Subject: Why sublicensing is important

From: John Levine <[email-masked]>
Date: 28 Aug 2004 17:05:23 -0000

A recent article in eWeek makes it crystal clear that the crucial
issue in the Microsoft patent license is sublicensing, and that the MS
lawyers can't (or at least won't) change the terms.

Sublicensing isn't an merely because MS is big company with lots of
lawyers.  The IBM Public License (see below) that they use for code
that they release to open source projects is sublicensable.  So why is
it critical here?  The reason you don't allow sublicenses of a free
license is to preserve your ability to change the terms in the future.
I'm not weaving conspiracy theories here, I'm just stating the
obvious.

So the question is whether we're willing to use a license that
Microsoft has told us that they're considering changing.  Without
attributing any evil intent, I find that much too risky simply because
I don't know what situation Microsoft will be in three or five years
from now, and neither does anyone else.  As someone who is constantly
writting twiddles to mail software and exchanging them with other
people (qmail patches, mostly) this presents a huge spanner that could
be chucked into the works at any time.

Since a lot of people have made it equally clear that they're willing
to go ahead with Sender ID, the least bad option seems to me to be to
move both Sender ID and SPF ahead as experimental standards.  They're
both experimental because we still have only the sketchiest experience
with day to day usage of both, and we don't know about server loads,
DNS loads, likely spammer counterattacks, or anything else
operational.  People who are so inclined can easily implement both,
particularly if they use the same DNS records.  Then MARID can turn
its attention to other things like CSV which are also useful and less
contentious, and let the IETF standards process work the way it's
supposed to, leading with any luck to the rough consensus and running
code that I think we all still want.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

PS:

eWeek article: http://www.eweek.com/print_article/0,1761,a=134028,00.asp

IBM public license: http://www-124.ibm.com/developerworks/opensource/license10.html

FYI, I happen to know the guy who write the article, and I think he
can be counted on to get his facts right.  Also, several people have
suggested that one could circumvent the sublicensing clause by
rounding up all of your friends and having them all get licenses that
could later be used if the terms change, but no-transfer prevents
that.  (No doubt this same scenario occurred to people in Redmond.)

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: "John Glube" <[email-masked]>
Date: Sat, 28 Aug 2004 15:20:15 -0400

John,

Thank you for putting forward your suggestions.

After Anne Mitchell made her initial post concerning the
Microsoft license, I sat down and re-analyzed the patent
license and reviewed the status of Sender-ID for my
personal benefit.

The conclusions I reached were:

* Reject Sender-ID because of the patent license, given
certain technical drafting issues and a lack of knowledge
about the formal patent application.

I realized that I had missed certain issues in my first go
through of the draft license and FAQ. 

* Allow Sender-ID to proceed, but on a conditional basis,
subject to field testing and resolution of the issues
surrounding the patent license and the exact nature of the
claimed intellectual property.

I also felt I did not have enough knowledge about how
Sender-ID would actually work in the wild to support full
approval at this juncture.

(The issues surrounding the implementation of the text
record by large corporations as reported to this list,
along with subsequent comments made about the design,
simply highlighted the difficultly for me.)

Upon balance my inclination was to go with the second
option of conditional approval.

In making these comments, I want to be clear that I still
consider Microsoft has done a good job in the FAQ and draft
patent license.

I attribute no bad intent to Microsoft. The negotiating
team which presented the FAQ and draft patent license to
this WG was carrying out their task, to fully protect the
organization's interests while being fair.

However, after going through the material for a second
time, after Anne rang the alarm bell, for which I am most
grateful, as her stance took courage, I personally
concluded the draft patent license did not go far enough. 

As to SPF, because it was not formally before the IETF, I
came to no conclusion other than to note, even though a lot
of work has been done with SPF, from inquiries I made large
scale testing was required before one could consider SPF as
a full standard.

(I realize some folks will probably consider the last
statement the equivalent of heresy, but...)

As to CSV, I will simply state having read through all of
the online discussions along with the drafts, I concur with
your analysis and suggestion.

For these reasons, I support your suggestion that both
Sender-ID and SPF be granted approval as experimental
standards. 

I agree that any approval of Sender-ID as a full standard,
in addition to being conditional upon testing and the like,
also be subject to satisfactory resolution of the issues
surrounding the intellectual property rights and patent
license.

I repeat, from my perspective my stance is not meant as a
criticism of the Microsoft negotiating team. 

Because of its size, Microsoft is easy to attack. Microsoft
is simply a large group of individuals working together to
achieve common goals. 

The individuals involved do take great pride in achieving
their common objectives and rightfully so.

Balancing the competing interests is not an easy task. This
is why I fully support the concept of conditional approval
for Sender ID as an experimental protocol. 

This will give the parties involved the time needed to sort
through the thorny issues surrounding the draft patent
license, while allowing for large scale testing of Sender
ID. In turn this will ensure, on full roll out, any rough
edges have been worked through so resulting in a better
result for all concerned.

John
 
John Glube
Toronto, Canada
 
The FTC Calls For Sender Authentication
http://www.learnsteps4profit.com/dne.html

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.737 / Virus Database: 491 - Release Date: 11/08/2004

---

From: Roy Badami <[email-masked]>
Date: Sun, 29 Aug 2004 00:07:47 +0100

>>>>> "John" == John Levine <[email-masked]> writes:

    John> A recent article in eWeek makes it crystal clear that the
    John> crucial issue in the Microsoft patent license is
    John> sublicensing, and that the MS lawyers can't (or at least
    John> won't) change the terms.

I think allowing sublicensing of the patent grant would significantly
weaken the effectiveness of the reciprocal patent grant as a defensive
measure.  It seems fairly obvious to me that the license is drafted in
such a way as to give maximum protection to the community as a whole
against patent claims on Sender ID.

Would it be possible for Microsoft to give some legally binding
guarantee that the Sender ID license will _always_ be available under
the current terms?  Would that meet your concerns?

Would Microsoft be willing to take such a step?

      -roy

---

From: "John Glube" <[email-masked]>
Date: Sun, 29 Aug 2004 10:19:03 -0400

Just for the record, since many people on this list may not
know, I do have a law degree (along with an undergraduate
degree in economics and mathematics) along with 25 years of
experience in providing sophisticated business and legal
analysis, including a number of years focused on issues
surrounding intellectual property, trade, marketing and
regulatory matters.

I should have added this to my earlier message in this
thread, when I wrote: 

>I sat down and re-analyzed the patent license and reviewed
>the status of Sender-ID for my personal benefit.

I regret any inconvenience.

John
 
John Glube
Toronto, Canada

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.742 / Virus Database: 495 - Release Date: 19/08/2004

---

From: "John R Levine" <[email-masked]>
Date: 29 Aug 2004 15:34:10 -0400

> the current terms?  Would that meet your concerns?

The reciprocal license issue hadn't struck me as an important one before,
but I see your point.

I agree that language promising to offer new licenses on similar terms to
anyone designated by current licensees would be about as good as
sublicensing, albeit more cumbersome for users.

> Would Microsoft be willing to take such a step?

Good question.  In view of the discussion with OSI's lawyer reported in
the article I cited, I'd be surprised if it hadn't come up.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: "John Glube" <[email-masked]>
Date: Mon, 30 Aug 2004 02:26:30 -0400

John and Roy,

Just a couple of follow up points to your discussion.

In an earlier post on this topic, I referenced Anne's note.
After going through the FAQ and draft license a few more
times, my own analysis pointed to a number of technical
concerns. These are more than just the sub-licensing issue. 

These include:

* MS wants to limit the patent license grant to that
intellectual property which is necessary to allow the
Licensee to only implement the Sender ID Specification,
presuming there is no other technically reasonable
alternative available.

In my view the proposed limitations are overly restrictive,
unduly favouring the competitive interests of MS.

MS needs to give more thought to properly balancing the
underlying interests.

In this case, we are dealing with email, part of the
Internet's very fabric.

There has been some discussion about the financial and
market power of MS. 

To avoid any concern, MS could consider going beyond even
IBM's stance and donating its IPR, along with any future
IPR involving Sender ID to the MS trust, with the
appropriate beneficiaries for a trust of this nature, the
trustees being nominated by MS, the trust protector being
Bill Gates.

The MS Trust would have the purpose of furthering the
continuous development of Sender ID.

Under the trust terms, anyone who wishes to implement
Sender ID including MS could apply to the trust for a
royalty free patent license upon reasonable terms (licensee
to take on an "as is where is" basis, waiving any right to
sue the trust for damages).

The key proviso? The applicant would have to grant its
existing IPR or any future IPR involving Sender ID to this
trust.

MS in turn could guarantee the trust's ability to perform
its functions, including defending any countervailing
patent claims made against the trust and enforcing
licensees obligations under any patent license as granted.

(Needless to say, much thought would have to go into
refining this concept.)

All I am saying is that at present the patent license does
not strike the proper balance. 

I add this is an extremely complex area, especially with
the international implications.

* MS, being an American corporation is subject to US export
law. 

The license contains a clause which reflects the need to
comply with any applicable export restrictions.

Firms outside the US may well sign the license. 

With the reciprocal patent grant, the clause reflects the
need to comply with any applicable foreign export
restrictions.

We require clarification as to whether there are any
existing US restrictions which prohibit export of the IPR,
including the need for export permits. Will MS undertake to
take the necessary steps to obtain and keep in force any
required export permits

However, there is an underlying issue. 

The US is a leader in developing new technologies. 

As a result, the US has very sophisticated and complex laws
regulating exports with extraterrorial application.

The US, imposes export restrictions on its technology for a
variety of social, political and strategic reasons. Members
of Congress and the President in their respective roles as
elected representatives of the American people pass the
needed laws to safeguard US national interests. 

The IETF and related bodies is a standards organization for
the Internet, which is world wide.

Even if Sender ID were granted RFC status tomorrow, world
wide implementation will take time.

Email is a crucial part of the Internet.

Though there may not be any applicable restrictions today,
the US for very valid strategic reasons necessary to
protect American national interests may at some future time
decide to impose restrictions on the export of technology
which could aid another nation state in fighting the spam
scourge, including the use of the Sender-ID technology or
any derivative and collaborative works.

MS can't guarantee such a restriction could not happen and
it would be wrong to ask for this kind of guarantee.

This possibility is not as far fetched as it may seem.

In saying this I appreciate there are a myriad of treaties
which impose various restraints on what nation states can
do.

This issue simply highlights the problem of properly
dealing with the potential clashes between national
interests and world wide implementation of an Internet
standard dealing with email.

* Applicable law  Typically in contracts between parties of
equal bargaining strength a jurisdiction is chosen which is
mutually acceptable to both parties.

Personally, I would prefer English law, with the venue
being the Court of Queen's Bench in London, England, no
right to a jury trial, the parties having the right to
agree on binding mediation.

However, the likelihood of this happening is slim to none,
so let me suggest New York State law and US law, the venue
being the US District Court of Southern Manhattan, no right
to a jury trial, the parties having the right to agree on
binding mediation.

I simply outline these points, so that folks appreciate, oh
if we just get MS to deal with the sublicensing issue as
Roy has proposed, all is fine.

Also, based on technical comments, it seems Sender ID is a
solution put forward in response to certain design criteria
of various large financial institutions who are confronted
with a real and immediate problem. 

This problem apparently affects:

* their continued ability to rely on email for
transactional purposes; and,

* their customers ability to trust email from financial
institutions, given the level of financial loses being
suffered.

Unfortunately, this pressing need also highlights the
rational for only granting experimental protocol status to
a standard which has global application.

Why? There are fundamental technical disagreements
concerning Sender-ID's role which remain unresolved.

The biggest one. Whether a proposal like Sender-ID is only
one part of a multi-layered defence which includes various
approaches to sender authentication , or should we treat
Sender ID as the only viable framework for sender
authentication.

Unfortunately, this lack of consensus highlights the
difficulty in granting Sender-ID anything more than
experimental status without first completing a full scale
operational and security review by graybeards and
conducting wide scale tests.

This analysis also points to how difficult it is for any
IETF WG to get involved in detailed analysis of any
proposed patent license.

This is why the guidelines contained in the RFC's dealing
with how to treat IPR claims have great merit.

In putting forward this analysis, I reiterate although I do
have a law degree and significant experience in legal and
business analysis, I am not a lawyer. This comment is
merely for information purposes only.

John
 
John Glube
Toronto, Canada

---

---

From: "John Glube" <[email-masked]>
Date: Mon, 30 Aug 2004 02:50:21 -0400

Two additional comments:

* The use of a trust (or the IBM form of patent license)
would also establish a precedent for how to deal with
DomainKeys.

* The counter argument to any perceived concerns about
application of US export law is simple. 

The US is a pluralistic democracy, with an enshrined bill
of rights and has been said before a democracy is the worst
system of governance, except for all the others.

John Glube 
Toronto, Canada

---

---

From: "Chris Haynes" <[email-masked]>
Date: Mon, 30 Aug 2004 09:11:21 +0100

"John Levine" opined:

<snip>
>...  the least bad option seems to me to be to
> particularly if they use the same DNS records.

</snip>

This proposal has within it the opprtunity to ameliorate the concerns over
Sender-ID's lack of defense against the Sender-ID-specific mode of
'bounce-bomb' attack - documented this morning in
"TECH-OMISSION: Security vulnerability - Malicious DSN attacks".

For an experimental phase the concerns could be reduced by:

1) Releasing Sender-ID at the same time as, or after, SPF

2) Recommending, either in Sender-ID or in an accompanying  BCP that:

"In the event of a Sender-ID test result of 'Fail', an SPF test of the Mail-From
address SHOULD be undertaken. If that SPF test should also 'Fail' the message
SHOULD be silently discarded."

draft-zinn-smtp-bounces-01.txt may be cited as 'proto-authority' for the
discard.

If this approach were to prove successful, I would recommend that the SHOULDs
above be changed to MUSTs in a post-experimental phase.

Chris Haynes