Subject: [mile] IPR and Transfer Considerations

From: "Baker, Jon" <[email-masked]>
Date: Fri, 3 Aug 2012 15:27:44 +0000

During the MILE WG session there were questions raised related to MITRE IPR. I would like to make sure that the list is aware that MITRE has accommodated all IPR related requests that have been made by this group. There are three issues that have been raised:

1- Shortly before the Paris meeting (IETF 83) a concern was raised about the wording in the disclaimer portion of our terms of use pages not aligning well with the wording that that IETF uses. At that time we made a small change to the disclaimer for all the relevant efforts we support. To the best of my knowledge, this issue was addressed. 

2- At the Paris meeting it was clear that there was confusion about the licensing of CVE and several other efforts. I was asked, "How much does CVE cost?" This too has been addressed. CVE and these other efforts are clearly free to use.  

3- Lastly, during the MILE WG session Tuesday of this week, it was made clear that MITRE needs to post IPR disclosures for all of the relevant efforts that MITRE supports. As of August 2, 2012 IPR disclosures have been submitted. I don't think they have been posted by the IETF yet. 

Are there other IPR concerns that we are not aware of?

There were also questions raised about MITRE's willingness to transfer IPR to the IETF. I attended the Paris meeting (IETF 83) and during the SACM side meeting was given the opportunity to discuss MITRE's perspective on this topic. At the time I talked through what MITRE sees as the key distinctions to be made when considering transferring a given effort to any other organization. As a reminder I discussed the following:

REGISTRIES VS. LANGUAGES 
----------------------------------
Roughly speaking, efforts can be grouped into two primary categories: registries of named objects (e.g. CVE) and languages for defining structured content (e.g. OVAL). As a rule, languages are good candidates to go to formal standards bodies as they mature. In contrast, while registries may be referred to by the work developed in standards bodies as external dependencies; standards bodies do not typically operate registries.

EFFORTS HAVE MULTIPLE SUBCOMPONENTS
------------------------------------------------------
Registries tend to have three primary sub-components, including:
     i) the syntax of the namespace,
     ii) the registry of officially recognized objects and
     iii) definitions of acceptable use (which may include product testing requirements).
Languages tend to have four primary sub-components, including:
     i) the specification of the language,
     ii) repositories of content written in that language,
     iii) a reference implementation that can be used to verify both the language and content authored in the language and
     iv) definitions of acceptable use (which may include product testing requirements).
These components need to be considered separately. 

USG EFFORTS VS. MITRE MANAGED EFFORTS
-------------------------------------------------------
In considering the transition of MITRE efforts to standards bodies and how these decisions will be made, it is important to clearly distinguish between US Government (USG) efforts and efforts that our sponsors have directed MITRE to operate as a neutral 3rd party under our FFRDC charter.

As you might imagine this leads to a sort of matrix that must be considered to ultimately ensure that a successful and appropriate transition is made for any given effort. Outside the MILE and SACM lists there are many organizations that depend upon the efforts that MITRE has led for many years, in some cases it is several hundred or more. In fact, it is hard to imagine an INFOSEC professional in the US that has not used CVE (either directly or indirectly)  in their career and CVE is translations are available in many other languages too. MITRE has a responsibility to ensure the stability of these efforts and not lose sight of the community that depends upon them today.

Rest assured that MITRE and our sponsors view successful transfer of standards to international bodies as the ultimate goal of much of our standards work. MITRE is actively following the MILE and SACM lists, has raised awareness of the relevant IETF activities in the existing standards related forums that we host, and is actively engaging with our sponsors on the topic of international standards. 

Thanks,

Jon

============================================
Jonathan O. Baker
G022 - IA Industry Collaboration
The MITRE Corporation
Email: [email-masked]

---

From: Sean Turner <[email-masked]>
Date: Fri, 03 Aug 2012 11:11:59 -0700

> 3- Lastly, during the MILE WG session Tuesday of this week, it was made clear that MITRE needs to post IPR disclosures for all of the relevant efforts that MITRE supports. As of August 2, 2012 IPR…

I checked with the secretariat and they've been submitted.  Thanks.

> Are there other IPR concerns that we are not aware of?

This is hard to answer without having seen the disclosure.

MILE WG: When they're posted review them.

spt

> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>