RFC 6701

RFC 6701: Sanctions Available for Application to Violators of IETF IPR Policy 🎀

Title block tea ☕: This is RFC 6701, written by A. Farrel (Juniper Networks) and P. Resnick (Qualcomm). It's dated August 2012, the category is Informational, and the ISSN is 2070-1721. The title block doesn't list any documents it obsoletes or updates.

Abstract ✨

The IETF has developed and documented policies that govern how all IETF participants behave when it comes to Intellectual Property Rights (IPR) they might reasonably be aware of. 💅

The IETF takes conformance to these IPR policies super seriously. 😤 But there's been some confusion about what the right sanctions are when someone breaks these policies, and how and by whom those sanctions get applied. 🙈

This doc digs into those questions and lays out a bunch of potential actions the IETF community can take in cases related to patents. 🦋

Status of This Memo 📋

This document is not an Internet Standards Track specification. It's published for informational purposes. 🌸

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every doc the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 for the details. 🧐

Info about this doc's current status, any errata, and how to give feedback is at:

http://www.rfc-editor.org/info/rfc6701

Copyright Notice 🌈

Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. ✨

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Please read these carefully, because they spell out your rights and restrictions for this doc. 👀 Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes. 🫶

1. Introduction 💖

The IETF has developed and documented policies that govern how all IETF participants behave when it comes to intellectual property they might reasonably be aware of. These live in RFC 3979 [BCP79], and people get reminded about them constantly. 🙌 This doc summarizes and references those policies, but it does not replace or stand in for the full statement in [BCP79]. Readers and IETF participants need to know what's in [BCP79]. 📖

The policies in RFC 3979 [BCP79] say that each individual participant is responsible for disclosing, or making sure someone discloses, Intellectual Property Rights (IPR) when all of the following apply:

• they are aware of the IPR
• the IPR is relevant to the IETF work they are participating in
• the IPR is owned by the individual or by a company that employs or sponsors the individual's work

Following these IPR policies is really important, and we need to understand both what sanctions can be applied to participants who break the policies, and who is in a position to apply them. 🧠

This document digs into those questions and lays out a bunch of potential actions the IETF community can take in cases related to patents. All of these sanctions are currently available in IETF processes, and at least two violations of the IPR policy have been handled with some of the sanctions listed. 🔥 As Section 4 explicitly calls out, a posting rights (PR) action (described in [BCP25] and [RFC3683]) is an applicable sanction for breaching the IETF's IPR policy. 💅

Note: This document specifies some administrative sanctions that can be imposed by and through IETF administrative processes. It does not address or limit other legal sanctions, rights, or remedies that exist outside the IETF, or any legal rights or remedies anyone has regarding IPR. 🙅‍♀️

This doc doesn't cover the parallel, but equally important, topic of actively promoting conformance with the IETF's IPR policy. That's covered in [RFC6702]. 🎀

2. Description of IETF IPR Policy 🌸

The IETF's IPR policy is set out in [BCP79]. Nothing in this document defines or redefines it. This section just highlights some important parts of those policies. More info on the IETF's IPR policy can be found at [URLIPR] and [URLIESGIPR]. 🔗

2.1. Responsibilities of IETF Participants and Timeliness ⏰

According to RFC 3979 [BCP79], individual IETF participants have a personal responsibility to disclose, or make sure someone timely discloses, IPR they're aware of. That IPR is either owned by them, or owned by a company that employs or sponsors them, and it impinges on the contribution they make to the IETF. 🫶

RFC 3979 [BCP79] also defines a "contribution," which includes Internet-Drafts, emails to IETF mailing lists, presentations at IETF meetings, and comments made at the microphone during IETF meetings. Remote participants count just as much as people participating in person at IETF meetings. 💻

Timeliness of disclosure matters a ton in RFC 3979 [BCP79]. That doc never gives a precise definition of "timeliness," and this doc isn't going to either. 🤷‍♀️ What you need to understand is that how disruptive an IPR disclosure is to the smooth working of the IETF depends directly on how late in the process it happens. So a disclosure made on a published RFC is very likely to be way more disruptive than the same disclosure made on an early revision of an individual Internet-Draft. 😭

Third-party disclosures can also be made by anyone who has cause to believe IPR exists. These disclosures must be accompanied by the reasons for the disclosure. 📝

Each individual IETF participant also has a choice under the IETF's IPR policy. If someone is unwilling or unable to disclose relevant IPR in a timely manner, they have the option to refrain from contributing to and participating in IETF activities about the technology covered by the IPR. 🦋

2.2. How Attention Is Drawn to These Responsibilities 📣

The IETF draws everyone's attention to the IPR policy [BCP79] through the "Note Well" statement on the IETF web pages [URLNoteWell], in presentations at working group and plenary meetings, and in the boilerplate text in every Internet-Draft and RFC. 🌈 On top of that, anyone signing up for an email list hosted at ietf.org accepts the Note Well statement. ✅

[RFC6702] suggests a bunch of additional ways to draw IETF participants' attention to the IPR policy. 🎀

2.3. How IPR Disclosures Are Made 📬

The procedure for filing IPR disclosures is on the IETF's web site at [URLDisclose]. Third-party disclosures can also be made by email to the IETF Secretariat, or through the web page. 💌

Early disclosures, or warnings that there might be IPR on a technology, can also be made. 👀

2.4. How Working Groups Consider IPR Disclosures 🧩

In the normal course of events, a working group that's notified of IPR has to decide whether to keep going with the work as it is, or revise the work to try to avoid the IPR claim. This decision is made on the working group's mailing list using normal rough consensus procedures. 🗳️ However, discussions about whether an IPR claim applies, or about how appropriate or meritorious the IPR licensing terms are, are outside the scope of the WG. The IPR situation gets considered by working group participants as the document moves through the development process [RFC2026], especially at key moments like when the working group adopts the document and during last call. 📅

It's really important to understand that the way a working group handles an IPR disclosure is separate from the sanctions that can be applied to the individuals who broke the IETF's IPR policy. So if a working group decides to, say, completely re-work an Internet-Draft to avoid a piece of disclosed IPR, that shouldn't be seen as a sanction against the authors. 🙅‍♀️ Especially with a late IPR disclosure, though, a working group choosing to do this can be a harmful side effect on the working group (it slows down publication of an RFC and might derail other work the group could be doing). That should count as one of the reasons to apply sanctions to the individuals concerned, as described in the next two sections. 💀

2.5. The Desire for Sanctions 😤

Not conforming to the IETF's IPR policy undermines the work of the IETF, and sanctions ought to be applied against offenders. 🔥

2.6. Severity of Violations ⚖️

There are clearly different sorts of violations of IPR policy. 🫠 Sometimes a working group participant just doesn't realize that the IPR they invented applies to a particular working group draft. Sanctions (if any) need not be at all severe. 🌸 However, a working group document editor who waits until near the publication of a document to reveal IPR they themselves authored should face more serious sanctions. These are judgments the working group chairs and area director can make. 👑

This topic makes up the bulk of the material in Sections 5 and 6. 🧚

3. Who Initiates Sanctions 🦋

Any IETF participant can draw attention to an apparent violation of the IETF's IPR policy. They can do this by emailing a short summary of the relevant facts and events to the appropriate IETF mailing list. 📧 Normally, the working group chairs and area directors take responsibility for keeping the IETF running smoothly and for enforcing IETF policies, including the IPR policy. So when sanctions are appropriate, working group chairs will be the first actors when there's an active working group involved in the technical work, and area directors will be the first actors in other cases. The first step will usually be the working group chairs or area director gathering the facts and talking the matter through with the IETF participants involved. 🫶

Working group chairs are already empowered to take action against working group participants who flout the IPR rules and so disrupt the smooth running of the IETF or a specific working group. They can do this just like they can respond to any other disruption. 💪

The working group chairs have the responsibility to pick the appropriate actions, since they're closest to the details of the issue. 🔍 If there's no working group involved, or if making the decision or applying the sanctions is awkward or difficult for the working group chairs, the responsible AD is available to guide or direct the action if necessary. 🌈

...to be continued in Part 2 💖

4. Available Sanctions ✨

okay bestie, so this section is a menu 💅 of sanctions the IETF can use when someone breaks its IPR policies. It's NOT a checklist, it's not a "pick just one" situation, and it's definitely not saying every case gets the nuclear option 🙈. Some cases are tiny, some are wild, and the ordering is only roughly from mildest to spiciest.

In lots of cases it can also make sense to tell the wider IETF community what happened and what got done, so everyone can spot patterns and deal with them 👀🫶

The list is in approximate order of severity, but please don't treat that order as gospel or as the thing that decides what happens in each case 💜. Section 5 has notes on fairness, and Section 6 helps you pick a sanction that fits the situation 🦋.

a. A private chat between the working group chair or area director and the individual to figure out what went wrong and how to stop it happening again 🌸.

b. A formal but private warning that the individuals must improve their behavior or risk one of the other sanctions 📝.

c. A formal warning on an IETF mailing list that the individuals must improve their behavior or risk one of the other sanctions 📣.

d. Announcing to the working group that the individuals failed, aka "name and shame" 😭💀.

e. Ongoing refusal to accept the individuals as editors of any new working group documents. Appointing editors is totally up to the working group chairs, who act for the working group as explained in RFC 2418 [BCP25] 👑.

f. Removing the individuals as working group document editors, either on specific documents or across the whole working group 🧹.

g. Moving the individuals' attribution in a document to the "Acknowledgements" section, with or without a note explaining why they're there and not in "Authors' Addresses" (aka the IPR policy violation) 🎀. The area director can also record this in the Datatracker entries for the documents concerned 🗂️.

h. Deprecating or rejecting the individual document (whether it's an RFC or an Internet-Draft), or stopping work on the affected technology 🥀.

i. Applying a temporary suspension of individuals' posting rights to a specific mailing list, following the guidelines in [BCP25]. These bans hit specific individuals and specific working group mailing lists, at the working group chairs' discretion, for no more than 30 days ⏳.

j. Removing individuals' posting privileges using a Posting Rights Action (PR Action) as per [RFC3683]. This is the big hammer 🔨, used when other sanctions aren't enough or didn't work. When a PR action is in place, the subjects lose posting rights to one particular IETF mailing list for a year (unless it's revoked or extended), and whoever maintains any IETF mailing list can, at their discretion and without further explanation or discussion, also remove posting rights 🚫.

PR actions are introduced by an area director and are considered by the IETF community and the IESG to work out IETF consensus 🗳️.

Heads up: anyone who has supplied text that goes into an IETF document (RFC or Internet-Draft) has a right to be recognized for that contribution 🫶. So authors' names can't be totally wiped from a document if they break the IPR policy, UNLESS their text is also completely removed. Their name can come off the front page and even move out of "Authors' Addresses," as long as their contribution is properly acknowledged in "Acknowledgements" 💖.

4.1. An Additional Note on the Applicability of PR Actions 🧐

so PR actions need a little extra explaining 🤓. According to [RFC3683], a PR action may be used by the IETF when "a participant has engaged in a 'denial-of-service' attack to disrupt the consensus-driven process" 💥.

[RFC3683] also points to RFC 2418 [BCP25] and [RFC3005] for guidance on dealing with abusive behavior 📚. RFC 2418 is updated by RFC 3934 on this topic (see [BCP25]) ✨.

Sometimes ignoring or flouting the IETF's IPR policy can be seen as disruptive to the smooth running of a working group or the whole IETF. When that happens, the offender might be deemed a disruptive individual under [BCP25] and [RFC3683], and so could face a sanction that restricts their right to post to IETF mailing lists, as described in bullets h and i of Section 4 of this document 🚷🥺.

5. A Note on Fairness and Appealing Decisions ⚖️

okay so everyone in the IETF can appeal a decision they think is unfair or wrong 🙌. Anyone who feels they got a raw deal, or that a call was made incorrectly, can appeal. The appeals process is in Section 6.5 of [RFC2026] and backed up by the IESG statement at [URLIESG2026] 📜. Any sanction listed above can be appealed this way 💅.

6. Guidance on Selecting and Applying Sanctions 🎯

whoever is handing out sanctions for breaking the IETF's IPR policy needs to make sure the punishment fits the crime and takes into account all the circumstances 🧠. The judgment has to be fair too, so that similar situations get similar treatment in the future ⚖️✨.

If there's any doubt, the person choosing the sanction should ask the relevant part of the IETF community, or the community as a whole 🗣️. They should also feel totally free to ask their colleagues for advice (co-chairs, area directors, or the whole IESG) 🫂.

This is a judgment call based on all the circumstances of each specific case 💭. Some guidance notes are in Appendix A 📝.

7. Security Considerations 🔐

okay, this part is serious 😤. Nothing in this document directly affects the operational security of the Internet. BUT ignoring the IETF's IPR policies can wreck the IETF's standards development process, so it can be treated as an attack on the IETF working properly 🚨. Also, a late IPR disclosure (or a total failure to disclose) could be an attack on deployed, operational equipment on the Internet 💀🖥️.

8. Acknowledgments 🌷

Thank you to Lou Berger, Ross Callon, Stewart Bryant, Jari Arkko, and Peter Saint-Andre for their comments on an early version of this document 💖.

Thanks to Subramanian Moonesamy and Tom Petch for their comments on the work 🙏. Thanks to Dan Wing, Tony Li, and Steve Bellovin for the discussions 💬. Thanks to Stephen Farrell for a thorough review as document shepherd 🧚.

Extra thanks for textual improvements around IETF last call go to Randy Bush, Brian Carpenter, Jorge Contreras, Russ Housley, Barry Leiba, Murray S. Kucherawy, Benoit Claise, Sean Turner, and Stewart Bryant 🌈🫶.

9. References 📚

9.1. Normative References 💜

[BCP25]       Bradner, S., "IETF Working Group Guidelines and
              Procedures", BCP 25, RFC 2418, September 1998.

              Wasserman, M., "Updates to RFC 2418 Regarding the
              Management of IETF Mailing Lists", BCP 25, RFC 3934,
              October 2004.

[BCP79]       Bradner, S., Ed., "Intellectual Property Rights in IETF
              Technology", BCP 79, RFC 3979, March 2005.

              Narten, T., "Clarification of the Third Party
              Disclosure Procedure in RFC 3979", BCP 79, RFC 4879,
              April 2007.

[RFC2026]     Bradner, S., "The Internet Standards Process --
              Revision 3", BCP 9, RFC 2026, October 1996.

[RFC3683]     Rose, M., "A Practice for Revoking Posting Rights to
              IETF Mailing Lists", BCP 83, RFC 3683, March 2004.

9.2. Informative References 🌸

[RFC3005]     Harris, S., "IETF Discussion List Charter", BCP 45, RFC
              3005, November 2000.

[RFC6702]     Polk, T. and P. Saint-Andre, "Promoting Compliance with
              Intellectual Property Rights (IPR) Disclosure Rules",
              RFC 6702, August 2012.

[URLDisclose] IETF, "File an IPR Disclosure",
              http://www.ietf.org/ipr/file-disclosure.

[URLIESG2026] IETF, "On Appeals of IESG and Area Director Actions and
              Decisions",
              http://www.ietf.org/iesg/statement/appeal.html.

[URLIESGIPR]  IETF Tools, "Intellectual Property",
              http://trac.tools.ietf.org/group/iesg/trac/
              wiki/IntellectualProperty.

[URLIPR]      IETF, "Intellectual Property Rights (IPR) Policy",
              http://www.ietf.org/ipr/policy.html.

[URLNoteWell] IETF, "Note Well",
              http://www.ietf.org/about/note-well.html.

Appendix A. Guidance on Selecting and Applying Sanctions 🔍

okay so Section 6 said picking a sanction is a carefully made judgment call 🧠, and this appendix is a list of questions that might help with that judgment ✨. It's guidance only, not prescriptive or exhaustive, and it doesn't put any weight on any one question ⚖️.

• How long has the participant been active in the IETF? ⏳
• Is there some exceptional circumstance? 🤔
• Are there special circumstances that imply the individual would not have seen or understood the pointers to and content of [BCP79]? 👀
• How late is the disclosure? Is the document already a working group document? How many revisions have been published? How much time has elapsed? Have last calls been held? Has the work been published as an RFC? 📅
• Is the individual a minor contributor to the IETF work, or clearly a major contributor? 🌟
• Is there a reason the individual forgot the IPR existed (for example, it was filed many years before the work in the IETF)? 🧠
• Was the individual told by their company that disclosure was imminent, but then something different happened? 🏢
• How speedy and humble was the individual's apology? 🥺
• How disruptive to the IETF work are the disclosure and the associated license terms? A factor in this is whether the IETF community sees a need to rework the document 🛠️.
• Does the large number of patents the individual has invented provide any excuse for failing to notice that one of their patents covered the IETF work? 💡

Authors' Addresses 💌

Adrian Farrel
Juniper Networks
EMail: adrian@olddog.co.uk

Pete Resnick
Qualcomm
EMail: presnick@qualcomm.com