Hi Joe,
To fully understand your criticism, please respond to the following points.
1. Please quote the exact formulations from the cited emails:
https://mailarchive.ietf.org/arch/msg/tls/lnSPh3Wr6vgdjivHGj1mxCun3Rs/
https://mailarchive.ietf.org/arch/msg/tls/NhXrBcIlWhskI8uX0CllrTxEFuU/
that, in your opinion, "violate or are close to violating the IETF Code of
Conduct."
2. Please explain why these instances constitute "personal attacks," and in
particular, how I should be able to "intimidate other participants."
I hold no decision-making authority within the IETF (except as a member of the
working group).
Consequently, I have no power to restrict anyone, and looking at the debate,
there is no indication whatsoever that anyone has been intimidated.
What I did was cite facts and interpret them regarding a potential conflict of
interest, which I consider a legitimate debate (see point 3).
It would also be helpful in this context to provide clarification as to whether
the basis of an off-list warning shifted from "mischaracterization" to
"personal attack," as described previously on this mailing list:
"1. Joseph Salowey issued me an off-list warning on July 6. He characterized my
response to Paul Wouters as a "mischaracterization" of the IAB's findings.
2. I asked him to explain how a direct quote constitutes a mischaracterization.
He could not.
3. He then pivoted the basis to "personal attack." I asked him to retract the
warning as selectively applied and shared more clear counter examples. He did
not respond." [1]
This creates the impression that "personal attack" is a standard accusation
used to silence critics.
Making these emails public, if both parties agree, would help to mitigate
repeated claims of biased behavior and to sharpen the criteria defining exactly
what constitutes a "personal attack."
You might also take into account a participant's statement in your email to me:
"Mentioning something that can be a conflict of interest doesnt violate code of
conduct or close to. Harassment gets there but this was not it." [2]
3. In RFC 7282 (On Consensus and Humming in the IETF) Section 7 [3] titled
"Five people for and one hundred people against might still be rough consensus"
a conflict of interest is described, where one side "has a very elegant
algorithm to address the issue, one which works especially well on their
particular piece of hardware," "recruits one hundred people," "mostly people
who work at the same company [...] and who never participated before," and
engages in "vote stuffing."
The conflict of interest in this scenario is clearly of a financial nature, as
the company would gain an advantage by selling their hardware ("same company,"
"especially well on their particular piece of hardware").
The underlying logic is that a conflict of interest revealed by specific
behavior must be taken into consideration when determining whether a consensus
exists.
I can immediately recall two NSA operatives and two employees of a French
defense company who exhibited the exact same voting pattern without ever
participating in the debate. One of the NSA operatives used a private account
such that many readers do not immediately recognize him as an NSA official, and
one of the two employees of the French defense company signed up solely for the
purpose of voting.
For proper procedures at the IETF -- both regarding the question of whether a
consensus exists as determined by the working group chair, and for any
participant who wishes to challenge the decision of the working group chair
according to IETF procedures -- the question of conflict of interest must be
transparent, part of the debate, and properly documented.
Moreover, the question of whether a conflict of interest exists must remain
open to discussion for every reader to determine.
The International Committee of Medical Journal Editors states this very
clearly: "Although the presence of a relationship or activity does not always
indicate a problematic influence on a paper’s content, perceptions of conflict
may erode trust in science as much as actual conflicts of interest. Ultimately,
readers must be able to make their own judgments regarding whether an author’s
relationships and activities are pertinent to a paper’s content." [4]
Furthermore, the NSA is known for conducting clandestine operations [5]:
"The SIGINT Enabling Project actively engages the US and foreign IT
industries to covertly influence and/or overtly leverage their commercial
products' designs."
"Insert vulnerabilities into commercial encryption systems, IT systems,
networks, and endpoint communications devices used by targets."
With its multi-billion dollar budget, the NSA also generally has the means to
practice social engineering, for example, by placing operatives at strategic
positions in organizations or by funding covert actors who play their role in
advancing the NSA's interests.
To make the situation even worse, companies from the communications or
"defense" sector have a financial interest in receiving large-scale government
orders, so they naturally tend to favor the NSA's position. Thus, while the
question of conflict of interest is already, to some extent, a scientific
matter -- as seen with the International Committee of Medical Journal Editors,
where the reader (scientist) ultimately must be able to "make their own
judgments" -- this becomes even more important in the context of a military
intelligence service like the NSA, known for conducting clandestine operations
and the power to also influence companies, e.g., by obtaining their support in
standardization processes.
The question of conflict of interest must be part of the debate and discussed
openly, including observations that may indicate conflicts of interest, which
also applies to the behavior of participants, as seen in the RFC example cited
above.
In particular, I find this argument disturbing: that a question regarding a
conflict of interest "was already previously appealed and answered here by the
IESG" [6] or "This matter is resolved as far as the IESG is concerned." [7]
This eliminates any possibility for a meaningful discussion about the matter,
although this matters for both scientific conduct in the field of cryptography
-- where the NSA not only attacks cryptographic algorithms but also, as
confirmed by its own leaked documents, conducts sabotage of cryptographic
standardization processes -- as well as for the question of consensus.
The question of conflict of interest was assessed by a certain entity at a
certain point in time to reach a certain decision.
Not only "[u]ltimately, readers must be able to make their own judgments" [4]
about conflicts of interest, which requires an open debate, but also all
ongoing developments must be included in it.
Simply relegating the question of conflict of interest to a certain entity's
decision at a certain time (which in this case even only referred to an earlier
decision by some other entity) is inconsistent with scientific practice (and
also not with the example set out in the RFC).
I note that I require additional time to study IETF procedures and formulate my
response.
Kind regards,
Ken Kubota
____________________________________________________
Ken Kubota
https://doi.org/10.4444/100
[1] https://mailarchive.ietf.org/arch/msg/tls/LvUiinuyMPCXTFMrbeYB0aa1Iw4/
[2] https://mailarchive.ietf.org/arch/msg/tls/P57ytYmUA6jxh_ehxR9_lMcQXQc/
[3] https://www.rfc-editor.org/rfc/rfc7282.html#section-7
[4]
https://www.icmje.org/recommendations/browse/roles-and-responsibilities/author-responsibilities--conflicts-of-interest.html
"Individuals may disagree on whether an author’s relationships or activities
represent conflicts. Although the presence of a relationship or activity does
not always indicate a problematic influence on a paper’s content, perceptions
of conflict may erode trust in science as much as actual conflicts of interest.
Ultimately, readers must be able to make their own judgments regarding whether
an author’s relationships and activities are pertinent to a paper’s content.
These judgments require transparent disclosures. An author’s complete
disclosure demonstrates a commitment to transparency and helps to maintain
trust in the scientific process."
[5] https://www.eff.org/files/2014/04/09/20130905-guard-sigint_enabling.pdf
[6] https://mailarchive.ietf.org/arch/msg/tls/wahhT6eE39viKcIusKK4dTKzcIE/
[7] https://mailarchive.ietf.org/arch/msg/tls/GQ2cEosoHH9UyKp_9tIW15BW0Cw/
> Anfang der weitergeleiteten Nachricht:
>
> Von: Ken Kubota <[email protected]>
> Betreff: [TLS] Fwd: Warning about TLS mailing list behavior
> Datum: 16. Juli 2026 um 01:20:24 MESZ
> An: [email protected]
> Kopie: [email protected], IAB Chair <[email protected]>, TLS Chairs
> <[email protected]>
>
> For your information.
>
> ____________________________________________________
>
> Ken Kubota
> https://doi.org/10.4444/100
>
>
>
>> Anfang der weitergeleiteten Nachricht:
>>
>> Von: Joseph Salowey <[email protected]>
>> Betreff: Warning about TLS mailing list behavior
>> Datum: 15. Juli 2026 um 22:02:45 MESZ
>> An: [email protected]
>>
>> HI Ken,
>>
>> You have recently sent messages to the list that violate or are close to
>> violating the IETF Code of Conduct in BCP 54 / RFC 7151. In particular we
>> have identified the following issues:
>>
>> You sent messages to the list that are personal attacks by accusing
>> individuals of conflict of interest. Examples include [1] and [2] and
>> additional messages on the list
>>
>> This can be interpreted as an attempt to intimidate other participants.
>>
>> Please keep communication on the mailing list professional and civil.
>> Consider this a private warning for inappropriate mailing list behavior;
>> required by BCP 94 / RFC 3934.
>>
>> Joe
>> TLS Working Group Co-Chair
>>
>> [1] https://mailarchive.ietf.org/arch/msg/tls/lnSPh3Wr6vgdjivHGj1mxCun3Rs/
>> [2] https://mailarchive.ietf.org/arch/msg/tls/NhXrBcIlWhskI8uX0CllrTxEFuU/
>>
>
> _______________________________________________
> TLS mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]
