Subject: Re: Nomcom 2010-2011: READ THIS: Important Information on Open Disclosure

From: Brian E Carpenter <[email-masked]>
Date: Wed, 22 Sep 2010 10:19:56 +1200

Tom,

On 2010-09-22 04:29, NomCom Chair wrote:
> Hi Folks,
> 
> A few folks have submitted some very helpful comments and I'd like to
> share the answers publicly.
> 
> Q: If the List is Open why does it require a Login?
> 
> A: As interpreted by this NomCom, the list is disclosed to the IETF
> community but remains confidential within the IETF community.  
> 
> Note the wording in RFC 5680:
> "The NomCom may disclose a list of names of nominees who are willing to
> be considered for positions under review to the community, in
> order to obtain feedback from the community on these nominees."
> 
> The disclosure is only "to the community".  You must have a "community"
> login to see the list.  
> 
...
> Q:  Can I disclose the Open List of Willing Nominees outside the IETF
> community?  Can I copy and distribute it or make it publicly available
> outside the community?
> 
> A:  Well, I am not a lawyer but I would advise not to.  This NomCom
> interprets the Open Disclosure as disclosing confidential information "to
> the community" as supported by the wording in RFC 5680.  
> 
> Maybe this is a bit over simplified, but if I tell you (i.e., the
> Community) something confidential that does not mean you (i.e., a member
> of the Community) can tell others.  
> 
> NomCom is doing the disclosing to the group known as the IETF Community.
> The IETF Community members are not authorized by this NomCom to disclose
> it further.  Keep the list within the community.  

I am a bit mystified. Since the IETF is open to anyone who cares
to participate, there is no finite community within which to keep
this list (or any other non-confidential information). Once the list
of willing candidates is released, it is just as public as anything
else in the IETF, as far as I can see. RFC 5680 is pretty clear
about this:

  "The
   process change described in this document allows the NomCom to openly
   solicit information about nominees who are willing to be considered."
and
  "The list of nominees willing to be considered for positions under
   review in the current NomCom cycle is not confidential."

      Brian

---

From: Dave Cridland <[email-masked]>
Date: Wed, 22 Sep 2010 00:09:51 +0100

On Tue Sep 21 23:19:56 2010, Brian E Carpenter wrote:
> this list (or any other non-confidential information)

Well, I'm not sure it matters. Anyone interested in the list is, by  
any reasonable definition, a member of the community. In fact, given  
the lack of definition of the community, one could cheerfully argue  
that anyone who the list of nominees is disclosed to counts as a  
member of the community, since by knowing the nominee list they are  
to some degree "involved".

While I think there's sufficient doubt to reduce this from "public",  
ie unrestricted publishing, I don't see any argument that could hold  
any water preventing anyone sending any third party the nominee list.

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 22 Sep 2010 00:14:28 +0100

On 21/09/10 23:19, Brian E Carpenter wrote:
> I am a bit mystified. 

Me too. I hope we don't end up with having to say a supposed
"ok" to 96 pages of gibberish legalese before we can see such
secrets. (That's not currently the case, but that's where we
probably end up if "needs a login" is the interpretation of
"open disclosure.")

Really open is good enough. However, its ok to fix this with
the next NomCom too.

S.

---

From: John C Klensin <[email-masked]>
Date: Tue, 21 Sep 2010 19:30:33 -0400

--On Wednesday, September 22, 2010 10:19 +1200 Brian E Carpenter
<[email-masked]> wrote:

>> A few folks have submitted some very helpful comments and I'd
>> like to share the answers publicly.
>> 
> I am a bit mystified. Since the IETF is open to anyone who
> cares to participate, there is no finite community within
> which to keep this list (or any other non-confidential
> information). Once the list of willing candidates is released,
> it is just as public as anything else in the IETF, as far as I
> can see. RFC 5680 is pretty clear about this:

(Off list -- if Tom thinks this is relevant, he is welcome to
respond)

There is one difference between "login with credentials that are
known to everyone" and "no login required" and that is whether
the names are picked up by the usual search engines.  It is not
clear to me that the open disclosure of candidates requirement
was intended to create a "by agreeing to be a candidate, one
makes the fact of having done so an extremely public and
permanent record".  Certainly that does nothing to further the
IETF's processes; it may or may not be helpful to the candidate
(but, under the current rules, I think any candidate who wants
to make his or her candidacy public is [still] able to do so in
other ways).

So, while I share some of the concerns about the way in which
this is being done, I think it may be reasonable to keep the
information from becoming mechanically public.

     john

---

From: Bob Hinden <[email-masked]>
Date: Tue, 21 Sep 2010 17:02:20 -0700

Thomas,

>   review in the current NomCom cycle is not confidential."

+1

The list of accepted candidates should be posted on the IETF site like the rest of the noncom information.  That was the intent of the discussion that lead up to RFC 5680.  Or to put it another way, anyone who reads the IETF web site is part of the community.

The is no need for a log in or having to agree to a confidentiality agreement.  RFC5680 says:

      The list of nominees willing to be considered for positions under
      review in the current NomCom cycle is not confidential.

Bob

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 22 Sep 2010 08:53:29 -0700

On 9/21/2010 5:02 PM, Bob Hinden wrote:
> The list of accepted candidates should be posted on the IETF site like the
> rest of the noncom information.

+1

On the other hand, the practical reality is that getting an IETF login is easy
enough to make this issue pretty minor, IMO.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: todd glassey <[email-masked]>
Date: Wed, 22 Sep 2010 11:02:20 -0700

> enough to make this issue pretty minor, IMO.

The instant there are formal login's then there are members.

Todd
> 
> d/
> 
> 
> 
> 
> No virus found in this incoming message.
> Checked by AVG - www.avg.com 
> Version: 9.0.851 / Virus Database: 271.1.1/3152 - Release Date: 09/21/10 23:34:00
> 

-- 
//-----------------------------------------------------------------

This message may contain confidential and/or privileged information.
If you are not the addressee or authorized to receive this for the
addressee, you must not use, copy, disclose or take any action based
on this message or any information herein. If you have received this
message in error, please advise the sender immediately by reply e-mail
and delete this message.

Thank you for your cooperation.

---

From: John C Klensin <[email-masked]>
Date: Wed, 22 Sep 2010 14:41:34 -0400

--On Wednesday, September 22, 2010 08:53 -0700 Dave CROCKER
<[email-masked]> wrote:

>> The list of accepted candidates should be posted on the IETF
>> site like the rest of the noncom information.
> 
> 
> +1
> 

Unfortunately, I have to nearly agree with Todd on this one.  A
login/ signup list available to the entire community, and for
which members of the community have to sign up if they are to
obtain information that is supposed to be generally available to
that community,is very easy to confuse with a membership list,
raising issues of privacy, etc.  I'm not too concerned about it,
but I wish that there had been more discussion of whether this
was necessary and other ways to accomplish it if it is.

    john

---

From: Ross Callon <[email-masked]>
Date: Wed, 22 Sep 2010 15:28:20 -0400

--On Wednesday, September 22, 2010 08:53 -0700 Dave CROCKER
<[email-masked]> wrote: 
> ...On the other hand, the practical reality is that getting an
> IETF login is easy

I have two thoughts on this:

One the one hand, I agree with the part of Dave Crocker's email that getting an IETF login is easy enough that the approach that the current nomcom is taking seems to be workable. 

Also, I don't think that we want press articles about who is running for IETF leadership positions, who was rejected and who was accepted, and so on. Thus the fact that the current approach makes you agree to keep the names confidential would appear to be a very strong statement to the press not to publish the contents of the list.

Ross

---

From: Thomas Walsh <[email-masked]>
Date: Wed, 22 Sep 2010 16:02:20 -0400

All the points being raised are very worthy of discussion and I suggest these be considered and clarified in a future update to RFC 5680 (should it be needed).  Until there is such an update, NomCom must work with RFC 5680 as written.

Open Disclosure and Feedback are closely tied per RFC 5680:
-----------------------------------------------------------
Note that Section 5, "Disclosing a Nominee List", of RFC 5680 specifically ties disclosing a nominee list "as part of the NomCom's request for feedback from the community". The disclosure by this NomCom is to support the feedback process. 

There is no language in RFC 5680 for the list to be disclosed for any other purpose. Maybe that is a point to be addressed in the future.   

Is Disclosure Mandated by RFC 5680:
----------------------------------
No, it is not.  RFC 5680 does not require any NomCom to disclose the list at all nor to disclose the entire list for that matter.  Since this is the first time the open disclosure has been instituted, NomCom is taking a careful course. 

In the past, such information was available only to a subset of the community.  Now, for this NomCom, it is available to anyone in the community who wants it and it is easy to obtain.

How to disclose has not been specified:
---------------------------------------
How the Open Disclosure is implemented is not specified in RFC 5680.  If the community wants to specify this in detail for future NomCom's that can certainly be done.  

Summary:
--------
The purpose of Open Disclosure is to allow feedback from the entire community rather than a highly restricted subset.  No other purpose has been specified.  For NomCom to do more than what RFC 5680 specifies would be to over step its bounds.

Tom Walsh
Chair, NomCom 2010-2011

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Ross Callon
Sent: Wednesday, September 22, 2010 12:28 PM
To: [email-masked]
Cc: IETF discussion list; NomCom Chair
Subject: RE: Nomcom 2010-2011: READ THIS: Important Information on Open Disclosure

Ross
_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: todd glassey <[email-masked]>
Date: Wed, 22 Sep 2010 13:19:18 -0700

> Also, I don't think that we want press articles about who is running for IETF leadership positions, who was rejected and who was accepted, and so on. Thus the fact that the current approach makes y…

No I totally disagree. TRANSPARENCY is the rule - and it means all
parties are properly tracked and all reviews are done in plain sight.
That means that the people doing the reviews are accountable for them in
a legal sense and that is a long-time coming here.

So ... No, everything gets published.

Todd

---

From: Jari Arkko <[email-masked]>
Date: Wed, 22 Sep 2010 13:25:25 -0700

I agree with Dave that the issue is minor. But FWIW, I too had assumed 
that the change that we approved did mean that the list would be public, 
e.g., an open web page under the nomcom's pages.

Jari

---

From: SM <[email-masked]>
Date: Wed, 22 Sep 2010 13:43:46 -0700

>was necessary and other ways to accomplish it if it is.

Yes.

RFC 5680 was published in October, 2009.  It would be strange if we 
have to resort to interpretations of the RFC in this discussion about 
Open Disclosure of Willing Nominees.

Quoting from Section 4:

   'We assume that asking for feedback from the entire community is
    preferable to asking for feedback from large segments of the
    community, while keeping the rest of the community "in the dark".'

And quoting from Section 6:

      "The list of nominees willing to be considered for positions under
       review in the current NomCom cycle is not confidential.  The
       NomCom may disclose a list of names of nominees who are willing to
       be considered for positions under review to the community, in
       order to obtain feedback from the community on these nominees."

We can nit about what "disclose a list of names" means or we can 
argue that the text does not say that "the list of names will be 
publicly available".

At 12:28 22-09-10, Ross Callon wrote:
>Also, I don't think that we want press articles about who is running 
>for IETF leadership positions, who was rejected and who was 
>accepted, and so on. Thus the fact that the current approach makes 
>you agree to keep the names confidential would appear to be a very 
>strong statement to the press not to publish the contents of the list.

Having press articles is a side effect of being public.  Whether one 
likes it or not, one has to live with it or else one might end up 
devising ways around the spirit of the RFC.  There was a discussion 
about the visibility when making the selection in February 2009 [1].

Quoting part of a message from Brian Carpenter [2]:

   "As for the general principle of publishing the list, it was suggested
    to me today (in Beijing) that being nominated, even if not selected,
    may be well viewed as an honour."

And Leslie Daigle [3]:

   "But, if the IETF community decided it still doesn't want to have a public
    list of only the list of willing volunteers, it would remain an option."

And in a message from Spencer Dawkins [4]:

  "We note that (for example) the Internet Architecture Board publishes
   the nominee list for their representative to the Internet Society
   Board of Trustees, without apparent ill effects, but we are also
   willing to accept that a NomCom might consider nominees whose names
   have not been announced, for a variety of reasons, if this is the
   right thing to do, in NomCom's judgement."

I have read the comments posted by the NomCom Chair [5].

Regards,
-sm

1. http://www.ietf.org/mail-archive/web/ietf-nomcom/current/msg00066.html
2. http://www.ietf.org/mail-archive/web/ietf-nomcom/current/msg00081.html
3. http://www.ietf.org/mail-archive/web/ietf-nomcom/current/msg00077.html
4. http://www.ietf.org/mail-archive/web/ietf-nomcom/current/msg00338.html
5. http://www.ietf.org/mail-archive/web/ietf/current/msg63827

---

From: Ross Callon <[email-masked]>
Date: Wed, 22 Sep 2010 16:57:18 -0400

So would you even make public the comments that people send in? 

IMHO we have not agree to this (and I wouldn't support it). 

Ross

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of todd glassey
Sent: Wednesday, September 22, 2010 4:19 PM
To: [email-masked]
Subject: Re: Nomcom 2010-2011: READ THIS: Important Information on Open Disclosure

Todd

---

From: John E Drake <[email-masked]>
Date: Wed, 22 Sep 2010 15:13:40 -0700

Tom,

Thanks, this is very helpful.  As I read RFC 5680, it does not change in any way the handling of confidential information (e.g., feedback on candidates, or its deliberations) specified in RFC 3777.  Is that correct?

Thanks,

John 

Sent from my iPhone

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Thomas Walsh
> Sent: Wednesday, September 22, 2010 1:02 PM
> To: Ross Callon; [email-masked]; IETF discussion list; NomCom Chair
> All the points being raised are very worthy of discussion and I suggest
> these be considered and clarified in a future update to RFC 5680
> (should it be needed).  Until there is such an update, NomCom must work
> with RFC 5680 as written.
> 
> Note that Section 5, "Disclosing a Nominee List", of RFC 5680
> specifically ties disclosing a nominee list "as part of the NomCom's
> request for feedback from the community". The disclosure by this NomCom
> is to support the feedback process.
> 
> There is no language in RFC 5680 for the list to be disclosed for any
> other purpose. Maybe that is a point to be addressed in the future.
> 
> No, it is not.  RFC 5680 does not require any NomCom to disclose the
> list at all nor to disclose the entire list for that matter.  Since
> this is the first time the open disclosure has been instituted, NomCom
> is taking a careful course.
> 
> In the past, such information was available only to a subset of the
> community.  Now, for this NomCom, it is available to anyone in the
> community who wants it and it is easy to obtain.
> 
> How the Open Disclosure is implemented is not specified in RFC 5680.
> If the community wants to specify this in detail for future NomCom's
> that can certainly be done.
> 
> Summary:
> --------
> The purpose of Open Disclosure is to allow feedback from the entire
> community rather than a highly restricted subset.  No other purpose has
> been specified.  For NomCom to do more than what RFC 5680 specifies
> would be to over step its bounds.
> 
> Tom Walsh
> Chair, NomCom 2010-2011
> 
> One the one hand, I agree with the part of Dave Crocker's email that
> getting an IETF login is easy enough that the approach that the current
> nomcom is taking seems to be workable.
> 
> for IETF leadership positions, who was rejected and who was accepted,
> and so on. Thus the fact that the current approach makes you agree to
> keep the names confidential would appear to be a very strong statement
> to the press not to publish the contents of the list.
> 
> Ross

---

From: Thomas Walsh <[email-masked]>
Date: Wed, 22 Sep 2010 18:35:05 -0400

That is correct.  RFC 3777 still applies to the confidentiality of feedback and deliberations.

RFC 5680 only allows a NomCom to disclose a list of willing nominees to the community to solicit feedback. 

Tom

-----Original Message-----
From: John E Drake 
Sent: Wednesday, September 22, 2010 3:14 PM
To: Thomas Walsh; Ross Callon; [email-masked]; IETF discussion list; NomCom Chair
Subject: RE: Nomcom 2010-2011: READ THIS: Important Information on Open Disclosure

Tom,

Thanks,

John 

Sent from my iPhone

> Ross Callon

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 22 Sep 2010 17:33:06 -0700

On 9/22/2010 1:02 PM, Thomas Walsh wrote:
> Is Disclosure Mandated by RFC 5680: ---------------------------------- No, it
> is not.  RFC 5680 does not require any NomCom to disclose the list at all nor
> to disclose the entire list for that matter.  Since this is the first time
> the open disclosure has been instituted, NomCom is taking a careful course.
>
> community.  Now, for this NomCom, it is available to anyone in the community
> who wants it and it is easy to obtain.

As I said in my previous post, I do not think the decision has major practical 
effect, one way or the other.  It's worth discussing in terms of principals and 
concerns, but not much more than that, IMO.  Since anyone can get an IETF login, 
and since they do not disclose who they really are, and since the IETF 
"community" is some thousands of people, we need to be clear that there is no 
privacy created by putting something under IETF login access control.

I think that conservative thinking is the safer 'error' to make, if it's 
reasonable to call a choice, here, an error.  So while I don't happen to think 
it necessary to put the list under access control, I'd rather have had Nomcom 
"err" in that direction that to blindly choose open access.  If open access had 
been the choice and it was then deemed an error, it would be unfixable.

Identity vs. Access Control:

    Online identity is a hot topic these day, where hot means popular and 
volative.  It often does get coupled with resource usage authorization. 
Discussions are often confusing, and notably miss the question of whether a 
given online identifier is coupled with a real world identity (person, 
organization or formal role.)  Some identifier mechanisms only worry about 
whether one usage of the identifier is by the same agent as a previous usage, 
without worrying about who that actor really is.  Virtually all public email and 
mass-market web login services work that way.

    So does the IETF's login.

    It doesn't check whether the actor creating a login is real, has multiple 
IETF logins, or anything else that is substantial.  It's goal is, therefore, one 
of ensuring that the use of an identifier is reliable, not that the actor 
associated with it is known.  In other words, it's a reliable labeling 
mechanism, not really an identity mechanism, in its basic form.

    Yes, there are some specific services on the IETF web site that have 
/additional/ access control lists.  These lists most definitely /are/ formed 
with specific knowledge of what real person owns a particular identifier. 
Nomcom's internal pages are an example of this.  But this goes beyond the basic 
use of IETF logins.

d/
-- 

   Dave Crocker

---

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 22 Sep 2010 22:23:57 -0500

Ummm, no.

> IMHO we have not agree to this (and I wouldn't support it).

Here's the new text from RFC 5680 (and it's all additions, no deletions or 
changes) at the end of the three paragraphs in [RFC3777], Section 3, 
"General", bullet 6, which are currently:

      All deliberations and supporting information that relates to
      specific nominees, candidates, and confirmed candidates are
      confidential.

      The nominating committee and confirming body members will be
      exposed to confidential information as a result of their
      deliberations, their interactions with those they consult, and
      from those who provide requested supporting information.  All
      members and all other participants are expected to handle this
      information in a manner consistent with its sensitivity.

      It is consistent with this rule for current nominating committee
      members who have served on prior nominating committees to advise
      the current committee on deliberations and results of the prior
      committee, as necessary and appropriate.

   add the following paragraphs:

      order to obtain feedback from the community on these nominees.

      The list of nominees disclosed for a specific position should
      contain only the names of nominees who are willing to be
      considered for the position under review.

      The NomCom may choose not to include some names in the disclosed
      list, at their discretion.

      The NomCom may disclose an updated list, at their discretion.  For
      example, the NomCom might disclose an updated list if the NomCom
      identifies errors/omissions in a previously disclosed version of
      the disclosed list, or if the NomCom finds it necessary to call
      for additional nominees, and these nominees indicate a willingness
      to be considered before the NomCom has completed its
      deliberations.

      Nominees may choose to ask people to provide feedback to the
      NomCom, but should not encourage any public statements of support.
      NomComs should consider nominee-encouraged lobbying and
      campaigning to be unacceptable behavior.

      IETF community members are encouraged to provide feedback on
      nominees to the NomCom, but should not post statements of support/
      non-support for nominees in any public forum.