The Internet Engineering Task Force Submitted to the House of Representatives Sub-Committee on Technology, Environment, and Standards June 28, 2001 Scott Bradner Executive Summary: The Internet Engineering Task Force (IETF) is the primary standards organization for the basic Internet technology. It is international, consensus-based, self-funded, open to all participants, transparent, allows appeals, vendor-neutral with merit-based technical evaluation. Participation is free and all working and final documents are freely available over the Internet. It has an advanced process to deal with intellectual property rights and has relationships with many other international standards development organizations. The Internet Engineering Task Force The Internet Engineering Task Force (IETF) is the group that is generally considered to be the primary developer and keeper of the basic standards for the Internet. It is an open international standards development body. The IETF operates under the auspices of the Internet Society, a Reston VA based non-profit international membership organization dedicated to the support and expansion of the Internet. Starting with fewer than 25 participants in 1986, IETF meetings now attract more than 2,000 people each with thousands more participating via electronic mailing lists. The IETF is the keeper and maintainer of all of the original Internet standards. These include TCP/IP itself, SMTP (electronic mail), FTP (file transfer), DNS (domain names), telnet (remote login), and many more. Since 1986, the IETF has developed hundreds of new standards. These include MIME (enhanced email), IPsec (secure Internet communications), http (the transport protocol for the world wide web), DHCP (dynamic address assignment), BGP (used to direct Internet traffic to the proper destination), PPP (used for most dialup Internet access), and, more recently, a number of standards dealing with the convergence of the telephone and Internet worlds. IETF Standards: IETF standards are voluntary standards produced by a rigorous, well-defined open public process. The IETF does not, however, make any attempt to police or mandate the use of those standards; companies and individuals decide whether or not the standards are useful to them (i.e the free market decides whether a standard is adopted by the community or not, rather than government-imposed regulatory action) The IETF does not submit its standards to other standards organizations for their approval, though numerous standards organizations do reference and depend upon IETF standards in their own work. A short history of the IETF: In 1968 U.S Defense Department's Advanced Research Projects Agency (ARPA) started a research project to develop what was then a new computing concept: A packet (or datagram) based computer network. That work first created the ARPANET which evolved into today's Internet. The Internet Configuration Control Board (ICCB) was established in 1979 by Vint Cerf, then at ARPA and the co-developer of the Internet Protocol TCP/IP, as an informal committee to help guide the further development of TCP/IP and related protocols. By 1983 the ARPANET and TCP/IP related activities had expanded enough to warrant the creation of a number of task forces to deal with specific aspects of this development. At this time the ICCB was renamed the Internet Activities Board (IAB) and became self-organizing. These IAB task forces included the Internet Engineering Task Force (IETF), the End-to-End Task Force, a Security Task Force and a few others. The IETF first met on its own January 16 and 17th 1986 in San Diego, California. Twenty-one people attended that meeting. The IETF structure at this meeting included a number of Working Groups which had been established to explore specific technical issues and a steering group to manage the operation of the Working Groups. By 1989 the IETF had 20 Working Groups and a multi-step Internet Standards Process had been defined. A variant of this standards process is still in use today. An IETF Secretariat was later created to manage the meetings and standard-setting process. Participation in the IETF The work of the IETF is conducted primarily through the use of Internet mailing lists. Anyone, anywhere in the world, who is interested in the work of the IETF can subscribe to, and participate in, any of the IETF mailing lists. There is no concept of membership and no participation fee is required. The IETF also holds face-to-face meetings three times a year. The next face-to-face meeting is in London England in August 2001. Most IETF working groups meet for a few hours to resolve open issues during each face-to-face meeting. But all decisions taken at the face-to-face meetings are tentative and must be ratified on the working group mailing lists so that people who were not at the face-to-face meeting can have their input. The face-to-face meetings are open to anyone who wants to attend and is willing to pay a meeting fee. Individuals participating in the IETF do so as individuals and not as representatives of the companies that employ them. Specifically, ideas and opinions are judged on their technical merit not by which company is espousing them. IETF Funding: From its start the overwhelming majority of the costs of the IETF have been born primarily by the individuals that volunteer to do IETF work. This includes members of the IETF management committees and the IETF chair. They, or their employers, cover the travel and other expenses incurred when working on IETF projects or attending IETF meetings. Early IETF meetings were partly funded by US government agencies. In 1991, as the meetings grew and became more costly, IETF instituted a small meeting fee to help offset the cost of holding the meetings. In 1997 the IETF stopped receiving any U. S. government financial support. Meeting fees are now adjusted each year to match the projected Secretariat and meeting costs. In addition, the Internet Society funds the IETF publication process and provides a legal umbrella, including insurance coverage, for the IETF activities. The Internet Society in turn is supported by thousands of individual members and 120 mostly for-profit organizational members from around the world. IETF documents: The principal IETF documents are known as RFCs. The RFC publication series started in 1969 as "Requests for Comment." The "RFC" name is now used on a wide range of IETF materials other than actual requests for comment. All IETF standards and standards-track documents are RFCs but not all RFCs are standards. There are several classes of RFCs. IETF standards are published as standards-track or Best Current Practice RFCs. In addition there are informational, experimental and historic RFCs. RFCs are published by the RFC Editor, a group that continues the work of Jon Postel, who was the initial RFC Editor and managed the RFC publication process from 1969 until his death in October 1998. The RFC Editor is funded by the Internet Society. All IETF working documents (known as Internet Drafts), the RFCs, and the mailing list archives are available for free over the Internet. RFCs may be freely reproduced or translated into other languages. IETF Organization: The IETF has continued to grow in size and scope. There are now 129 working groups organized into 9 technical "Areas," including the Applications Area, the General Area, the Internet Area, the Operations and Management Area, the Routing Area, the Security Area, the Sub-IP Area, the Transport Area, and the User Services Area. Each Areas is managed by one or two volunteer Area Directors. These Area Directors, along with the IETF Chair, make up the Internet Engineering Steering Group (IESG). The IESG is the standards approval body of the IETF. See the IETF web site (www.ietf.org) for a full list of working groups and their charters. A separate Internet Architecture Board (IAB), which is a descendent of the old Internet Activities Board, provides architectural advice to the IETF and ISOC and is responsible for dealing with the relations between the IETF and other organizations. The members of the IESG and IAB, as well as the IETF chair, are selected by a nominations committee whose members are randomly selected from volunteers who have attended two out of the last three IETF meetings. IETF Working Groups: The process of IETF working group formation and operation is described in RFC 2418. An IETF Working Group is created when the IESG (with the advice of the IAB) determines that there is a specific issue warranting attention and that there individuals that are willing to work on the issue. Each Working Group has a charter that describes what issue the group is working on and defines the scope of the Working Group's activities. Working Group charters are negotiated among the individuals chosen to be the working group chairs, the Area Directors, the IESG and the IAB. Working group charters also contain lists of goals and milestones, along with target dates specifying when each is expected to be completed. New tasks are added to working group charters only after being approved by the IESG. Working groups may be terminated when they have completed their tasks. The IETF Standards Process: The IETF Standards Process as defined in RFC 2026 is a straight-forward, but highly-detailed process. The Standards Process seeks rough consensus (but not unanimous consent) and technical operability. -- The first requirement -- rough consensus -- ensures that poor ideas do not make it through the review process. The consensus requirement minimizes the pressure to add unnecessary features to a proposal in order to secure unanimous support. Because there is no concept of IETF membership, the IETF does no voting - the Working Group chairs and the IESG are charged with discerning the level of consensus in the meetings and mailing lists. -- The second objective -- technical operability, or "running code" -- means that multiple actual and interoperable implementations of a proposal must exist and be demonstrated before the proposal can be advanced along the standards track. The multiple implementation requirement checks to see that more than one vendor or person felt the technology was worthwhile enough to implement. The requirement for interoperability also ensures that the documentation is clear enough that multiple implementers read and interpret the standard in the same way. The IETF has a three stage Standards Process. To reach the first stage, known as Proposed Standard, the Working Group, the mailing list community and the IESG must feel that the proposal is useful, technically sound and has no known problems. The second stage, known as Draft Standard, adds a multiple interoperable implementations requirement. The final stage, known as "Internet Standard," or just "Standard," indicates a measurable success in the market place. At each stage the level of the consensus in the Working Group and in the IETF as a whole are tested, usually by issuing a "last call" for comments. If the consensus is to support a proposal it is forwarded to the IESG for their evaluation. The proposal is published as a RFC if the IESG approves. In many cases, no industry consensus exists that it is worth the added effort to move things forward; the Proposed Standard level suffices in practice. Appeals process: RFC 2026 also defines a multi-stage appeals process that can be used if one or more IETF participants feel that Standards Process was not properly followed. Intellectual Property Rights: One of the most difficult areas in standards development these days is that of intellectual property rights (IPR). The IETF has seen many cases of submarine patents and other attempts to subvert the standards process. This is not just a problem for the IETF, many other standards development organizations have also had problems in this area. The IETF has revised its IPR rules over the years and now focuses more on ensuring disclosure than on requiring statements pledging fair and non-discriminatory licensing from all IPR holders. It is left to Working Group consensus to determine if a particular technology should be used in an IETF standard and the Working Group takes into account any IPR information that is available at the time of the working group's deliberations. This change was made after a company had blocked the IETF's Standards Process by refusing to provide such a licensing pledge. This was a company who asserted IPR claims without ever participating in the IETF process and without even knowing that the IETF was working in an area until after a standard had reached the final approval process. Companies who offer their IPR to the IETF are expected to provide a pledge of fair and non-discriminatory licensing before the IPR will be considered. The change in the IPR part of the IETF Standards Process also includes an empirical test of the fairness of licensing practices by requiring that the multiple interoperable implementations of a standard that are needed before it can be advanced to Draft Standard status be implemented with separate exercises of any required licenses. If the license terms are not seen as fair by implementers then the required multiple implementations will not be forthcoming and the proposal will not be able to be advanced on the standards track. Individuals engaged in the IETF process must disclose whether there are any IPRs that they or their company would benefit from or they may not participate in any of the IETF activity about the technology. Notice of this requirement is on the web pages that are used to register for IETF meetings or subscribe to mailing lists run by the IETF Secretariat and is included in RFC 2026. If IPR issues surface, the Secretariat contacts the IPR claimant to request a statement of fair and non-discriminatory licensing. The Secretariat maintains an on-line repository of all IPR disclosures and of any statements that IPR holders wish to make on their own or make in response to a request from the IETF Secretariat. The IETF and other standards organizations: For most of its early history the IETF had little impact on the traditional standard-setting community. However in the mid 1990s the Internet, and thus the IETF, started to become more visible and the IETF began to increase its interaction with other standards organizations. By 1995 it was starting to become clear to most observers, including government regulators, that TCP/IP and the IETF were going to remain important parts of the continued development of the world's communications future. The Internet Society and International Telecommunications Union - Telcom Standardization Division (ITU-T) exchanged memberships, and liaisons were designated between the IETF and the ITU-T, Internal Standards Organization (ISO), World Wide Web Consortium (W3C) and the ATM Forum. Many other organizations have requested that the IETF designate liaisons. However, liaisons to the IETF are not essential for the IETF to interact with other organizations. Since IETF Working Groups and documents are open to anyone, a person or organization can bring an issue to the IETF's attention simply by participating in the Working Group deliberations. In the last few years the IETF has undertaken joint standards development work with the ITU-T and with the W3C. Some observers believe that it may be more effective to assign one organization as the "lead" and encourage people from the other organization to participate in the Working Group deliberations. The IETF is quite concerned about maintaining constructive communication among standards organizations working in overlapping technical areas. A few years ago, the IETF established a private email list for representatives of standards development organizations to join. More than a dozen standards development groups have since subscribed to this list. The IETF sends all proposals for new IETF activity to this list as do a number of other organizations. This channel provides an early warning system for potentially competing efforts and facilitates the creation of communications paths between the efforts. Conclusion: IETF standards are now used by much of the data communications industry around the world. It is doubtful that any of the people who gathered at that first IETF in 1986 would have believed it if they were told that within a dozen years TCP/IP would have become the predominate data communications protocol in the world and all of the alternatives, whether company proprietary technology or official public standard, would have fallen by the wayside. In a practical sense, users of modern data networking can not ignore the work of the IETF, and the IETF will continue to serve an important facilitating role in the emergence of new Internet technologies.