Subject: [Iasa20] summary table for the legal comparison of options

From: Jari Arkko <[email-masked]>
Date: Sun, 18 Mar 2018 20:35:21 +0000

The design team has been tossing around a table that would summarise the different options and how they relate to each other, at least in terms of their legal implications and who is able to perform specific tasks. The content comes largely from Alissa and the lawyers, but we thought it would be useful to try to see how the different things discussed in the design team document and legal options document relate to each other.

Comments, corrections, and additions are very welcome.

Jari

---

From: Michael Richardson <[email-masked]>
Date: Sun, 18 Mar 2018 22:48:42 +0000

I think that box II.b: Can donors write checks to IAO?,
for the "Activity of ISOC" that the value should be YES.

   https://www.ietf.org/mail-archive/web/iasa20/current/msg00336.html

We simply need to get the "doing business as" = "IETF" paperwork filed.
(In ontario, it costs $50, and you do it at an ATM-like kiosk)

{but, option 3 is still my preferred choice}

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Sun, 18 Mar 2018 22:52:10 +0000

Hmm, we're documenting there how it currently is, and right now if you
donate to IETF, you make out a check to ISOC that is kept in a specific
IETF account. I don't think we have that option with a US entity unless we
do one of the other options in the table.

On Sun, Mar 18, 2018 at 22:49 Michael Richardson <[email-masked]>
wrote:

> _______________________________________________
> iasa20 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/iasa20
>
-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 19 Mar 2018 13:27:10 +1300

On 19/03/2018 11:52, Joseph Lorenzo Hall wrote:
> Hmm, we're documenting there how it currently is,

In that case there's a bug. The row "Can IAO Board hire and fire the IAO 
Exec Dir?" should be "Yes" in all columns. Today the IAD is an ISOC
employee, but hired and fired by the IAOC. It's very clear in RFC 4071,
which was of course accepted by the ISOC Board in 2005:
"A committee of the IAOC is responsible for hiring and firing the IAD,..."

Also I think that the row "Can IAO Exec Dir hire and fire staff 
and contractors without ISOC approval?" should be split. It's clear today
that the IAD cannot hire and fire staff, but s/he manages contracts
and the signature by ISOC is a formality that doesn't deserve a "No".
(Unless we are being lawyers, but we're not.)

    Brian

and right now if you

---

From: Andrew Sullivan <[email-masked]>
Date: Sun, 18 Mar 2018 21:08:40 -0400

Hi,

> "A committee of the IAOC is responsible for hiring and firing the IAD,..."

As far as I understand the law -- and note that I am neither an HR
professional nor a lawyer, though I have had to do hiring and firing
in the United States though but not in Virginia -- either the IAOC/IASA
never set up the committee structure actually necessary to accomplish
this or else it is not legally possible.

One can't be fired by anyone other than one's employer.  ISOC is the
IAD's employer.  Only ISOC can fire the IAD, as a matter of law.  The
IAOC might decide that someone is no longer acceptable as IAD, but if
ISOC refused to fire such a person I don't know what happens.
Similarly, if the IAOC wanted to hire someone and ISOC refused, I
don't know hwat happens.  It seems the real bug is in RFC 4071,
because it appears to be asserting something that is simply factually
false.

I suppose it would have been possible to figure out some way to make
the members of the relevant committee employees of ISOC, though that
makes populating the IAOC or at least the relevant committee even
harder than it is already (my employer, for instance, absolutely
forbids concurrent employment by anyone else).  Anyway, I see no
evidence in the archive that this sort of arrangement ever happened.

> (Unless we are being lawyers, but we're not.)

I think you are assserting a simple formality that is not borne out by
evidence.  ISOC has a formal obligation to protect itself quite apart
from the IETF and the latter's wishes.  It is not obviously true that
the interests of ISOC generally and its organized activity (the IETF)
are always perfectly aligned, and I can think of examples from my
experience where what was obviously correct from the IETF's point of
view was not obvious from ISOC's point of view.  So, both in principle
and at least in an experience I have had, the "formality" claim
appears to me to be false.

None of this is to cast aspersions on anyone's good will or
intentions.  It is instead to recognise that, as conditions change,
the accurate description of them changes too.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 19 Mar 2018 15:03:38 +1300

> this or else it is not legally possible.

The committee membership is defined in RFC4071, but since the former
IAD was hired during the transition and startup phase, there was no
IAOC committee for his hiring; or if you prefer, the whole IAOC served
as the committee. (The IAOC was formed on 2005.04.07 by which time
the IAD search was almost done; the IAD was announced on 2005.05.31.)

There was certainly a committee for the IAD performance reviews
during the first couple of years of the IAOC. What was done recently,
I don't know.

But I am *not* talking about legal details. I'm talking about the de facto
situation. If the IAOC committee, which includes the ISOC President,
decided to fire the IAD, then I'm certain that ISOC would get on with it.

> appears to me to be false.

We disagree on that.

> the accurate description of them changes too.

Indeed. But those two lines in the comparison table make it look as
though the current model has defects which IMHO it has not suffered from.

Regards,
    Brian

---

From: Bob Hinden <[email-masked]>
Date: Mon, 19 Mar 2018 07:38:15 +0000

Andrew,

> On Mar 19, 2018, at 1:08 AM, Andrew Sullivan <[email-masked]> wrote:
> 
> Hi,
> 

When I was on the IAOC and it’s chair, if the IAOC had decided the IAD was not doing his/her job, then we would have told ISOC this and the person would be gone.  The IAOC put a lot of effort into writing annual performance reviews for the IAD.  The IAOC clearly has the authority to fire the IAD and hire a new one.  ISOC would have done exactly what the IAOC asked it to do.

Bob

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Mon, 19 Mar 2018 09:32:58 +0000

ISOC currently would be able to decide for itself whether or not to follow
through with the IAOC's wishes (we hour they would). As ISOC is the legal
employer of the IAD, they currently do the hiring and firing for that role.
That cell is correct.

On Mon, Mar 19, 2018 at 07:38 Bob Hinden <[email-masked]> wrote:

> When I was on the IAOC and it’s chair, if the IAOC had decided the IAD was
> not doing his/her job, then we would have told ISOC this and the person
> would be gone.  The IAOC put a lot of effort into writing annual
> performance reviews for the IAD.  The IAOC clearly has the authority to
> fire the IAD and hire a new one.  ISOC would have done exactly what the
> IAOC asked it to do.
>
> Bob
>
>
> >

---

From: Bob Hinden <[email-masked]>
Date: Mon, 19 Mar 2018 09:47:31 +0000

Joseph,

> On Mar 19, 2018, at 9:32 AM, Joseph Lorenzo Hall <[email-masked]> wrote:
> 
> ISOC currently would be able to decide for itself whether or not to follow through with the IAOC's wishes (we hour they would). As ISOC is the legal employer of the IAD, they currently do the hiring and firing for that role. That cell is correct.

Legally that is true, but in practice it’s not true.  For example, the IAOC made compensation decision about the IAD and ISOC always implemented.

Bob

---

From: Randy Bush <[email-masked]>
Date: Mon, 19 Mar 2018 09:58:35 +0000

> the IAOC made compensation decision about the IAD and ISOC always
> implemented.

not while i served my sentence on the iaoc.  the actual compensation was
a secret.

randy

---

From: Alissa Cooper <[email-masked]>
Date: Mon, 19 Mar 2018 10:10:35 +0000

If people go back to review the exchange between Pete and Kathy at the session at IETF 100, there was a need identified there to understand the extent of the legal authority that can be shifted from ISOC or shared between ISOC and the IAOC. The table that Jari circulated is responsive to that, I think. It seems quite appropriate for both ISOC and the IETF to understand, at bottom, who has the legal authority to do what.

With that said, the legal reality has effects on the practical reality. Hiring is not a one-step process. Because ISOC is the employer (or, in the case of the IIAD, the entity extending the contract), the process of doing the hiring has to comply with ISOC’s HR processes, which include things like doing a compensation study, establishing salary/benefits ranges, and negotiating benefits or contract terms. These processes apply to all of ISOC and the IAOC does not have input into most aspects of them (nor should it, IMO, given that the IAOC oversees one person out of a 100-person organization). The same is true for firing; although I don’t know the details since it hasn’t come up while I’ve been on the IAOC, I would presume that firing an ISOC employee involves some specified performance management steps that apply across all of ISOC. (Side note: it’s interesting that I don’t know the details of this despite being on the IAOC, because in other organizations with which I’m familiar anyone in an employee management role would have had to been trained up on what the employee management processes are.)

The same extends to the notion of ISOC’s contract signing authority being a “formality.” ISOC takes on legal liability for every contract it signs. We might want them to rubber stamp every contract that arrives on their desk for us, but in practice they do their own legal review, which seems justified given that the liability is theirs. And those reviews can raise issues that we then have to negotiate in order to work out. I would not call that process a formality.

Alissa

> On Mar 18, 2018, at 8:35 PM, Jari Arkko <[email-masked]> wrote:
> 
> <IASA 2.0 legal options table v4.pdf>

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 19 Mar 2018 06:28:36 -0400

> decided to fire the IAD, then I'm certain that ISOC would get on with it.

I believe that is true, too.  But that's not the same thing as being
able to hire and fire and so on: ISOC has that power.  That's not a
"legal detail".  It's _the meaning_ of "able to hire and fire".  This
doesn't seem like a complicated distinction to me.

> > appears to me to be false.

I assume we are not disagreeing about what my experience was, so it
must be my claim that the formality claim is false in principle.
Perhaps you could say something about what you think is false in that
argument: is it that ISOC has a formal obligation to protect itself as
an organization apart from the IETF?  Is it that the interests of ISOC
generally and the IETF as a particular activity might sometimes not be
perfectly aligned?  Something else?

I don't believe that anyone is claiming that there's some serious
breakdown in the relationship between the IETF and the rest of ISOC.
But some who have rather more recent experience than you do in the
direct functioning of IASA have observed that the mechanisms available
under the current structure mean that decisions can be affected by the
difference between the broader interests of ISOC as an organization,
and the interests of the IETF narrowly considered.  There is nothing
wrong with that: it is to be expected given the overall growth and
maturity of ISOC as an organization and the consensus model of the
IETF.

Fortunately, we never have had to test the issue of differences in
hiring or firing the IAD.  But it is plain that there is a legal
difference there, and that is a difference that could make a
difference.  And, without breaking the commitments to discretion
appropriate to IAOC membership, I think several people have testified
to their experiences of seeing the edges of that difference bearing on
IETF adminstrative decisions.  I don't think you have much of an
argument by stamping your foot and insisting that such things never happen.

Best regards,
A

-- 
Andrew Sullivan
[email-masked]

---

From: Michael Richardson <[email-masked]>
Date: Mon, 19 Mar 2018 10:34:07 +0000

Joseph Lorenzo Hall <[email-masked]> wrote:
    > Hmm, we're documenting there how it currently is

I don't believe that we are doing that.

The table list three options which are not current.
That we (ISOC) have never filed a "Doing Business As" (IETF) document is a
mystery to me.

    > to IETF, you make out a check to ISOC that is kept in a specific IETF account.
    > I don't think we have that option with a US entity unless we do one of the
    > other options in the table.

Google found this in a mere milisecond:
  https://www.entrepreneur.com/encyclopedia/doing-business-as-dba

  Procedures for filing for a fictitious name vary among states. In many
  states, all you have to do is go to the county offices and pay a
  registration fee to the county clerk. In other states, you also have to
  place a fictitious name ad in a local newspaper for a certain amount of
  time. The cost of filing a fictitious name notice ranges from $10 to
  $100. Your local bank may also require a fictitious name certificate to
  open a business account for you; if so, they can tell you where to go to
  register.

  In most states, corporations don't have to file fictitious business names
  unless the corporations do business under names other than their
  own. Incorporation documents have the same effect for corporate businesses
  as fictitious name filings do for sole proprietorships and partnerships.

So I added "Virginia" to the search and got:
  https://www.scc.virginia.gov/clk/befaq/fict.aspx

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Mon, 19 Mar 2018 10:35:40 +0000

> Legally that is true, but in practice it’s not true.  For example, the IAOC made compensation decision about the IAD and ISOC always implemented.

The table summarizes a legal memo.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Mon, 19 Mar 2018 10:41:16 +0000

> The table list three options which are not current.

The last column is the status quo option. We don't currently have ISOC
doing business at IETF (I didn't know that was possible, sounds like it
is). That could be part of any revamp of the status quo we work on if
the community doesn't favor the disregarded LLC or Type 1 SO options.

It sounds like that may provide a way for people to make checks out to
IETF (ISOC doing business as IETF) and then have that deposited in the
ISOC-owned but delegated-to-IETF bank account? Do I have that right?

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 19 Mar 2018 06:48:44 -0400

> ISOC-owned but delegated-to-IETF bank account? Do I have that right?

Yes, under that approach the cheques to be written for the IETF could
say "IETF" on them, and ISOC could receive them and deposit them in an
account with the named owner "IETF".  ISOC could conduct any business
as the IETF, of course, and the DBA name would do nothing about the
other adminsitrative issues we've been discussing, but it would solve
the name-on-cheque issue.  It would _not_ address the
money-is-fungible argument, since all the accounts would still be
controlled by ISOC (because "IETF" would literally just be another
name for certain business activities of ISOC).  This is of course
basically the situation we're in now.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Jari Arkko <[email-masked]>
Date: Mon, 19 Mar 2018 11:12:36 +0000

FWIW, my thoughts and experiences on this matter are close to what Andrew is writing here.

Of course Brian is correct that what we at the IETF management say (about hiring, firing, compensation, contracts), ISOC takes it very seriously. But in the current arrangement they have a role and duty to play too even for these practical matters, and they do it diligently. It is not a no-op or a mere formality. I’ve been involved in many instances where the control interface is far from direct (and quite rightly so, under the current arrangements). Or even the query interface.

(And again, FWIW, I’m generally in favour of organisations where control interfaces are short and direct.)

Jari

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 19 Mar 2018 14:59:10 +0000

I will add that the informal arrangements on hiring/comp (which seem to have varied over time with the IAOC) work fine when all is well. But when and if there are any disagreements or worse, the legal aspects of the arrangement will matter rather a lot. So it seems a good time to properly square that away, as part of a normal part of the maturation process of the organization and in order to better and more clearly define roles, responsibilities, and authority.

Jason

On 3/19/18, 11:13 AM, "iasa20 on behalf of Jari Arkko" <[email-masked] on behalf of [email-masked]> wrote:

    
    
    Jari

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 20 Mar 2018 08:14:57 +1300

> not while i served my sentence on the iaoc.  the actual compensation was

When the IAD was appointed, the salary level was discussed explicitly.
Obviously, it was a confidential discussion, but since the IAOC was the
hiring body (as I said before, acting as its own committee) it had
to be discussed. There was a sub-committee for the subsequent annual
reviews, so it would be normal to limit the compensation discussion to
that sub-committee.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 20 Mar 2018 08:21:58 +1300

> The table summarizes a legal memo.

Yes. Where we seem to disagree is whether that is particularly useful to
us in reaching a decision. I believe that in practical terms the table
is unfair to the present arrangement. That's not to deny that (as Andrew
has said) that ISOC has to perform due diligence in some cases. However,
don't forget that if we move the legal responsibility to a new entity,
the due diligence still has to be performed by somebody. It's unclear to
me that any effort is saved.

    Brian

---

From: "Leslie Daigle" <[email-masked]>
Date: Tue, 20 Mar 2018 02:42:35 -0400

That was true when the first IAD was appointed.

It is not, recently, true.

Leslie.

-- 

-------------------------------------------------------------------
Leslie Daigle
Principal, ThinkingCat Enterprises
[email-masked]
-------------------------------------------------------------------

---

From: "Leslie Daigle" <[email-masked]>
Date: Tue, 20 Mar 2018 02:49:23 -0400

It occurs to me I should unpack that a bit.

ISOC is a much larger, established organization now than it was in 
2004/05.   It has established pay grades and salary ranges and a more 
robust personal data confidentiality environment than existed a dozen 
years ago.  One of the consequences is resistance to sharing things like 
salary information.

That’s the sort of thing that I attempted to characterize in my 
various “we’ve all grown up” material, previously.

We are dealing with the ISOC of 2018.  That ISOC is 1/ demonstrably 
different than the ISOC of 2004, and 2/ as eager for our relationship to 
evolve to a new form as the IETF is (as far as I can tell).

Leslie.

--

---

From: Michael Richardson <[email-masked]>
Date: Tue, 20 Mar 2018 09:34:26 +0000

Joseph Lorenzo Hall <[email-masked]> wrote:
    > The last column is the status quo option.

I disagree.  It's not the status quo.  It's close.
It's not "do nothing".

The last column is that the IETF is *not* a seperate legal entity.

    > We don't currently have ISOC

    > ISOC-owned but delegated-to-IETF bank account? Do I have that right?

Yes, exactly.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 20 Mar 2018 09:39:39 +0000

In terms of legal organizational options, the last column is the "activity
of ISOC" option, which bounds from "do nothing" to "make it better within
the existing framework", but the legal consequences are the same.

Joseph Lorenzo Hall

---

From: Jari Arkko <[email-masked]>
Date: Tue, 20 Mar 2018 10:20:08 +0000

> ISOC is a much larger, established organization now than it was in 2004/05. It has established pay grades and salary ranges and a more robust personal data confidentiality environment than existed a dozen years ago.
> 

+1 

Indeed. All components of the system (ISOC and IETF included) are now much better at due diligence on all topics (not just salaries) and do their tasks very carefully. And they cannot entirely ignore organisational boundaries.

Jari

---

From: Bob Hinden <[email-masked]>
Date: Tue, 20 Mar 2018 10:23:17 +0000

> On Mar 19, 2018, at 10:35 AM, Joseph Lorenzo Hall <[email-masked]> wrote:
> 
> 
> 

Yes, but if the purpose is to help the community decide what it wants to do, it would be better to show what is current practice.  You could add an additional column.

Bob

---

From: Jari Arkko <[email-masked]>
Date: Tue, 20 Mar 2018 10:24:35 +0000

Brian,

> However,

Obviously, the actual tasks still need to be performed. There I agree.

But the question is whether extra effort is needed for either passing through the firewall of organisational borders (and experience says some effort is needed) or possibly also duplicating some effort (not sure about that).

The point of the other organisational options is that lines of control and information flow are clearer and with less boundaries that need to be crossed, making practical operations easier and responsibilities clearer.

Jari

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 20 Mar 2018 06:42:44 -0400

I may be dense, but any new column would duplicate the last column as
there is no legal distinction between the two (the table summarizes
the Morgan Lewis memo of legal options and overlays the draft-haberman
options at the top for comparison; any changes to IASA in an IASA++
model would happen under the current legal framework).

CDT's Annual Dinner, Tech Prom, is March 29, 2018. Don't miss the tech
event of the year!
Reserve a table today.: https://cdt.org/annual-dinner/

---

From: Bob Hinden <[email-masked]>
Date: Tue, 20 Mar 2018 11:42:11 +0000

Alissa,

> On Mar 19, 2018, at 10:10 AM, Alissa Cooper <[email-masked]> wrote:
> 

I think that’s all true.  However, I note that if we have our own organization we will need a similar set of HR rules and processes for our employees.  We will be subject to the personnel laws and regulations in the country where the organization is homed.  The choice isn’t ISOCs or none.

This is also a factor in picking a picking a country for the new organization to be formed.  For example, in some countries it’s very difficult to fire an employee, in others it easier.

Bob

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 21 Mar 2018 11:37:11 +1300

> Indeed. All components of the system (ISOC and IETF included) are now much better at due diligence on all topics (not just salaries) and do their tasks very carefully. And they cannot entirely igno…

No, of course not. But the words in RFC4071, which were formally accepted
by the ISOC Board, haven't changed:
" A committee of the IAOC is responsible for
  hiring and firing the IAD, for reviewing the IAD's performance, and
  for setting the compensation of the IAD."
Apparently ISOC has not been honouring that agreement. I don't recall
an IETF consensus to drop the last clause.

     Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 21 Mar 2018 11:42:53 +1300

> model would happen under the current legal framework).

I think Bob was asking for a column describing reality, not legal fictions.

We've just learned of one substantial difference between reality (IAOC
subcommittee does not set IAD's compensation) and legal fiction (under
BCP101, agreed by the ISOC Board, IAOC subcommittee does set IAD's
compensation). And, by the way, that's a fact that might significantly
change opinions.

    Brian