[BOARD] Latest update on CyberCrime treaty statement
We have had a number of conversations today with various people.
Below are several points which I hope will clarify the situation and
address people's concerns.
This situation will be the first topic in this Thursday's
teleconference. A great number of issues were raised which we have
found difficult to respond to in any cohesive fashion, so they aren't
all addressed here. Our hope is that the interactive nature of the
teleconference will be more productive.
1) Gene Spafford will take over the operation of the web site and
signature collection. The next email will include a copy of what
we have created so that everyone can review it and provide
feedback. While I cannot commit Spaf to any specific date, I
believe he is aiming to have a web site available sometime around
2) While MITRE has decided to move away from hosting the web site, it
was never our intention to try and stop this statement from moving
forward, or to prevent Board members from pursuing it. We
recognize that many Board members strongly believe that this
activity should move forward. Individual Board members from MITRE
will continue to sign the statement as they see fit (I will
continue to sign).
3) As this activity is (a) not directly related to CVE, and (b) not an
"official" Editorial Board activity, we encountered some delays
because we had to move higher up the management chain than we would
with "normal" CVE-specific activities. (For those of you who have
been working to get your company to support this statement, that is
effectively what we have had to do with respect to publishing the
web site; and some aspects of this activity are different from the
way MITRE normally operates, which is one of the reasons why we are
transitioning the web site). In the future, MITRE will be more
careful to prevent non-CVE activities from getting tied up by
MITRE's own internal processes, so that it does not adversely
affect Board members who have strong interest in such activities.
Please don't read more into that last sentence than what was said;
we just don't want this situation to happen again.
4) MITRE did not provide any copies of the statement to our contacts
at the Department of Justice, nor did we say that this effort was
being spearheaded by the Editorial Board. While DoJ's opinions
bolstered those of MITRE's own legal counsel, our decision to give
up control of the web site was made independently of DoJ.
5) MITRE will still be working on this treaty, albeit from a different
angle. Our counsel (within MITRE and outside of it) has suggested
that a way to reduce the risk of misinterpretation is to help craft
a "document of record" or amplification of the treaty. These
documents, which are included with the treaty, provide background
information so that legislators can understand what the treaty
signers' intentions were. We will continue to work this "legal
angle" with other organizations who would like to pursue this
I hope this has addressed the most serious concerns.