<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.line874, li.line874, div.line874
{mso-style-name:line874;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.line862, li.line862, div.line862
{mso-style-name:line862;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:323432643;
mso-list-type:hybrid;
mso-list-template-ids:-851157548 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.5in;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.0in;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.5in;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.0in;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.5in;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:5.0in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:1144540527;
mso-list-type:hybrid;
mso-list-template-ids:-1243547074 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l2
{mso-list-id:1178159494;
mso-list-type:hybrid;
mso-list-template-ids:-553988308 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:22.5pt;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l3
{mso-list-id:1461993618;
mso-list-type:hybrid;
mso-list-template-ids:2070550462 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>I think this repeats a lot of work previously done, including gathering comments from Mozilla and Google. I think the next steps are here possible reform proposals and decide whether the forum, as a whole, as an appetite for reform. <a name="_MailEndCompose"><o:p></o:p></a></p><span style='mso-bookmark:_MailEndCompose'></span><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><b>From:</b> govreform-bounces@cabforum.org [mailto:govreform-bounces@cabforum.org] <b>On Behalf Of </b>Kirk Hall<br><b>Sent:</b> Monday, July 18, 2016 4:29 PM<br><b>To:</b> 'Govreform@cabforum.org' <Govreform@cabforum.org><br><b>Subject:</b> [cabf_governance] FW: Discussion on the Governance Review WG call<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Our next WG call is tomorrow (Tuesday) at 10:00 am Pacific. Can we cover the attached recap first, and try to find consensus on what direction we are trying to go?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Once we get a document that fairly outlines basic choices, with pros and cons for each, it would be useful to forward to the Forum for comment and input.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Also, before we proceed, it would be really useful to find out from Oracle and Java what they didn’t like about our current IPR policy (and whether they will join our WGs in the future if we change our IPR – if not, it may not be worth changing the IPR policy for them). <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>It would also be useful to find out why Mozilla and Google voted no on the Code Signing WG ballot – was it because Code Signing is beyond the current scope of the Forum’s purpose under Bylaw 1.1 (that can easily be expanded), because only one application (Microsoft) so far has committed to using the CSRs, because a vote at the Forum level would invoke our current IPR (and force Mozilla and Google to disclose IP, which they prefer not to do), or some combination of the three? Or something else? <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>There is no point in changing our IPR or Forum structure if it’s not going to change the outcome in cases like this (or if Mozilla and Google are going to block any proposals for change the Governance WG offers), so let’s gather this information now to help us work efficiently.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Comments?<o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><b>From:</b> Kirk Hall <br><b>Sent:</b> Tuesday, July 12, 2016 9:24 AM<br><b>To:</b> 'Govreform@cabforum.org' <<a href="mailto:Govreform@cabforum.org">Govreform@cabforum.org</a>><br><b>Subject:</b> Discussion on the Governance Review WG call <o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Any comments on this? Is it a fair summary of our choices?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Again, our work will proceed much more quickly if we find consensus on what we are trying to do.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>At some point, I think we should run these options past the full Forum just to get some feedback.<o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><b>From:</b> Kirk Hall <br><b>Sent:</b> Tuesday, July 5, 2016 4:22 PM<br><b>To:</b> <a href="mailto:Govreform@cabforum.org">Govreform@cabforum.org</a><br><b>Subject:</b> Discussion on the Governance Review WG call today<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>I wanted to capture some of the discussion on the Governance Review WG call today. Maybe we group edit it, and provide to the Forum members for comment? I have tried to make this as neutral and fair as possible. <b><span style='color:red'>Please offer edits if you like to the text below or in the attached Word document copy, and circulate among the WG members.</span></b><span style='color:red'> </span>At some point, maybe we discuss at the Forum level to get some feedback.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><b><u>Problems being addressed<o:p></o:p></u></b></p><p class=MsoListParagraphCxSpFirst style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;line-height:normal'><u><o:p><span style='text-decoration:none'> </span></o:p></u></p><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;line-height:normal;mso-list:l1 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>CAs and one browser participant worked on code signing guidelines in a Working Group, but the guidelines were defeated in a ballot at the Forum level by the vote of two browsers. The two browsers questioned whether code signing was within the scope of the Forum’s mission (especially if the result is a set of guidelines followed by only one vendor), and also may have wanted the ballot to fail so the IPR disclosure requirements would not apply and they would not have to disclose their IPR or face RAND-Z free licensing<o:p></o:p></p><p class=MsoListParagraphCxSpLast style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;line-height:normal;mso-list:l1 level1 lfo2'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>The scope of the Forum is arguably too narrow to allow non-SSL certificate working groups and ballots. Bylaw 1.1 provides:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal'><b><o:p> </o:p></b></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;text-indent:.25in;line-height:normal'><b>1.1 Purpose of the Forum:</b><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal'>The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of leading certification authorities (CAs) and vendors of Internet browser software and other applications. <br><br>Members of the CA/Browser Forum have worked closely together in defining the guidelines and means of implementation for best practices as a way of providing a heightened security for Internet transactions and creating a more intuitive method of displaying secure sites to Internet users.<b><span lang=EN style='color:black'><o:p></o:p></span></b></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal'>In addition, the two browsers who voted against the code signing guidelines ballot may have been concerned that the working group was two narrow (with only one code signing user participating at the working group level) <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoListParagraphCxSpFirst style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;line-height:normal;mso-list:l0 level1 lfo4'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>“Interested Parties” are allowed to fully participate today on Working Groups under Bylaw 3.2, but must first sign the Forum’s RAND-Z IPR agreement. Two code signing certificate users, Adobe and Oracle, declined to participate in the working group, perhaps because they didn’t want to sign the IPR agreement (this should be confirmed).<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;line-height:normal;mso-list:l0 level1 lfo4'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>CAs would like the Forum (in some form) to be able to work on non-SSL issues such as code signing, S/MIME, and client certificate usages, in large part out of convenience (many of the main CA players are already involved in the Fourm, and it is convenient to schedule calls and meetings in the current structure). Some CAs have suggested simply creating spin-off, parallel new groups to handle non-SSL cert issues (using Forum Bylaws and other procedures where relevant), but others would prefer not to set up parallel groups for these other certificate uses, but instead keep in inside the Forum in some manner.<o:p></o:p></p><p class=MsoListParagraphCxSpLast style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;line-height:normal;mso-list:l0 level1 lfo4'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>Some members may want to move from the current RAND-Z IPR covering all Forum and working group activities as a whole, while others may be interested in a W3C-type “participation” model, where the RAND-Z IPR requirements only apply to those Forum and Working Group members who actually participate on an issue or guideline. Adding procedures to track “participation” for IPR purposes adds complexity, but W3C has rules that could be used as a model.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>There are at least three basic options for moving forward. (Ballot 165, which was adopted at the end of March and set up the charter for the Governance Review Working Group, is included at the end of this message.)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><b><u>Option 1 – Make No Major Changes / Keep Forum Focused on SSL Only<o:p></o:p></u></b></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'>Under Option 1, make no major changes to Bylaw 1.1 – Purpose of the Forum and do not change the current IPR Agreement, membership rules, voting rules, etc. Eliminate any working groups dealing with non-SSL certificate issues (e.g., code signing working group)<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Pros</u></i>: Keeps Forum focused on its main business – SSL certificates. If new separate groups form for code signing, etc. (perhaps using Forum Bylaws and procedures as a starting point), helps those groups focus on their business and avoids cross-group problems with IPR policies, voting rights, etc.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>Gives new groups (e.g., code signing, or “Non-TLS Certificate Forum”) freedom to adopt different IPR policy, voting rules, etc. Can set separate times and places for meetings (avoid time conflicts with Forum meetings)<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>Allows non-CA, non-browser members of new groups to participate on an equal basis with CAs. Avoids “dilution” of control, participation from current limitation of CAs and browsers (with “skin in the game”)<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Cons</u></i>: Loss of efficiency, harder logistics for CAs already interested in both SSL and non-SSL certificate issues. Potentially more overhead (separate websites, email systems, etc.)<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Open Questions</u></i>: If new groups are created (e.g., code signing group), will application users like Adobe and Oracle participate? If not, probably won’t be successful. Will users like Adobe and Oracle sign a RAND-Z IPR agreement (as they would be full participants for each new subject matter organization they join)? If not, how to deal with IPR issues.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><b><u>Option 2 – Keep Forum as parent focused on SSL, allow non-SSL WGs to be independent<o:p></o:p></u></b></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoListParagraphCxSpFirst style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;mso-list:l3 level1 lfo6'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>Under this option, SSL certificate issues would remain at the Forum (parent organization) level, with no change in IPR policy or voting rules<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;mso-list:l3 level1 lfo6'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>The Bylaws would be amended to allow non-SSL cert issues to be worked on at the WG level<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;mso-list:l3 level1 lfo6'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>The IPR would be amended to limit reach of the IPR disclosure and licensing requirements based on “participation” level but would remain a RAND-Z (royalty free) basis. CAs and browsers would be bound by the IPR agreement on SSL cert issues as they are today, but not on the work of non-SSL cert WGs. Non-SSL WGs would have authority to approve and enact ballots at the WG level, and would not forward them to the Forum for approval or a new ballot (and so avoid triggering IP disclosure requirements at the Forum level). In this way, non-SSL cert WGs can be autonomous, and participants in the WGs will be protected by a RAND-Z IPR, but NON-participants of a particular non-SSL WG would NOT have to disclose any relevant IPR on a WG proposal.<o:p></o:p></p><p class=MsoListParagraphCxSpLast style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;mso-list:l3 level1 lfo6'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>The Forum would charter all new WGs (both SSL-cert related WGs, and non-SSL cert related WGs), and would set the voting rules for non-SSL cert WGs (e.g., final WG guidelines must be approved by 2/3 of WG members, as there will not be separate classes of CAs and browsers in these non-SSL cert WGs. We may need to set voting limits for participants who don’t have “skin in the game” so the non-SSL cert WGs can’t be taken over by individual participants who are not CAs or applications).<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Pros</u></i>: Allows the Forum to work on non-SSL cert issues at the WG level, without forcing Members only interested in SSL to participate or vote on non-SSL guidelines and have to disclose or license their IP if a guideline passes (and without forcing those Members to veto a proposal for this reason). Maximizes efficiency for those CAs who want to work on both SSL cert and non-SSL cert issued in the same Forum and at the same meetings. Avoids duplication of overhead (web page, mailing lists, meetings, etc.) when working on non-SSL cert issues. Interested Parties can already participate in WGs if they sign the IPR, so no change is required there.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Cons</u></i>: Non-CAs/non-browsers who are participants in WGs could feel like second class participants because they don’t have a vote at the Forum level on formation or charter of WGs, voting rules, etc. (but this is the case today for Interested Parties, plus CAs who are Forum members would probably represent the interests of those participants at the Forum level anyway). Option 2 will be more complex than what we have today. Moving to a “participant / RAND-Z” IPR system will require more record keeping as to who is or was a participant (like W3C), so is more complex (but, so long as we limit a duty to disclose to those who sign up for a particular WG, and maintain our standard RAND-Z IPR agreement for each WG, it may not be that complex).<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Open Issues</u></i>. Will applications like Oracle and Java agree to join a WG if they have to sign our current RAND-Z IPR agreement (even if disclosure is limited only to those issues in those WGs in which they participate)? Unknown – need to ask.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>Would this Option 2 satisfy the browsers who voted no on the code signing guidelines at the Forum level? Unknown – need to ask.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><b><u>Option 3 – Restructure Forum to Be Management Only, Put SSL Cert and other Issues in Separate WGs</u><o:p></o:p></b></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoListParagraphCxSpFirst style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:22.5pt;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;mso-list:l2 level1 lfo8'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>Under this option, Bylaws would be amended so the scope of the Forum covers all types of certificates and all work of the Forum would be done at the WG level, and the Forum itself (parent level) would just perform a management and coordination function, but not work on substantive issues or vote to adopt particular guidelines. It is likely that “members” at the Forum level would be more like an executive committee made up of representatives of the various WGs – SSL certs, code signing certs, S/MIME, client certs, etc. – so the Executive Committee membership would no longer be just CAs and browsers. The Executive Committee would set meeting dates, charter new WGs, set participation requirements (e.g., “skin in the game”), set a uniform IPR policy for each WG, maintain participation records and copies of guidelines adopted at the WG level, etc. The name of the Forum might need to be changed to reflect the broader reach of all the WGs, such as “PKI Forum” (already used elsewhere).<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:22.5pt;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;mso-list:l2 level1 lfo8'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>Modify the current IPR agreement to be “participation only” based on WG participation – but continue to be RAND-Z. The IPR agreement would probably be uniform for each WG, probably adopted at the Forum Executive Committee level.<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:22.5pt;margin-bottom:.0001pt;mso-add-space:auto;text-indent:-.25in;mso-list:l2 level1 lfo8'><![if !supportLists]><span style='font-family:Symbol'><span style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]>Guidelines would be developed and adopted at the WG level, according to voting rules set by the Forum (for the SSL cert WG, it might be the same voting and participation rules we have today; for other WGs, there could be a simple rule such as approval by 2/3 of all WG members, perhaps with voting sublimits applied to participants who are not involved in the commercial work of the WG subject – e.g., are not a CA or a relevant application). Guidelines adopted at the WG level would not be reviewed or approved at the Forum Executive Committee level, so no IPR agreement requirements would ever occur at the Forum Executive Committee level<o:p></o:p></p><p class=MsoListParagraphCxSpLast style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;mso-add-space:auto'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Pros</u></i>: This creates a certain symmetry – all WGs are equal and fairly independent, with SSL certs being treated no differently from code signing certs, etc. We could leverage the experience of the current Forum in running these types of WGs, and would enjoy the efficiency of having the various WG meetings occurring at the same location during the same week (which would allow CAs to participate in all the WG meetings if they have an interest). When the work of WGs overlaps, the Forum Executive Committee would coordinate and avoid conflicts. Using a standard, participation-based RAND-Z IPR agreement at each WG level would avoid confusion. Browsers would need only participate in the SSL certificate WG if they want, and not be exposed to any of the other certificate issues or IP disclosure and licensing requirements.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Cons</u></i>: The Forum has 11 successful years behind it in raising the bar for SSL certificates, and risks losing that track record and diluting its effectiveness if SSL certificates become only one WG of many. It’s not clear that very many new participants will show up and participate in the non-SSL cert WGs compared to today (or will sign a participation based RAND-Z IPR policy), so why make all these changes if it doesn’t increase participation? If some WGs want to go to a non-RAND-Z IPR agreement form, will the Forum allow this, or will the Forum say no? <o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>By converting the Forum level from an SSL certificate group to an Executive Committee coordinating group (with non-CAs and non-Browsers represented), CAs and browsers will lose power in setting the direction for the Forum and its WGs, and ultimately the Forum Executive Committee could do things that CAs and browsers don’t like – e.g., drop IPR agreements for all WGs, limit the scope of the SSL certificate WG, etc. – why take that risk?<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>If participation in various WGs grows, will the WGs be able to meet in the same location during the same 3-day period as our current Forum meetings? Or will some WGs want all-day meetings to work on more ambitious projects? If the latter, we may lose some of the efficiency of this approach, and might as well ask the WG to leave the Forum and just become its own new organization.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><i><u>Open Issues</u></i>: Will applications like Oracle and Java agree to join a WG if they have to sign our current RAND-Z IPR agreement (even if disclosure is limited only to those issues in those WGs in which they participate)? Unknown – need to ask.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>Would this Option 3 satisfy the browsers who voted no on the code signing guidelines at the Forum level? Unknown – need to ask.<o:p></o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>Would this Option 3 require more administrative duties at the Forum Executive Committee level than we are equipped to provide as a volunteer organization with no funding or staff? Hard to say, but could be a challenge if the number of WGs and numbers of participants on each WG grows too large. We can’t be a copy of W3C with our current resources.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'>*****<o:p></o:p></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'><o:p> </o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>B<b>allot 165 - Formation of Governance Review Working Group</b><o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>The following motion has been proposed by Dean Coclin of Symantec and endorsed by Robin Alden of Comodo and Kirk Hall of Trend Micro:<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>-- MOTION BEGINS --<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>In accordance with Section 5.3 of the CA/B Forum Bylaws, the chartering of a new working group by ballot is required. This Ballot proposes chartering of the Governance Review Working Group. The Working Group’s charter will be as follows:<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>1. Consider revisions to the scope of the Forum to include possible additional topics such as code signing, SMIME and client certificate usages<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>2. Review the scope of the IPR and IP ownership issues<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>3. Consider options for representation of others in forum issues<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>4. Review voting rules and rights<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>5. Review admin functions<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>6. Examine making the forum an “official” organization (e.g. Incorporation)<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>7. Review how requirements and guideline documents would be structured in a newly organized forum would be done<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>The group’s deliverables will be:<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>1. An extensive report with one or more proposals on possible changes to the Forum organization (“proposed structure”)<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>2. A proposal on requirements and guideline document structure and proprietorship<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>3. A form of ballot or ballots to implement any recommendations<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>The Working Group shall expire once the deliverables have been completed.<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>-- MOTION ENDS --<o:p></o:p></span></p><p class=line874 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>The review period for this ballot shall commence at 2200 UTC on 17 March 2016, and will close at 2200 UTC on 24 March 2016. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2200 UTC on 31 March 2016. Votes must be cast by posting an on-list reply to this thread.<o:p></o:p></span></p><p class=line862 style='margin:0in;margin-bottom:.0001pt;background:white'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:black'>A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here:<span class=apple-converted-space> </span></span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><a href="https://cabforum.org/members/"><span style='border:none windowtext 1.0pt;padding:0in'>https://cabforum.org/members/</span></a><span style='color:black'><o:p></o:p></span></span></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt'><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:0in;margin-bottom:.0001pt;line-height:normal'><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>