Subject: does Nemo apply to IETF submissions...

From: "todd glassey" <[email-masked]>
Date: Sat, 12 Nov 2005 16:04:38 -0800

Jorge, Q:  Can I ask a legal question, that being does the doctrine of "Nemo dat quod non habet" apply to IETF submissions and those rights the IETF would propagate through to its end-users? And if so is it smart that the only proof of ownership of the IP is the email submission process? - an unauthenticated one at that?

Todd Glassey

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: Fred Baker <[email-masked]>
Date: Sat, 12 Nov 2005 20:51:52 -0800

IANAL

In such a case, says the one who considers himself to be a generally  
"reasonable man", one would have to provide that they had better  
title than the submitter.

There are countries in the world for whom PGP/etc authentication  
would pose a problem - it is technically illegal to have such  
software on one's computer. I personally don't have that problem and  
am happy enough to prove to you that this email is from me, but  
requiring all submitters to do the same would preclude submissions  
from, for example, China. And BTW, signiing the email in which I send  
it in demonstrates that I sent the email; it doesn't squat at about  
the contents, which might included a doctored or etc draft in a MIME  
attachment; that signature would have to be on the document itself.

On the other hand, I have had cases in which someone put my name on a  
draft as a co-author and I had to get that changed as I had not co- 
authored and in some cases was not in favor of their proposal. That  
has, however, generally been simple enough - I simply publicly  
repudiate the draft.

If Alice wrote a draft which Bob submitted under his own name, Alice  
would have a legitimate complaint with Bob. There have been cases in  
which such things were discussed in the IETF; those cases have  
resulted in our present "note well" notice. But community review in  
the appeals process and the pressure of loss of face on the part of  
the one who did it have been sufficient to deal with such in the past.

What's your point?

On Nov 12, 2005, at 4:04 PM, todd glassey wrote:

> Jorge, Q:  Can I ask a legal question, that being does the doctrine  
> of "Nemo dat quod non habet" apply to IETF submissions and those  
> rights the IETF would propagate through to its end-users? And if so  
> is it smart that the only proof of ownership of the IP is the email  
> submission process? - an unauthenticated one at that?
>
> Todd Glassey

---

From: "todd glassey" <[email-masked]>
Date: Sun, 13 Nov 2005 14:19:14 -0800

Fred - are we speaking to the visio workflow ? 
  ----- Original Message ----- 
  From: Fred Baker 
  To: todd glassey 
  Cc: Contreras, Jorge ; [email-masked] 
  Sent: Saturday, November 12, 2005 8:51 PM
  Subject: Re: does Nemo apply to IETF submissions...

  IANAL

  In such a case, says the one who considers himself to be a generally "reasonable man", one would have to provide that they had better title than the submitter.

With regard to IP protection claims - I agree - but since the Submitter's claims to the IP are not at all substantiated by the submission process except as a self-stated effort, this is not hard or unreasonable. It is this lack of preparation that is part of the larger issue of being accountable for its actions and any damage they might cause.

  There are countries in the world for whom PGP/etc authentication would pose a problem - it is technically illegal to have such software on one's computer.

Maybe to have those countries issue those tokens but not to recieve them.

   I personally don't have that problem and am happy enough to prove to you that this email is from me, but requiring all submitters to do the same would preclude submissions from, for example, China. 

How so? - All the IETF has to do is acknowledge SPAM and the process of forging an EMAIL header breaks the law, and its recieving and using these may as well, especially if an IP submission is made under this banner and the IETF doesnt do ***anything*** to verify that veracity. 

Remember - the participation in a WG is not a viable identifier of an individuals IP rights, and since the IETF is claiming "no memberships" are formally maintained, my opinion is that it would be negligent to try and force a corelation between the person participating in filing a document and then in its vetting... otherwise,  there clearly are members of the IETF ad the paper-sham of their being no accountable membership would vaproize IMHO.

BTW  - the Email Submission system has hope too I think, all  it would have to do is to fully enforce header rules to prevent email spoofing, a requirement for assured delivery in these days where so much fraudulent email stems from China as an example retorting your example Fred...

I cant speak for the Chinese Govenment's responsibilities, but I can for the IETF's, and it has a responsibility - and a legally enforceable one, to make sure the people submitting IP not only have the right to do so but are who they say they are. 

My feeling is that now by its refusal to do so then it make itself a party to any fraudulent releases that are filed through its flimsy and inherently unreliable system - one that would not stand up in any Court today becuase of the global SPAM email Problem. Bluntly - SPAM is the cause of the mandate for an authenticated delivery system and there is no choice any more.

  And BTW, signiing the email in which I send it in demonstrates that I sent the email; 

Yes - this is true - and since its "you" that the IETF is establishing the GIFT or CONTRACTUAL relationship with, that legally speaking is what it takes. 

Also under eSign, which can be formally invoked the signature process, at least a convenyance would have more legal clout... i.e. would  have similar if not exact legal competence as a wet-signed document - this is an issue of a mechanical formality.

  it doesn't squat at about the contents, 

Which is why a recursive process between the Submitter and the Gateway itself could and would address this and the proving of the email address at least more than once. Again - this is what would in SOX world be called a MONITORING CONTROL and while its not perfect, its mo bettah than what is in place now and would not financially tax the IETF's Editors I would think...

  which might included a doctored or etc draft in a MIME attachment; that signature would have to be on the document itself.

Could be done...

The problem is basic GIFT law then is a problem - The IETF's process "negligently assumes" that today's email is real ... and since the email account, something that can be set up in a heartbeat through GMAIL  or any number of free providers has no way of being traced really, this is an issue. 

You could not enter into a contract with anyone you couldnt identify - nor would you want to. So why accept a flimsy statement of ownership from someone who cannot from a audit perspective be authenticated in retrospect or have any of their rights proven by the simple submission of a document, and an unauthenticated email one at that?

  On the other hand, I have had cases in which someone put my name on a draft as a co-author and I had to get that changed as I had not co-authored and in some cases was not in favor of their proposal. That has, however, generally been simple enough - I simply publicly repudiate the draft.

Which may be fine for you in the near term but what about in a google search five years from now? I bet the faked document shows up... and persists to be availbale - so how do we know what's real?

  If Alice wrote a draft which Bob submitted under his own name, Alice would have a legitimate complaint with Bob. There have been cases in which such things were discussed in the IETF; those cases have resulted in our present "note well" notice. But community review in the appeals process and the pressure of loss of face on the part of the one who did it have been sufficient to deal with such in the past.

  What's your point?

They (those controls) arent sufficient any more. The problem is IP collissions and the possibility the IETF could be used to blast an enety by disclosing its proprietary trade secrets. The IETF cannot and must not ignore external IP rights and process requiremts as a SDO or it will be trounced sooner or later.

    Todd Glassey

------------------------------------------------------------------------------