Subject: Re: Re; 3rd Party Disclosure problem in RFC 3979

From: [email-masked] (Scott Bradner)
Date: Mon, 13 Mar 2006 19:11:58 -0500 (EST)

Thomas 

its too bad you did not check with the editor of that RFC
before jumping to conclusions

it is not accurate to say its a typo because it's not - based on
discussion in the WG I specifically removed the process whereby
the Secretariat was directed to contact the IPR holder in such cases

if there is a typo at all its that the text should have
not refered to the disclosures under section 6 - it should have
said under section 6.1.1 and section 6.1.2

the text in v00 of the ID said
   (C)  Where the IESG has been informed of claimed intellectual
      property rights under (A), the IETF Executive Director shall
      request from the claimant of such rights, a written assurance that
      upon approval by the IESG of the relevant Internet standards track
      specification(s), all persons will be able to obtain the right to
      implement, use, distribute and exercise other rights with respect
      to an Implementing Technology under openly specified, reasonable,
      non-discriminatory terms unless such a statement has already been
      submitted. The Working Group proposing the use of the technology
      with respect to which the intellectual property rights are claimed
      may assist the IETF Executive Director in this effort.  The
      results of this procedure shall not, in themselves, block
      advancement of a specification along the standards track.  A
      working group may take into consideration the results of this
      procedure in evaluating the technology and the IESG may defer
      approval when a delay may facilitate obtaining such assurances.
      The results will, however, be recorded by the IETF Executive
      Director, and be made available.  The IESG may also direct that a
      summary of the results be placed on-line.

the text was in version 02 published in March 2003
this text was removed in version 03 published in March 2003

thus I expect the disussion that resulted in the removal was at the 
56th IETF meeting, 16-21 March 2003 - even though there is no mention
in the minutes

I do not recall specifically what the arguments were that it would 
be better to remove a process that had been in our process since 
2026 - he only thing I specifcally remember was that teh process
had almost never been used - maybe someone else has a better memory than I do

you may disagree with the working group conclusion but it was no typo

Scott

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipr-wg

---

From: Scott W Brim <[email-masked]>
Date: Mon, 13 Mar 2006 16:45:07 -0800

On 03/13/2006 16:11 PM, Scott Bradner allegedly wrote:
> I do not recall specifically what the arguments were that it would be
> better to remove a process that had been in our process since 2026 -
> he only thing I specifcally remember was that teh process had almost
> never been used - maybe someone else has a better memory than I do

I would imagine ... the IETF would then be in the middle of an assertion
by the third party about the first -- assuming the first party could be
contacted at all.  Is the IETF supposed to explain the 3rd party's
assertions to the 1st?

---

From: "todd glassey" <[email-masked]>
Date: Mon, 13 Mar 2006 17:27:03 -0800

In response to Scott and Thomas I think any 3rd party testimony as to IP
issues may be a privacy invasion... Here is the model:

"Party of the 1st part files a draft about IP it turns out the party of the
2nd part owns. The Editors publish the draft as an ID or a RFC. Sometime
later, another party, the party of the 3rd part finds out that party of the
2nd part owns the IP, and reports this to the Secretariat in a 3rd-party IPR
disclosure.

Situation one - party of the 1st part works for party of the 2nd part.

Situation two - party of the 1st part has no connection to party of the 2nd
part.

--------------------------------

Here is the question - Did the party of the 3rd  part violate the party of
the 2nd part's rights to privacy?

My lay answer is that I think so...  and further that the IETF's
secretariat's contacting the party of the 2nd part to demand disclosure
would also an additional invasion of the party of the 2nd part's privacy.
Jorge?

If thats true it seems that the only possible way around this would be if
the party of the 1st part who filed the IP with the IETF worked for or was
formally an agent of the party of the 2nd part, and so was acting on behalf
of the party of the 2nd part, which might allow one to claim that the party
of the 2nd part practiced a Submarine Patent Tactic - still what would you
do?

Todd Glassey

---

From: Thomas Narten <[email-masked]>
Date: Mon, 13 Mar 2006 21:16:33 -0500

Hi Scott.

> before jumping to conclusions

Sorry, I wanted to get this before the WG in advance of next week's
meeting, and I will be offline part of this week.

> the Secretariat was directed to contact the IPR holder in such cases

...

> 56th IETF meeting, 16-21 March 2003 - even though there is no mention

I just spent an hour or so reviewing the mail archives. I looked both
during the period between the two drafts and a little before and a
little afterwards.

I did not find any discussion of this issue.

Any other suggestions on where to look for discussion on this matter?
Anyone else recall discussing this point?

Thomas

---

From: [email-masked] (Scott Bradner)
Date: Mon, 13 Mar 2006 21:19:09 -0500 (EST)

> I did not find any discussion of this issue.

my memory is that the discusison was in the meeting - I do not recall it
was a long discussion - maybe 15 min

Scott

---

From: Thomas Narten <[email-masked]>
Date: Mon, 13 Mar 2006 21:33:54 -0500

> contacted at all.  Is the IETF supposed to explain the 3rd party's

Note: I've always assumed a pretty simple model for how third party
disclosures are supposed to work.

1) someone makes a disclosure. The disclosure presumably names an
   alleged IPR holder and/or includes a patent number or other
   concrete reference that allows one to identify the IPR holder.

2) The secretariat sends its standard followup request to the IPR
   holder pointing out that a third-party disclosure has been made,
   and do they intend to license under RAND or other terms per 3979.

3) IPR holder does the normal thing, which ranges from doing it's own
   disclosure (once it has reviewed the situation) to not responding
   at all.

4) WG follows the above, and takes into account whatever statement IPR
   holder makes, or does not make, in its deliberations.

Without having 3rd party disclosures result in a request from the
secretariat, we can end up in weird situations where a third party
disclosure has been made, but the IPR holder (who may well be active
in other WGs) is not necessarily even aware that the third-party
disclosure has been made. I don't think the community is well served
in this case.

Thomas

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 15 Mar 2006 13:25:30 +0100

> was a long discussion - maybe 15 min

A couple of comments with AD hat on:

1. If it's not in the minutes and wasn't discussed on the list,
I think the fellow who wrote up the IETF standards process would
tell you that as far as the process is concerned, it didn't happen.

2. As far as I recall, the IPR WG charter at that time didn't
authorize changes of IPR policy anyway, and this was a change,
since 2026 section 10 said:

>    (C)  Where the IESG knows of rights, or claimed rights under (A), the
>       IETF Executive Director shall attempt to obtain from the claimant
>       of such rights, a written assurance...

which applied regardless of the source of disclosure.

Now with AD hat off:

If it isn't a typo, IMHO it's a bug. It makes 3rd party disclosures
good only for one thing - creating FUD and having a chilling effect
on the draft(s) concerned. We have running code proof of this negative
effect right now in a certain case.

We don't, as far as I can see, expose ourselves in any way by simply
asking a standard question to the alleged IPR owner when a 3rd party
disclosure. Whether the alleged IPR owner answers is out of the IETF's
control, but I would suggest that we have two choices:

1. Require the question to be asked

or

2. Remove the possibility of 3rd party disclsosures.

     Brian

P.S. I already raised this issue a couple of times on the
list under the subject "A detail in BCP 79".

---

From: [email-masked] (Scott Bradner)
Date: Wed, 15 Mar 2006 08:45:45 -0500 (EST)

ell it sorta  happened because a changed version of the ID ws posted for
discussion but that specific change was not noted in the change log

> effect right now in a certain case.

the charter said to follow our running code - and the chaseing of 3rd
party disclosures was not running code - I if recall Steve Coya said
that he had not done this for many years - so the change was following 
the charter

this is not to say that the change was the rigyt thing to do but lets
discuss it on it merit rather than try to dismiss it for dubious process
reasons

Scott

---

From: "todd glassey" <[email-masked]>
Date: Wed, 15 Mar 2006 06:10:14 -0800

In response  -
----- Original Message ----- 
SNIP

> which applied regardless of the source of disclosure.

I dont believe that the IETF and the IESG can grant unconditional rights to
things they cannot show positive control over - its just not legal, no
matter what a bunch of technologists negotiated as their interpretation of
the law.

> effect right now in a certain case.

Actually it also liable's the IETF in that the IETF becomes a party to the
violation of the IP owners rights to privacy.

> asking a standard question to the alleged IPR owner when a 3rd party

No, I think you are wrong and that the verifying the 3rd party complaint
isd another violation of the individuals privacy and that it happens as a
formal communication from the Secretariat's office libels the IETF cleanly.
The issue Brian is what constitutes the Courts and Industry Accepted
'Standard of Care' with regard to the transfer of IP and the required
diligence on the transfer.

>  Whether the alleged IPR owner answers is out of the IETF's
> 2. Remove the possibility of 3rd party disclosures.

I suggest that 3rd Party Disclosures are a liability to the IETF and need to
be removed immediately.

Todd Glassey

---

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 15 Mar 2006 09:18:48 -0600

Responding with slight trepidation...

From: "todd glassey" <[email-masked]>

> diligence on the transfer.

I know that "Spencer doesn't get this" is NOT a meaningful observation in 
IPR (either the domain or the working group), but "Spencer doesn't get 
this". What individual are you talking about? The alleged owner of the IPR, 
or the third-party discloser?

If "alleged owner", I would be OK with having someone review the form letter 
that would be sent, but I bet large corporations send letters like this all 
the time ("we" - for some value of "we" - "have noticed that you might have 
IPR in this space. Could you either confirm (and send us licensing 
information) or deny this?"). I don't see how we are asking anything 
different (no need to explain, if we are. I'm not the person who needs to 
understand). This seems very solvable, if that's the concern.

If "third-party discloser", I would imagine that we could say, "it's been 
suggested" (note the absence of nouns) "that you might have IPR in this 
space. Could you either ..."). So this seems very solvable, if that's the 
concern.

> I suggest that 3rd Party Disclosures are a liability to the IETF and need 

I agree with Brian that if we accept third party disclosures and don't 
contact the alleged IPR owners, that's dumb and not helpful.

I would prefer to contact alleged IPR owners, since (this IS blindingly 
obvious to me) just because the IETF doesn't list third-party disclosures on 
a website doesn't mean that third-party disclosures won't be made, 
informally and in ways that we don't like.

Who's to say I won't call Cullen Jennings from a pay phone and, speaking 
with a hankerchief over my mouth, whisper, "the Gaflammitz corporation has 
IPR out the wazzoo on STUN/TURN/ICE, so you need to reject these techniques 
because they won't license to anyone with a last name starting with the 
letter J", and hang up the phone.

And if I do that, what is Cullen supposed to do, as RAI AD and co-chair of 
BEHAVE?

Spencer, who is wondering if "wazzoo" has ever appeared in an IPR e-mail 
before...

---

From: Pekka Savola <[email-masked]>
Date: Wed, 15 Mar 2006 18:37:36 +0200 (EET)

> From: "todd glassey" <[email-masked]>
....

You should have kept Todd in Cc: so I wouldn't have had to see this 
message :-/

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 17 Mar 2006 11:57:20 +0100

> discuss it on it merit rather than try to dismiss it for dubious process

As a fairly attentive WG participant at that time, I was absolutely
oblivious of the change or of the statement that the requirement wasn't
being followed. I was quite amazed last year to discover both that the
Secretariat wasn't doing this and that they had been told not too.
My intention was not to rewrite history, but to make the point that
this was a big surprise to me.

Now, as for the merits, I have no doubt. It's a bug. The only effect
of a 3rd party disclosure without follow up is to chill discussion
of the technology in the WG, or in extreme cases to throw doubt onto
already approved specifications.

    Brian

---

From: "Spencer Dawkins" <[email-masked]>
Date: Fri, 17 Mar 2006 06:38:10 -0600

From: "Brian E Carpenter" <[email-masked]>

> already approved specifications.

I'm agreeing with everything you said except "in extreme cases". If someone 
doesn't like an approved specification and can find any apparent IPR claim 
at USPTO that MIGHT be applicable, why would they not make a disclosure? I'm 
not even sure that would be "bad faith" - we encourage people to disclose 
IPR claims that they are aware of.

And if you can't find an apparent IPR claim at USPTO that MIGHT be 
applicable to any random specification, you're probably asleep or dead, I 
suspect, but I'll leave this as an exercise for the reader.

Spencer

---

From: "Spencer Dawkins" <[email-masked]>
Date: Fri, 17 Mar 2006 10:10:55 -0600

From: <[email-masked]>

> Is there a reason to constrain the search to the USPTO?
> Perhaps there are claims in other jurisdictions ... (noting
> that the US has not signed the Madrid accords and so most
> of the rest of the world has a different view on IPR claims)

No, except that most of the "gee, I patented using a laser pointer to 
entertain cats" patents I've seen have been USPTO, but certainly not all, as 
Bill points out.

My point is that USPTO would be a good place to start gathering background 
for FUD - other places may work as well, but I can't comment on that based 
on knowledge.

Spencer

---

From: "todd glassey" <[email-masked]>
Date: Fri, 17 Mar 2006 18:51:01 -0800

Specner - In response

So perhaps what you are running into is the lack of real oversight and
control on the IETF's Processes - this is an instance where you are worried
about someone shooting down an initiative by creating a hubbub about some IP
in a patetent or an applied for patent. And this is good that we are talking
like "That Title 35 Rights and Title 17 Rights are both critical becuase the
IETF's processes require the physical implementation of 'some thing' in a
standards track and this triggers the Title 35 Rights issues".

The Title 35 inclusions however open a whole new set of 'cans of worms' and
it might be a six-pack of worms too - the issues mean we need to carefully
build workflows and model each conveyance for each practice (standards, BCP,
IETF Governance, etc) and each legal constraint we need to address (i.e the
IP laws and Privacy issue). This in a legal sense is "simple diligence" and
its just what you do in the real world.

3rd party disclosures
---------------------
So what do you do about 3rd party disclosures - and BTW - did anyone in the
EU check to see if a 3rd party disclosure might violate the EU's privacy
directive - I bet it does.

There is precedent too for what to do in the Internet Society's
Operations... & since ISOC  honors 'private' domain registry's for the
public  its clear that the IETF's parent organization is clear on the
importance of privacy management and proper legal disclosures.

If the IETF were for instance to put in place processes for which the IETF
mandated they must be done, like the mandatory disclosure by third parties
of IP issues or Rights issues they know about with some IP,  and that
disclosure by an uninvolved 3rd party is illegal in some countries, then I
would be concerned that the IETF's processes force people to break the law.

IPR Report's as a weapon
---------------------------
Anyway I think that the 3rd Party Disclosure risk isn't one of someone
firing off a bunch of IPR disclosures because doing so to prevent someone
elses initiatives would be criminal - let me explain. I believe that the
filing of the 3rd party notice is a privacy invasion and that it also
constitutes tortuous interference since there is no required legal need to
disclose who the IP belongs to in the filing. The problem is that its done
by email and that brings RICO into it here in the States and the US DoJ MUST
and DOES investigate each and all RICO Compliants ... you dont have to
believe me - call your favorite FBI Agent and ask them.

A response from the IETF's Lawyer here?
-------------------------------------------
How about it Jorge - if someone files fraudulent or manufactured IPR notices
about something in some patent office that this 'individual believes'
impugns the transfer of the IP to the IETF because of some undisclosed lein
or IP claim - does that disclosure constitute an illegal act? if not in the
US is it anywhere?

How would this 3rd party be qualified legally to
make such a formal statement?
---------------------------------------------
OK... Makes sense, but how would the 3rd party filer be realistically
qualified to evaluate some other claim in a patent as impacting some other
IETF initiative??? This is a serious question because it brings the
Unlicensed Practice of Patent Law into the IETF as something formally
accepted I think. My feeling that this requirement forces the 3rd Party to
practice Law without a License and its a felony in the US.

The answer probably is that unless they had significant experience in
valuing or managing IP, or they had multiple patents of their own, or they
were a licensed patent agent or a praticing and licensed patent attorney,
they might in that instance be formally qualified to make a public diclosure
to the IETF, but unqualified testimony from a witness who likely has their
own competing initiatives to this one, about the legal impact of a patent
already filed or granted...

In closing - let me get personal too by the way, and ask the WG if anyone
else besides me has any patents?  Many many of you, like SMB and others are
published in the real-world, so let me ask, out of curiosity how many of
yopu have filed or own issued patents?

Todd Glassey, Global Patent Owner

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 19 Mar 2006 22:18:09 +0100

Spencer Dawkins wrote:
> I'm agreeing with everything you said except "in extreme cases". If 
> someone doesn't like an approved specification and can find any apparent 
> IPR claim at USPTO that MIGHT be applicable, why would they not make a 
> disclosure? I'm not even sure that would be "bad faith" - we encourage 
> people to disclose IPR claims that they are aware of.

Yes. The problem is not there; it's specifically the lack of follow-up
with the alleged IPR owner that causes the problem.

    Brian