[gentoo-project] Comrel Improvements: Expectations of Privacy

[Raymond Jennings]

> General Background

> This is the first in a series of threads I plan to start, each around
> some aspect of our Comrel process. If you have a concern that isn't
> covered in this post please start a separate thread, and I do intend
> to start others. This isn't intended to suggest that this is the ONLY
> issue that is worth discussion about Comrel. I just expect there to
> be potentially a large amount of interest in the topic and I think
> we're better served if things are divided into somewhat-separable
> topics.
>
> In these emails I'm speaking purely on my own behalf, and not for the
> Council/Foundation/etc. I know these bodies have an interest in these
> topics and may very well offer official input at some time. I really
> just want to foster open discussion so that we can air opinions before
> we actually get to setting/changing policy.

My personal opinion is that, whatever the policy is, having it publicly 
documented and thus setting expectations in advance will be an 
improvement by itself.

> The Issue
> Recently there has been some questioning of whether we have the right
> balance of privacy in Comrel disputes. Some specific questions to be
> addressed are:
>
> 1. When information is turned over to comrel who does it get shared
> with, and under what circumstances?
> 2. Do any members of the community have an obligation to report? Can
> members of comrel/trustees/officers/council/etc be told information in
> private without it being shared back with comrel for the official
> record?

Depends on the issue at hand.

> 3. Specifically, what information gets shared with people named in a
> dispute of some kind?

See below

> 4. Under what circumstances will information be shared with a
> government authority/etc?

Not a lot of leeway here, if a subpoena or a search warrant gets 
involved.  IIRC, the Gentoo Foundation is a US nonprofit corporation 
and therefore subject to US law, plus the laws of whatever state a) 
contains the assets in question, and/or b) is the state of 
incorporation for the foundation.

NB:  I think that there should be public and convenient documentation 
citing where the assets containing such information are located, as a 
means of public declaration of what jurisdiction applies.

I'm not a lawyer, but I do know that the jurisdiction under which the 
information is contained and/or serves as the state of incorporation 
(new mexico, IIRC?) will control any "involuntary" disclosures that the 
foundation will not have any discretion about.

So...whatever the situation here happens to be, should at least be 
publicly documented in an easily visible manner.

> 5. Do subjects of comrel action generally have a "right to face their
> accuser?"

Yes and no, in my opinion.  The accuser should be held responsible for 
their accusation, but an offender who is rightly accused should not be 
able to intimidate a witness, so to speak.

My proposal:

1.  Anonymously provided information cannot, by itself, be used as 
evidence.  The identity of the "plaintiff" must at a minimum be known 
to comrel.

2.  Any member of comrel who accepts, uses in a comrel case, or posts 
evidence or testimony from a confidential source takes responsibility 
for the truth of the information so presented, in detail:

    * They are responsible for the truth of the information

    * If the information is challenged or rebutted, they are 
responsible for relaying the challenge to the source for rebuttal.  
This is kiiinda how spamcop works with spam reports.  If the report is 
challenged, the challenge gets sent through spamcop back to the 
reporter.

    * If the information is proven to be false or worse forged, or the 
accuser fails his duty to support his accusation, the comrel member 
responsible for it must either:

       - take the blame for the falsehood, or

       - expose the identity of the person supplying the false 
information, and possibly process a CoC violation against the original 
reporter for "perjury"

    In this case, holding comrel responsible is only intended ot make 
sure they do not willingly tolerate bad information.  If the comrel 
person responsible for the information is doing their job properly, 
they should very easily be able to take the blame and dump it where it 
belongs without any risk of eating blame they don't deserve.

3.  People who give false information to comrel must be held 
accountable for "perjury".  If someone gives false evidence or makes an 
unfounded allegation, they should be held responsible for it.

4.  People who misuse comrel by deliberately making false complaints, 
or needlessly escalating issues that do not require comrel attention, 
should be handled the same as any other CoC violation as would be 
reported to comrel to begin with.

    * Relatedly, someone who, after agreeing to be responsible to 
comrel for their report, fails to properly rebut any challenges, or 
fails to withdrawi their complaint if it proves to be unfounded, is 
themselves causing trouble for Gentoo, and should not be able to use 
comrel-provided anonymity as a shield behind which to spam their 
enemies with comrel bullets.

To be blunt:

If someone tries to abuse comrel by supplying a false accusation, they 
themselves are the ones that should be held responsible for violating 
CoC (and it should be a CoC violation to make a false complaint or 
submit false information to comrel, if it isn't a violation already), 
and it should be comrel's job to hold a malicious reporter responsible.

Furthermore, if a comrel member, hypothetically speaking, fails to hold 
the malicious or negligent reporter responsible, they are aiding and 
abetting the misconduct in question and should be willing to eat the 
blame for it if they aren't willing to expose the true culprit.

> 6. What should be communicated about comrel actions, both proactively
> and when people inquire about them?
>
> I think there are a number of pros and cons to any approach we take,
> and it is possible for reasonable people to hold a different opinion
> on this topic.
>
>
> The Current State
> As best as I understand it (and corrections are welcome), this is how
> things work today (I'm just trying to stick to the facts in this
> section):
>
> Nobody in Gentoo has an obligation to raise issues to Comrel. If
> somebody privately tells me that they're having a problem with
> somebody, I can offer advice/etc, or advise them to go to Comrel, but
> I'm not obligated to do so.
>
> If somebody does go to Comrel, what they say is generally kept
> confidential from anybody not in Comrel. So, if I were to complain to
> Comrel that ulm has been voting against too many of my Council
> proposals, Comrel might or might not even tell ulm that there was a
> complaint, and if they did they wouldn't tell him that I made the
> complaint or provide any exact copies of the complaint.
>
> If somebody appeals a Comrel decision to the Council, then all
> information that Comrel has on the case is made available to the
> Council.
>
> After a case is concluded, information is maintained indefinitely, and
> available to some members of Comrel. It might be shared with all of
> Comrel if another case comes up.
>
> While this has not happened within my knowledge, I imagine that if a
> lawsuit came up or a threat of one, any relevant information would be
> shared with the Trustees and anybody they designate. There isn't any
> proactive monitoring by the Foundation.
>
> In general Comrel actions are kept confidential. A general member of
> the community (developer or otherwise) typically doesn't find out that
> there even has been a dispute, let alone the results of one. However,
> I know there have been exceptions, including a recent one on -core.
> When significant actions like forced retirement occur non-devs on
> impacted teams may not be informed, though if they make specific
> inquiries a fairly minimal statement might be given.
>
>
> Discussion
> Here I'll offer my own opinions, though many are not strongly held. I
> really want to foster discussion around the pros/cons as I don't think
> that the answers to the questions I framed are necessarily completely
> obvious.
>
> I'll start with what I see as the largest controversy: the right of
> the accused to face their accuser. In almost all courts this is a
> fairly universal right. In private companies/organizations it tends
> to be much less so. The main benefit of keeping complaints
> anonymous/private is that people will feel more free to come forward
> with complaints without fear of retaliation. The obvious downside is
> that the accused feels the process is unfair since it is a black box
> to them, and they may be less receptive to the legitimacy of concerns,
> and indeed the anonymity might result in false claims since they're
> harder to refute.
>
> I suspect private organizations also tend to keep this stuff
> confidential because it makes them harder to sue, and that concern
> does apply to Gentoo to some degree.
>
> Next, mandatory reporting: I think we ought to give serious
> consideration to it for a couple of reasons. Companies often have
> mandatory reporting, for example if somebody were to copy me on an
> email that violates company policy around something like sexual
> content, I could be fired merely for having been sent it but not
> reporting it to HR, because I have people who report to me. For
> positions like Trustees/Officers of the Foundation I suspect that if
> they're aware of a potential situation where Gentoo has some
> liability, they would have a fiduciary duty to act on it. That may or
> may not apply to Council members as well. There is another reason why
> mandatory reporting might make sense: it avoids putting people in
> leadership situations in a tricky situation where they feel like they
> have to both keep something confidential and try to deal with a
> serious problem solo, because they feel like it would be wrong to
> ignore it. With a mandatory reporting policy then people know
> up-front that leaders are basically an extension of Comrel, and then
> once the situation is handed off to Comrel the person it was disclosed
> to can safely step away and let Comrel do its job.
>
> Finally, when it comes to communicating outcomes of comrel actions, I
> suggest keeping the distribution minimal. If somebody is forced to
> retire from a leadership role, then those who were a part of their
> team probably should know. If somebody is forced to retire from a
> team then the team lead should be told. I don't really see a ton of
> value in communicating comrel actions widely in general. The problem
> with communicating things widely is that it makes it harder for the
> person subject to the action to re-integrate themselves into the
> community once any actions expire. Also, there is less risk of
> liability for defamation/etc if nothing is publicly communicated. At
> my own workplace there is really no distinction between somebody being
> fired and leaving of their own accord as far as announcements to
> coworkers and such are concerned. Indeed, there is also usually
> little distinction between being fired for cause or because you simply
> are no longer needed when it comes to communication with the person
> being separated either.
>
> I'll go ahead and wind this down here as it already feels a lot longer
> than I intended (perhaps the topic was still too broad, though I see
> these items as being fairly related). Again, the goal here is to spur
> discussion and end up with policies that there is some kind of
> community backing for, whether they end up being the status quo or
> otherwise. Ultimately whatever is decided upon should be documented
> so that when somebody contacts Comrel they know up-front what will be
> done with any information they provide, and so on.
>
> So, whether you think this is great or the worst drivel you've ever
> read, please do speak up...
>
> --
> Rich