Subject: Re: Circle of Fifths

From: joel jaeggli <[email-masked]>
Date: Sun, 01 Nov 2009 22:36:52 -0800

Doug Ewell wrote:
> Paul Hoffman <paul dot hoffman at vpnc dot org> wrote:
> 
>> Take the past two day's of press coverage for ICANN, for example. They
>> are being lauded for making the domain name system usable in other
>> scripts as if this was their doing. Nothing in ICANN's press releases
>> pointed out that literally tens of thousands of hours of volunteer
>> time had been spent by the IETF over the past decade to make this work.
> 
> Indeed, the top new item on today's English Wikipedia page reads: "The
> Internet regulator ICANN approves plans to allow Unicode top-level
> domains for the first time."  Thus not only does ICANN get the credit,
> but "Unicode" continues to be used to mean "non-Latin-script."

If we got all the credit we deserved for IDN they'd be burning in effigy
or worse world-wide...

> -- 
> Doug Ewell  |  Thornton, Colorado, USA  |  http://www.ewellic.org
> RFC 5645, 4645, UTN #14  |  ietf-languages @ http://is.gd/2kf0s 
> 
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 4 Nov 2009 21:18:14 -0500

As near as I can make out, ICANN collects bucketloads of cash without
really having any idea why. The only rationale seemed to be to pay a
rather surprising large salary to the CEO.

Has ICANN managed to address its difficulty with supplier lock in for
the dotcom contract? Not that I am aware, they have not done what is
necessary to give themselves a choice of registrar when the contract
renews and so they will have no real choice but to award yet another
sole source contract to the incumbent contractor. Which Is suspect
rather suited the old management since it is much easier for an
organization that hands out contracts worth half a billion dollars a
year to pay their CEO the sums they did than it would be if the
contracts were rather more modest in size.

Has ICANN resolved the issues with DNS security? And here I do not
mean simply deployment of DNSSEC which will harm rather than hurt.

There is rather a long list of similar questions.

Given the tricky political situation that ICANN is in by its very
nature, given the even more precarious situation they have put
themselves in by their own decisions, given the fact that money is not
a scarce resource, a prudent board ICANN board would in my view be
buying all the friends and supporters they can while they are cheap.

Instead they are currently looking to raise even more money through
the sale of TLDs but last time I heard were curiously uninterested in
providing any material support to the root operators who would be
bearing the expense of supporting these new domains.

On Sat, Oct 31, 2009 at 11:07 AM, Ole Jacobsen <[email-masked]> wrote:
>
> "Millions of dollars of PR value"? What exactly does that mean, Paul?
> More to the point: How is ICANN funded? Unless I'm mistaken, they are
> funded by registrar/registry fees and, yes, application for new TLD
> fees, all of which comes from a healthy domain industry. That's not to
> say that ICANN shouldn't or couldn't fund technical work of course,
> but let's be clear about how the money is actually flowing.
>
> And with sponsorship money comes a whole lot of things that we geeks
> have typically wanted to stay well clear of such as "value" for the
> sponsors in a number of different ways, but yes, I agree we may not
> be able to stay pure forever.
>
> The press release may not have mentioned the IETF, but the work of the
> technical community certainly WAS mantioned directly as well as
> indirectly during this entire event. Maybe we should ask Thomas Narten
> to summarise this for us, he is the IETF-ICANN liaison.
>
> Ole
>
>
> Ole J. Jacobsen
> Editor and Publisher,  The Internet Protocol Journal
> Cisco Systems
> Tel: +1 408-527-8972   Mobile: +1 415-370-4628
> E-mail: [email-masked]  URL: http://www.cisco.com/ipj
>
>
>
> On Sat, 31 Oct 2009, Paul Hoffman wrote:
>
>> At 2:55 AM -0700 10/31/09, Ole Jacobsen wrote:
>> >You're not the first one to suggest that, but they do have a very
>> >different "business model" including covering travel for certain
>> >people and charging no meeting fees. It might make sense for us to
>> >approach the "domain industry" directly though...
>>
>> The "domain industry" does not profit from the IETF work nearly as
>> much as ICANN does. Take the past two day's of press coverage for
>> ICANN, for example. They are being lauded for making the domain name
>> system usable in other scripts as if this was their doing. Nothing
>> in ICANN's press releases pointed out that literally tens of
>> thousands of hours of volunteer time had been spent by the IETF over
>> the past decade to make this work.
>>
>> ICANN gets millions of dollars of PR value from the work that the
>> IETF does, whereas the "domain industry" gets very little. ICANN
>> should strongly consider helping pay for that work.
>>
>> --Paul Hoffman, Director
>> --VPN Consortium
>>

-- 
-- 
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/

---

From: John Levine <[email-masked]>
Date: 5 Nov 2009 17:53:02 -0000

>rather surprising large salary to the CEO.

Agreed, except for the surprise part.  The whole staff is paid
impressively large amounts and has been as long as I've been watching
ICANN.  They seem to feel that their peer organizations for
compensation purposes are investment banks rather than other
non-profits.

>bearing the expense of supporting these new domains.

If I were a root server operator, it would take an implausibly large
amount of money to be worth the strings that ICANN would attach.  A
key reason that the DNS still works is that there's no root server
contract, so the root operators can individually or jointly tell ICANN
to pound sand if they don't care for the root zone that ICANN offers
them. Hence ICANN is very cautions about changes.

R's,
John

---

From: Steve Crocker <[email-masked]>
Date: Thu, 5 Nov 2009 17:44:19 -0500

Full disclosure: I serve on the ICANN board of directors, and I chair  
ICANN's Security and Stability Advisory Committee (SSAC).  Both of  
these are volunteer, i.e. unpaid, positions, but ICANN does pay my  
travel expenses for meetings.

It's mildly amusing to see how this thread has drifted from where it  
started.  Also annoying.  See inline for responses.

> compensation purposes are investment banks rather than other

I don't have access to the salaries of individual employees, and I  
doubt you do either.  In general, ICANN pays its staff competitively  
in order to attract and retain skilled people.  A very large number of  
people also participate in ICANN as volunteers, similar to the way the  
IETF, ISOC and other organizations work.

> them. Hence ICANN is very cautions about changes.

This is multiple pieces of nonsense:

o ICANN is very cautious about changes to the root because that's the  
right thing to do.  A huge amount of work goes into vetting each and  
every requested change.  To suggest they are cautious only because of  
the root operators is both factually wrong and insulting.  It's really  
time to stop bashing the ICANN staff.  When they make a mistake,  
they'll admit it and fix it.  The competence level inside ICANN is  
surely as good as in the IETF and other organizations.

o The idea that the root operators would actually catch or stop errors  
in the root zone is more fantasy than reality.  The root operators are  
highly automated and don't generally look at the content of each  
update of the root zone.  At a recent meeting in the EU, a senior  
official at a major registry made the claim that the root operators  
were the last line of defense against malicious or capricious behavior  
by ICANN or the U.S. Government, and that DNSSEC would diminish the  
ability of the root operators to protect a registry from being removed  
from the root zone.  I took the opportunity ask if the root operators  
were, in fact, ready, willing and able to serve in such a capacity.   
If so, were there realistic plans and practice in place?  We're living  
in a post 9/11 world where organizations take such questions  
seriously.  They prepare plans and they practice dealing with  
contingencies.  I followed up with the root operators at a subsequent  
meeting.  No such plans exist, and the root operators do not seem  
inclined to organize themselves to act in such a capacity.  (I'm not  
taking a position pro or con as to whether they should have such a  
role.  I'm only saying there's no connection between the claim that  
they have this role and any realistic chance that they would actually  
do so today.)

o There's no basis at all for saying anything at all about what  
strings ICANN would attach to support for the root operators.  The  
root operators aren't asking for support, so the question simply  
hasn't come up.

Steve

---

From: "John R. Levine" <[email-masked]>
Date: 5 Nov 2009 23:30:14 -0500

> I don't have access to the salaries of individual employees, and I doubt 
> you do either. ...

Hi, Steve. As you know, ICANN is a legally incorporated as a public 
charity operating for the public benefit, exempt from taxes under IRS code 
section 501(c)(3).  Like every exempt organization, it files an annual 
financial statement on IRS Form 990, which includes the amounts paid to 
the highest paid employees and contractors and is available for public 
inspection.  The most recent 990 I can find online is from 2007.

It says that ICANN paid CEO Paul Twomey $691,610 plus $255,649 pension 
contribution.  They paid COO Doug Brent $390,939 plus $98,412 pension plus 
$23,804 expenses.  They paid General Counsel John Jeffrey $314,500 plus 
$63,982 pension.  They paid VP Kutt Pritz $318,846 plus $79,627 pension. 
They paid VP Thressa Swinehart $251,497 plus $62,916 pension.  They paid 
VP David Conrad $197,779 plus $53,028 pension.  They paid VP Denise Michel 
$235,722 plus $52,500 pension, plus an impressive $115,649 expenses, 
presumably living expenses in Brussels.  They paid Ombudsman Frank Fowlie 
an astonishing $437,727 via his consulting corporation in Canada.  They 
didn't pay you anything.

There's more, but this is plenty to get the idea.  To approximate what 
everyone else is paid it's easy enough to look at the staff and budget 
numbers, and it's quite clear nobody is underpaid.

>> amount of money to be worth the strings that ICANN would attach. ...

I actually don't think we have any serious disagreement here.  ICANN's 
management of the root zone is cautious for all sorts of reasons, and as 
you note the root server operators have no plans to say no to what ICANN 
offers them.  It's always been clear that one reason is that the 
consequences if any of the root servers felt unable or unwilling to accept 
ICANN's root would be too awful to contemplate, so it'll never happen.

But to return to the original issue, ICANN has plenty of money if they 
wanted to support the IETF.  But the IETF needs to get organized enough to 
ask in a way to which you and the rest of the board can say yes.

R's,
John

---

From: Steve Crocker <[email-masked]>
Date: Fri, 6 Nov 2009 05:28:52 -0500

On Nov 5, 2009, at 11:30 PM, John R. Levine wrote:

>>> impressively large amounts and has been as long as I've been  
>>> watching ICANN.  They seem to feel that their peer organizations  
>>> for compensation purposes are investment banks rather than other  
>>> non-profits.
>
>> doubt you do either. ...
> charity operating for the public benefit, exempt from taxes under  
> IRS code section 501(c)(3).  Like every exempt organization, it  
> files an annual financial statement on IRS Form 990, which includes  
> the amounts paid to the highest paid employees and contractors and  
> is available for public inspection.  The most recent 990 I can find  
> online is from 2007.
>
> It says that ICANN paid CEO Paul Twomey $691,610 plus $255,649  
> pension contribution.  They paid COO Doug Brent $390,939 plus  
> $98,412 pension plus $23,804 expenses.  They paid General Counsel  
> John Jeffrey $314,500 plus $63,982 pension.  They paid VP Kutt Pritz  
> $318,846 plus $79,627 pension. They paid VP Thressa Swinehart  
> $251,497 plus $62,916 pension.  They paid VP David Conrad $197,779  
> plus $53,028 pension.  They paid VP Denise Michel $235,722 plus  
> $52,500 pension, plus an impressive $115,649 expenses, presumably  
> living expenses in Brussels.  They paid Ombudsman Frank Fowlie an  
> astonishing $437,727 via his consulting corporation in Canada.  They  
> didn't pay you anything.
>
> There's more, but this is plenty to get the idea.  To approximate  
> what everyone else is paid it's easy enough to look at the staff and  
> budget numbers, and it's quite clear nobody is underpaid.

I'm familiar with the 990.  Your original comment addressed the entire  
staff, and your last line above alludes to drawing an inference based  
on staff and budget numbers.  I've got a little bit of experience  
reading these kinds of numbers.  ICANN incurs rather substantial non  
labor expenses due to its meetings and other matters.  That, of  
course, leads to a separate discussion about ICANN's meetings, but  
let's not delve into that here.

> I actually don't think we have any serious disagreement here.   
> ICANN's management of the root zone is cautious for all sorts of  
> reasons, and as you note the root server operators have no plans to  
> say no to what ICANN offers them.  It's always been clear that one  
> reason is that the consequences if any of the root servers felt  
> unable or unwilling to accept ICANN's root would be too awful to  
> contemplate, so it'll never happen.

No, it's not too awful to contemplate.  Far from it.  As a matter of  
prudent planning, consideration of the consequences of a root operator  
refusing to update the root zone is definitely something that ought to  
be part of contingency and disaster planning.

> But to return to the original issue, ICANN has plenty of money if  
> they wanted to support the IETF.  But the IETF needs to get  
> organized enough to ask in a way to which you and the rest of the  
> board can say yes.

You've just changed the subject from support for the root operators to  
support for the IETF.  The IETF situation was already discussed in  
detail.

Steve

---

From: Steve Crocker <[email-masked]>
Date: Fri, 6 Nov 2009 05:55:15 -0500

On Nov 5, 2009, at 11:39 PM, Phillip Hallam-Baker wrote:

> On Thu, Nov 5, 2009 at 5:44 PM, Steve Crocker <[email-masked]>  
> wrote:
>> these are
>> volunteer, i.e. unpaid, positions, but ICANN does pay my travel  
>> expenses for
>> meetings.
>>
>>> watching
>> doubt you
>> do either.  In general, ICANN pays its staff competitively in order  
>> to
>> attract and retain skilled people.  A very large number of people  
>> also
>> participate in ICANN as volunteers, similar to the way the IETF,  
>> ISOC and
>> other organizations work.
>
> $722,079 for the services of Twomey was far more than he could have
> expected in any other role and far more than his performance in the
> job justified.
>
> In response to John,: I think that prior to his appointment all of us
> would be very surprised to know what Twomey would be making in a few
> years time.
>
> Beckstrom can clearly demand a very substantial salary in other roles.
> That is why I used the past tense.
>
>
>> o ICANN is very cautious about changes to the root because that's  
>> the right
>> thing to do.  A huge amount of work goes into vetting each and every
>> requested change.  To suggest they are cautious only because of the  
>> root
>> operators is both factually wrong and insulting.  It's really time  
>> to stop
>> bashing the ICANN staff.  When they make a mistake, they'll admit  
>> it and fix
>> it.  The competence level inside ICANN is surely as good as in the  
>> IETF and
>> other organizations.
>
> One of the problems of living in the US is that there is really very
> little experience of long lived institutions. Let us stipulate for the
> sake of argument that all the current staff are competent, what
> guarantees do we have for situation 20 years from now, how about 50?
> How about 500? There is a College in Oxford that is currently facing
> the imminent expiry of its 499 year lease.

Yes, one of the problems of living in the U.S. is it's a young country  
that is unafraid to invent, experiment and reflect on its  
institutions.  Thus comes the Internet, invented even though we have  
the oldest operating democracy.

> I really don't think that this degree of thinking is evident in the
> design of ICANN.

Rather more than you're giving us credit for.  But there's a lot of  
ground to cover before we get to the 50 or 500 year mark.  We're just  
over one decade into this process.

> The type of situation that we can end up in is illustrated by the
> French recording rights society, which U2 withdrew their songs from
> after receiving a pittance (I seem to rememer it was less than $100)
> while the President of the organization proudly unveiled the grandiose
> multi-hundred million dollar building on which the money collected on
> behalf of U2 and the other artists had been spent.

Yup, that's why we spend so much time on governance models and issues,  
with more to come.

> o The idea that the root operators would actually catch or stop  
> errors in
>> the root zone is more fantasy than reality.  The root operators are  
>> highly
>> automated and don't generally look at the content of each update of  
>> the root
>> zone.  At a recent meeting in the EU, a senior official at a major  
>> registry
>> made the claim that the root operators were the last line of  
>> defense against
>> malicious or capricious behavior by ICANN or the U.S. Government,  
>> and that
>> DNSSEC would diminish the ability of the root operators to protect a
>> registry from being removed from the root zone.  I took the  
>> opportunity ask
>> if the root operators were, in fact, ready, willing and able to  
>> serve in
>> such a capacity.  If so, were there realistic plans and practice in  
>> place?
>>  We're living in a post 9/11 world where organizations take such  
>> questions
>> contingencies.
>>  I followed up with the root operators at a subsequent meeting.  No  
>> such
>> plans exist, and the root operators do not seem inclined to organize
>> themselves to act in such a capacity.  (I'm not taking a position  
>> pro or con
>> as to whether they should have such a role.  I'm only saying  
>> there's no
>> connection between the claim that they have this role and any  
>> realistic
>> chance that they would actually do so today.)
>
> Steve, it appears that you do not understand the security concerns
> that are driving the politics of DNS.
>
> The concern that ICANN might drop the Palestine zone out of the root
> is precisely the source of the Egyptian delegation concern. That is
> the reason why the ex-Interim Prime Minister of the Palestinian
> authority took the time to meet with Twomey, I can assure you that it
> was no social call.
>
> The concern that ICANN might drop Cuba out of the root zone is one of
> the principal drivers of the Brazilian concerns.
>
> The Russian and French delegations have no specific concerns that they
> have voiced to me but they certainly understand that ICANN has power
> over the communications system that is only checked by the US
> government, if at all.
>
> Some folk in the old US State department thought this situation was
> just dandy. Some folk in the new administration are less than happy
> with the situation. It means that all it takes to create an
> international crisis is for some fool in Congress to put in a bill to
> force ICANN to drop Cuba, Palestine or whatever other country they
> want to grandstand against out of the root.
>
> There is no particular secret to learning these concerns, you just
> have to do some active listening.

We're pretty far afield.  Conspiracy theories are easy to create.  I  
have listened to these sorts of arguments, including directly from the  
principals of some of the countries.  Simply not connected to reality,  
but definitely understandable in terms of the broader long standing,  
slowly evolving geopolitical drama.  The Internet is the political  
pawn of the decade.  It's important to sort out which issues are  
specific to the Internet and which are really proxies for the broader  
east vs west, north vs south, developing vs developed political  
tensions.

> Whether the concerns are credible or not, they are genuine. And some
> of the people who hold them have the power to ensure that DNSSEC is
> not deployed in their country.

The decision whether to deploy DNSSEC within an existing ccTLD is up  
to that operator.  Those decisions will be based on a wide variety of  
factors.  Some have already deployed.  Many more are in the process of  
doing so and will move forward more rapidly when the root is signed.   
Others will delay or choose not to, either for lack of resources,  
concerns over various pragmatics, or, as you say, for political  
reasons.  Fortunately, the benefit of DNSSEC is incremental.  The  
whole system doesn't unravel is some subset of the TLDs choose not to  
implement it.  It's a bit early to know whether the number of zones  
that will be permanently unprotected will be zero, a small number or a  
substantial number.  Let's revisit this in a few years.

> The idea that the root operators would serve as the last line of
> defense is not as naive as you imagine. The threat does not need to be
> very credible to ensure that ICANN is kept in line. Nor is it the
> 'root operators' who are the real last line of defense, rather it is
> the ISPs that route the address blocks for the IP addresses that they
> employ.

There are large number of ISPs.  Quite a few are monetizing the  
rewriting of DNS responses.

> Let us imagine that some Florida Congressman decides to grandstand
> with an amendment to force ICANN to drop Cuba out of the root. The
> preparations to protect against the damage would begin the minute the
> bill was published. The Internet community is pretty quick to respond
> in such cases, I don't think it would take more than a day before
> backup roots were ready to deploy if necessary.
>
> Since it is pretty clear that the rest of the world would move to a
> non-ICANN root regardless of the level of reliability it provides in
> preference to a root that is intentionally broken by the US Congress,
> the contingency planning does not need to be particularly thorough.
> This is explained to the Congressman by the State department in words
> of few syllables and the bill is quickly dropped.
>
> Note the interior political dynamic here. The problem is not 'the US',
> it is one egotistical member of Congress who has the power to create
> an international incident through grandstanding.

You're inventing a scenario and choosing your inferences.  Good plot  
for pulp fiction.

> DNSSEC completely disrupts that delicate balance of interests. If the
> DNSSEC root of roots is widely deployed in embedded devices according
> to current plans, a defection by ICANN becomes a real risk. At that
> point there is no certainty that the plan to drop out Cuba will fail.
> Most importantly, the State department now has to spend real political
> capital to ensure that the bill is dropped - if it chooses to do so.
> Perhaps the President prefers having their vote for Health Care or
> whatever.

ICANN is accountable and transparent.  You're creating a conspiracy  
scenario that really doesn't have a basis in fact or even in  
possibility.

> Now you have two approaches that you can take here. The first is that
> you can continue to ignore an issue that has created real concern
> outside the US, or you can look at minor modifications to the DNSSEC
> architecture that allow the concerned parties to be co-opted.

Discussion of architectural changes to DNSSEC belong in the DNSEXT WG.

> The real political problem here is that the Internet does not provide
> enough important jobs for everyone to feel included. So a technical
> architecture that provides more jobs for people to do, provides a
> means of co-opting those parties.

Discussion of political problems related to lack of employment seems  
pretty far afield for an IETF discussion list.

With due respect, we're well into an entirely different set of topics  
from yesterday.  I'm breaking off at this point.

Steve

> If you look at the original Web of Trust paper by Phil Z. you will
> note that his original plan had an option for quorate voting to
> establish trust relationships, an idea later implemented in SDSI. A
> mechanism that allowed for multiple root signers would give the
> Brazilian, French and Russian delegations something to take home to
> their governments and say 'this is how we can address the
> concentration of US interest'.
>
> We have 13 root servers, we should plan to have at least 13 apex
> roots. In fact we should allow anyone who wants to do so to become an
> apex root signatory and relying parties should have the option to
> choose whoever they please as and whatever voting criteria they
> please.
>
> The nice thing about this approach is that it re-establishes the
> previous situation where the risk of defection is controlled by
> removing the expectation of success rather than through the
> traditional approach of making defection difficult. No single apex
> signatory would be universally trusted so there is no risk of
> universal failure. And each relying party chooses multiple apex
> signers to trust so defection by a single signer does not even result
> in a local failure. If there is no expectation of failure there is no
> reason to default. So the only failures that might occur at an apex
> signatory would be through mistake rather than malice.
>
>
> This situation is considerably better for ICANN as well, if we replace
> 'Cuba' with 'Palestine', the CEO and staff of ICANN are suddenly on
> the front line of an irredentist dispute. What do people fight over in
> irredentist disputes? They fight over symbols, the WTC was attacked in
> 9/11 because its owners had set themselves up as a symbol of the
> capitalist system.
>
> Now as I said earlier, you can continue to ignore such security issues
> and tell everyone that they should not be at all worried by your
> friends. But lets face it, DNSSEC has been 'about to' deploy for the
> past ten years and has been 'expected soon' ever since I first met you
> almost fifteen years ago.
>
> You cannot deploy an infrastructure change by designing to the 80:20
> rule. You can't even do it by addressing the concerns raised in the
> working group. You have to go out there and look under the rocks and
> find out what is lurking there.
>
> Again, DNSSEC is a security protocol, your intended early adopter
> audience is made up of people who are unreasonable and paranoid. So
> don't complain when we say that we do not trust ICANN.
>
>
>> strings
>> ICANN would attach to support for the root operators.  The root  
>> operators
>> aren't asking for support, so the question simply hasn't come up.
>
> But that overlooks the fact that only four of the root servers
> survived the great DDoS attack. And two of those are run by VeriSign.
>
> So ICANN's failure to recompense the root operators for their services
> further deepens the vendor capture issue that is the reason that
> Twomey really was never worth three quarters of a million bucks a
> year.
>
>
> --

---

From: Bill Manning <[email-masked]>
Date: Sat, 7 Nov 2009 02:44:34 -0800

> be part of contingency and disaster planning.

	actually, from a stability, resiliency and surviabily point of
	view (or just call it contingency and disaster planning) one should
	seriously look at -ALL- the actors who have an operational role
	in the creation and publication of the root zone.

	In general, the root operators have a fairly long track record
	of ensuring the zone gets there.  Some operators are newer at the
	task than others, some of the other actors are just on their first
	decade of service.

	any credible contingency and disaster planning  would have to 
	include -ALL- of the operational actors in a coordinated 
	response, not something driven by one of them.

	IMHO of course.

-- 
--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 5 Nov 2009 23:39:03 -0500

On Thu, Nov 5, 2009 at 5:44 PM, Steve Crocker <[email-masked]> wrote:
> ICANN's Security and Stability Advisory Committee (SSAC).  Both of these are
> volunteer, i.e. unpaid, positions, but ICANN does pay my travel expenses for
> meetings.
>
> I don't have access to the salaries of individual employees, and I doubt you
> do either.  In general, ICANN pays its staff competitively in order to
> attract and retain skilled people.  A very large number of people also
> participate in ICANN as volunteers, similar to the way the IETF, ISOC and

> o ICANN is very cautious about changes to the root because that's the right
> requested change.  To suggest they are cautious only because of the root
> operators is both factually wrong and insulting.  It's really time to stop
> bashing the ICANN staff.  When they make a mistake, they'll admit it and fix
> it.  The competence level inside ICANN is surely as good as in the IETF and
> other organizations.

> o The idea that the root operators would actually catch or stop errors in
> the root zone is more fantasy than reality.  The root operators are highly
> automated and don't generally look at the content of each update of the root
> zone.  At a recent meeting in the EU, a senior official at a major registry
> made the claim that the root operators were the last line of defense against
> malicious or capricious behavior by ICANN or the U.S. Government, and that
> registry from being removed from the root zone.  I took the opportunity ask
> if the root operators were, in fact, ready, willing and able to serve in
> such a capacity.  If so, were there realistic plans and practice in place?
>  We're living in a post 9/11 world where organizations take such questions
> seriously.  They prepare plans and they practice dealing with contingencies.
>  I followed up with the root operators at a subsequent meeting.  No such
> themselves to act in such a capacity.  (I'm not taking a position pro or con
> as to whether they should have such a role.  I'm only saying there's no
> connection between the claim that they have this role and any realistic

> o There's no basis at all for saying anything at all about what strings
> ICANN would attach to support for the root operators.  The root operators

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 6 Nov 2009 09:53:47 -0500

On Fri, Nov 6, 2009 at 5:55 AM, Steve Crocker <[email-masked]> wrote:

> Yes, one of the problems of living in the U.S. is it's a young country that
> is unafraid to invent, experiment and reflect on its institutions.  Thus
> comes the Internet, invented even though we have the oldest operating
> democracy.

The US Constitution was an attempt to recreate the English
Constitution which at the time was at least 500 years old with
incremental improvements based on the best research of the day. It was
'built to last'. The founders took the time to understand the security
risks and built in checks and balances.

ICANN is not built in that fashion. It has no reall checks or
balances, just a set of people who airily dismiss the notion that they
might have a duty of accountability.

After every revolution, the plotters withdraw into a cabal and carve
up the power.

> We're pretty far afield.  Conspiracy theories are easy to create.

Conspiracies happen. You are playing in the big leagues here.

Those people you dismiss as 'conspiracy theorists', they made the
events of the latter half of the 20th century happen. they spent
thirty years doing things like situating the West German TV masts in
places that intentionally creat overspill into East German areas,
developing technical standards that ensure that the East Germans can
watch.

It is easy to tell a nutty conspiracy theory from a real one, the
nutty theory will be discussed endlessly (Roswell, JFK, etc.) the real
conspiracy theories are ignored. We know for a fact that Col. Ollie
North was supplying arms to the Iranian government and using the
receipts to supply Latin American terrorists. That is an
incontrovertible fact, it was a conspiracy but we don't need to talk
about it because we all know it is true.

> I have
> listened to these sorts of arguments, including directly from the principals
> of some of the countries.  Simply not connected to reality, but definitely
> understandable in terms of the broader long standing, slowly evolving
> geopolitical drama.

No, that is their reality.

Like you, I have been in the meetings where cybersecurity is
discussed. I am pretty sure you know that the policy of the US State
department is and has been for some time to ensure that the Internet
is as free as possible from censorship controls as a means of
destabilizing authoritarian regimes.

These are not conspiracy 'theories', they are conspiracies that you
and I know are fact because we have been a part of them.

>The Internet is the political pawn of the decade.  It's
> important to sort out which issues are specific to the Internet and which
> are really proxies for the broader east vs west, north vs south, developing
> vs developed political tensions.

No, it is not important for you to understand the reasons behind the
concern at all. What you have to do at ICANN is to deal with the
concern of your customers regardless of whether or not you consider
them to be well founded.

> The decision whether to deploy DNSSEC within an existing ccTLD is up to that
> operator.  Those decisions will be based on a wide variety of factors.  Some
> have already deployed.  Many more are in the process of doing so and will
> move forward more rapidly when the root is signed.  Others will delay or
> choose not to, either for lack of resources, concerns over various
> pragmatics, or, as you say, for political reasons.  Fortunately, the benefit
> of DNSSEC is incremental.  The whole system doesn't unravel is some subset
> of the TLDs choose not to implement it.  It's a bit early to know whether
> the number of zones that will be permanently unprotected will be zero, a
> small number or a substantial number.  Let's revisit this in a few years.

Or how about we look at the totality of the requirements now and start
fixing them now.

> You're inventing a scenario and choosing your inferences.  Good plot for
> pulp fiction.

No, I am setting out a realistic scenario that illustrates a valid
class of attack and you are choosing to attack it with ridicule rather
than taking it seriously.

I do have the standing in the community to demand a response here. At
the moment I am arguing here in the IETF forum, but there are other
forums open to me. I am speaking on this at RSA next year. The press
will be present. And I regard this entire conversation to be on the
record and official.

> ICANN is accountable and transparent.  You're creating a conspiracy scenario
> that really doesn't have a basis in fact or even in possibility.

Precisely what part of the scenario do you consider implausible?

Take a look at the grandstanding that the GOP and the Cubanista
community took part in during the Elian Gonzalez affair. Do you really
think that it is beyond belief that the people who exploited a seven
year old kid to further their political careers would not stoop to
creating this type of crisis if they got the idea?

And whatever you think is the case, do you imagine that it is worth
trying to persuade the rest of us that it is not.

> Discussion of architectural changes to DNSSEC belong in the DNSEXT WG.

No, this is a policy issue.

The DNSEXT working group has consistently taken the approach that it
has taken so long to get to this point that it is going to ignore all
new requirements, including deployment requirements until deployment
is complete. It has taken fifteen years to get to this point so the
only thing to do is to stop asking why.

Such groups are unlikely to solve the problem.

It is your job at ICANN to determine what the deployment requirements
are for DNS Security and communicate them to the relevant parties.
Simply passively waiting for the IETF to think up the requirements of
its own accord is not going to work. It certainly has not worked to
date. It will be another fifteen years before you have deployment at
this rate.

> Discussion of political problems related to lack of employment seems pretty
> far afield for an IETF discussion list.

Discussing the issues of inclusion are something that the IETF list
spends a very great deal of time doing.

> With due respect, we're well into an entirely different set of topics from
> yesterday.  I'm breaking off at this point.

So you break off at the point I suggest a solution, nice one.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 6 Nov 2009 12:30:18 -0500

>> management of the root zone is cautious for all sorts of reasons, and as you
>> note the root server operators have no plans to say no to what ICANN offers
>> them.  It's always been clear that one reason is that the consequences if
>> any of the root servers felt unable or unwilling to accept ICANN's root
>> would be too awful to contemplate, so it'll never happen.
>
> No, it's not too awful to contemplate.  Far from it.  As a matter of prudent
> planning, consideration of the consequences of a root operator refusing to
> update the root zone is definitely something that ought to be part of
> contingency and disaster planning.

So a contingency that a few posts ago you dismissed as 'nonsense' now
turns out to be something that does require extensive consideration.

But I note that you are actually discussing a different contingency,
the consequences of a single default. Clearly the root operators are
responsible to and accountable to the Internet community. I would
expect that a default by a single root operator would be dealt with by
ISPs redirecting packets sent to that IP address block to a different
root. It is not that hard, it is merely a matter of the BGP cabal
deciding that the expectations of the Internet community are not being
met and adjusting accordingly.

But that was not the scenario at issue. The scenario at issue was the
case that it is ICANN that is considered to be in default. That is not
going to happen because the consequence would be the end of ICANN.
Some of the root operators would back the ICANN line of course,
perhaps they all would. But if some part of the US government was to
decide to abuse the degree of control it has over ICANN, other
governments would respond in the same fashion and order their domestic
ISPs to redirect traffic away to approved roots.

The consequences for the Internet would be rather small. I doubt that
there would be much disruption of Internet service. But the diplomatic
dislocation would be huge and ICANN would be utterly broken in the
process.

The essential weakness of ICANN's position was recognized very early
on, before the organization was founded in fact. And that is why it
was tolerated in its current form. DNSSEC with a single root of trust
would transform it from constitutional monarch to absolute monarch.

Having people respond to such concerns by saying 'trust me, you are
paranoid' is not the way to win friends and influence people. As you
admit in your own posts, the national security issue has been raised
with you by the sovereign powers directly. Who do you think you are to
dismiss those concerns as delusions?

> support for the IETF.  The IETF situation was already discussed in detail.

And that topic was avoided as well, which is hardly surprising.

ICANN has already conceded the principle of supporting the IETF
through the highly conflicted award of the .org contract to a group
including ISOC. That is not a transparent or accountable mechanism. It
sets up a whole series of conflicts of interest for the ICANN and ISOC
boards.

It would be much better to simply give the money in the form of a
grant. Giving money to the IETF and W3C would provide a political
support base that ICANN desperately needs. It would also be justified
on the basis that ICANN exists to further the development of the
Internet and that ICANN revenues are driven by increased use of open
Internet protocols.

---

From: David Conrad <[email-masked]>
Date: Mon, 9 Nov 2009 13:16:37 -0800

On Nov 6, 2009, at 9:30 AM, Phillip Hallam-Baker wrote:
> Clearly the root operators are responsible to and accountable to the Internet community.

Err, no.

First, the root server operators are all independent actors performing a service for the Internet community for their own reasons.  They are formally responsible and accountable to different communities, e.g., the folks who run "C" are responsible to their share holders and the folks who run A and J do so under a cooperative agreement with the US government.

Secondly, there are no formal terms of responsibilities nor accountability to the Internet community.  In the past, specific root servers have been operated abysmally poorly and there was nothing that could be done by the "Internet community" to force root server operators to change the way they do things.  With one arguable exception (that of VeriSign) there are no service level agreements, no penalties for failure to perform, and no formal commitments whatsoever.

How exactly is that being "accountable to the Internet community"?

> DNSSEC with a single root of trust would transform it from constitutional monarch to absolute monarch.

I have no idea what this means.  As I'm sure you are aware, DNSSEC merely allows folks to validate data hasn't been modified between the point in which the data is signed and the validator.  If folks don't want to trust the ICANN/IANA KSK and/or VeriSign ZSK, they're free to import the individual trust anchors however they choose.  There is no magic here.

Regards,
-drc

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 10 Nov 2009 06:27:37 +0900

David Conrad wrote:
>     There is no magic here.

Oh good grief.

You are clearly entirely too close to this.

It is /all/ f'ing magic.

Every f'ing thing about the Internet is magic.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 10 Nov 2009 06:31:12 +0900

> Every f'ing thing about the Internet is magic.

Any sufficiently fubar'd technology is indistinguishable from the
Internet? ;-)

/psa

---

From: Mark Andrews <[email-masked]>
Date: Tue, 10 Nov 2009 09:32:05 +1100

In message <[email-masked]>, Phill
ip Hallam-Baker writes:
> >> I actually don't think we have any serious disagreement here. =A0ICANN's
> >> management of the root zone is cautious for all sorts of reasons, and as=
>  you
> >> note the root server operators have no plans to say no to what ICANN off=
> ers
> >> them. =A0It's always been clear that one reason is that the consequences=
>  if
> > No, it's not too awful to contemplate. =A0Far from it. =A0As a matter of =
> prudent

No, it wouldn't.  ISP's would just graft Cuba back onto the net.
It requires a little reconfiguration to add a trust anchor for Cuba
as well as the root but the world would route around such idiocy.

This would be a little like SiteFinder.  There would be a short
disruption until the world routes around the idiocy.  If new code is
needed it would appear at about the same rate anti SiteFinder code
appeared (read overnight).
 
> >> wanted to support the IETF. =A0But the IETF needs to get organized enoug=
> h to
> > support for the IETF. =A0The IETF situation was already discussed in deta=
> il.
> 
> -- =
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Bill Manning <[email-masked]>
Date: Fri, 13 Nov 2009 03:40:37 -0800

> First, the root server operators are all independent actors performing a service for the Internet community for their own reasons.  They are formally responsible and accountable to different commun…

	well A is certainly run under agreement with the DoC.  J on the other hand...

> Secondly, there are no formal terms of responsibilities nor accountability to the Internet community.  In the past, specific root servers have been operated abysmally poorly and there was nothing t…

	There is some intimation that L might be covered under a similar type of instrument.
	But I have no real time to investigate further.

> How exactly is that being "accountable to the Internet community"?

	I'm pretty sure you have the right direction here, that the operators are accountable to
	their communities.  I've a tough time with a workable definition of "Internet Community"
	though.

-- 
--bill