Subject: RE: [Raven] Re: Raven, What's Needed...

From: Scott Bradner <[email-masked]>
Date: Wed, 29 Dec 1999 09:25:16 -0500 (EST)

>I would like for the IETF lawyer to render an opinion on the IETF's
>obligations.
>
>I would very much like a written opinion, not an "I talked the IETF lawyer
>and she/he/it agrees with me" opinion. 

well, I did talk to the IETF lawyers (at the DC IETF meeting after the
plenary discussion) and for what it is worth - there is no current 
legal requirement in the US for any standards organization to do anything
in this area. (in spite of what the FBI spokesperson was quoted as saying)

but, that said, when there is a requirement for carriers to have 
specific abilities they will put requirements on vendors to supply them
with equipment & software that meets the requirements put on the carriers.
The vendors, in turn (as Fred Baker has noted), will want to have
"safe harbor" standards they can build to - standard that have been
OKed by the relevent powers - so they can not be held liable if the
required functions do not produce the desired (by law enforcement) results.
If the vendors can not get these safe harbor standards from the IETF they
will go elsewhere.

Elsewhere could be TIA which could define its own standard or point to
RFCs (informational or otherwise) that have been publised by the IETF
(if there are any)

I know the above verbage is not the same as a written opinion from
the IETF lawyer(s) and I will try to get such a written opinion.

Scott

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Ed Stone <[email-masked]>
Date: Wed, 29 Dec 1999 10:03:44 -0500

>the IETF lawyer(s) and I will try to get such a written opinion.

And it will be provided formally and publicly, as a document signed by the 
lawyer/firm and declaring the scope of the opinion and authorities, as is 
standard form for such matters? The lawyer/firm will be experienced in 
administrative and internet law?

Might we not benefit from this list providing some questions that such a 
review should address? Or at least discussing issues for legal opinion 
prior to the solicitation of it? Specifically, prior to getting the 
opinion, wouldn't it be a good idea to see the suggested questions or 
issues that you intend to provide, and the scope you define (if any), for 
discussion here? We don't want to have to go back multiple times, and 
surely we can put forward the essential items for discussion.

Obviously, the question(s) asked and the scope defined have a lot to do 
with the answers that may come back.

Since there has been no substantial discussion here of what should be 
asked, let's take the time to develop the issues formally, fully and 
publicly in this list, and THEN take them to the administrative/internet 
law firm...

Very roughly and preliminarily, here are a few issues:
1a. If CALEA and/or the August FCC ruling require that IETF create or 
modify protocols, what other nations/legal entities other than the US, if 
any, also may impose such requirements on IETF?

1b. If other nations create regulations or laws that cause the need for 
protocol creation or modification, such that the manufacturers of routers 
and related equipment for that nation express urgent market demand for 
protocol creation or modification to support such compliance, is such 
market demand alone sufficient to require IETF action, or are that nation's 
regulations and laws alone sufficient to require IETF action?

2. What is the specific portion of CALEA that extends its requirements 
beyond telecommunications providers to ISPs, the Internet, and other 
service providers? Please provide justification for this taking into 
account the Congressional Record transcript of the debate in which the 
exclusion of the Internet from CALEA was discussed (provide the relevant 
sections of the debate).

3. After contact and discussion with the ACLU attorneys and others who have 
filed suit against the August FCC ruling, what is your evaluation of their 
arguments and what is the timing that one might expect adjudication of 
their challenges?

4. What is the specific mechanism by which the "requirements" for a "safe 
harbor"  would be provided to IETF? Since the TIA report is not available, 
wouldn't it simply be the desires of LEAs? If structure is built to that, 
versus to the TIA report, is it reasonable to expect that intervening court 
process or the TIA report have a reasonable probability of providing a less 
intrusive set of requirements?

Those are the ones off the top of my head. I think this needs discussion, 
and we must avoid developing an informal, inconclusive and premature set of 
issues for professional, rigorous legal review. I strongly urge that 
premature legal inquiry be avoided, and let's develop the process (or at 
least see a statement of it) by which the legal inquiry will be made, and 
let's understand the nature and experience of the law firm that will 
address these issues. Has IETF already retained a law firm? Who, how selected?

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: [email-masked] (Mikus Grinbergs)
Date: Wed, 29 Dec 1999 12:49:44 -0600

On Tue, 28 Dec 1999 16:27:35 -0800 Fred Baker <[email-masked]> wrote
on Subject: RE: [Raven] Re: Raven, What's Needed...

> If it turns out that something does need to be done,
> and that we are responsible to do it, ...

Intriguing phrase: "If it turns out ... that we are responsible ... ".

WHO has the authority to make the IETF "responsible" for whatever,
unless it is by consensus among the IETF members themselves?

Have the limits of that "responsibility" been defined?  Suppose it
were possible to prove that six more people died as the eventual
result of some action taken by the IETF than would have died if
the IETF had not taken that particular action.  Can the survivors
of those six sue the IETF as "being responsible" for their deaths?

On Wed, 29 Dec 1999 10:03:44 -0500 Ed Stone <[email-masked]> wrote:
>   <snip>
>   <snip>

This is the other intriguing phrase:  " ... require IETF action ... ".

The problem I have with this cited material is that OTHERS (merely
by putting words to paper) get to "require" what the IETF does.
Shouldn't it be the IETF (by its own consensus) that decides upon
what actions to take?

My own feeling is that, useful though the result may be, the purpose
of the IETF as an organization does not lie in being "responsible" for
setting the "safe harbor" limits of any particular governmental ruling.

Is there a "Charter" for the IETF?  Does that "Charter" identify the
IETF as national or as international?  Let me suggest that the answer
to the question:  "To whom is the IETF collectively, and its members
individually, responsible?"  ought to go a long way towards addressing
"When is IETF action required?".

I feel that written opinions from lawyers, while necessary, are not
sufficient to determine who the IETF is, nor how IETF actions are to
be decided upon.  (As was asked on this list: "What if there are 100
IETF members ready and willing to form a new Working Group - should
they be prevented?")

Mikus Grinbergs    <[email-masked]>

---

From: "Thomas Junker" <[email-masked]>
Date: Wed, 29 Dec 1999 22:01:29 -0600

> Intriguing phrase: "If it turns out ... that we are responsible ... ".

Indeed.  I had thought to comment on that earlier, but a 
few trifling matters call my attention away from this list 
from time to time...

> unless it is by consensus among the IETF members themselves?

It seems to me the "responsibility" issue is completely 
bogus, as you suggest in your question.

> Have the limits of that "responsibility" been defined?  

Certainly not here.

> Suppose it

Doubtful, but nothing of that sort is at issue.  There are 
insinuations from several quarters that IETF is somehow 
obligated by laws that in fact place requirements on 
carriers and/or vendors, and even then only in limited 
jurisdictions.  I would be very surprised if there were 
any law on any books anywhere that purports to dictate to 
a standards body what it should specify in the way of 
standards... outside the dictatorships, of course.

> > any, also may impose such requirements on IETF?

IF CALEA and/or FCC "require" that IETF do anything 
whatsoever, we will all have much more to worry about than 
wiretapping.  Such an event would mark a turning point in 
the descent of the U.S. into police statehood.

> This is the other intriguing phrase:  " ... require IETF action ... ".

In the first instance I have to conclude that the word is 
being used loosely, and in the second as part of a flawed 
concept.

> Shouldn't it be the IETF (by its own consensus) that decides upon

Even that skips over the obvious:  where in the scheme of 
things does the concept of a "requirement" on an informal, 
unincorporated body even come from?  A body that 
manufactures no equipment and offers no communication 
services.  Sounds like a fantastical stretch to me.

> setting the "safe harbor" limits of any particular governmental ruling.

I agree.  Also, from earlier traffic here it would seem 
that IETF is not a standards organization within the 
context of "safe harbors."

> "When is IETF action required?".

No, actually it wouldn't, unless you are willing to allow 
a very loose and shifting meaning of "require."  Market 
and industry pressures, a perceived need to remain in the 
forefront of standard-setting, those things can be 
interpreted to "require" something in a subjective sense, 
but I think we should stick to the stricter meaning of 
"require," as in "such-and-such law requires..."  No law 
requires the IETF to do anything about any of this, nor is 
it comfortably conceivable that any law *could* require 
the IETF to do anything about any of this.

> IETF members ready and willing to form a new Working Group - should

That's a different issue, I believe.  The "If 100 
engineers are willing" issue revolved around the use of 
the imprimatur of the IETF, not around who controls whom.  
Brian wished to couch it in terms of "who are you to tell 
me what I cannot do?" but the real issue had only to do 
with his proceeding under a banner that is not his alone 
to use -- the name of the IETF.  Surely if a working group 
took the same position as Brian but, say, on the issue of 
developing protocols to facilitate the extermination of 
ethnic groups, IETF would tell them, "Get lost!"

Fred Baker's recent comments on the list seem to grant 
rather more credibility to the advocates of facilitating 
wiretapping than seem warranted (to make a really big 
pun).  I am puzzled that Fred would have such difficulty 
with the "requires" concept that he would go along with 
the vague and unsupported suggestions that "we need to do 
this" and/or the even more vague and even less supported 
suggestions that some law somewhere "requires" us to do 
anything at all.  

When I add to the mix Fred's ambiguous statements about 
the result of the straw poll(s) in Washington and the 
tolerance of an outlandish poster who has now generated 
fully 20% of the list traffic all by himself and has 
substantially derailed the discussion from its chartered 
quesion, I have to wonder what is really going on here.  
Whose purpose does this confusion and pandemonium serve?  
Certainly not the purpose at the core of RFC 1984.

Regards,

Thomas Junker
[email-masked]