[Mod-discuss] Re: WG Last Call: draft-ietf-modpod-group-processes-10 (Ends 2025-09-08)

["D. J. Bernstein" <[e-mail]>]

IETF LLC Executive Director writes:
> This segue below into antitrust unfortunately contains mistaken claims
> and a false allegation,

No, it doesn't. What you write is not responding to the actual content
of my objections; you're instead shifting to other topics. See below.

> > One sees the same procedures (with minor differences in details) in
> > pretty much every standardization organization---but not IETF.
> That is a mistaken claim.  Here is just one example of an SDO that has
> antitrust guidelines very similar to the IETF
> https://www.iso.org/files/live/sites/isoorg/files/developing_standards/docs/en/competition_law_guidelines.pdf

No, my claim is correct as stated. Since you picked ISO as an example:
ISO has the procedures I described. IETF does not.

You removed the context in which I described the procedures I was
talking about. Here's the first paragraph of the context: "In a
standards organization, each moderator's basic task is to make sure that
decisions have consensus. This doesn't require unanimity, but it does
require general agreement; fair consideration of each comment; a process
of attempting to resolve each objection; and documentation---for any
objection that was not resolved but that was instead overridden by
general agreement---of _why_ that objection was overridden."

These procedures are _required by law_. Specifically, the safe harbor
for standardization in antitrust law, namely 15 U.S.C. §4302, is only
for standardization meeting the definition in 15 U.S.C. §4301, which in
turn incorporates the requirements of OMB A-119, which defines consensus
as follows: "general agreement, but not necessarily unanimity, and
includes a process for attempting to resolve objections by interested
parties, as long as all comments have been fairly considered, each
objector is advised of the disposition of his or her objection(s) and
the reasons why, and the consensus body members are given an opportunity
to change their votes after reviewing the comments".

Seeing that ISO has these procedures is a simple matter of looking at
the ISO _Directives_, the central ISO standardization procedures.

I'll take an example to illustrate. The straightforward rule "Committees
are required to respond to all comments received" appears in the ISO
Directives, 2.5.3:

    https://www.iso.org/sites/directives/current/consolidated/index.html#_Toc165304990

For comparison, IETF _often_ has _individual_ responses to objections,
but

    (1) it's rare for those to be _official_ statements (i.e., there's
        usually no working-group response whose content can be appealed;
        the group isn't required to discuss an objection carefully
        enough to come to agreement on a response); and

    (2) it's certainly not true that _every_ objection receives a
        response (majorities can simply ignore the most important
        objections, while hiding this behind the continual noise of
        minor comments).

It's also not as if these failures are violations of IETF policy. It's
IETF's fault for failing to require a WG response to each objection.

_Beyond_ the ISO Directives, ISO also has _extra_ rules relevant to
antitrust law, such as the rules in the ISO document you mentioned:

    https://www.iso.org/files/live/sites/isoorg/files/developing_standards/docs/en/competition_law_guidelines.pdf

I agree that this document has some similarities to the IETF document

    https://www.rfc-editor.org/rfc/rfc9680.html

such as both documents having the word "guidelines" in the title, both
documents talking about antitrust law, etc. But this is completely
non-responsive to what I wrote about specific _differences_ between
IETF's procedures and the procedures of other SDOs.

> > Presumably the actual feedback was worded more like "You are
> > blatantly violating antitrust law and have to fix your procedures right
> > now".
> The allegation

"Presumably" is not stating an allegation; it is stating a presumption.
"Presume" means "suppose without proof", whereas "allege" means "assert
without proof"; "suppose" means "lay down tentatively as a hypothesis,
assumption, or proposal", whereas "assert" is definite.

> that this blog post is misrepresenting the feedback received

Hmmm. If the actual feedback to IETF LLC was worded like "You are
blatantly violating antitrust law and have to fix your procedures right
now", which then turned into IETF LLC's public characterization of the
feedback as "our current processes and procedures would not provide
strong mitigation of antitrust risk and that could only be achieved with
a detailed compliance policy", is that really _misrepresentation_?

I would have to think about this. _Maybe_ I'd end up concluding that the
answer is yes, but certainly that's not what I said above. The way that
you took this quote out of context forces the reader to do extra work to
see that you're attacking a strawman.

> is false.

IETF LLC should be providing the actual wording of the feedback for
IETF participants to evaluate---in part because secrecy is error-prone
and in part because IETF LLC claims that "IETF activities are conducted
with extreme transparency, in public forums".

Any argument that this feedback _must_ be kept secret would be hard to
reconcile with the argument that the feedback communicates the same
thing as what IETF LLC has posted.

Meanwhile we already _know_ that there's a gap between IETF's public
communication of the feedback it received and the actual feedback; the
only question is how large the gap is. Specifically,

    https://web.archive.org/web/20241219083129/https://mailarchive.ietf.org/arch/msg/tls/JC84TDxKTEekMuX87f3_ZNw_Tw4/

claims that "the IETF structure and processes are designed to mitigate
antitrust risks" and that this had been "thoroughly checked with
multiple sets of counsel", while the earlier message

    https://web.archive.org/web/20220514032045/https://mailarchive.ietf.org/arch/msg/antitrust-policy/f1iHM9p8N-U8p_pXen2ruDqjPPQ/

admits that IETF LLC "received private feedback from other lawyers that,
from the perspective of antitrust litigators, our current processes and
procedures would not provide strong mitigation of antitrust risk and
that could only be achieved with a detailed compliance policy".

> > As I've mentioned before, it's easy to see that the same list of
> > legal requirements was used to write
> >    https://www.ietf.org/blog/ietf-llc-statement-competition-law-issues/
> > with each requirement phrased as a claim that IETF follows the
> > procedures (look at "openness, balance of interests, due process, an
> > appeals process, and consensus" from 15 U.S.C. §4301, and compare that
> > to the part of the IETF statement starting "IETF participation is free
> > and open to all interested individuals"). The problem, in a nutshell, is
> > that those claims are false: that's not how IETF actually works.
> That is also a mistaken claim.

You're quoting multiple items. I presume you're referring to the last
item: i.e., I presume that you're saying that the claims on that page
match how IETF actually works. (Your subsequent text says "The IETF:"
and then makes various claims.)

Let's try an example, namely consensus. The page claims that "IETF
activities are conducted with extreme transparency, in public forums.
Decision-making requires achieving broad consensus via these public
processes".

But there's ample documentation elsewhere of IETF saying that consensus
_isn't_ required and that "rough consensus" is enough. So the page is
out of whack with how IETF actually works.

Readers of your subsequent text think that your list matches the page.
But you've actually shifted to _another_ series of claims about IETF.
You now write, for example, that IETF "operates with rough consensus";
but the page doesn't say "rough"!

One of my objections is that IETF isn't doing what the law requires. For
example, IETF doesn't require consensus. The issue here isn't just the
word "rough": the issue is that the law has a _definition_ of consensus
with the procedural protections that I listed (such as responding to
each objection), and IETF habitually violates those protections.

The IETF LLC statement claiming that everything is okay (1) doesn't
admit that IETF LLC received contrary feedback from various antitrust
litigators, (2) fails to address the OMB A-119 procedural protections
that 15 U.S.C. §4301 incorporates (I presume the lawyer who wrote the
IETF LLC statement looked at the "openness, balance of interests, due
process, an appeals process, and consensus" part of the law but missed
the "consistent with the Office of Management and Budget Circular Number
A-119" part; I quoted the OMB A-119 definition of consensus above); and
(3) is founded upon an easily debunked description of how IETF operates.

> https://www.ietf.org/blog/ietf-community-survey-2024/ 

Thank you for this link. The survey says that only 31.24% of 1060 survey
respondents agree that IETF "almost always" produces RFCs that "reflect
IETF consensus", while 38.90% say it "often" does, and the other 29.86%
don't even agree with "often".

Do you still claim that IETF's decision-making "requires achieving broad
consensus"?

  [ out of order: ]
> and therefore should not be considered evidence for rejecting the
> approach of a moderation team.  

Thank you for this clear example of IETF LLC steering the standards
process, in violation of "The IETF LLC has no role in the oversight or
steering of the standards process".

---D. J. Bernstein