Re: [Iasa20] WGLC: draft-ietf-iasa2-rfc4071bis

[Nick Doty <[e-mail]>]

Please forgive my non-intimately-involved-with-IETF-administrative-activities eyes if my questions are naive, but perhaps that kind of review will be useful for the WG.

Cheers,
Nick

---

There's a lot of passive voice in these descriptions, which makes it unclear who is making these decisions or executing these actions. For example, from the Introduction:

> Under this structure, the Internet Administrative Oversight Committee (IAOC) is eliminated

Who decided to eliminate the IAOC? When? Is that decision documented? Or:

> Under IASA 2.0, most of the responsibilities that [RFC4071] assigned to the IETF Administrative Director (IAD) and the Internet Society (ISOC) were transferred to the IETF LLC and IETF Administration LLC Executive Director (IETF Executive Director).

Who transferred those responsibilities? Did the IAD and ISOC choose to transfer them, or did they agree with someone else's choice to move them?

I see there are also previous comments on-list regarding the tense of these documents: present, future, past, etc. I agree that consistency there would be helpful in explaining what has happened or will happen. For example, I am genuinely not clear on whether IETF LLC is currently managing IETF's administrative activities or if that's a proposed change for the future. The two examples of passive voice I noted above use different tenses and I'm not sure if that implies something.

RFC4071 describes an effective date as tied to when the document is approved as a BCP, but there is no description of effective date in this document.

> This document outlines how the chosen option is structured

Who chose this option over the other documented options? Was that decision by consensus of IETF or IAOC or some other body?

Section 3.8 "Community Consensus and Grant of Authority" may perhaps be the answer to these questions; if so, that could be clarified. Is the "broad-based community consensus" documented somewhere? Was there an IETF-wide Last Call? Was the broad consensus for the general shift to a disregarded entity, or to all of the details of this IASA 2.0 structure? Is the review of this document intended to be the process of gathering consensus for the IASA 2.0 structure or is that consensus already established and reviews of this document are just reviews of the description of the previous consensus decisions?

I recognize that RFC4071 was equally vague regarding documentation of consensus, but I don’t think that needs to be repeated.

---

>  o  Compliance.  The IETF LLC is responsible for establishing and
> enforcing policies to ensure compliance with applicable laws,
> regulations, and rules.

This bullet point could be interpreted extremely expansively, in ways that may not be desirable. Which jurisdiction's laws will apply to the IETF LLC? If IETF LLC manages the operations of the IETF and a law passes requirements on design of technical systems to enable compliance with court orders providing access to message content, will the LLC be required to establish and enforce policies to ensure compliance with those laws? Ensure compliance by whom?

I think the intent is for the IETF LLC and its staff to follow applicable laws for its own internal operations, rather than the operations or decisions of the IETF, but if so, I think that distinction could be explicitly called out. We should be mindful that the simplicity of having a single independent organization representing the IETF and acting as its fiscal sponsor could also provide simplicity for a government regarding whom to pressure. Naming the administrative entity almost identically to the standard-setting activity could generate real confusion on the separation between the two and the control one exerts over the other.

Later on, the legal compliance areas are described with examples:
> anti-terrorism sanctions, export controls, data protection/privacy

Those seem like areas that might apply to IETF activity as much as or more so than to IETF LLC activity. Would export controls on encryption technology apply to publications of the RFC Editor?