Subject: Re: Proposed immediate addition to NoteWell use rules.

From: tglassey <[email-masked]>
Date: Mon, 01 Feb 2010 07:54:38 -0800

On 1/31/2010 1:45 PM, Russ Housley wrote:
> Thanks.  I think I understand your position clearly now.
>
> Russ
>
> On 1/31/2010 3:52 PM, John C Klensin wrote:
>>
>>
>> --On Sunday, January 31, 2010 14:20 -0500 Russ Housley
>> <[email-masked]>  wrote:
>>
>>> ...
>>> I agree with your observation about "norms".  You seem to
>>> think that coming to consensus on words that describe them is
>>> not going to be easy.
>>
>> Actually, I don't have an opinion about that.  It would
>> certainly be easy to say "no harvesting", for example.
>>
>>> I am unwilling to add words to the NOTE WELL without the
>>> consensus.
>>
>> I agree with that position.  I also agree with you that
>> complaining, or even making suggestions, in the absence of an
>> I-D that proposes specific changes and that could be considered
>> for adoption as a BCP is a waste of everyone's time.
The problem is that as the management of the IETF you are responsible 
for intentionally putting grossly incompetent practice into place 
whether it was voted in by a bunch List Members of not.

Todd

>>
>> However, I was trying to reason another step ahead and consider
>> what steps we might take if such an I-D were actually written.
>> I was suggesting that, however easy it might be to formulate
>> words, generating a BCP (or other clear evidence of consensus)
>> inevitably takes considerable resources.  Let me try to say that
>> differently.
>>
>> I  believe that
>>
>>     (1) It would not be useful to expend those resources
>>     unless we had a reasonable expectations that, e.g., a
>>     change to the Note Well would actually change behavior
>>     of anyone who is deliberately and consciously ignoring
>>     the unwritten norms today.
>>
>>     (2) Those who have been harvesting names from the IETF
>>     lists are almost certainly aware of those norms and are
>>     deliberately violating them for what they consider more
>>     important purposes.
>>
>>     (3) That implies that our trying to adjust the Note Well
>>     (presumably by formulating a new BCP) is not worth the
>>     effort --no matter how difficult or easy we believe
>>     finding the right words would be-- unless the Trust
>>     and/or ISOC were committed to litigation against those
>>     who were harvesting the IETF (or WG) list(s) and had
>>     already concluded, on advice of Counsel, that such
>>     litigation had good odds of success if the Note Well
>>     text were changed.
>>
>> To summarize, I do not believe that the IESG should either
>> assign the task for creating such a BCP to this WG or another
>> one, or consider a Last Call for an individual submission BCP,
>> unless a conclusion has first been reached that such a BCP would
>> be a good foundation for litigation and that the IETF (or
>> someone on the IETF's behalf) would, in fact, litigate.
>>
>> Is that more clear?
>>     john
>>
>>
>
>
> No virus found in this incoming message.
> Checked by AVG - www.avg.com
> Version: 8.5.432 / Virus Database: 271.1.1/2659 - Release Date: 01/31/10 06:39:00
>
>

---

From: tglassey <[email-masked]>
Date: Sun, 31 Jan 2010 09:15:51 -0800

On 1/31/2010 8:45 AM, Russ Housley wrote:
> The -honest mail list annoy me like everyone else.  I do not think it 
> is appropriate to add any text to the NOTE WELL that does not come 
> from a BCP.
>
> Please feel free to post an Internet-Draft with your ideas for 
> consideration as a BCP.
Then the ANY AND ALL USES control is what is effective and that is the 
problem. You (the IETF Management), as I have said, by the unrestricted 
use of all of that content, have allowed for this abuse.

The other issue is I want to post formally to the IPR Page that my Email 
Address(es) are not to be considered part of the IETF licensed 
properties and it wont allow for that. So by the way the process works 
today you force any member to accept this spamming because you refuse to 
put these simple controls in place.

Are you mad? This is lunacy and it's easily fixed. Just outlaw the use 
or compilation of IETF identities as member information for any purposes 
outside that WG's operations. If the WG Chair wants to formally allow 
the seeding of another list that is between the WG Chair and the new 
list operator. The issue is outside users and the amount of background 
noise they cause.

Why is it so difficult to see that a simple revision of the Note Well 
use guidelines is in place. Remember that there is nothing in the IETF's 
subscription process which warns the parties subscribing that the EMail 
Address they post through will become public and as such they may 
receive other emails to that address for which the IETF takes no 
responsibility... but that also doesnt exist...

So lets fix this one this time around. By the way you realize one of 
those suspensions from Harald I got was for arguing this very point. Why 
not bring Jorge in or at least formally ask him off list if the 
liability I point out is not accurate or not.

Todd
>
> Russ
>
> On 1/31/2010 11:34 AM, tglassey wrote:
>> I propose the following amendment to the NoteWell Use terms:
>>
>> "While IETF Technology Documents and their Vetting Process produces a
>> large amount of communications between parties, email addresses in those
>> may only be used in the furtherance of that specific initiative. Those
>> addresses are the property of the IETF and represent the one part of
>> IETF intellectual properties which are not made available to third
>> parties for the creation of pre-built mailing lists outside of the IETF
>> itself."
>>
>> This will stop anyone from harvesting the email addresses of people and
>> then setting up subsidiary lists
>>
>> Todd Glassey
>>
>
>
> Version: 8.5.432 / Virus Database: 271.1.1/2658 - Release Date: 01/30/10 19:35:00
>
>

---

From: tglassey <[email-masked]>
Date: Sun, 31 Jan 2010 08:34:09 -0800

"While IETF Technology Documents and their Vetting Process produces 
a large amount of communications between parties, email addresses in 
those may only be used in the furtherance of that specific initiative. 
Those addresses are the property of the IETF and represent the one part 
of IETF intellectual properties which are not made available to third 
parties for the creation of pre-built mailing lists outside of the IETF 
itself."

Todd Glassey

---

From: Lucy Lynch <[email-masked]>
Date: Mon, 1 Feb 2010 09:35:11 -0800 (PST)

On Sun, 31 Jan 2010, tglassey wrote:

> large amount of communications between parties, email addresses in those may 
> only be used in the furtherance of that specific initiative. Those addresses 
> are the property of the IETF and represent the one part of IETF intellectual 
> properties which are not made available to third parties for the creation of 
> pre-built mailing lists outside of the IETF itself."

While I sympathize with the impulse, I would not like to see this text
bolted on to the NoteWell. Please record a No from me.

- Lucy

> This will stop  anyone from harvesting the email addresses of people and then 
> setting up subsidiary lists
>
> Todd Glassey
> _______________________________________________
> Ipr-wg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipr-wg
>

---

From: John C Klensin <[email-masked]>
Date: Mon, 01 Feb 2010 12:55:17 -0500

--On Sunday, January 31, 2010 09:15 -0800 tglassey
<[email-masked]> wrote:

>...
> Are you mad? This is lunacy and it's easily fixed. Just outlaw
> the use or compilation of IETF identities as member
> information for any purposes outside that WG's operations. If
> the WG Chair wants to formally allow the seeding of another
> list that is between the WG Chair and the new list operator.
> The issue is outside users and the amount of background noise
> they cause.
>...

Todd,

I think the paragraph above exactly captures where we disagree.
I can think of no possible way by which the IETF would acquire,
or could reasonably claim, enough legislative authority to
"outlaw" anything, much less enough of the right sorts of
authority to enforce such laws.

If there were a legal context that said 'if an organization says
"don't use our mailing list for so-and-so", it is a crime to do
so and the state will enforce violations', we would be having a
very different conversation.   But, as far as I know --and,
unlike, e.g., some anti-harassment statutes about uses of the
PSTN-- there is no such statutory context.

Without that context --or somehow declaring the Internet as a
country that we govern and raising an army to support that
claim-- I think the most we could possibly do (even with
consensus and a BCP) would be to scatter statements around that
indicate that we consider certain kinds of behavior abusive and
as violating terms and conditions that people implicitly agree
to by subscribing to, or looking at the archives of, our lists
_and_ then trying civil litigation against anyone who violated
those norms.  My opinion on that subject is probably clear from
my prior notes.  But "outlawing" something requires the ability
to make laws, doing it meaningfully requires the ability to
enforce laws, and the IETF just doesn't have that sort of power
or authority.

    john

---

From: "Endre Jarraux Walls" <[email-masked]>
Date: Mon, 1 Feb 2010 13:09:34 -0500

I certainly agree with Lucy on this one - the language that the addresses
are property of the IETF is misleading in my opinion. I believe there should
be language in terms of acceptable use policies, but I believe the fix to
preventing harvesting should be a technological one and not necessarily a
legal one. The masking of email addresses in group lists is popular in other
mailing systems, why not IETF's? Protecting the addresses should be more an
issue of privacy policy than just preventing spam - the IETF clearly has a
fiduciary responsibility in this regard.

On the legal side, I would not oppose language that set form terms of use
that all members and anyone joining the lists must adhere to. But I'm not
sure there's much we could do beyond that. Certainly "outlawing" people from
harvesting the addresses is impossible, IMHO.

Endre Jarraux Walls

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Lucy Lynch
Sent: Monday, February 01, 2010 12:35 PM
To: tglassey
Cc: Contreras, Jorge; [email-masked]; [email-masked]
Subject: Re: Proposed immediate addition to NoteWell use rules.

> large amount of communications between parties, email addresses in those
may 

- Lucy

> This will stop  anyone from harvesting the email addresses of people and
then 

__________ Information from ESET Smart Security, version of virus signature
database 4824 (20100201) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature
database 4824 (20100201) __________

The message was checked by ESET Smart Security.

http://www.eset.com

---

From: Lucy Lynch <[email-masked]>
Date: Mon, 1 Feb 2010 11:32:17 -0800 (PST)

On Mon, 1 Feb 2010, tglassey wrote:

> On 2/1/2010 9:35 AM, Lucy Lynch wrote:
>>> addresses are the property of the IETF and represent the one part of IETF 
>>> intellectual properties which are not made available to third parties for 
>>> the creation of pre-built mailing lists outside of the IETF itself."
>> 
> Lucy do you and the rest of the TRUST members accept formal legal liability 
> for this decision and any damage it causes relying parties? Because if the 
> answer is NO then I put it to you that you in fact are liable as an officer 
> of the Trust... and since NO ERRORS AND OMISSIONS policy can be put in place 
> to cover damages from unenforceable contracts you have a sua sponte 
> responsibility to get it right the first time.

Todd -

I'm no longer a member of the IAOC and hence no longer an officer of the
IETF Trust. I'm just another volunteer - speaking with no hats on.

- Lucy

>> Version: 8.5.432 / Virus Database: 271.1.1/2662 - Release Date: 02/01/10 
>> 12:37:00
>>
>> 
>
>

---

From: Todd Glassey <[email-masked]>
Date: Mon, 01 Feb 2010 13:44:14 -0800

On 2/1/2010 11:32 AM, Lucy Lynch wrote:
>>>>    "While IETF Technology Documents and their Vetting Process 
>>>> produces a large amount of communications between parties, email 
>>>> addresses in those may only be used in the furtherance of that 
>>>> specific initiative. Those addresses are the property of the IETF 
>>>> and represent the one part of IETF intellectual properties which 
>>>> are not made available to third parties for the creation of 
>> Lucy do you and the rest of the TRUST members accept formal legal 
>> liability for this decision and any damage it causes relying parties? 
>> Because if the answer is NO then I put it to you that you in fact are 
>> liable as an officer of the Trust... and since NO ERRORS AND 
>> OMISSIONS policy can be put in place to cover damages from 
>> unenforceable contracts you have a sua sponte responsibility to get 
>> it right the first time.
>
> Todd -
>
Unfortunately your fiduciary role doesnt end there - I suggest you speak 
with Jorge about this formally.

Todd
>
> - Lucy
>
>> Todd Glassey
>>>
>>>> This will stop  anyone from harvesting the email addresses of 
>>>> people and then setting up subsidiary lists
>>>>
>>>> Todd Glassey
>>> Version: 8.5.432 / Virus Database: 271.1.1/2662 - Release Date: 
>>> 02/01/10 12:37:00
>>>
>>>
>>
>>
> Version: 8.5.432 / Virus Database: 271.1.1/2662 - Release Date: 02/01/10 12:37:00
>
>

---

From: Todd Glassey <[email-masked]>
Date: Mon, 01 Feb 2010 14:10:05 -0800

> authority to enforce such laws.
John this is the problem it doesnt take any legislative authority to 
tell people that cannot harvest addresses from IETF Technology 
Publications and you know it. This IS THE REAL PROBLEM THE IETF HAS and 
its about where the organizations collective head is placed not - let me 
say a little more - it is doubtful that a window crank would do any good 
here either IMHO.
> PSTN-- there is no such statutory context.
Which means that it is formally within the USES AUTHORIZED by the IETF 
to send any email to any of those addresses for any purposes. It is the 
IETF who as a collective and the IPR WG in particular that made this 
decision for all of the IETF and it is now in place. That says a lot of 
really bad things about the IETF and the people here in this WG and its 
pretty much cut in stone - the issue is how to fix it and whether it 
will take litigation against the people in management here at the IETF 
to wake you folks up.

I suggest that it may be closer than you think and that you all are 
accountable for the damages you have done with what I consider to be 
this WG's grossly incompetent actions. Sorry but accountability is 
something new for many here but its a thing that is going to stay with 
us all.

Todd

---

From: tglassey <[email-masked]>
Date: Mon, 01 Feb 2010 11:07:19 -0800

On 2/1/2010 9:35 AM, Lucy Lynch wrote:
>> specific initiative. Those addresses are the property of the IETF and 
>> represent the one part of IETF intellectual properties which are not 
>> made available to third parties for the creation of pre-built mailing 
>> lists outside of the IETF itself."
>

Lucy do you and the rest of the TRUST members accept formal legal 
liability for this decision and any damage it causes relying parties? 
Because if the answer is NO then I put it to you that you in fact are 
liable as an officer of the Trust... and since NO ERRORS AND OMISSIONS 
policy can be put in place to cover damages from unenforceable contracts 
you have a sua sponte responsibility to get it right the first time.

Todd Glassey
>
>> This will stop  anyone from harvesting the email addresses of people 
>> and then setting up subsidiary lists
>>
>> Todd Glassey

---

From: tglassey <[email-masked]>
Date: Mon, 01 Feb 2010 11:13:14 -0800

> authority to enforce such laws.
The problem John is that the IETF cannot change legal standards because 
they offend the technology crowd herein.
> very different conversation.
There is if the IP rights specified do not allow for it. The problem is 
that the people who designed the participation and use process ignored 
the issue of the EMAIL ADDRESSES - it was specifically brought up and in 
bringing it up I earned one of Harald's unwarranted and un-opposable 
suspensions which the IESG supported so the issue here is liability and 
it doesnt matter whether you personally claim you are not liable you in 
fact are.

Sorry but the IETF cannot put its head in the sand and claim "It wasn't 
our fault - we said we were not liable and you cannot touch us because 
we are technologists" - which from my perspective is why the IETF is in 
the position its in here...

Todd Glassey

>   But, as far as I know --and,

---

From: tglassey <[email-masked]>
Date: Mon, 01 Feb 2010 14:40:51 -0800

> fiduciary responsibility in this regard.

1)    Because then anyone can continue to use those addresses when they 
figure out another way around this matter.
> that all members and anyone joining the lists must adhere to.
2)    That is all that's necessary to fix this problem - it will allow 
individuals to seek their own recourse agaisnt the spammers
>   But I'm not
> sure there's much we could do beyond that.
Sure there is - and the fiduciary responsibility doesnt slip away when 
officers of the IETF change roles - the responsibility and failing for 
their period of office is still actionable after they leave office (so 
Lucy - so what you are not a trustee anymore - you can still be nailed 
for this stuff while you were a trustee - and that was my point - 
further, since you are still an IETF "gold" participant the fiduciary 
responsibility remains I am betting. Ask Jorge off list so he actually 
answers you on this one.
> Certainly "outlawing" people from
No its not - its easy. They are IP - all that has to happen is to say 
that ALL COMMUNICATIONS WITH REGARD TO IETF STANDARDS PROCESSES MUST 
TAKE PLACE WITHIN THE WG AND ON THE IETF'S LIST SERV. And further that 
no harvesting of addresses was acceptable uses therein.

This is all it takes and its no sweat off the IETF's back this way. The 
current solution encourages people to break the rules and its broken.

Todd