Subject: Problem with the confidentiality section of BCP78 - the language obligates the IETF to be able to retract something.

From: "TS Glassey" <[email-masked]>
Date: Thu, 25 Sep 2008 14:28:31 -0700

There is a significant problem with the text of BCP78's Confidentiality 
section in that it creates an expectation that the IETF has built in a 
retraction problem to address what to do when confidentiality is violated by 
someone. Just having this policy saying its not allowed means that the IETF 
is aware that their publishing that material will cause significant damage 
to the owners of that IP. That creates an obligation to address what to do 
when that rule is violated. This has direct impact on the IETF since it has 
been told about this issue several times now. I am hoping it listens this 
time.

------------------------------------

3.2.  Confidentiality Obligations

   No information or document that is subject to any requirement of
   confidentiality or any restriction on its dissemination may be
   submitted as a Contribution or otherwise considered in any part of
   the IETF Standards Process, and there must be no assumption of any
   confidentiality obligation with respect to any Contribution. Each
   Contributor agrees that any statement in a Contribution, whether
   generated automatically or otherwise, that states or implies that the
   Contribution is confidential or subject to any privilege, can be
   disregarded for all purposes, and will be of no force or effect.

The first as we note in the opening sentence of 3.2 is that the IETF will 
not accept confidential information for submission and that simply isnt the 
case. The IETF's claiming that information submitted to it was not 
confidential is also not enforceable. Its a smokescreen to make it look like 
this issue has been dealt with when in fact its still a liability.

The problem is that the mechanical process of the IETF itself will not know 
whether this information is confidential or not, so acknowledging that this 
can happen and by stating that the IETF wont accept confidential 
information, this creates a new responsibility, and that is to build a 
process to address the retraction of information published by the IETF which 
turns out to be confidential.

   No information or document that is subject to any requirement of
   confidentiality or any restriction on its dissemination may be
   submitted as a Contribution or otherwise considered in any part of
   the IETF Standards Process, and there must be no assumption of any
   confidentiality obligation with respect to any Contribution.

Which reaffirms that the IETF *** MUST *** have a process for retracting 
content published under the IETF's any and all uses doctrine.

   Each
   Contributor agrees that any statement in a Contribution, whether
   generated automatically or otherwise, that states or implies that the
   Contribution is confidential or subject to any privilege, can be
   disregarded for all purposes, and will be of no force or effect.

This last statement is almost funny - "we agree that something that US Law 
says is real is not real"... nice and funny too.

No content that comes with any formal statement of its being confidential 
can be accepted in any form. This is not negotiable and its not something 
that can be negotiated around.  The addition of a confidentiality statement 
to anything that is submitted document's that the submitter is not legally 
empowered to represent that participation in the IETF and so the IETF's 
claiming that it is not bound by such claims is clearly not true.

---
Personal Disclaimers Apply

TS Glassey 

_______________________________________________
Ipr-wg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipr-wg