Subject: Re: Posting with psudonyms...

From: Olaf Kolkman <[email-masked]>
Date: Tue, 18 Jun 2013 10:53:30 +0200

Colleagues

[I am following this list using digests, and I do not how to reply in thread....]

Dave Crocker hit the nail on the head:

> On 6/17/2013 8:22 AM, Mary Barnes wrote:
>> I think you can nicely ask.  But, I'm not sure there's anything you
>> can do beyond that.
> 
> 
> For people who passively observe IETF activity, it probably doesn't matter.
> 
> For anyone who "contributes" I believe the IETF's IPR rules imply a 
> requirement to divulge one's true identity.

This is not about consensus, it is not about wanting to know but about serious risks on the IPR front.

On the DANE list I wrote:
<quote>
[...] But IMHO we have to keep the Note-Well seriously. If folk contribute technology to the IETF it would be could if we (collectively) have a reasonable idea who those folk are.

It would be very painful if in the future I'd be implementing technology that was brought to the IETF by [email-masked] and I found I was being sued by a very real legal entity by infringing their patents.

It is off course not the case that everybody has to know everybody but if we _collectively_ do not know who is behind [email-masked] then I start to feel uncomfortable about using the technology, specifically if the contributions are highly innovative and competent and thus patentable.

For debates like this, or any other process issue, I really do not care if you use Pseudonyms or not[*].
</quote>

I (as implementer) cannot run the risk that we do not know who contributed a _good_ idea that ends up in the spec. 

Please let us not over-engineer solutions. I am fine if the chair knows with reasonable certainty who is contributing. So Mary's nicely ask, works for me, but if we really cannot get our finger behind the submitter of potentially patentable input, we may need to be as bold to refuse it.

--Olaf

[*] I know that [email-masked] has commented on some IETF discussions in the past.

---

From: Olaf Kolkman <[email-masked]>
Date: Tue, 18 Jun 2013 11:51:14 +0200

O
> But where does it say that this is a requirement? I did try to find this but could only find references to declaring IPR, but it doesn't say that the person declaring knowledge of IPR needs to reveal his identity. So it seems that it would be completely ok for Spiderman to come forward and state that Acme Inc has IPR on IP over spiderwebs… I'm not saying it isn't there, I just couldn't find it.

This comes from the goal and purpose of our IPR policies: As an implementor I want to be sure that anybody in the standardization process has put their cards on the table and are accountable.

I cannot hold an pseudonym accountable.

--Olaf

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Tue, 18 Jun 2013 12:39:02 +0000

But those are not the goal and purpose of the IPR policies.

The goal is that IPR is disclosed, so that the working group can make valid technical decisions based on that IPR disclosure.

There is no goal that needs to link a contributor to that IPR, only that the IPR is disclosed.

All the contributor has to state is that all IPR they reasonably know about has been disclosed.

Invariably the IPR pages make that linkage only by implication anyway. For example company X makes a declaration on IPR. A contributor happens to work for company X. There is only an implication that the contributor led to the IPR declaration (and indeed that connection may be untrue).

RFC 3979 carries no statements about how this is enforced, and indeed my understanding is that many IETF people believe the only enforcement point is a court of law.

Keith

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Olaf Kolkman
Sent: 18 June 2013 10:51
To: Klaas Wierenga
Cc: Working Group Chairs
Subject: Re: Posting with psudonyms...

O

But where does it say that this is a requirement? I did try to find this but could only find references to declaring IPR, but it doesn't say that the person declaring knowledge of IPR needs to reveal his identity. So it seems that it would be completely ok for Spiderman to come forward and state that Acme Inc has IPR on IP over spiderwebs... I'm not saying it isn't there, I just couldn't find it.

--Olaf

---

From: Dave Cridland <[email-masked]>
Date: Tue, 18 Jun 2013 14:04:01 +0100

(Grumble - reply-to-all this time)

On Tue, Jun 18, 2013 at 1:39 PM, DRAGE, Keith (Keith) <
[email-masked]> wrote:

> ******
>
> Invariably the **IPR** pages make that linkage only by implication
> anyway. For example company X makes a declaration on **IPR**. A
> contributor happens to work for company X. There is only an implication
> that the contributor led to the **IPR** declaration (and indeed that
> connection may be untrue).
>
> **
>

I think the point made was (read: I think the point made should have been)
that when IPR is *not* disclosed, the presence of a pseudonymous
contributor makes the question of whether the IPR was known to participants
or not rather harder to answer, and that in turn may make the resultant
court cases nastier too. It's pretty easy to see something's awry if
Company X was participating, or a participant's name is on the patent.

Of course, this rather implies that participant's affiliations should be
more prominent, too - I'm certainly guilty of not using my employee's
domain for IETF work. (In case you're wondering, currently Arcode,
previously Isode - I like companies ending with ~ode).

Dave.

---

From: Olaf Kolkman <[email-masked]>
Date: Tue, 18 Jun 2013 15:25:21 +0200

On Jun 18, 2013, at 3:04 PM, Dave Cridland <[email-masked]> wrote:

> 
> I think the point made was (read: I think the point made should have been) that when IPR is *not* disclosed, the presence of a pseudonymous contributor makes the question of whether the IPR was known to participants or not rather harder to answer, and that in turn may make the resultant court cases nastier too. It's pretty easy to see something's awry if Company X was participating, or a participant's name is on the patent.
> 

Exactly!

Albeit with the nuance that we do not even have to go to court in order for such a practice to have effect on the relevance of our standards work.

If I see pseudonyms entering technology into an IETF standard, and I have no idea where that technology comes from then I am going to be _extremely_ conservative if it comes to implementing the standard. I cannot afford the risk. The more obvious it is that we are dealing with a pseudonym, the higher the risk, and the less likely I am to implement said technolgy. To take that a step further, why would I participate in a working group if the result is to risky to implement?

To me the use of pseudonyms when technology is submitted is a potential harmful thing to the IETF as a whole.

The openness of a process is based on its transparency _and_ accountability. 

--Olaf

---

From: "Andrew G. Malis" <[email-masked]>
Date: Tue, 18 Jun 2013 16:19:16 +0200

I think the IESG is going to look VERY closely at any draft they receive
for publication where the shepherd says in the writeup that the WG has no
idea who sourced the ideas in the draft.

Cheers,
Andy

On Tue, Jun 18, 2013 at 3:25 PM, Olaf Kolkman <[email-masked]> wrote:

> Albeit with the nuance that we do not even have to go to court in order
> for such a practice to have effect on the relevance of our standards work.
>
> If I see pseudonyms entering technology into an IETF standard, and I have
> no idea where that technology comes from then I am going to be _extremely_
> conservative if it comes to implementing the standard. I cannot afford the
> risk. The more obvious it is that we are dealing with a pseudonym, the
> higher the risk, and the less likely I am to implement said technolgy. To
> take that a step further, why would I participate in a working group if the
> result is to risky to implement?
>

---

From: Ted Lemon <[email-masked]>
Date: Tue, 18 Jun 2013 14:28:44 +0000

On Jun 18, 2013, at 10:19 AM, Andrew G. Malis <[email-masked]> wrote:
> I think the IESG is going to look VERY closely at any draft they receive for publication where the shepherd says in the writeup that the WG has no idea who sourced the ideas in the draft.

Of course, if a contributor doesn't show up for meetings in person, it's going to be very difficult to tell the difference between a legitimate-sounding pseudonym and a real name.

Ultimately if someone fakes an identity and contributes to a draft, and then that draft subsequently turns out to have submarine IPR that the fake person knew about, that person's identity is going to come out in the ensuing court case, and the court is quite likely to rake the offending patent holder over the coals.

So a strategy of planting submarine patents in IETF protocols using a pseudonym and then suing implementors is likely to backfire in a big way.   I don't think (IANAL) it'd be worth the risk.  But there's a limit to what we can do to stop it, so that's really moot.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 18 Jun 2013 07:48:02 -0700

On 6/18/2013 6:04 AM, Dave Cridland wrote:
> I think the point made was (read: I think the point made should have
> been) that when IPR is *not* disclosed, the presence of a pseudonymous
> contributor makes the question of whether the IPR was known to
> participants or not rather harder to answer, and that in turn may make
> the resultant court cases nastier too. It's pretty easy to see
> something's awry if Company X was participating, or a participant's name
> is on the patent.

+1

The topic of IPR in the IETF rests on accountability, not just 
disclosure of the IPR.  The Note Well is more about individual 
participation than about publishing a claim.  This goes directly 
contrary to methods of anonymization that people use.

If a person is contributing to the IETF, they need to be forthcoming 
about their identity.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Warren Kumari <[email-masked]>
Date: Tue, 18 Jun 2013 10:50:05 -0400

> I think the IESG is going to look VERY closely at any draft they receive for publication where the shepherd says in the writeup that the WG has no idea who sourced the ideas in the draft.

Would the shepherd say this? I've shepherd a number of documents and I've never thought to say "I know the author of this draft, we had lunch" -- in the same way it wouldn't occur to me to say that I don't.

Also, when you shepherd a document you mainly think about the content of the primary idea, not all of the bolt ons…

W

--
Don't be impressed with unintelligible stuff said condescendingly.
    -- Radia Perlman.

---

From: Yoav Nir <[email-masked]>
Date: Tue, 18 Jun 2013 14:58:26 +0000

> Also, when you shepherd a document you mainly think about the content of the primary idea, not all of the bolt ons…

As a shepherd, would you be as comfortable with a document where the upper left corner said this:

               Fluffy
          Independent

As you would if it said:

      Cullen Jennings
                Cisco

I think questions would have been asked long before we got to the shepherding stage.

Yoav (an unpronounceable jumble of letters I use in all my dealings with English-speakers)

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Tue, 18 Jun 2013 15:10:22 +0000

> disclosure of the IPR.  

Which words of RFC 3979 tell me that?

Keith

> -----Original Message-----
> From: Dave Crocker [mailto:[email-masked]]
> Sent: 18 June 2013 15:48
> To: Dave Cridland
> Cc: DRAGE, Keith (Keith); Olaf Kolkman; Working Group Chairs; Klaas
> Wierenga

---

From: Warren Kumari <[email-masked]>
Date: Tue, 18 Jun 2013 12:05:33 -0400

> As a shepherd, would you be as comfortable with a document where the upper left corner said this:

Nope, but the original said: "where the shepherd says in the writeup that the WG has no idea who sourced the ideas in the draft." -- this didn't make it clear (to me at least) that this only applied to funny pseudonyms -- if the draft were authored by Fluffy I'd *probably* mention it, but it may be worth mentioning to shepherds that they should call things like this out…

> Yoav (an unpronounceable jumble of letters I use in all my dealings with English-speakers)

Ahha! This entire thread was intended to make someone slip up like you just did -- this implies that  you are not posting under your real identity, and are staging a Sybil attack and / or are tying to avoid IPR investigations!  <adjusts Pince-Nez, twirls Homburg and knocks on floor with cane>  I win the Hercule Poirot prize for today!

W

:-)

--
"Build a man a fire, and he'll be warm for a day. Set a man on fire, and he'll be warm for the rest of his life." -- Terry Pratchett

---

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Tue, 18 Jun 2013 09:19:26 +0000

On Jun 18, 2013, at 10:53 AM, Olaf Kolkman <[email-masked]> wrote:

Olaf,

Klaas

---

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Tue, 18 Jun 2013 10:16:24 +0000

Olaf,

On 18 jun. 2013, at 11:51, "Olaf Kolkman" <[email-masked]<mailto:[email-masked]>> wrote:

O

I am not arguing against the use/necessity of this, nor the spirit of the policies but I wonder if this is written anywhere, and if not, whether it shouldn't

Klaas

--Olaf

---

From: joel jaeggli <[email-masked]>
Date: Tue, 18 Jun 2013 18:32:13 +0200

> Ahha! This entire thread was intended to make someone slip up like you just did -- this implies that  you are not posting under your real identity, and are staging a Sybil attack and / or are tying…
Confusion of pseudonymity vs anonymity  ensues. There are many 
participants whose  appellation differs from their government issued 
identity. we need to stop conflating the two. *
*

---

From: Olaf Kolkman <[email-masked]>
Date: Wed, 19 Jun 2013 09:02:06 +0200

> So a strategy of planting submarine patents in IETF protocols using a pseudonym and then suing implementors is likely to backfire in a big way.   I don't think (IANAL) it'd be worth the risk.  But…

It doesn't need to get stopped. Not in a procedural or process way (please not). But I would hope that the folk that play here understand that openness is about transparency and accountability and are forthcoming when asked. 

Its all about reasonable levels of trust in, and professionalism of the IETF as an organization. That should concern us all.

An IESG statement explaining the issue might be sufficient to point to.

--Olaf

---

From: Jari Arkko <[email-masked]>
Date: Sun, 23 Jun 2013 13:30:59 +0300

> Of course, if a contributor doesn't show up for meetings in person, it's going to be very difficult to tell the difference between a legitimate-sounding pseudonym and a real name.

Indeed. And checking for the source of ideas is not at the top of our review checklist at the IESG. That being said, in my experience, for 99.99% of IETF work we know very well who the contributors are, so this is not the most common worry for things that we do in the IETF.

But I understand the few cases where this is not the case, and I understand Olaf's desire for accountability of persons participating in a working group.

Jari