear <[email-masked] <mailto:[email-masked]> > wrote:

Hi Adrian,

> On 25 Oct 2019, at 12:18, Adrian Farrel <[email-masked] <mailto:[email-masked]> > wrote:
> 

Eliot

-- 
Eligibility-discuss mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/eligibility-discuss

---

From: Michael Richardson <[email-masked]>
Date: Fri, 25 Oct 2019 10:17:31 -0400

> I think that would help mitigate the risk of any attack.

I agree.

    > DoS has to spend at least eight months preparing.

I am unclear if SM's recall draft enfranchises all remote participants are
nomcom eligible, or if it just does that for recall motions.  I agree that
the attack surface is not that big.

    > done on the mailing lists and through Internet-Drafts. Hooray for that!

!

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Fri, 25 Oct 2019 10:30:29 -0400

John C Klensin <[email-masked]> wrote:
    > not the recall committee.

Tweaking the list for petitions for a process that effectively never gets
used is boring.  It's not worth the RFC.

If we are going to do something, let's find a way to enfrachise (fully)
people in category (b).

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: "Pete Resnick" <[email-masked]>
Date: Fri, 25 Oct 2019 09:42:16 -0500

Brian and Eliot (and anyone else who shares similar concerns):

I did not see either of you address Adrian's proposed mitigation: Would 
requiring some number of physical participants to also sign the petition 
allay your concerns? If so, what would that number be? If not, why not?

pr

On 24 Oct 2019, at 21:55, Brian E Carpenter wrote:

>>> certain
>> I fear the wheel may come off your Gedankenexperiment as you 
>> introduce ever more subcategories of participant.
>> And so on. I am pretty sure you can't parameterise this successfully 
>> and, while you might know it when you see it, that means that you 
>> cannot properly write down what it would mean to be "a participant in 
>> good standing."
>>
>> Presumably that a number (G.T. 0) of recalls petitions are filed 
>> without due cause, and that those petitions would do enough harm to 
>> the IETF that it would merit making a statement that some people are 
>> not considered of sufficient standing to have their concerns 
>> addressed by a recall petition. And what is that potential harm?
>> Are there other costs/harms? Maybe there could be if there was a 
>> flurry of recalls. But surely that would show up.
>>
>> But I will still maintain that the 3-of-5 rule, or something similar 
>> (since 3-of-5 is required for physical, we might require 5-of-5 by 
>> remote when no more than 2-of-5 has been physical), is enough to 
>> handle any gaming of the system. And should gaming show up (which it 
>> would, I think, although I caution against anyone saying that a 
>> recall that fails is anything other than a legitimate concern 
>> correctly expressed) then we could easily revisit this. That is, we 
>> can use DevOps principles to refine as necessary, yet make 
>> incremental and beneficial changes.
>>
>> To make clear my reverse problem statement. I am only somewhat 
>> concerned that remote participants might at some future time have 
>> grounds for requesting a recall. Frankly, I think there are probably 
>> other ways of addressing the issues that arise (although I will 
>> confess that I only feel confident in those other ways after 20 years 
>> participating and 6 years on the IESG, so perhaps remote participants 
>> might feel the need of a more blunt instrument). No, what worries me 
>> is what we say to the 850 or so people who register and participate 
>> remotely at IETF meetings when we state that they do not have the 
>> right of any involvement in a procedure designed to rectify iniquity.
>>
>> Best,
>> Adrian
>>

-- 
Pete Resnick http://www.episteme.net/
All connections to the world are tenuous at best

---

From: "Andrew G. Malis" <[email-masked]>
Date: Fri, 25 Oct 2019 10:50:50 -0400

I fully agree with Michael that fully enfranchising all active IETF
participants, whether or not they're able to physically attend IETF
meetings, is the right goal, and SM's draft is a good step in this
direction.

Perhaps having registered for the past n of x IETF meetings, for your
favorite values of n and x, is a reasonable way to discern an active IETF
participant. An additional requirement could be, for remote registrations,
actually having logged into Meetecho at least once during a meeting as
proof of participation.

That would require anyone planning a "DOS attack" on the system via bogus
registrations needing to do quite a bit of advance work.

Cheers,
Andy

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 25 Oct 2019 15:54:25 +0100

Hi Michael,

I don't want to oppose your proposals to work on NomCom eligibility. In
fact, I encourage you and I hope we can get somewhere with it.

But, I feel you are overriding the discussion. You are welcome to say "I
think your problem is boring and I don't want to work on it," but why should
that stop others from completing a small piece of work with an incremental
improvement?

Thanks,
Adrian
-----Original Message-----
From: Michael Richardson <[email-masked]> 
Sent: 25 October 2019 15:30
To: John C Klensin <[email-masked]>
Cc: Brian E Carpenter <[email-masked]>; [email-masked];
[email-masked]; 'Eliot Lear' <[email-masked]>
Subject: Re: [Eligibility-discuss] Handling the fear of "bogus" recall
petitions

--
]               Never tell me the odds!                 | ipv6 mesh networks
[
]   Michael Richardson, Sandelman Software Works        |    IoT architect
[
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails
[

---

From: Eliot Lear <[email-masked]>
Date: Fri, 25 Oct 2019 16:59:38 +0200

> On 25 Oct 2019, at 16:42, Pete Resnick <[email-masked]> wrote:
> 
> I did not see either of you address Adrian's proposed mitigation: Would requiring some number of physical participants to also sign the petition allay your concerns? If so, what would that number be? If not, why not?

Yes.  Adrian is offering a an approximation method, which may limit access initially to some in favor of simplicity.  I think two meetings is sufficient.  Is it two meetings EVER or two out of the last N?  Dunno.

Eliot

---

From: "Pete Resnick" <[email-masked]>
Date: Fri, 25 Oct 2019 10:03:58 -0500

On 25 Oct 2019, at 9:59, Eliot Lear wrote:

>> I did not see either of you address Adrian's proposed mitigation: 
>> Would requiring some number of physical participants to also sign the 
>> petition allay your concerns? If so, what would that number be? If 
>> not, why not?
>
>
> Yes.  Adrian is offering a an approximation method, which may limit 
> access initially to some in favor of simplicity.  I think two meetings 
> is sufficient.  Is it two meetings EVER or two out of the last N?  
> Dunno.

Eliot, you misunderstood my question and Adrian's original mitigation 
proposal:

Stick with SM's original proposal.

Add the requirement that there must be X people on the petition who 
meets the current rules (attended 3/5 physical meetings).

Would that allay your concern?

pr

---

From: Richard Barnes <[email-masked]>
Date: Fri, 25 Oct 2019 11:07:19 -0400

> Would that allay your concern?

I can't speak for Eliot, but what you're saying would not allay my
concerns.  Note the "if and only if" in my earlier mail -- if people have
no skin in the game, they should get no say, not even as filler on a form.

Again, we need some guiding principle / problem statement here, not just
negotiating details.

--Richard

---

From: "Pete Resnick" <[email-masked]>
Date: Fri, 25 Oct 2019 10:26:06 -0500

On 25 Oct 2019, at 10:07, Richard Barnes wrote:

> concerns.  Note the "if and only if" in my earlier mail -- if people 
> have no skin in the game, they should get no say, not even as filler 
> on a form.
>
> Again, we need some guiding principle / problem statement here...

You, like Eliot, did propose a "skin in the game" principle. I did not 
see a clearly articulated reason that such a principle is the right one, 
other than it "leads to the right result", which simply re-introduces 
the question, "What is the 'right' result?" And even in your proposed 
list of determining skin in the game, you include "participated in 
discussions in meetings", which brings us back to the question of 
whether "remote registration" is a good way to capture that.

> ...not just negotiating details.

Aside from this being a bit hostile, I think it's also an unfair 
characterization: We often figure out what our principles are and 
whether we've articulated them reasonably by discussing particular 
details and seeing how they fit into our proposed principles. We also 
use such examples to explore how edge cases not captured by our 
principles can be handled.

I took Adrian's proposal as the latter: SM's document assumes (maybe) 
that 3/5 remote registration is a close enough metric for skin in the 
game, and Eliot's concern was that you could end up with people with no 
actual skin in the game initiating the petition. Adrian proposed 
requiring someone under the current rule to be on the petition as a 
backstop for the new metric being misused. I think it's reasonable to 
ask the question: Does using such a backstop allay the concern, or is 
there something more to the issue and we really need a better metric? 
This is not about negotiating some compromise.

pr

---

From: Eliot Lear <[email-masked]>
Date: Fri, 25 Oct 2019 17:30:44 +0200

Hi Pete,

> 
> Eliot, you misunderstood my question and Adrian's original mitigation proposal:
> 

Sorry.  A few messages flying back and forth.

> Add the requirement that there must be X people on the petition who meets the current rules (attended 3/5 physical meetings).
> 

I do not know how to solve for X.  That would be my only concern.

Eliot

> 
> pr
> --
> Pete Resnick http://www.episteme.net/ <http://www.episteme.net/>
> https://www.ietf.org/mailman/listinfo/eligibility-discuss <https://www.ietf.org/mailman/listinfo/eligibility-discuss>

---

From: Eliot Lear <[email-masked]>
Date: Fri, 25 Oct 2019 17:39:23 +0200

> On 25 Oct 2019, at 14:52, Richard Barnes <[email-masked]> wrote:
> 

Sort of.

You want a big enough pool of people in the NOMCOM to have some detachment from any particular Area.  And those people should have understanding of what should be expected from that individual, independent of what they read on the job of description.  That is acculturation or experience with the organization.  Vague, but not useless.

> With regard to NOMCOM and recall, this raises the question of who is affected by the choice of who is on the leadership bodies.  Clearly not everyone; your average user of the Internet has no reaso…

I’m a little less clear on how to evaluate some of that, but

> 
> --Richard
> 
> 
> On Fri, Oct 25, 2019 at 6:51 AM Eliot Lear <[email-masked] <mailto:[email-masked]>> wrote:
> Hi Adrian,
> 
> > On 25 Oct 2019, at 12:18, Adrian Farrel <[email-masked] <mailto:[email-masked]>> wrote:
> >

---

From: Eliot Lear <[email-masked]>
Date: Fri, 25 Oct 2019 17:39:26 +0200

Hi Pete,

> On 25 Oct 2019, at 17:26, Pete Resnick <[email-masked]> wrote:
> 
>> I can't speak for Eliot, but what you're saying would not allay my concerns.  Note the "if and only if" in my earlier mail -- if people have no skin in the game, they should get no say, not even as filler on a form.
>> 
> You, like Eliot, did propose a "skin in the game" principle. I did not see a clearly articulated reason that such a principle is the right one…

Just to answer this head on: my reasoning is that a problematic leader impacts those whose work she or he governs from a work product standpoint.  Examples:

AD no show: slows work for everyone, and can impact software/product.
AD proprietary favoritism: slows work for some for purpose of impacting architecture/stalling competition.

For the record I haven’t perceived the latter as having happened.  Just a theoretical.  Now this is just the “skin in the game” aspect.  There is also the culture aspect.  I think Adrian’s later proposal manages a pretty good proxy for both.

Eliot

---

From: Michael StJohns <[email-masked]>
Date: Fri, 25 Oct 2019 11:47:14 -0400

On 10/25/2019 9:46 AM, Adrian Farrel wrote:
>
> Nicely said, Richard. And to be fair to Eliot, he started off trying 
> to qualify a number of ways of counting participation.
>
Actually, I don't think I completely agree with Richard's taxonomy.   
Yes the IESG has impact on the set of people Richard listed, but the IAB 
- not so much,, and the LLC even less so - at least directly.

I think it's probably a distraction trying to measure the "much more 
affected" here.

> And that just leaves us trying to measure who is “much more affected” 
> in a relatively simplistic way so that we avoid complex evaluations 
> and appeals and such like.
>
> The current system tried to summarise all of these aspects through the 
> raw measure of attendance. That is, it wasn’t using attendance for its 
> own sake (although, obviously, as you note, one of classes of people 
> who are affected), but as a crude measure of who was contributing in 
> all of the various ways.
>
> So, what is going on here is to recognise that the existing measure is 
> excluding a group of people who contribute just as much in various 
> ways, and to try to find a simple way of including them. Obviously, 
> there is no intention to open us up to harm, but a strong feeling that 
> we need to attempt to be fairer.
>
> Thus, the proposal was to use repeated remote attendance over a period 
> as a measure. There may be other measures and discussing them would be 
> good. But those I have heard so far tend to get complicated quickly.
>
I think that Eliot's  "skin in the game" comment is somewhat on target.  
People who attend in person contribute themselves to much more than just 
the documents/standards/WGs in which they're participating - they mentor 
and discuss and socialize the IETF culture; the cost and fees of 
attending the meeting show at least someone thinks its valuable to have 
them there.  The individual dedicates some amount of time to attending 
the meeting and that time is mostly not available for other purposes.  
(Although with sufficient sleep deficit many things are possible...)

Remote participation is by its very nature constrained to somewhat 
tactical (e.g. a document, a wg, a comment) interaction that's difficult 
to map to influence on the organization and its hard to draw 
equivalences with the in-person attendees on "skin in the game".  And 
the lack of in-person participation for any given person could be due to 
any number of circumstances including lack of resources to attend.

So how about making this simple:

Anyone (remote attendee, random person off the street, etc) can put 
their name on a recall petition by writing a check for $250USD (prorated 
for the average annual income of their country of citizenship), and 
supplying that with a redacted copy of their passport page or 
appropriate identity card.    If the recall petition is upheld and the 
person removed, they get their money back.  If not, the IETF drops the 
money in the IETF endowment. They have to sign an affidavit that the 
money is their personal money and they have not been and will not be 
reimbursed by any third party including their employer if any.

So for everyone - the skin in the game to sign a recall petition is an 
equal value - to them.  It has to cost them something personally to put 
the IETF through the pain of a recall.

And not many people would spend $250 equivalent for a DOS attack.

Later, Mike

> Best,
>
> Adrian
>
> *From:*Richard Barnes <[email-masked]>
> *Sent:* 25 October 2019 13:52
> *To:* Eliot Lear <[email-masked]>
> *Cc:* [email-masked]; [email-masked]
> *Subject:* Re: [Eligibility-discuss] Handling the fear of "bogus" 
> recall petitions
>
> I'm puzzled by the focus on meeting attendance and acculturation 
> here.  The former is at best an obsolete metric; the latter is so 
> vague as to be useless.
>
> Let me try to articulate propose a different operating principle here, 
> one effectively of self-determination: A person should have a say in a 
> decision if and only if they are affected by the outcome. I think this 
> principle leads to the right result in the base case, and provides 
> helpful insights in the recall/NOMCOM case.
>
> By "the base case", I mean: Who gets to participate in the development 
> of IETF specifications? While some are affected more than others, IETF 
> technologies have impacts for the whole Internet, so it makes sense 
> that anyone involved in the Internet should have a say -- and 
> nowadays, that's basically anyone.
>
> affected by the choice of who is on the leadership bodies.  Clearly 
> not everyone; your average user of the Internet has no reason to care 
> who's on the IESG.  Meeting attendees are affected to a degree, since 
> the NOMCOM-appointed leadership is in charge of setting the agenda and 
> the norms for participation. The people who are much more affected by 
> the leadership are those who are actively participating in document 
> production -- people who have authored documents, participated in 
> discussions in meetings, contributed to last calls, chaired WGs, etc.
>
> --Richard
>
>     > Asides from the fact that that leads to perpetuation and
>     ossification, I think we are agreed that "some level" of
>     established participation is required.
>     >
>     > Now, I would argue that physically attending three IETF meetings
>     does not do much more than show financial support from a sponsor
>     organisation. I might even suggest that there are a few people who
>     have attended a number of IETF meetings who really have no clue
>     how the IETF works: they "vote" on mailing lists; they post
>     individual drafts and are upset that no one converted them to
>     RFCs; they don't read the drafts. So let's not make the barriers
>     for remote participants such that we embarrass ourselves.
>     >
>
>     Yes, we have had all of that.  None of this guarantees clue, and
>     quite honestly, to address your other point, the culture sometimes
>     does have to change. So long as that is a conscious change, that’s
>     fine, but not knowing the culture means it would not be.
>
>
>     > On the other hand, I do agree that we need to see remote
>     participants as, in some sense, full participants before
>     considering that they can start a recall. So we are just arguing
>     about the detail.
>     >
>     > You (it seems to me) are suggesting a large number of potential
>     criteria against which we can measure "involvement". I am looking
>     for a more simple measure just like the 3-of-5 that we apply for
>     physical presence where we don't additionally require co-authoring
>     of I-Ds or some such.
>     >
>     I would be happy if someone attended so much as once, such that
>     the 3/5 would apply. The lengthy criteria was just meant to lower
>     the bar as far as possible, but one can certainly at least start
>     simple.
>
>
>     > And I'm happy to talk about that. But the question of "culture"
>     comes down to this: what is the IETF culture and where is it
>     documented?
>
>     Oh I don’t even think we have to go that far.  So long as someone
>     has an educated perspective, their entitled to decide that for
>     themselves.
>

---

From: Michael StJohns <[email-masked]>
Date: Fri, 25 Oct 2019 12:05:32 -0400

On 10/25/2019 11:47 AM, Michael StJohns wrote:
> Yes the IESG has impact on the set of people Richard listed, but the 
> IAB - not so much,, and the LLC even less so - at least directly.
>
Sorry for replying to my own post, but I had a "eureka" moment after 
reflecting on the last sentence above.

Why not have two nomcoms - one for the IESG (minus the IETF chair), and 
one for everything else.   The nomcom for the IESG could be open to 
remote participants while the other nomcom could use the current 
eligibility requirements.

It would also reduce some of the time commitments of any given Nomcom 
participant by splitting the load.

Later, Mike

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 26 Oct 2019 08:41:54 +1300

Hi,

Y'all have been typing busily while I was sleeping, so let me answer Adrian's point first (and I did read John Klensin's reply too), and then Pete's question:
> Or, at least, I did agree until the last sentence.

Firstly, yes, we are *only* talking about who can sign a recall petition, so it's reasonable to aks whether personal knowledge is needed, or whether the "target" of a petition is just a pattern of behaviour that can be observed remotely.

> But, contrarywise, the exact point, the substance, of a recall petition is based on "personal knowledge" of the recallee. That is, they have done something sufficiently egregious and notable to the…

I'm inclined to agree. That's why I wrote "assuming", in fact. In other words, it should be clear (and, BTW, consistent with our anti-harassment stance) that the target of a recall petition is a pattern of (mis)behaviour, not a person as such. So really the criterion for petitioners should be that they are in a position to observe patterns of behaviour, IMO.

> allay your concerns? If so, what would that number be? If not, why not?

The alternative would be some complex criteria that petitioners must have been subscribed to N mailing lists for M months, or co-authored at least X drafts, or something like that. But that quickly becomes a bureaucratic nightmare. So I'd be more inclined to go with Adrian's idea, with maybe 1/3 of petitioners needing to be Nomcom-eligible.

Regards
   Brian

---

From: Michael Richardson <[email-masked]>
Date: Sun, 27 Oct 2019 14:49:33 -0400

> that stop others from completing a small piece of work with an incremental

Because:
  1) it takes time and energy to get done
  2) potentially results in a bunch of additional questions that must now be
     resolved in future work, and
  3) seems to be a solution to a problem that we do not clearly have
     (what would we do for solutions without requirements in protocol space...)

For instance, will in SMs document, it is unclear to me who is eligible to be
(randomly) selected for the recall committee.  Do the new criteria apply?
(it doesn't say that).

If so, then the group of people who remove a member is different than the
group who can seat them.

If it's the original nomcom eligibility criteria, then the group of people
who can sign the petition might not be able to participate in the actual
removal.   But, maybe we don't even WANT any of the 10 (or 20) signators of
the original petition to be on the recall committee....  maybe we want them
available to "testify"?

Assuming we answer the above questions, have we just created a different pool
of people at great administrative cost, which will effectively never get used?
I can see a lot of "slippery slope" arguments coming at this document during
IETF LC, which will basically triple the amount of time it's gonna take.

Section 2.2 about Remote Participants tells me nothing about how the criteria
would apply.  Registered remotely... but did they pick up their badge?
(Because I think the secretariat removes people from the list who didn't show
up in person)

So in my opinion, solving the nomcom eligibility problem for remote users
solves the recall problem as well.

---

From: Michael Richardson <[email-masked]>
Date: Sun, 27 Oct 2019 14:54:29 -0400

> no skin in the game, they should get no say, not even as filler on a

But, they do have skin the game, having registered remotely for 3/5 of the
last few meetings.  That requires at least 12 months of preperation.

I guess someone could keep 10 (or 20) sock puppet accounts around all the
time and sell this service on the dark-net, but...

    > Again, we need some guiding principle / problem statement here, not just

Well, I mostly agree.

But, the result of the signatures goes to the ISOC President to strike a
recall committee.  The ISOC President gets to exercise judgement, and then
we get to randomly select 10 people to serve on the committee, and this
document doesn't admit remote attendees to the committee.

{I've been through multiple political parties that have had to deal with
"outsiders" crashing their leadership campaigns.   Hell... I've been involved
(unsuccessfully) in crashing the leadership campaigns of parties that were
verring toward racist/fashists.  I can read the fine print of consitutions
quite well.  So let me assure you that I understand your concern}

---

From: Michael Richardson <[email-masked]>
Date: Sun, 27 Oct 2019 15:04:51 -0400

Brian E Carpenter <[email-masked]> wrote:
    > The alternative would be some complex criteria that petitioners must
    > have been subscribed to N mailing lists for M months, or co-authored at
    > least X drafts, or something like that. But that quickly becomes a
    > bureaucratic nightmare. So I'd be more inclined to go with Adrian's
    > idea, with maybe 1/3 of petitioners needing to be Nomcom-eligible.

Doesn't this break if we later change nomcom-eligible to include remote-only participants?

(I don't think that the complex criteria need to be bureaucratic. It's just a
few lines of python)

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 28 Oct 2019 08:26:42 +1300

> Doesn't this break if we later change nomcom-eligible to include remote-only participants?

The two discussions may not be entirely separable.
 
> (I don't think that the complex criteria need to be bureaucratic. It's just a

Well, there are things like people whose email address changes but yes, it's
not really the mechanics of the criteria - just the complexity for people
to understand. The current rule is at least fairly simple.

   Brian

---

From: S Moonesamy <[email-masked]>
Date: Sun, 27 Oct 2019 16:07:22 -0700

Hi Michael,
>(randomly) selected for the recall committee.  Do the new criteria apply?

The latest version of the document is at 
https://tools.ietf.org/html/draft-moonesamy-recall-rev-02  Section 
3.1 intents to update the first four paragraphs of Section 7.1 of RFC 
7437 by replacing them.

>If so, then the group of people who remove a member is different than the

The document does not make any change to the other sections of RFC 
7437, e.g. the one about the creation of the Recall Committee.  The 
group is not different.

>the original petition to be on the recall committee....  maybe we want them

That text in Section 7.3 was reviewed by two IESGs.  If it was 
unclear, it should have been flagged during the IESG evaluations.

>(Because I think the secretariat removes people from the list who didn't show

The IETF 105 attendance list has 861 remote participants.  The list 
is probably incorrect as there isn't a last name or first name for 
Row 1.  It should be possible to get a list of remote attendees from 
Meetecho.  Are there "blue sheets" for remote participants?

Regards,
S. Moonesamy

---

From: John C Klensin <[email-masked]>
Date: Sun, 27 Oct 2019 23:47:53 -0400

--On Friday, 25 October, 2019 10:26 -0500 Pete Resnick
<[email-masked]> wrote:

> I took Adrian's proposal as the latter: SM's document assumes
> (maybe) that 3/5 remote registration is a close enough metric
> for skin in the game, and Eliot's concern was that you could
> end up with people with no actual skin in the game initiating
> the petition. Adrian proposed requiring someone under the
> current rule to be on the petition as a backstop for the new
> metric being misused. I think it's reasonable to ask the
> question: Does using such a backstop allay the concern, or is
> there something more to the issue and we really need a better
> metric? This is not about negotiating some compromise.

Pete,

Although I don't have a strong objection to Adrian's proposal,
nor to suggestions that someone not be considered a "remote
participant" (focusing on the "participant" part) unless they
actually sign into Meetecho for one or more sessions (I've even
suggested that a time or two), let me reinforce Any Malis's
observation.  If what we are worried about is DoS attacks, then
anyone wanting to organize one is going to have to start
planning and organizing bots or sock puppets more than a year in
advance.  If their intent is to attack a particular I* member,
that almost guarantees ineffectualness: they would spend a year
getting organized, and then initiate a process that would have
even someone seated at the beginning of that period in front of
the nomcom for renewal (or not) before they could be removed.
If their intent, instead, is to attack the IETF and its ability
to do work, well, there are much easier ways.

While I do not doubt the sincerity of those who are concerned
about DoS attacks and bogus petitions, analyses like the above
cause me to believe that the concerns are somewhat misplaced.

Several people have suggested that, if we cannot completely
reform the recall model, doing anything with the petition
process is a waste of time and energy.  Much as I would like to
see a complete process overhaul, I disagree with that view too.
The problem of remote participants -- even very active ones, not
being able to initiate recalls to seek to control an abusive or
out-of-control I* member is real, it makes the IETF look bad and
less hospitable to such people, to at least a first order
approximation, we know how to solve it.  A complete overhaul of
the recall process is a more complex matter and we don't have
good solutions to several of the issues including the
observation that, if the recall committee is going to work
largely f2f as the Nomcom does, a 3/5 f2f requirement does not
seem inconsistent with the requirements of the role.  That
doesn't mean we can't do better; if does suggest that insisting
on a complete solution as a condition for doing anything at all
is, whether that is the intention of not (and I assume that it
is not) a fairly good way to be sure that nothing happens at
all, at least in the relatively near future.

(and yes, Mike's suggestion of splitting the Nomcom function
itself into two parts is, to me, fascinating and deserving of
more consideration but it seems to me to be completely
orthogonal to the proposal on the table.)

best,
   john

---

From: John C Klensin <[email-masked]>
Date: Mon, 28 Oct 2019 00:14:48 -0400

--On Friday, 25 October, 2019 08:52 -0400 Richard Barnes
<[email-masked]> wrote:

>...
> With regard to NOMCOM and recall, this raises the question of
> who is affected by the choice of who is on the leadership
> bodies.  Clearly not everyone; your average user of the
> Internet has no reason to care who's on the IESG. 

Actually, while I can't speak to "average", I think there is a
situation in which the "average user of the Internet" might be
significantly affected by who is on the IESG.  Consider a
possible situation that, AFAIK, has never occurred but to which
we have occasionally come uncomfortably close.  Suppose that the
actions and decisions of a particular IESG had the appearance of
being strongly motivated by the interests, product designs, or
semi-proprietary protocols of their employer (or other vendor to
whom they have financial ties).  That is a problem.  By
potentially warping the marketplace as well as IETF decisions,
it could have an effect on users of the Internet who, under
normal circumstances, would have no idea what an "IESG" is.  I
don't see a sequence of appeals as a particularly good way of
dealing with a problem like that, especially if it cannot be
mitigated by someone counseling the problem AD into stopping the
behavior involved.   At that point, it seems to me that those
who were being hurt -- both users and competing companies who
might not have employees actively participating in the IETF and
maybe others -- would have, AFAICT, two possible alternatives.
One is an effective recall procedure; the other would be to seek
legal action against the IETF for not properly managing that
type of conflict of interest.  I think we would want to avoid
the second if at all possible (especially since, for those who
remember hearing about it, the ASME case and some similar ones
may suggest that we might lose).   That doesn't suggest that we
should go back to "the anyone can initiate a petition of RFC
2027" and its immediate successors.  It does suggest that, to
the extent possible, having a process that is not obviously
discriminatory toward some group of active participants is
probably wise.

   john

---

From: Michael StJohns <[email-masked]>
Date: Mon, 28 Oct 2019 00:20:43 -0400

> orthogonal to the proposal on the table.)

Not completely.   My observation was that splitting the Nomcom (and 
hence the related recall committee process - should have been more clear 
- I was dealing with lack of sleep) into two and making the membership 
of the IESG selecting/recalling committee(s) open to remote attendees 
might make some sense.  My thought here is that the remote-only 
attendees tend to have some idea of the standards related processes and 
giving them some say in the selection (or recall) of the people 
implementing those processes makes sense.

The IAB and LLC tend to be more about the support structure for the 
standards process and other things (e.g. IRTF, in-person meeting 
structure, long term planning, external relationships, etc) and leaving 
that to a Nomcom/Recall committee selected using the current criteria of 
in-person attendance, at least for the interim, also appears to make sense.

Creating a second Nomcom to off-load some of the work seems to make even 
more sense given the number of positions that the current Nomcom needs 
to fill each cycle - and it keeps ticking upwards.

WRT to the question of bogus  - ISTM you have to solve the problem of 
bogus people not only for the recall process, but for the selection of 
the Nomcom  at some point if you want to open either to remote 
participation.  It may be time to enumerate the possibilities people 
have discussed so far and just pick one.

I think I agree with Andy that the threat to the recall process is 
pretty minimal under most of the proposals.  There may be a higher 
threat if we want to open the appointment side.

Later, Mike

---

From: Michael Richardson <[email-masked]>
Date: Mon, 28 Oct 2019 11:07:12 -0400

S Moonesamy <[email-masked]> wrote:
    >> Section 2.2 about Remote Participants tells me nothing about how the
    >> criteria would apply.  Registered remotely... but did they pick up
    >> their badge?  (Because I think the secretariat removes people from the
    >> list who didn't show up in person)

    > The IETF 105 attendance list has 861 remote participants.  The list is
    > probably incorrect as there isn't a last name or first name for Row 1.
    > It should be possible to get a list of remote attendees from Meetecho.
    > Are there "blue sheets" for remote participants?

1) You can participate on Meetecho without registered.
   (I guess we agree that they don't count)

2) You can register as a remote an never join a single Meetecho.

3) You can register as a remote user, but then not login to Meetecho, and
   then you won't get counted as attendee.

I would think that the official list would be the one from the secretariat.
If we are going to do all this work, then let's do it for the selection
commitee too.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 28 Oct 2019 11:08:47 -0400

Brian E Carpenter <[email-masked]> wrote:
    >> Brian E Carpenter <[email-masked]> wrote: > The
    >> alternative would be some complex criteria that petitioners must >
    >> have been subscribed to N mailing lists for M months, or co-authored
    >> at > least X drafts, or something like that. But that quickly becomes
    >> a > bureaucratic nightmare. So I'd be more inclined to go with
    >> Adrian's > idea, with maybe 1/3 of petitioners needing to be
    >> Nomcom-eligible.
    >>

    >> (I don't think that the complex criteria need to be bureaucratic. It's
    >> just a few lines of python)

    > Well, there are things like people whose email address changes but yes,
    > it's not really the mechanics of the criteria - just the complexity for
    > people to understand. The current rule is at least fairly simple.

The secretariat deals with this already for on-site attendees.
If we could demand that people have a datatracker login, then they
effectively do the email change themselves.  I believe that the registration
system is going towards being linked to the DT login.

---

From: "Andrew G. Malis" <[email-masked]>
Date: Mon, 28 Oct 2019 11:41:10 -0400

I was remote for the Montreal IETF, and I needed my registration number in
order to log into Meetecho as a participant for WG sessions, so I could be
included in the blue sheets for sessions where I was a participant.

You are correct in that you don't need a registration number to just use
Meetecho as an observer.

> committee too.

+1

Cheers,
Andy

On Mon, Oct 28, 2019 at 11:07 AM Michael Richardson <[email-masked]>
wrote:

> is

---

From: S Moonesamy <[email-masked]>
Date: Mon, 28 Oct 2019 08:58:35 -0700

Hi Michael,
>    (I guess we agree that they don't count)

Please see https://www.ietf.org/how/meetings/104/remote/  Meetecho 
requires registration.

>2) You can register as a remote an never join a single Meetecho.

Yes.

>    then you won't get counted as attendee.

I doubt that Meetecho would could it as the user did log into a session.

>I would think that the official list would be the one from the secretariat.

Yes.

>If we are going to do all this work, then let's do it for the selection

Someone will have to submit a proposal if he/she would like to 
identify and address the wider issue(s).

Regards,
S. Moonesamy

---

From: Michael Richardson <[email-masked]>
Date: Mon, 28 Oct 2019 22:37:35 -0400

> Please see https://www.ietf.org/how/meetings/104/remote/  Meetecho requires
    > registration.

I can observe without registration.
I can ask questions on jabber without registration.
(I can do this by mistake, and wind up on not the list, or claim that I did)

    > Someone will have to submit a proposal if he/she would like to identify and
    > address the wider issue(s).

I would be happy to do that, but up until last week I didn't know what the
problem statement was, so I thought we were going to discuss if there was a
path forward.