response 1 of 35:

Mar 14 04:44 UTC 2001

forgive my ignorance, but what is an Institutional Member?

response 3 of 35:

Mar 14 08:05 UTC 2001

In deciding on ID requirements, it's probably worth first considering what
we need the ID for.  I believe the original rationalle several years ago was
that the Internet was a closed academic network, and that we needed to be very
careful about being good neighbors if we were going to let members of the
public onto it.  I don't think anybody thinks of the Internet that way
anymore, and organizations that care tend to invest large amounts of resources
into securing their Internet connections, rather than trusting the rest of
the Internet to be good neighbors.  It may still be important, to make our
own lives easier, to be able to ensure that somebody we cut off for misusing
Internet access doesn't come back again and again, but we already have that
problem and deal with it for misuse of our own system.

The other reason for requesting ID, that's been given occasionally, is that
we need a list of names and addresses of members, to give to the state if they
ask.  That means we need to ask our members for their names and addresses,
and means our members should give us accurate information.  It certainly means
we shouldn't knowingly falsify the list.  However, asking for proof of the
information our members give us is probably going a bit far.  That certainly
isn't anything any other non-profit I've ever joined has asked for.

response 5 of 35:

Mar 14 14:31 UTC 2001

Re #4: I'd rather not get stuck on the particular check that inspired this
item.  If we could come up with a general policy on ID for institutional
members, then future treasurers and I won't have to fret over this every
time it comes up.

Re #1&2: When Grex was founded, it was assumed that all members would be
people.  Later the bylaws were amended to allow institutions to become
members.  They read in part:

  a. Any individual or institution supporting the goals and objectives of
     this organization as enumerated in the Preamble, and who agrees to
     abide by these bylaws and pay dues, is eligible for membership.

The bylaws go on to say that institutional members have the same status as
individual members, except that they may not vote in elections or serve on
the Board of Directors.

Re #3: Here is the standard message I send to people when they ask me why
they need to send ID to become members:

 There are two reasons Grex requires ID from its members:

 1. While we are very comfortable allowing anonymous users access to Grex,
 we are not comfortable unleashing them on the rest of the Internet.  It
 would be irresponsible of the Grex administration to allow people we
 can't identify to telnet through Grex to other systems, so we require ID
 from everyone we allow to do that. 

 2. Cyberspace Communications is required by the state of Michigan to
 maintain an up-to-date list of members.  Implied in this requirement is
 that we make sure no two memberships are held by the same person.  So we
 require ID to connect accounts with real people and make sure no one has
 the ability to vote twice in Grex elections. 

Since institutional members may not vote, #2 is not as relevant as #1 to
them.  Some staff member please correct me if I'm wrong, but I think
people trying to telnet through Grex is still a problem that we are
concerned about, and constitutes a valid reason for requiring ID from
members.

response 7 of 35:

Mar 14 14:51 UTC 2001

Here's the current ID policy, from the 9/27/1995 board minutes.  It was
intended for verification of both members nonmembers for internet access,
but we have yet to get around to applying it to nonmembers.  Note that it
was adopted before we allowed institutional members.  Points (2) and (5)
are the relevant ones.

 T. Verification Policy - John Remmers passed around a verification policy
 which he had formulated. A few words were modified, but there was a long
 discussion about whether it should be possible for trusted people, such
 as staff, to relay information to the verifier. Ultimately, the wording
 in this respect was left intact.

 Here is the final wording of the motion:

 MOTION: (remmers, steve)

 (1) Anyone requesting access to Grex services for which verification
 is required shall present proof of his or her identity. Members and
 non-members will be held to the same verification criteria. In order
 to be considered verified, a person shall submit a photocopy of an
 item of acceptable identification and a signed letter requesting the
 access.

 (2) The acceptable items of identification are government-issued ID,
 school-issued ID, library-issued ID, or a personal check written to
 Cyberspace Communications Inc. by the person requesting access. To be
 accepted, the item must be currently valid (i.e. not expired), must
 identify the person by name, and must include additional identifying
 information other than a photograph (such as home address,
 passport number, or name of school).

 (3) There shall be one individual, referred to hereafter as "verifier",
 who is responsible for accepting verification requests and ID,
 notifying the appropriate staff member(s) so that access may be
 granted if the criteria of (1) and (2) are met, and notifying the
 requester if the ID is not acceptable.

 (4) The board shall solicit volunteers and appoint the verifier. The
 term of office is one year and is renewable. Any verified user is
 eligible for the post of verifier. If a volunteer for the post is not
 currently verified, then for the purpose of gaining eligibility he or
 she may present identification to the board that meets the criteria
 enumerated in (2).

 (5) In the case of personal checks submitted to the treasurer of
 Cyberspace Communications Inc., the treasurer may also verify a user,
 provided the check meets the criteria of (2) and is accompanied by a
 signed letter as required in (1).

 (6) An individual whose request for verification is denied may
 appeal the decision to the board. The board's ruling on appeals
 is final.

 PASSED: 7-0

response 9 of 35:

Mar 14 18:36 UTC 2001

Why don't we do the same thing the bank does: require that a corporation has
to supply us with two real people to represent the corporation or institution.
Perhaps the treasurer and president of the instituion's board.  That way we
can use the same "people" policies on these folks, and still have the
institution as the member.

response 11 of 35:

Mar 14 19:04 UTC 2001

(I think #9 is a good compromise.)

response 13 of 35:

Mar 15 02:59 UTC 2001

I'd think that the normal ID requirements would be fine for institutional
members, i.e. we have to make a good faith effort to ensure that we know the
name and contact info of a real person who is voluntarily associated with the
account.  After all, what's the difference between a member with a driver's
license calling itself "Foobar, Inc." and a member with a driver's license
calling himself "Greg Fleming"?  The fact that the first person has
voluntarily chosen to waive voting priveleges in exchange for having the
membership be "in someone else's name" doesn't seem to be overly significant
to me, as far as security and accountability policies are concerned. 

response 15 of 35:

Mar 15 08:57 UTC 2001

It should be noted that there's been no evidence at all that the case that
inspired this item has anything to do with spam.  That's the conspiracy
theorists going wild.

response 17 of 35:

Mar 15 11:58 UTC 2001

(Since the board is meeting in less than a week, I recommend
that they enact a policy and that it be applied to any pending
requests for institutional membership.)

response 19 of 35:

Mar 15 16:37 UTC 2001

Fair enough.

response 21 of 35:

Mar 16 04:50 UTC 2001

I don't feel comfortable going into the specifics of a payment here in coop.
That's why this is an item about a general policy on ID for institutional
members.

response 23 of 35:

Mar 16 19:18 UTC 2001

Regarding Collen's suggestion in #9: I think requiring two people may be one
too many.  We might potentially have an istitutional member which really
only *has* one person.  And we certainly have institutional members which
are not full-fledged corporations, so I don't think we should require
specific corporate officers to sign.  In other words, I think whatever
policy we adopt should be broad enough to include small and informal
organizations.

That said, we don't want to be hoodwinked, either.