RFC 9389
Nominating Committee Eligibility
Nominating Committee Eligibility 🎀
Title block tea ☕: this is RFC 9389, a Best Current Practice (BCP 10), written by M. Duke at Google LLC, dated April 2023, published by the Internet Engineering Task Force (IETF). Its ISSN is 2070-1721. It obsoletes RFC 8788 and RFC 8989 and updates RFC 8713. Lowkey a lot of paperwork, but the main idea is simple. 💅
Abstract ✨
okay so the IETF Nominating Committee (NomCom) picks candidates for a bunch of IETF leadership committees 👑. [RFC8713] has rules for who can be a NomCom volunteer, and the big one is that you need to show up in person for three of the last five in-person meetings 🧳. Then in 2020 and 2021 the IETF had six fully online plenary meetings in a row, and remote tech got SO much better, fr fr 🌈. There was even an experiment where remote attendance counted toward NomCom eligibility 🦋.
So this doc updates RFC 8713 with a brand new set of eligibility criteria, built up from first principles, while taking the much bigger role of remote attendance into account 🫶. It also obsoletes RFC 8788 and RFC 8989 💜.
Status of This Memo ✨
This memo documents an Internet Best Current Practice 🌸.
This is an IETF product 🎀. It represents the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on BCPs, check Section 2 of RFC 7841 📚.
Info about the current status of this doc, any errata, and how to give feedback can be found at https://www.rfc-editor.org/info/rfc9389 🔗.
Copyright Notice ✨
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved 🥰.
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please actually read them, because they explain your rights and restrictions for this doc 📜. Also, any Code Components pulled out of this doc have to include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Revised BSD License describes 🖤.
Table of Contents 🧚
1. Introduction
2. NomCom Principles
3. Criteria
4. Security Considerations
4.1. NomCom Capture
4.1.1. A Surge of Volunteers
4.1.2. The Two-per-Organization Limit
4.1.3. One Year of Participation
4.2. Disruptive Candidates
4.3. Additional Remedies
5. IANA Considerations
6. References
6.1. Normative References
6.2. Informative References
Appendix A. NomCom Capture Calculations
A.1. No per-Organization Limit
A.2. Two per Organization
Acknowledgments
Author's Address1. Introduction 🌷
[RFC8713] sets up how the Internet Architecture Board (IAB), Internet Engineering Steering Group (IESG), IETF Trust, and IETF LLC Directors get picked 👑. The main player is the Nominating Committee (NomCom), which nominates exactly one candidate for each open position 🎯. Those nominations still need to be confirmed by other bodies ✅.
NomCom voting members are picked at random from a pool of volunteers who meet certain eligibility requirements 🎲. So it matters that people in the pool are IETF participants who are likely to actually know IETF processes and practices 🧠. There are also restrictions so that no more than two volunteers with the same primary affiliation get chosen 🙅♀️.
Section 4.14 of [RFC8713] says volunteers need to have attended three of the previous five meetings 📅. In practice that meant the volunteer picked up their registration badge at an in-person meeting 🪪. And current members of the Internet Society Board of Trustees, plus the bodies the NomCom nominates members for, are ineligible 🚫.
[RFC8989] was an experiment after six consecutive fully online meetings from 2020 to 2021 🖥️. The old reading of the requirement would have left zero eligible volunteers, so it's giving emergency 🚨. That doc stretched the attendance requirement to also count logging in to at least one session of a fully online IETF meeting 💻.
[RFC8989] also made two other ways to qualify 🛤️: (1) being a working group chair or secretary in the past three years, and (2) being an author or editor of an IETF Stream RFC in the past five years, which includes Internet-Drafts in the RFC Editor queue 📝.
This doc talks through some of the first principles behind NomCom eligibility design, and gives recommendations for how attendance-based qualification should work 🦋.
This doc replaces the attendance criteria in the first two paragraphs of Section 4.14 of [RFC8713] with the criteria from [RFC8989], and it obsoletes RFC 8989 to make it clear that the doc has been superseded 🔄. All other text in [RFC8713], including the other paragraphs of Section 4.14, stays exactly the same 🫡.
[RFC8788] set up the procedures for the 2020-2021 NomCom 🗓️. By definition [RFC8788] doesn't apply to future NomComs, but this doc formally obsoletes it anyway 💅.
2. NomCom Principles 💜
The NomCom is supposed to be made up of randomly selected members of "the community" 🎀. For years, in-person attendance was a decent stand-in for how committed someone was to being a member ✈️. Two days of travel plus an attendance fee is a big spend of time and money 💸.
On top of that, in-person attendance was thought to help people get to know leadership candidates and really absorb the spirit of the IETF, even though there's no mechanism that guarantees any of that interaction 🤷♀️.
A basic IETF principle is that the community should govern itself, so volunteers need to show real commitment to the IETF 🤝. Capping the number of volunteers sponsored by any one organization keeps things from getting messy in a way that disrupts IETF operations or works against the community as a whole 🛡️.
A requirement for in-person attendance has always shut some people out of qualifying for the NomCom 🥺. But attitudes about business travel are changing, remote meeting tech keeps getting better, and lots of longtime community members are choosing to take part remotely, whether for cost or personal reasons 🌈. The NomCom has also already finished two cycles using entirely online tools 💻.
Letting remote attendance count lowers the barrier to entry ⬇️. The IETF has historically offered a fee-free remote participation option, through a waiver or otherwise, so the only investment needed is logging on once per meeting at a specific time (sometimes an inconvenient hour where you live) ⏰. This doc doesn't formally require the NomCom to work totally remotely, but including remote-only attendees in the pool will probably mean the NomCom needs a remote component to operate 🖥️.
Last but not least, overly restrictive criteria make it harder to build a broad talent pool 🌟.
3. Criteria 🎀
The text below replaces the first two paragraphs of Section 4.14 of [RFC8713] 🔁. The overall idea: a person has to satisfy the conditions of one of three paths to volunteer 🛣️. Any single path is enough, unless the person is otherwise disqualified under Section 4.15 of [RFC8713] 🚫.
- Path 1: The person registered for and attended three out of the last five IETF meetings, either in-person or online 🎟️. In-person attendance is whatever the Secretariat's record keeping says 📋. Online attendance means being a registered person who logged in for at least one session of an IETF meeting 💻.
- Path 2: The person was a Working Group Chair or Secretary within the three years before the day the call for NomCom volunteers goes out to the community 📣.
- Path 3: The person has been a listed author or editor on the front page of at least two IETF Stream RFCs within the five years before the day the call for NomCom volunteers goes out to the community 📚. An Internet-Draft that the IESG has approved and that sits in the RFC Editor queue counts the same as a published RFC, and the relevant date is the day the draft was added to the RFC Editor queue 🗂️. Just to be super clear, the five-year timer reaches back to five years before the day the call for NomCom volunteers goes to the community ⏳.
4. Security Considerations 🔥
This part is dramatic, and it's supposed to be 😭.
4.1. NomCom Capture 👑
The scariest threat tied to NomCom eligibility is that an organization, or a group of organizations coordinating together, tries to grab a majority of NomCom positions 😱. Then they could pick IETF leadership that pushes a self-serving agenda, against what's best for the community as a whole 💀.
Here's a fun wrinkle: [RFC8713] lets the NomCom Chair decide the NomCom voting requirement, so a simple majority might not be enough 🤔. But seven of ten forms a quorum, so in the worst case seven NomCom members working together can almost certainly get their way 😬.
Whatever you think about letting remote attendees in, it lowers the minimum cost of making a NomCom-eligible volunteer 📉. Before, it took three in-person trips of around five days each, spread over at least eight months 🧳. Now it's zero financial cost plus the time to log in three times over at least eight months 🖱️. Some organizations won't be put off by either version, but others will 🙃.
4.1.1. A Surge of Volunteers 🌊
A big pile of legitimate volunteers makes it really hard to control a majority of NomCom slots 🏰. Even setting aside any limit on how many selections come from one organization, basic probability shows that to have even a 50% chance of controlling six or more NomCom positions, an attacker needs roughly 60% of the volunteer pool 🎲. For example, if there are 300 "legitimate" volunteers, an attacker has to produce 365 volunteers to go past a 50% chance of NomCom capture (see Appendix A) 🧮.
A sudden surge in volunteers, especially people nobody recognizes as part of the community, is an early-warning sign of a capture attempt 🚨. Anyone worried about the integrity of the process should bring those worries to the IESG so they can investigate 🕵️♀️. Where needed, the confirming bodies can act to invalidate such candidates, as defined in Section 3.7.3 of [RFC8713] 🙅♀️.
Also, loosening eligibility criteria lowers the cost to an attacker of producing eligible volunteers, but it also increases the number of legitimate volunteers, and that makes an attack harder 💖✨.
4.1.2. The Two-per-Organization Limit
Okay so the two-per-organization limit from Section 4.17 of [RFC8713] makes this capture attack way messier 😤. To get around it, an organization would have to do one or more of the following:
- coordinate with at least two like-minded organizations to produce a NomCom majority,
- incentivize members of other organizations (possibly through a funding agreement) to support its agenda, and/or
- propose candidates with false affiliations.
The IETF does not routinely confirm the affiliation of volunteers, but if there's an investigation, it could kick out volunteers who lied about their affiliation 🙅♀️. Publishing the list of volunteers and affiliations also lets the community double-check those claims. Community accountability is so iconic 💅.
Assuming that 300 legitimate volunteers are all from different organizations, three conspiring organizations would need 771 volunteers (257 per organization) for a 50% chance of NomCom capture (see Appendix A). That's a LOT of people to fake, bestie 😭.
4.1.3. One Year of Participation
Attending three meetings takes at least eight months of waiting ⏳. So given how many volunteers it'd take to capture the process, an attack would need a surge in attendees over the course of a year. That kind of surge might trigger a community challenge to the list of eligible volunteers, and/or a leadership investigation to detect suspicious behavior (e.g., logging in to a single session and then immediately logging out) 👀. If abuse of process happens, leadership would then have months to adjust policy before the NomCom cycle begins, and/or disqualify candidates. Not the vibe for the attacker 💀.
4.2. Disruptive Candidates
Note that counting remote participation towards NomCom eligibility lets a single individual pull off an attack that used to require coordination 🫠. By registering for remote attendance to IETF meetings using a number of different identities over a year, an individual can make each of those identities NomCom eligible and then serve under any one of them that is selected for the NomCom. Once selected, that person could try to disrupt the process or prevent the timely conclusion of its work. Less severely, an attacker could simply improve their chances of being selected for NomCom. Sneaky, sneaky 🦹♀️.
This attack is much harder to detect or prevent than equivalent attacks were before, since it doesn't require coordination among multiple attendees. The attacker can't be sure of fee waivers for some or all of the different identities, but the lower cost for remote participation also makes this attack more feasible than it would have been under prior rules 💸.
However, the voting member recall procedure in Section 5.7 of [RFC8713] exists to allow removal and replacement of disruptive figures. So there is a way out, periodt 🙌.
4.3. Additional Remedies
Additional changes to the process to further obstruct attacks against the NomCom are beyond the scope of this document 🤷♀️. Still, a challenge process against volunteers with a suspicious reported affiliation, or who might be aliases of a single volunteer, could trigger an investigation 🔍.
Similarly, the challenge to the random selection described in Section 4.17 of [RFC8713] can explicitly include appeals against the data used to qualify the volunteer, rather than the randomization process 🎲.
5. IANA Considerations
This document has no IANA actions. Nothing to register here, bestie 🌸.
6. References
6.1. Normative References
[RFC8713] Kucherawy, M., Ed., Hinden, R., Ed., and J. Livingood,
Ed., "IAB, IESG, IETF Trust, and IETF LLC Selection,
Confirmation, and Recall Process: Operation of the IETF
Nominating and Recall Committees", BCP 10, RFC 8713,
DOI 10.17487/RFC8713, February 2020,
<https://www.rfc-editor.org/info/rfc8713>.6.2. Informative References
[RFC8788] Leiba, B., "Eligibility for the 2020-2021 Nominating
Committee", BCP 10, RFC 8788, DOI 10.17487/RFC8788, May
2020, <https://www.rfc-editor.org/info/rfc8788>.
[RFC8989] Carpenter, B. and S. Farrell, "Additional Criteria for
Nominating Committee Eligibility", RFC 8989,
DOI 10.17487/RFC8989, February 2021,
<https://www.rfc-editor.org/info/rfc8989>.Appendix A. NomCom Capture Calculations
Section 4 offers some mathematical results for the probability of NomCom capture. This appendix shows the work 🧮✨.
Note that the number of combinations of b items chosen from a population of a items is often expressed as
⎛a⎞ a!
⎜ ⎟ = ────────
⎝b⎠ (a-b)!b!
Figure 1A.1. No per-Organization Limit
Appendix A.1 assumes there is no limitation on the number of volunteers from a given organization. Appendix A.2 assumes that no single organization produces more than two volunteers.
Let L be the number of "legitimate" volunteers (i.e., those not allied with an attacker) and A be the number of attacking volunteers. Then there are the following ways to select a NomCom:
⎛L+A⎞
⎜ ⎟
⎝ 10⎠
Figure 2The number of outcomes where attackers capture the NomCom is:
10
——
╲ ⎡⎛A⎞ ⎛ L ⎞⎤
╱ ⎢⎜ ⎟ ⎜ ⎟⎥
—— ⎣⎝i⎠ ⎝10-i⎠⎦
i=6
Figure 3Therefore, the probability of capture is
10 ⎛A⎞ ⎛ L ⎞
—— ⎜ ⎟ ⎜ ⎟
╲ ⎝i⎠ ⎝10-i⎠
╱ ──────────
—— ⎛L + A⎞
i=6 ⎜ ⎟
⎝ 10 ⎠
Figure 4For L = 300, this probability crosses 50% at A = 365 📈.
A.2. Two per Organization
Assume that the population of L is drawn from L different organizations (this assumption is unfavorable to the attacker). Assume also that there are three conspiring organizations. Then no more than 6 members can be drawn from A.
Let B be the number of nominees per attacking organization, so that A = 3B.
The number of combinations to pick exactly N attackers, N <= 6, is
min(N,2)⎡ min(2,N-i) ⎤
—— ⎢ —— ⎥
⎛ L ⎞ ╲ ⎢⎛B⎞ ╲ ⎛⎛B⎞ ⎛ B ⎞⎞⎥
C(N) = ⎜ ⎟ ╱ ⎢⎜ ⎟ ╱ ⎜⎜ ⎟ ⎜ ⎟⎟⎥
⎝10 - N⎠ —— ⎢⎝i⎠ —— ⎝⎝j⎠ ⎝min(2, N-i-j)⎠⎠⎥
i=0 ⎣ j=0 ⎦
Figure 5And the probability of capture is
C(6)
───────
6
——
╲
╱ C(i)
——
i=0
Figure 6For L = 300, the A required to exceed a 50% probability of capture is 771 🎯.
Acknowledgments
Brian Carpenter and Stephen Farrell wrote RFC 8989, which provides the core of this document 🫶.
Luc André Burdet, Brian Carpenter, and Donald Eastlake provided useful editorial suggestions 💖.
Author's Address
Martin Duke
Google LLC
Email: martin.h.duke@gmail.com📦 where this page comes from
- ietf: rfc9389 2023-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms