Re: [gentoo-project] Comrel Improvements: Expectations of Privacy

[Matthew Thode]

I'll echo Rich's statement that my opinions are my own, not the
Trustees, also, I am not a lawyer.

Rich, I'm glad you started these, I may send one or two as well,
however, I think it'd be good to do one at a time in order to actually
have action on them.

On 09/30/2016 07:59 PM, Rich Freeman wrote:
> General Background
> This is the first in a series of threads I plan to start, each around
> some aspect of our Comrel process.  If you have a concern that isn't
> covered in this post please start a separate thread, and I do intend
> to start others.  This isn't intended to suggest that this is the ONLY
> issue that is worth discussion about Comrel.  I just expect there to
> be potentially a large amount of interest in the topic and I think
> we're better served if things are divided into somewhat-separable
> topics.
>
> In these emails I'm speaking purely on my own behalf, and not for the
> Council/Foundation/etc.  I know these bodies have an interest in these
> topics and may very well offer official input at some time.  I really
> just want to foster open discussion so that we can air opinions before
> we actually get to setting/changing policy.
>
>
> The Issue
> Recently there has been some questioning of whether we have the right
> balance of privacy in Comrel disputes.  Some specific questions to be
> addressed are:
>
> 1.  When information is turned over to comrel who does it get shared
> with, and under what circumstances?

Here I feel the current status quo is fine, info turned over to comrel
resides within comrel unless an appeal is made to council, who would
then have access.  Trustees would also have access if something legal
came up.  The one change I'd like to see (and should likely go into it's
own email) is that council (that which 'governs' comrel) should be able
to spot audit them as well.

> 2.  Do any members of the community have an obligation to report?  Can
> members of comrel/trustees/officers/council/etc be told information in
> private without it being shared back with comrel for the official
> record?

Here I feel we differ slightly, in general I agree that we should
heavily encourage devs/staff/foundation-members to report I'm not sure
how we could enforce it.  I do however think that council and even more
so trustees have a duty to report, but this is not codified anywhere.

As far as being told info in private goes, I think we can be told such
info, but if something breaches a certain level it should go to comrel
(or the appropriate party).  I don't know exactly what that level is,
but it's probably just the rules we already have in place.

> 3. Specifically, what information gets shared with people named in a
> dispute of some kind?

I think this depends on how it's reported.  If it's reported from a
third party wishing to be anonymous then I don't think they necessarily
need to know.  However, if it's first party then unless there is an
amazing reason, I don't think identities need to be hidden.

As for the information, I think each party should be able to see the
evidence, if it needs to be anonymized then that can happen as well.

> 4. Under what circumstances will information be shared with a
> government authority/etc?

When it's needed?  I don't think we need to do anything more here.

> 5. Do subjects of comrel action generally have a "right to face their
> accuser?"

No.  The reason I say this is because Gentoo is not a 'court' and we are
free to do what we want here.  I generally think it's good and perhaps
even beneficial for some sort of confrontation to happen between the
accuser and the accused, but only in so much as to solve whatever issue
is at hand.  If the accuser wants to stay out of it, that's fine.

If there is someone trying to game the system I do think that needs to
be punished harshly, as it is poison.

> 6. What should be communicated about comrel actions, both proactively
> and when people inquire about them?

If something is already public then a short note is appropriate,
otherwise a short note in private upon questioning is good.  Like you
said below, a note to the project/herd/team/whatever lead is probably
useful as well.

>
> I think there are a number of pros and cons to any approach we take,
> and it is possible for reasonable people to hold a different opinion
> on this topic.
>
>
> The Current State
> As best as I understand it (and corrections are welcome), this is how
> things work today (I'm just trying to stick to the facts in this
> section):
>
> Nobody in Gentoo has an obligation to raise issues to Comrel.  If
> somebody privately tells me that they're having a problem with
> somebody, I can offer advice/etc, or advise them to go to Comrel, but
> I'm not obligated to do so.
>
> If somebody does go to Comrel, what they say is generally kept
> confidential from anybody not in Comrel.  So, if I were to complain to
> Comrel that ulm has been voting against too many of my Council
> proposals, Comrel might or might not even tell ulm that there was a
> complaint, and if they did they wouldn't tell him that I made the
> complaint or provide any exact copies of the complaint.
>
> If somebody appeals a Comrel decision to the Council, then all
> information that Comrel has on the case is made available to the
> Council.
>
> After a case is concluded, information is maintained indefinitely, and
> available to some members of Comrel.  It might be shared with all of
> Comrel if another case comes up.
>
> While this has not happened within my knowledge, I imagine that if a
> lawsuit came up or a threat of one, any relevant information would be
> shared with the Trustees and anybody they designate.  There isn't any
> proactive monitoring by the Foundation.
>
> In general Comrel actions are kept confidential.  A general member of
> the community (developer or otherwise) typically doesn't find out that
> there even has been a dispute, let alone the results of one.  However,
> I know there have been exceptions, including a recent one on -core.
> When significant actions like forced retirement occur non-devs on
> impacted teams may not be informed, though if they make specific
> inquiries a fairly minimal statement might be given.
>
>
> Discussion
> Here I'll offer my own opinions, though many are not strongly held.  I
> really want to foster discussion around the pros/cons as I don't think
> that the answers to the questions I framed are necessarily completely
> obvious.
>
> I'll start with what I see as the largest controversy: the right of
> the accused to face their accuser.  In almost all courts this is a
> fairly universal right.  In private companies/organizations it tends
> to be much less so.  The main benefit of keeping complaints
> anonymous/private is that people will feel more free to come forward
> with complaints without fear of retaliation.  The obvious downside is
> that the accused feels the process is unfair since it is a black box
> to them, and they may be less receptive to the legitimacy of concerns,
> and indeed the anonymity might result in false claims since they're
> harder to refute.
>
> I suspect private organizations also tend to keep this stuff
> confidential because it makes them harder to sue, and that concern
> does apply to Gentoo to some degree.
>
> Next, mandatory reporting:  I think we ought to give serious
> consideration to it for a couple of reasons.  Companies often have
> mandatory reporting, for example if somebody were to copy me on an
> email that violates company policy around something like sexual
> content, I could be fired merely for having been sent it but not
> reporting it to HR, because I have people who report to me.  For
> positions like Trustees/Officers of the Foundation I suspect that if
> they're aware of a potential situation where Gentoo has some
> liability, they would have a fiduciary duty to act on it.  That may or
> may not apply to Council members as well.  There is another reason why
> mandatory reporting might make sense: it avoids putting people in
> leadership situations in a tricky situation where they feel like they
> have to both keep something confidential and try to deal with a
> serious problem solo, because they feel like it would be wrong to
> ignore it.  With a mandatory reporting policy then people know
> up-front that leaders are basically an extension of Comrel, and then
> once the situation is handed off to Comrel the person it was disclosed
> to can safely step away and let Comrel do its job.
>
> Finally, when it comes to communicating outcomes of comrel actions, I
> suggest keeping the distribution minimal.  If somebody is forced to
> retire from a leadership role, then those who were a part of their
> team probably should know.  If somebody is forced to retire from a
> team then the team lead should be told.  I don't really see a ton of
> value in communicating comrel actions widely in general.  The problem
> with communicating things widely is that it makes it harder for the
> person subject to the action to re-integrate themselves into the
> community once any actions expire.  Also, there is less risk of
> liability for defamation/etc if nothing is publicly communicated.  At
> my own workplace there is really no distinction between somebody being
> fired and leaving of their own accord as far as announcements to
> coworkers and such are concerned.  Indeed, there is also usually
> little distinction between being fired for cause or because you simply
> are no longer needed when it comes to communication with the person
> being separated either.
>
> I'll go ahead and wind this down here as it already feels a lot longer
> than I intended (perhaps the topic was still too broad, though I see
> these items as being fairly related).  Again, the goal here is to spur
> discussion and end up with policies that there is some kind of
> community backing for, whether they end up being the status quo or
> otherwise.  Ultimately whatever is decided upon should be documented
> so that when somebody contacts Comrel they know up-front what will be
> done with any information they provide, and so on.
>
> So, whether you think this is great or the worst drivel you've ever
> read, please do speak up...
>
> --
> Rich
>
>


-- 
-- Matthew Thode (prometheanfire)