CA/Browser Forum
Home » Posts » 2016-11-10 Minutes

2016-11-10 Minutes

Final Minutes CABF Teleconference 10 November 2016

**Attendees: ** Arno Fiedler (D-TRUST GmbH), Atsushi Inaba (Globalsign), Ben Wilson (Digicert), Bruce Morton (Entrust), Christopher Kemmerer (SSL.com), Curt Spann (Apple), Dean Coclin (Symantec), Dimitris Zacharopoulos (Harica), Doug Beattie (Globalsign), Fotis Loukos (SSL.com), Gervase Markham (Mozilla), JP Hamilton (Cisco), Jeremy Rowley (Digicert), Jody Cloutier (Microsoft), Leo Grove (SSL.com), Peter Bowen (Amazon), Peter Miscovic, (Disig), Rich Smith (Comodo), Rick Andrews (Symantec), Ryan Sleevi (Google), Steve Medin (Symantec), Tyler Myers (GoDaddy), Virginia Fournier (Apple), Wayne Thayer (GoDaddy).

Invited Guests: Marc Braner (former Microsoft IP attorney who also previously worked at Apple), Helene Workman (current Apple IP attorney).

  1. Roll Call

  2. Read Antitrust Statement

  3. Review Agenda – no changes

  4. Approval of Minutes of F2F Meeting Oct. 19-20, 2016 and teleconference of Oct. 27. Kirk noted that Ryan had submitted multiple changes to the Minutes for consideration the previous evening and member had not had time to evaluate, so the approval of these Minutes will be deferred until the next meeting.

  5. IPR Policy. [Note: Because of the importance of this agenda item, the recording of this portion of the meeting was converted into the transcript below. The discussion of this agenda item occurred in two parts – at this point in the agenda, and again at the end of the teleconference. The transcripts of these two segments are presented consecutively in this section of the Minutes for convenience.]

Virginia: I’d like to introduce Helene Workman and Marc Braner, both were on the team that drafted the CAB Forum IPR policy initially. Helene is the head of the standards legal team at Apple. Marc was at Microsoft when the IPR policy was drafted. I’d like to request that people hold their questions and comments until after Marc and Helene have had an opportunity to talk so we can make sure that we hear what they have to say and of course we can schedule additional calls if necessary if there are still questions after that but we want to make sure that we can hear what Helene and Marc have to say. So with that, Helene and Marc, do you want to go ahead and provide your comments on the IPR policy and the order of operation for that?

Helene: Sure. Marc, do you want to go first?

Marc: Sure. The IPR Policy of the CAB Forum was a multi-year effort, one I was involved in, and Helene was involved in, and at least six other companies if I recall correctly. And after a lot of discussion, we decided that we wanted, given the nature of the guidelines, created by CAB Forum, we wanted to make these guidelines available royalty-free, we thought that was the best chance for broad adoption.

We started drafting the IPR policy not from scratch, and that whole thing evolved to the existing IPR policy understood and been in existed for a long time. We decided to base the CAB Forum IPR Policy on W3C. The W3C was another policy. Helene was involved in that and it took years to develop and agree on. So we started on the W3C and we made modifications to take into account the fact that we wanted to keep it as simple as possible and make it as low-overhead as possible. We wanted to make changes to account for different terminology. For example, in the W3C, standards are called recommendations, and in the CAB Forum they are called guidelines. So I think the section in question, section 4.1, which deals with the review period, and in the W3C, the initial review period is five months. We thought that was way, way too long. So we made some changes for a different CAB Forum process. So the language in section 4.1 … (garbled).

Kirk: Marc, you’re breaking up.

Marc: So the intent was to have a review period that would take place before any vote on a document guideline. The reason for that is what might come up in a review period would provide facts and that people would be able to do a more informed vote. I can stop there. One thing I did want to say is that I’m not giving legal advice to the Forum or any members of the Forum. I’m just trying to give some historical context.

Helene: Just to follow up on what Marc said, again, this isn’t legal advice, I’m just trying to share some historical context. So I was part of the group that worked on this policy. I was also part of the drafting group for W3C. In drafting the CAB Forum IPR policy we were looking toward the W3C policy as a base. The idea was to use that same framework of having that default royalty-free grant with a period for excluding your essential claims, if you wanted to. As Marc said, we took into account differences between CAB Forum and W3C, and so there’s a review timeframe there, and other differences, section 4.1, and the exclusion review period. That is the same idea available for you there where before you adopt a final guideline you provide an exclusion review period so that people can assess whether they have essential patents and if they don’t want to license them under the royalty-free default license they have an opportunity to exclude them, and then, when you’re actually voting on whether to adopt them in the final guidelines, you have all of that information. And also there is the PAG process in here that is from W3C as well. So all of that was contemplated that it be before you actually take the vote to make something the final guideline so that people can have informed voting. So that is my recollection from my involvement in the development of the IPR policy.

Virginia: So it looks like we have time for questions.

Dean: This is Dean. Thank you for the overview. That is my recollection as well. You may have seen some of the back and forth on the mailing list. If you have, do you have any commentary one way or the other on those posts and which direction we should be going now?

Virginia: Dean, I think it might be helpful if you can be more specific about which posts you’re referring to.

Ryan: Dean, I can lead with a very specific question. The W3C process has a very specific work mode with respect to all of these obligations and contributions, right? There is the chartering of a work group, there is area director review, there is the act of publishing the first public working draft, which is what triggers the remainder of this IPR policy, and there is the advancement of each of these to maturity levels in the document, which may materially impact the review period, because you have, for example, the ability to make changes to the first public working draft, and what gets advanced to candidate recommendation. You need to have an opportunity to do IP review. From your recollection from the original discussions, was there guidance as part of the work mode and scope of the CAB Forum’s activities, given that we are unchartered and have a virtually limitless scope and therefore a virtual limitless set of IP obligations?

Helene: I can respond to that and then Marc you can add on. So my recollection is that there was a discussion about scope. Actually, there is a definition of scope in the policy which provides some constraints around what would actually be considered an essential claim, and so that is how it was addressed here.

Ryan: So the scope that you refer to in the IPR Policy is the scope of what defines an essential claim, but I’m speaking more so to the scope of the Forum’s activities, which is something that the W3C as part of the chartering obligation which then triggers all of these other commitments, defines a very particular scope of that activity. So creating a set of guidelines on how a __ – enabled mobile phone should use identification on the device is something that the Forum could conceivably work on without any checks and balances.

Helene: Right, so this is just again my recollection, you know, I think the way we decided to handle technology scope, and this was just from a policy perspective, we weren’t talking about process, per se, not charters and things like that, but to put some bounds on what could be, what could fall into the bucket of what could be an essential claim. There was concern that it shouldn’t be unbounded from a technology perspective. So that is why there is a scope definition that gets into more detail as to specific technology boundaries. Then we were doing the W3C policy. So, I think that was when we were working on the policy, that was what we were focused on. People working on the policy didn’t want to put anything in their portfolio is at risk. They wanted there to be some technology bounds and there was a lot of discussion on that. Marc do you have anything to add?

Marc: No. That’s exactly what I remember.

Ben: This is Ben Wilson. One of the things we probably should have done once the IPR policy was adopted we should have gone in and revised the bylaws to mirror the process for doing the guideline documents so that they were consistent. I think that was one of the problems. When I took over implementing the IPR policy I tried to follow the bylaws but then also the IPR policy, but we never got closure on either having a PAG or having a vote in a second vote after the IPR review period. It was just as the IPR review period. And we asked if anyone has any essential claims, please state those, and in the majority of cases no one ever responded to the IPR notice.

Helene: If I could just respond. The one thing that is confusing about that is the concept was you would have the IPR review period. If something came up, then you would institute a PAG. And once you got some output from your PAG, then you would react to that that, whatever it was, it could be there was no real issue proceed with your vote, it could be, you know we think there is an issue here, and then you would have your vote.

Ryan: I have another question, again using the parallels with W3C, which is that the IPR review process is only triggered when there is consensus on a document or a draft. Was any of this anticipated during the early discussions as to what would say prevent a member from producing a draft in isolation and saying they want to submit that for IP review? And then present a ballot? Hopefully that makes sense. When comparing the two, the Forum’s only way of measuring consensus today is with a formal vote, whereas the W3C has the chair of the working group making a call for consensus. Do you recall any discussions about the differences between those two behaviors?

Marc: So, this is Marc. I don’t specifically recall any discussion. The intent was that the guidelines would not be subject to a review period until the discussion had reached a meaningful stage. And it was the chair of the working group who was supposed to make that determination. Certainly it wasn’t specifically contemplated but it was within the realm of contemplation that it would maybe be pursuant to a straw poll. And then a review would take place and then once the review took place, then it would go through the adoption process.

Peter: This is Peter. The IPR actually calls for the chair to make the request for the review or to initiate the review period. Was that seen as a judgment call on the chair’s part? Meaning just because members, for example, three members proposed a ballot, it was actually up to the chair to decide whether to accept such a ballot, and then initiate a review period?

Marc: Yes.

Kirk: One more question, but Marc, you did this in 2012? Or something like that? The CAB Forum had already been going for seven years and had already been following a procedure for how ballots were put forward and how the voting was to occur.

Marc: No. This thing was started 2007.

Helene: It was started in 2010 or something, right?

Marc: No. Before that.

Helene: OK. So there were a couple of years of discussion, but the Forum was already going. I don’t recall getting into very specific details or discussion about that. There was whatever process there was for moving things along. Right. The point is that now with the IPR Policy, you know, before you have the vote, and to approve something as a final guideline, the chair needs to initiate this review period.

Peter: My question was not about the chair initiating it. You had mentioned that in the W3C that the chair determines consensus. Or Ryan did, I apologize, I’m not familiar with the W3C, so I’m having to work off what you’re saying on the call. The challenge … the concern that I’m hearing here is that is the Forum currently interprets it, there is not an option for the chair to determine that there is not consensus on a ballot before initiating the review period. So regardless of how ridiculous we’re thinking the situation may be, the chair is essentially operating as a robot. In other words, if the chair receives a properly endorsed ballot, they must initiate the review period, even if is clear that every other member of the Forum is objecting. I think that is where major concern is coming in. If you take that stance, then three members can cause havoc on the Forum. Especially the other half, when Marc kicked this off, he said that the objective is royalty-free guidelines, but that’s not actually the lever of the moment being enforced in the Forum. We haven’t done PAGs, so we’ve accepted the fact that we have encumbered guidelines. So I think it is a two-fold problem. If the intent was to make royalty-free guidelines, we haven’t done so, and we’re not requiring consensus before we try to do these review periods.

Helene: Can I just respond? We have to be careful in these discussions not to conflate a bunch of things together. The question is what was the history or intent of the IPR Policy, right, well, what does the language say? The language says you do the review period before you have to vote on the final guideline. Now, if there is some, and I think there is a question that if the CAB Forum hasn’t been following that, then that’s a problem. And CAB Forum has to figure out how it’s going to address that, right? That means you have guidelines that, in my view, not giving any legal advice, that are vulnerable. They’re vulnerable to attack if they are not final guidelines, and you’re following your procedure. So CAB Forum has to think about if there are guidelines that fall into that category where you haven’t followed your process, what do you do about that? And how are you going to remedy that? That’s a separate question. Then you might have an issue where maybe there is something in your process that you want to address. That’s separate from your IPR policy. Maybe there is something from a process standpoint that you want to discuss and figure out and ask how this is working? Maybe have some sort of process document or make a change somewhere, I don’t know, but that’s a separate thing. I think it gets very confusing if you try to lump these all together.

Marc: I think that’s exactly right.

Peter: OK. Well let me break it into the one, so, at the very beginning of these comments, it was said that the CAB Forum’s objective, the objective of the IPR Policy writers, was to end up with royalty-free guidelines.

Marc: That’s not .. I’m sorry to interrupt, but that’s not accurate. First of all, you never know if it is going to be royalty free. The best you can do is know that the other members of the Forum are not going to seek a royalty. You don’t know about other third party patents out there, and it’s impossible to know. That’s number one. Number two, the whole reason you have an IPR Policy, is not necessarily to achieve one type of licensing environment over another. It is to achieve balance between the desires of the implementers, getting that as royalty free and the rights of the IP holders. Yes. The objective is to try to achieve a royalty-free environment. The idea of a review period is that you can identify patents that might encumber a guideline that are owned by members of the Forum. Maybe you can convince the owner to license it royalty-free, you can try to design around it, change your guideline so that it doesn’t encumber the patent. So, again, even though the objective is to provide a royalty-free environment, that has to be achieved by balancing all of the various competing interests.

Peter: OK, fair enough, I think that answers the questions. It sounds like the intent of the authors, if I can have you confirm, the intent was that the review period should only be triggered when there is general consensus in the Forum. The challenge that is being raised is that that was never enshrined in the bylaws because the bylaws effectively … there is one view of the bylaws that there is no option for the chair to choose the review period. As soon as the ballot has three members endorsing it, it forces a review period. And so it seems like this may not be an IPR policy issue, this may actually be a bylaw issue. I think that’s one way to look at this, right?

Helene: Can I respond to that? And I’m sorry, I don’t, I’m not recognizing voices to names. Who was that speaking?

Peter: I’m sorry. This is Peter Bowen from Amazon.

Helene: OK. Great. Thank you. So to be honest, I don’t know whether it was, I don’t recall that it was in our minds that it specifically be consensus. It was to be whatever. We weren’t really focused on the process. There was a process in place getting developed, so I don’t know whether it was consensus. There were rules in the bylaws about putting together a motion, and then what it takes for a motion to carry, and all of that. I don’t recall conversations around that.

Ben: This is Ben, and I agree with Helene. We worked on the IPR policy. We got it finalized, and there are a lot of other disputes that we were working on that we were trying to resolve and those took up a lot of the conversations just trying to get other things resolved with regard to it. So, what we have is what we have, and as I said earlier in the call we need to revise the bylaws to make them more in line with the IPR policy.

Helene: Right, and I think that is a separate conversation on whether you need to revise the bylaws, or whether you need to talk about process, or maybe develop a process document. I don’t know whether you have one. I think that is a separate conversation. I think that if you have guidelines out there that you didn’t do an IPR exclusion period for, that’s an issue that you should address.

Ryan: Right. This is Ryan with Google. It sounds like there is consensus that, at a minimum, the production of a final guideline involves, as the bylaws say, some form of ballot, so we need to have a ballot, as well as setting aside any IP concerns with an IPR review period that follows the IPR policy. And on that point I will say I haven’t heard any disagreement either from Helene or Marc or from anyone on the call or on the list. We’re all in agreement that the combination of these things produce a final guideline. The issue of course is whether or not the IPR policy requires an order or whether the bylaws require a specific order, and when there is disagreement between these two, about possible ordering, on how to resolve this issue. I think that is what a lot of the discussion has been around.

Helene: And I would say that my recollection was that the intent of the people drafting the policy, that the order be, that you do the IPR policy and then you have the vote on whether to make it a final guideline.

Kirk: You said IPR Policy. You meant IPR review period?

Helene: Yes. Sorry. You have the exclusion review period first, right? And then you take your vote on whether to make it a final guideline.

Kirk: So we’re at 35 minutes past the hour. I have no objection if you want to keep discussing exactly this, or do we want to talk about next steps? So does anyone want to talk more about what our current IPR policy means? Does anyone want to talk about what we should do next? I think everyone agrees that some form of clarification and possible change is a good idea whether that can be accomplished only in the bylaws or whether we also have to change the IPR policy is an open question. Does anyone want to comment on that?

Peter: I think the proposal on the list is in the general sense is that somebody proposed we make a clarification in the bylaws. I think that is probably the most expedient path forward, if possible, because among other things, as we all know the IPR policy is an agreement, and so amending it requires a whole round of amendment to an agreement with signatures whereas the bylaws, a change there, if we can get consensus to a change that is acceptable to all, or at least acceptable by vote of the appropriate number of members, then we can move forward without having to redo the IPR policy.

Kirk: Let me ask Helene and Marc a question. If the Forum decides that it wants to put the review period after the vote, do you think we can do that with a bylaw change, or do you think we have to modify our IPR agreement?

[Mark and Helene talking simultaneously]

Helene: That would be interesting, yes. That would be a significant change to the IPR policy.

Ryan: I guess I would add to that question, but I realize that Helene and Marc may not have been following the mailing list, which is, you know, it sounds like we are in agreement that in order for a final guideline to be produced two steps have to occur. The question, and certainly as reflected in the year of IPR review notices that Ben sent, it sounds like there is the statement that even that year the notices were insufficient? Even though that definition that we just said, a review period and a ballot. If we said that’s not valid, then what has been proposed is that there be a ballot to adopt. There have been a couple of proposals. One is a ballot to adopt a document, have the review notice, and a ballot to finalize the document. And you can find that process within the dependencies of the bylaws describing a possible work mode that was not formally spelled out in the bylaw process. That is one possible solution to the problem where there is a vote of the Forum to adopt the document. A review notice is not triggered until adoption of the ballot, but it is not a final guideline until after the review notice and a second ballot is held on the basis of that review notice. With that description as an example, does that match your understanding of the intent and process of the IPR policy as compared to the W3C call for consensus review / call for adoption?

Helene: That level of detail wasn’t discussed. So I don’t know that you can say that was the intent or doesn’t match the intent. I would say that it doesn’t match the intent in the sense that if you’re asking people to say yea or nay to adopting this without having the information in front of them to make that decision. That would be contrary to the intent of what we were trying to do. I guess one other way of phrasing this would be that you could in your process you make a motion to issue an exclusion review period on a document. The motion is whether this document is ready to have an exclusion review period. Yes or No? Then if that motion passes, you’re clear to have the exclusion review period initiated. Then people have to consider whether the document is mature enough to have an exclusion review period.

Ryan: Yes. That was the process that I was trying to describe, which was that there is not a formal adoption on that initial ballot. It is essentially a measure of consensus. A consensus measure must pass in order to go to a review notice, and then for it actually to be adopted, it needs to have a ballot after the review notice to actually adopt that document as a final guideline or final maintenance guideline. So the actual adoption is that second ballot that follows the review notice. But that there is a measure of consensus prior to the review notice that is formally enshrined.

Helene: That is one example. I think you could do a straw poll, too, you can have a discussion about the process, but I think that people need to keep in mind that whatever this discussion is, and whatever the outcome, that’s moving forward. If you have issues as to things that have already happened, you need to deal with that. I don’t want to lose track of two separate conversations here.

Kirk: Helene, what I heard you saying was not that there could be a straw poll to approve the actual ballot. What you were saying instead was just to have a vote that this ballot is ready to start the IPR review period, yes or no.

Helene: Exactly.

Kirk: If people say yes, it better be because it’s not making people commit to whether or not they support the contents of the ballot, it’s just saying it’s ready to go forward to a review period. If people said, we hate this and we don’t want to be bothered they can vote no and that would end it.

Peter: Right. This is Peter from Amazon again. The thing I think that I have consistently heard to put it in a context that is regardless of the actual bylaws is it is very problematic for members to be voting on the adoption of a document that is a final guideline or final maintenance guideline without full knowledge of any exclusion notices that exist or that would exist from members. I mean, is that in a slightly broader sense the concern or the statement?

Helene: Yes.

Wayne: I think it may be part of it from my mind. This is Wayne Thayer from GoDaddy. The bigger issue in my mind is the practical issue that we’re at Ballot 180 and out of those 180 ballots, at best only a handful actually had IPR concerns and a lot of them are very minor changes that we were trying to make. So we’re introducing a lot of extra process to cover what I know I fully understand is a very important scenario, but the process that we’re talking about now still requires us to vote twice every time we have a ballot. It still requires that extra effort, and the bigger concern I have is that it allows people to go through this whole process, debate the merits of what we’re changing, then have a review period. Everybody forgets what we talked about and so we get to a final vote and we have a history of issues only surfacing when people actually look at something and have to commit to vote for it. I think a process that addresses that would be much better for the Forum overall, so what we’re talking about now is better in that you have to vote before and after, but it still introduces more process and it still will create a situation where for the 95% of things or more that don’t create any IPR disclosures, you have to vote again.

Rich: This is Rich from Comodo. I have put forth a proposal that seems to address both issues which was we carry on with our normal process. We draft a ballot, we get three endorsers, we put it out as a ballot and we vote on it. I guess we would be voting on the assumption at that point there are no exclusions and there are no IPR conflicts. It does not become final with that vote. However, it goes into the IPR review. If there are no IPR exclusions, then you take that first vote as the final vote if adopted and it becomes the final guideline. However, if there are any exclusions filed for that ballot, then that previous ballot is immediately nullified, you do the PAG or whatever the process entails there and there must be another full vote. It’s based on the assumption that there are no exclusions, but if there are exclusions, you hold another vote so that people can vote with full knowledge.

Gerv: That has been proposed before and it’s a very sensible process. We should do that.

Kirk: Can I ask though, Marc and Helene, you both spoke before when I asked this question, so I couldn’t hear your answers. My prior question was if we decide to put voting before the IPR review period would that require a change to the IPR agreement, and please answer that separately to make sure I get your answers.

Marc: Yes. It would require a change to the IPR agreement. You can’t do it with a change to the bylaws.

Helene: Yes. It would require a change. And I would say that this is not unusual. Those provisions that the CAB Forum has of a default license obligation with an exclusion period is not unusual. It’s in W3C and other places as well. I have not seen it other places where they do the formal vote first and have the exclusion review period and do it that way. So I don’t see why you would need to make that change, quite frankly. You just put some indication in place that your document is ready to enter your review period. I’m not comfortable voting without all of the information.

Gerv: But you are voting with all of the information. You are voting on the assumption that there is no disclosure, and if there is disclosure the vote is null and void and effectively as if it never happened. So you vote assuming there is no disclosure, and if there is disclosure then you have a PAG and figure out what to do. So you are voting with all of the information.

Helene: I would just say you don’t have all of the information because you yourself have not done any of your IPR analysis or really looked into it from an IPR perspective.

Gerv: The issue that we’re trying to deal with is that 98% of our ballots have no IPR consequences at all in practice, and we don’t want to optimize for the 2% because it means we’ll never get anything done.

Helene: So have you done IPR review periods with a ballot?

Ryan: During Ben’s chairmanship there was a series of IP reviews. Ballot 67 is when we adopted the IPR policy and then that came into effect August 9, 2012. For the series of ballots from 2013 to early 2014 there were notices of IPR review periods. Those notices followed the completion of the ballot. So in every one of those cases for those notices between 2013 and 2014 with the completion and successful voting of the ballot which then triggered the review notice. However, there are two outstanding issues, which are perhaps fundamental, and this is where we’ve ended up in our current situation, which is the adoption of the IPR policy in and of itself triggered exclusion notices, but within the IPR policy, basically the trigger wasn’t followed for the formation of a PAG. What to do on that bootstrapping sort of problem wasn’t followed, and that’s the first order of problem. The second order of problem was that following Ballot 169, and really most of the ballots from 2014 onward did not have review notice periods formally attached and formally published by the chair. So we’ve ended up in a situation where we ask what is the status of those ballots that happened? And then when Ballot 169 happened, we received additional exclusion notices. Before Ballot 169 we got to the new version of the IPR policy, version 1.4, that also received some exclusion notices. Further, there were some issues with how those exclusion notices were received which caused concern among the members. So we do have a situation where there have been multiple exclusion notices filed on the documents over the course of four and a half years. A PAG has not been formed to address any of these specific things. A PAG has been formed to address the IPR policy. And so we’re trying to work through a process to actually publish final guidelines that are fully consistent with the bylaws and the IPR policy, and so the issue at hand is what those obligations mean as stated in our bylaws and the IPR policy.

Kirk: Ryan, one more thing, some of the exclusion notices, actually all of the exclusion notices were improper because they did not indicate whether or not the holder the IP was granting royalty-free licenses, etc. So I don’t think any of them were valid.

Ryan: So you’re talking about even the 2012 notices. This is an area of discussion for the PAG that we haven’t formed, so goal is basically restarting the work of the Forum or for lack of a better phrase, is to treat Ballots 181 – 182 and essentially re-adopt the Forum’s past products, calling them draft guidelines and recognizing the fact that there were bylaw inconsistencies and formally adopt them as final guidelines, but then also setting the expectation of how we move forward with further things. And so, the issue with voting then IPR review I totally appreciate that you want to make sure that you know what exclusion notices others have provided, but you also want to do your internal portfolio review to make sure that your company you are comfortable voting or excluding the notices, and so I’m very appreciative of that concern. The concern being raised here though is that an IPR review before voting allows for the ability of three members to exercise IP and patent policy teams of particularly large organizations, and at Google we have a lot of IP, which should come as no surprise, and even if we are supportive of royalty-free licenses, that’s something that our IP counsel will have to review every possible ballot, which today, at least in our bylaws, only requires three members. And so the core, fundamental concern is how to quantify consensus to go to the IP review process and that’s where the bylaws are relevant. The IPR policy certainly purports that the formal adoption of a final guideline cannot happen without an IP review, and the bylaws support that the formal adoption of a final guideline cannot happen without a vote. So we know these two things are necessary and critical things. The issue is that the intersection of them does not spell out a process to resolve the ordering between those and both have tradeoffs, and that’s why we’re discussing this now because none of our documents gone through our process arguably to make them final guidelines.

[At this point the Forum discussed other agenda items, then returned to this subject at the end of the teleconference. The continuing discussion is listed here.]

Dean: Before we go, the IPR thing is a very serious thing that we need to resolve, and I don’t think that on the list it is going to get resolved in a way that is expedient. Virginia has suggested an IPR committee, for lack of better word, that would be in charge of scoping all of these different ideas and coming up with a resolution. And I’m wondering if it’s worth getting that committee together and having them work independently of these Forum calls and coming up with a recommended solution.

Kirk: Sounds like a good idea to me. What do other people think?

Ryan: Going through the minutes from the face-to-face, you said there would be a straw poll for 183 but the best way forward from our past calls was putting forward a ballot to resolve the immediate process concerns. I’m totally appreciative of wanting to resolve the long-term thing. I’m just curious, are we basically saying there is no path for a short-term solution? Because as it stands, we have an issue as to whether Ballots 180 to 182 are valid ballots. And that’s going to continue to be a specter hanging over our head, so I’m just some hoping we can just put forward a ballot to resolve process and then look at this broader on how we improve the process, and treat these as separable acts.

Virginia: So, I don’t know why you think they’re invalid.

Ryan: Why do I think they’re invalid? So the issue is whether or not the bylaws permit the review period to happen before without having the adoption of the document text. Right, this is the core issue that we spent the past hour discussing, on consensus on whether or not the chair can declare that review period before the members have had a vote, and I know we have disagreement, but I provided on the list the examples within our IPR policy and bylaws that support both interpretations, and so we have to resolve that.

Virginia: But it’s… I think it is pretty clear from what we just heard that it’s the review period then the vote.

Ryan: Well we heard the review period and the vote. As noted, there is this contract, but the issue is we have this disagreement over what this contract means.

Virginia: Well, you might have disagreed with the interpretation of the legal documents, but that is what they say. Just because you disagree with it doesn’t mean that the ballots are invalid.

Dean: Hence my comment about a review committee being worthwhile at this point.

Kirk: Dean, I’ll send out an invite to people to see who wants to participate in that. What were you going to say, Wayne?

Wayne: I agree, I think we need to get a group of people together and try to solve the problem. I’m encouraged to hear Ryan say he thinks there might be a short-term solution, but we need to convene some group of people to put that ballot together.

Kirk: All right, I’ll send the invite out. Any other comments? OK, thank you all.

[These are the agenda items discussed between the two segments above.]

  1. Governance Change working group update. Dean stated that the working group had met again, and was going point by point through its charter. The group recently discussed whether the Forum should be an incorporated organization and is looking at the pros and cons of that and determining how other types of organizations handle that.

  2. Validation Working Group Status. Jeremy said the Validation Working Group would start meeting again on alternate Thursdays starting Thursday. Nov. 17 at 12:00 pm Eastern time. Many members have already indicated interest in joining this call, and he will send a calendar invitation. Kirk said he recalled there are maybe three pending issues for discussion, and he will try to remember what they are.

  3. Policy Review Working Group update. Ben said the working group continued to go through the BRs and look at terminology that was used about “CA” and other issues. The group was also working on the draft ballot that Li-Chun had presented, and would report when it was ready for consideration. Dimitris said he had gotten feedback from Tim Hollebeek of Trustwave trying to merge the existing documents with documents Dimitris had presented at the F2F meeting, and once the Forum’s IPR issues are resolved they can move forward.

  4. Next F2F meetings. Kirk asked Dean for an update on the date and location of the Spring 2017 meeting. Dean said he was happy to announce that Cisco would host the next meeting at its offices in Research Triangle Park, North Carolina. The date would be one of the following: March 14-16, 21-23, or 28-30, 2017. He will sent out a new Doodle poll to check on the best dates for members. Kirk thanked Dean and Cisco, and added that the other meetings in 2017 were as follows: 20-23 June 2017 Berlin (Host: D-Trust) and 3-5 Oct 2017 Taipei (Host: Chunghwa Telecom).

  5. Any Other Business – there was no other business. The members had run out of time to discuss CT and CAA, but could continue the discussion on the mailing list.

  6. Next call. Kirk pointed out that US Thanksgiving on November 24, so the next teleconference will be on Thursday, Dec. 8, 2016. Gerv noted that would be four weeks between teleconferences, and asked if the members wanted to meet next week or in three weeks instead. Kirk noted that changing the dates of Forum teleconferences would affect scheduled working group meetings. In the end, the members decided not to schedule an interim meeting, so the next teleconference will be on Dec. 8, 2016.

  7. Adjourn

Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed

Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.6 - Ballot SMC08 - Aug 29, 2024

This ballot sets a date by which issuance of certificates following the Legacy generation profiles must cease. It also includes the following minor updates:

  • Pins the domain validation procedures to v 2.0.5 of the TLS Baseline Requirements while the ballot activity for multi-perspective validation is concluded, and the SMCWG determines its corresponding course of action;
  • Updates the reference for SmtpUTF8Mailbox from RFC 8398 to RFC 9598; and
  • Small text corrections in the Reference section

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).