Subject: Re: [mile] IPR and Transfer Considerations

From: "Baker, Jon" <[email-masked]>
Date: Tue, 7 Aug 2012 13:03:40 +0000

There are a few items that warrant clarifying for the working group related to MITRE IPR and the standardization efforts MITRE supports. MITRE holds a trademark and copyright on the various standardization efforts we support for the sole purpose of ensuring they remain open and free to use. Applying a copyright and holding a trademark are the essential tools that are used to ensure the efforts we manage remain open and free to use. In my review of other organizations that operate standardization efforts trademark and copyright are widely  used for this purpose. 

The following text was copied from the FAQ about this on the OVAL web site (https://oval.mitre.org/about/faqs.html#a18) and provides the general statement that MITRE has publicly made on this matter: 

“MITRE has copyrighted the OVAL Language for the benefit of the community in order to ensure it remains a free and open standard, as well as to legally protect the ongoing use of it and any resulting content by government, vendors, and/or users. MITRE has trademarked ® the OVAL acronym and the OVAL logo to protect their sole and ongoing use by the OVAL effort within the information security arena.”

This same rational has been used for all other standardization efforts that MITRE has managed. 

Regarding marketing, MITRE operates a booth at approximately 6 conferences (RSA, BlackHat, and a few others) per year as an outreach activity for the various standardization efforts we support. This booth helps us connect with software vendors and end users in a way that we simply could not do otherwise. Raising awareness of the various standardization efforts and engaging with the community of users and implementers is crucial to the success of any given effort. 

MITRE has never collected a royalty for use of CVE or any of the efforts we support. Collecting such a royalty would be counter to the nature of MITRE as a not for profit charted to work in the public interest. MITRE has operated CVE in this way for over 12 years and OVAL for nearly 10 years.

As an interesting aside, MITRE has worked with OWASP for several years related to efforts like CVE, CWE, and CAPEC. I believe there is also an active OWASP project using OVAL and other efforts MITRE supports. If you search the OWASP site you will find many related items.

Also note that SWIDs are an ISO standard (19770-2). MITRE is not involved in the development of the SWID standard other than we have actively worked with TagVault to determine how best to integrate CPE and SWID tags. The connection is fairly logical in that SWID tags need an identifier for installed software and CPE Names provide a standard identifier for that purpose.

Regarding XCCDF, MITRE has acted as the community moderator of XCCDF for several years and was involved in the early stages of the creation of XCCDF. XCCDF was created by Neal Ziring at the NSA and published as a NIST IR. MITRE does not hold any IPR related to XCCDF. 

If the MILE working group has further questions about the standardization efforts MITRE supports we would be happy to help.

Thanks,

Jon

============================================
Jonathan O. Baker
G022 - IA Industry Collaboration
The MITRE Corporation
Email: [email-masked]

>-----Original Message-----
>From: David Misell [mailto:[email-masked]]
>Sent: Friday, August 03, 2012 6:24 PM
>To: Sean Turner
>Cc: Baker, Jon; [email-masked]; [email-masked]
>Subject: Re: [mile] IPR and Transfer Considerations
>
>Sean,
>
>I had an in depth conversation following the conference call at which I
>raised some of these issues.
>
>To be frank the MITRE IPR is a marketing campaign supporting the
>following branded Terms from the CPE web site cpe.mitre.org;as witnessed
>at various security industry events since 2009.
>
>
>Going forward volunteer sector, IETF and OWASP, BCS and IET will all
>have similar works in progress, also potentially in support of NIST 800
>best practise recommendations.
>
>If we are to progress this, the best format may be to adopt creative
>commons, rename and avoid the following branded terms, unless they can
>be in some way opened  to more than "free for  public use", which would
>allow US enforcement of IPR in a unilateral way, as is currently being
>legislated for.
>
>
>For example how would I be able to train CVE terms mirrored to NIST 800
>series best practice without paying MITRE a royalty.
>
>
>Configurations (CCE)
>
>Vulnerabilities (CVE)
>
>Software Weakness Types (CWE)
>
>Attack Patterns (CAPEC)
>
>Cyber Observables (CybOX)
>
>Log Format (CEE)
>
>
>Software ID Tags (SWIDs)
>
>Malware (MAEC)
>
>Checklist Language (XCCDF)
>
>Assessment Language (OVAL)
>
>Security Content Automation (SCAP)
>
>Making Security Measurable
>
>
>What assurance can you give tha no IPR protection will be exerted at any
>point in the future on behalf of MITRE by US government, how can we
>assure a creative commons style approach.
>
>Yours Faithfully,
>
>Dave
>
>David S Misell MSc (Information Security RHUL) MBCS CISSP
>
>
>On Fri, 2012-08-03 at 11:11 -0700, Sean Turner wrote:
>> On 8/3/12 8:27 AM, Baker, Jon wrote:
>> > During the MILE WG session there were questions raised related to MITRE
>IPR. I would like to make sure that the list is aware that MITRE has
>accommodated all IPR related requests that have been made by this group.
>There are three issues that have been raised:
>> >
>> > 1- Shortly before the Paris meeting (IETF 83) a concern was raised about
>the wording in the disclaimer portion of our terms of use pages not aligning
>well with the wording that that IETF uses. At that time we made a small
>change to the disclaimer for all the relevant efforts we support. To the best of
>my knowledge, this issue was addressed.
>> >
>> > 2- At the Paris meeting it was clear that there was confusion about the
>licensing of CVE and several other efforts. I was asked, "How much does CVE
>cost?" This too has been addressed. CVE and these other efforts are clearly
>free to use.
>> >
>> > 3- Lastly, during the MILE WG session Tuesday of this week, it was made
>clear that MITRE needs to post IPR disclosures for all of the relevant efforts
>that MITRE supports. As of August 2, 2012 IPR disclosures have been
>submitted. I don't think they have been posted by the IETF yet.
>>
>> I checked with the secretariat and they've been submitted.  Thanks.
>>
>> > Are there other IPR concerns that we are not aware of?
>>
>> This is hard to answer without having seen the disclosure.
>>
>> MILE WG: When they're posted review them.
>>
>> spt
>>
>> > There were also questions raised about MITRE's willingness to transfer IPR
>to the IETF. I attended the Paris meeting (IETF 83) and during the SACM side
>meeting was given the opportunity to discuss MITRE's perspective on this
>topic. At the time I talked through what MITRE sees as the key distinctions to
>be made when considering transferring a given effort to any other
>organization. As a reminder I discussed the following:
>> >
>> > REGISTRIES VS. LANGUAGES
>> > ----------------------------------
>> > Roughly speaking, efforts can be grouped into two primary categories:
>registries of named objects (e.g. CVE) and languages for defining structured
>content (e.g. OVAL). As a rule, languages are good candidates to go to formal
>standards bodies as they mature. In contrast, while registries may be referred
>to by the work developed in standards bodies as external dependencies;
>standards bodies do not typically operate registries.
>> >
>> > EFFORTS HAVE MULTIPLE SUBCOMPONENTS
>> > ------------------------------------------------------
>> > Registries tend to have three primary sub-components, including:
>> >       i) the syntax of the namespace,
>> >       ii) the registry of officially recognized objects and
>> >       iii) definitions of acceptable use (which may include product testing
>requirements).
>> > Languages tend to have four primary sub-components, including:
>> >       i) the specification of the language,
>> >       ii) repositories of content written in that language,
>> >       iii) a reference implementation that can be used to verify both the
>language and content authored in the language and
>> >       iv) definitions of acceptable use (which may include product testing
>requirements).
>> > These components need to be considered separately.
>> >
>> > USG EFFORTS VS. MITRE MANAGED EFFORTS
>> > -------------------------------------------------------
>> > In considering the transition of MITRE efforts to standards bodies and how
>these decisions will be made, it is important to clearly distinguish between US
>Government (USG) efforts and efforts that our sponsors have directed MITRE
>to operate as a neutral 3rd party under our FFRDC charter.
>> >
>> >
>> > As you might imagine this leads to a sort of matrix that must be considered
>to ultimately ensure that a successful and appropriate transition is made for
>any given effort. Outside the MILE and SACM lists there are many
>organizations that depend upon the efforts that MITRE has led for many
>years, in some cases it is several hundred or more. In fact, it is hard to imagine
>an INFOSEC professional in the US that has not used CVE (either directly or
>indirectly)  in their career and CVE is translations are available in many other
>languages too. MITRE has a responsibility to ensure the stability of these
>efforts and not lose sight of the community that depends upon them today.
>> >
>> > Rest assured that MITRE and our sponsors view successful transfer of
>standards to international bodies as the ultimate goal of much of our
>standards work. MITRE is actively following the MILE and SACM lists, has
>raised awareness of the relevant IETF activities in the existing standards
>related forums that we host, and is actively engaging with our sponsors on the
>topic of international standards.
>> >
>> > Thanks,
>> >
>> > Jon
>> >
>> > ============================================
>> > Jonathan O. Baker
>> > G022 - IA Industry Collaboration
>> > The MITRE Corporation
>> > Email: [email-masked]
>> >
>> >
>> > _______________________________________________
>> > mile mailing list
>> > [email-masked]
>> > https://www.ietf.org/mailman/listinfo/mile
>> >
>> _______________________________________________
>> mile mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/mile
>
>--
>Kind Regards,
>dave
>David S. Misell,
>07710380044
>

---

From: Stephen Hanna <[email-masked]>
Date: Tue, 7 Aug 2012 16:58:21 -0400

MILE folks,

I found the MITRE IPR disclosures. They're not linked to MILE in the
IETF's IPR disclosure tool. Here's a URL that you can use to find them:

http://datatracker.ietf.org/ipr/search/?option=patent_search&patent_search=mitre

Now I'll go do some studying of them...

Thanks,

Steve

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Baker, Jon
> Sent: Tuesday, August 07, 2012 9:04 AM
> To: [email-masked]; Sean Turner
> Cc: [email-masked]; [email-masked]
> There are a few items that warrant clarifying for the working group
> related to MITRE IPR and the standardization efforts MITRE supports.
> MITRE holds a trademark and copyright on the various standardization
> efforts we support for the sole purpose of ensuring they remain open
> and free to use. Applying a copyright and holding a trademark are the
> essential tools that are used to ensure the efforts we manage remain
> open and free to use. In my review of other organizations that operate
> standardization efforts trademark and copyright are widely  used for
> this purpose.
> 
> The following text was copied from the FAQ about this on the OVAL web
> site (https://oval.mitre.org/about/faqs.html#a18) and provides the
> general statement that MITRE has publicly made on this matter:
> 
> “MITRE has copyrighted the OVAL Language for the benefit of the
> community in order to ensure it remains a free and open standard, as
> well as to legally protect the ongoing use of it and any resulting
> content by government, vendors, and/or users. MITRE has trademarked ®
> the OVAL acronym and the OVAL logo to protect their sole and ongoing
> use by the OVAL effort within the information security arena.”
> 
> Regarding marketing, MITRE operates a booth at approximately 6
> conferences (RSA, BlackHat, and a few others) per year as an outreach
> activity for the various standardization efforts we support. This booth
> helps us connect with software vendors and end users in a way that we
> simply could not do otherwise. Raising awareness of the various
> standardization efforts and engaging with the community of users and
> implementers is crucial to the success of any given effort.
> 
> 
> MITRE has never collected a royalty for use of CVE or any of the
> efforts we support. Collecting such a royalty would be counter to the
> nature of MITRE as a not for profit charted to work in the public
> interest. MITRE has operated CVE in this way for over 12 years and OVAL
> for nearly 10 years.
> 
> As an interesting aside, MITRE has worked with OWASP for several years
> related to efforts like CVE, CWE, and CAPEC. I believe there is also an
> active OWASP project using OVAL and other efforts MITRE supports. If
> you search the OWASP site you will find many related items.
> 
> Also note that SWIDs are an ISO standard (19770-2). MITRE is not
> involved in the development of the SWID standard other than we have
> actively worked with TagVault to determine how best to integrate CPE
> and SWID tags. The connection is fairly logical in that SWID tags need
> an identifier for installed software and CPE Names provide a standard
> identifier for that purpose.
> 
> Regarding XCCDF, MITRE has acted as the community moderator of XCCDF
> for several years and was involved in the early stages of the creation
> of XCCDF. XCCDF was created by Neal Ziring at the NSA and published as
> a NIST IR. MITRE does not hold any IPR related to XCCDF.
> 
> If the MILE working group has further questions about the
> standardization efforts MITRE supports we would be happy to help.
> 
> Thanks,
> 
> Jon
>

---

From: SM <[email-masked]>
Date: Tue, 07 Aug 2012 19:14:26 -0700

Hi Jon,
At 06:03 07-08-2012, Baker, Jon wrote:
>and free to use. Applying a copyright and holding a trademark are 
>the essential tools that are used to ensure the efforts we manage 
>remain open and free to use. In my review of other organizations 
>that operate standardization efforts trademark and copyright are 
>widely  used for this purpose.

Is it MITRE's position that its copyright, or any other, notice has 
to be included in draft-ietf-mile-sci-04?

Regards,
-sm

---

From: "Baker, Jon" <[email-masked]>
Date: Wed, 8 Aug 2012 12:17:18 +0000

If copyrighted material is used then the copyright notification must be included. This is mentioned on the terms of use page for each of the efforts we support and can be found in the IPR disclosures I posted.

If a trademarked name is used then the trademark must be recognized. Take a look at the NIST publication for SCAP (http://csrc.nist.gov/publications/nistpubs/800-126-rev2/SP800-126r2.pdf). It includes the following text:

"OVAL and CVE are registered trademarks, and CCE, CPE, and OCIL are trademarks, of The MITRE Corporation."

The document then also includes the registered trademark on the first use of OVAL, which occurs in the executive summary section. 

I would expect something similar in an IETF draft. A colleague of mine pointed out that if you do a Google search for "is a registered trademark of" site:ietf.org/rfc/ that you'll come up with plenty of examples of registered trademarks in RFCs.

Thanks,

Jon

>From: SM [mailto:[email-masked]]
>Sent: Tuesday, August 07, 2012 10:14 PM
>To: Baker, Jon
>Cc: [email-masked]

---

From: Adam Montville <[email-masked]>
Date: Wed, 8 Aug 2012 17:39:46 +0000

>Now I'll go do some studying of them...

Steve, I've looked at those entries and something eludes me.  They all
reference "patents."  But, it seems that it *could* be that the wording
uses "Patent" as a generic term to include trademarks and copyrights (for
example, section 1 is worded as follows: "Patent Holder/Applicant ('Patent
Holder')").

Just an honest question here, but if we're concerned about
copyright/trademark issues, why are the IPR disclosures in terms of
patents?

---

From: Sean Turner <[email-masked]>
Date: Wed, 08 Aug 2012 20:08:47 -0400

> copyright/trademark issues, why are the IPR disclosures in terms of

I think this stems from the way the IPR disclosure page is set up.  You 
can disclose any kind of IPR: patents, trademarks, copyrights, etc.

spt

---

From: Adam Montville <[email-masked]>
Date: Thu, 9 Aug 2012 16:09:12 +0000

>can disclose any kind of IPR: patents, trademarks, copyrights, etc.

Thanks for the follow-up, Sean.  I'll take this for what it's worth and
simply remain confused, but move on :-)

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 09 Aug 2012 10:23:29 -0600

> simply remain confused, but move on :-)

Having been involved in an IPR disclosure about a trademark, I will
vouch that you can complete such disclosures. However, the disclosures
(or lack thereof) that tend to derail technical work typically involve
patents, not copyrights or trademarks. (Rant about the overly-general
term "IPR" elided...)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Sean Turner <[email-masked]>
Date: Fri, 10 Aug 2012 08:31:24 -0400

> simply remain confused, but move on :-)

I'll bring this up with the IESG and see if we can maybe make it clearer.

spt