Re: [Eligibility-discuss] Handling the fear of "bogus" recall petitions

[John C Klensin <[e-mail]>]

--On Friday, October 25, 2019 15:55 +1300 Brian E Carpenter
<[e-mail]> wrote:

> Adrian,
> 
>> I think you are worried about "gaming the system"
> 
> That may be so, but:
> 
>> c.  Those who have never attended.
> 
> also seems to me to be a proxy for "Those who have very
> limited personal knowledge of the person being recalled, so
> may not be capable of fair assessment of their conduct."
> 
> Personally I'm more worried about that than the risk of gaming
> or DOSsing the system. Now while it's true that a non-attendee
> might have frequently met the recallee at (say) ITU-T
> meetings, it's still probably the best proxy we've got for
> "very limited personal knowledge". Assuming, of course, that
> we think such personal knowledge is needed.

Brian, keep in mind that we are talking about petitioners here,
not the recall committee.  While I think there are strong
arguments for considering different rules for its composition
than for the Nomcom, no one has proposed anything specific along
those lines and the "small steps" principle suggests not
touching it right now.

People who sign recall petitions without knowledge of the person
being targeted are a different problem, but I don't think any
evidence has been offered that would suggest remote participants
would be more likely to exhibit that particular form of bad
behavior than those who attend in person.  Borrowing from an
unrelated thread, to suggest that remote participants would be
more prone to such behavior would constitute making a vague
accusation against unspecified parties and doing so with no
specific evidence.

Beyond that, I want to repeat what I've said on the call and
earlier.  In that nearly eight years between October 1996 (RFC
2027) and June 2004 (RFC 3777, which introduced the 20
signatures and nomcom eligibility requirements), our rule about
petitions for initiating the process was that "anyone" could do
it.  No requirement for IETF participation, attending meetings,
or writing things;  no multiple signatures as a cross-check or
barrier; no requirement for proof of humanity or even proof of
life.  Many of us will recall that the number of IETF
participants who were accused of being or recruiting sock
puppets or engaging in long-term troll-like behavior was larger
than it is in these kinder and gentler times.  It would have
taken exactly one such troll or other bad actor to initiate a
recall process.  It would have taken exactly one such bad actor
with the ability to manufacture bots or sock puppets to generate
recalls against every single Nomcom appointee.   And yet the
number of recall attempts (filed petitions) during that period
was zero.  

THere are many possible ways to mount a DoS attack against the
IETF.  The easiest and probably most destructive would be to
create a large number of fake identities, sign them up for the
IETF list, and then attack one IETF Last Call after another, a
process that would not only prevent us from getting any work
done but that would prevent our changing procedures to work
around the problem.  That has also happened zero times.

The evidence that remote participants are being deprived of the
ability to use the recall process to protect themselves against
abusing behavior in the leadership is clear and obvious.  Not
doing something about that because of fears of a problem that
has never occurred despite many opportunities strikes me as, at
best, having our priorities wrong.  Of course, one can argues
that the recall process is unusable in practice and therefore
creating a more fair initiate process is irrelevant, but I
really hope we don't need to go there, if only because it would
invite appeals that go more or less directly to the ISOC BoT.

best,
   john