[gentoo-project] Comrel Improvements: Expectations of Privacy

[Rich Freeman]

General Background
This is the first in a series of threads I plan to start, each around
some aspect of our Comrel process.  If you have a concern that isn't
covered in this post please start a separate thread, and I do intend
to start others.  This isn't intended to suggest that this is the ONLY
issue that is worth discussion about Comrel.  I just expect there to
be potentially a large amount of interest in the topic and I think
we're better served if things are divided into somewhat-separable
topics.

In these emails I'm speaking purely on my own behalf, and not for the
Council/Foundation/etc.  I know these bodies have an interest in these
topics and may very well offer official input at some time.  I really
just want to foster open discussion so that we can air opinions before
we actually get to setting/changing policy.


The Issue
Recently there has been some questioning of whether we have the right
balance of privacy in Comrel disputes.  Some specific questions to be
addressed are:

1.  When information is turned over to comrel who does it get shared
with, and under what circumstances?
2.  Do any members of the community have an obligation to report?  Can
members of comrel/trustees/officers/council/etc be told information in
private without it being shared back with comrel for the official
record?
3. Specifically, what information gets shared with people named in a
dispute of some kind?
4. Under what circumstances will information be shared with a
government authority/etc?
5. Do subjects of comrel action generally have a "right to face their
accuser?"
6. What should be communicated about comrel actions, both proactively
and when people inquire about them?

I think there are a number of pros and cons to any approach we take,
and it is possible for reasonable people to hold a different opinion
on this topic.


The Current State
As best as I understand it (and corrections are welcome), this is how
things work today (I'm just trying to stick to the facts in this
section):

Nobody in Gentoo has an obligation to raise issues to Comrel.  If
somebody privately tells me that they're having a problem with
somebody, I can offer advice/etc, or advise them to go to Comrel, but
I'm not obligated to do so.

If somebody does go to Comrel, what they say is generally kept
confidential from anybody not in Comrel.  So, if I were to complain to
Comrel that ulm has been voting against too many of my Council
proposals, Comrel might or might not even tell ulm that there was a
complaint, and if they did they wouldn't tell him that I made the
complaint or provide any exact copies of the complaint.

If somebody appeals a Comrel decision to the Council, then all
information that Comrel has on the case is made available to the
Council.

After a case is concluded, information is maintained indefinitely, and
available to some members of Comrel.  It might be shared with all of
Comrel if another case comes up.

While this has not happened within my knowledge, I imagine that if a
lawsuit came up or a threat of one, any relevant information would be
shared with the Trustees and anybody they designate.  There isn't any
proactive monitoring by the Foundation.

In general Comrel actions are kept confidential.  A general member of
the community (developer or otherwise) typically doesn't find out that
there even has been a dispute, let alone the results of one.  However,
I know there have been exceptions, including a recent one on -core.
When significant actions like forced retirement occur non-devs on
impacted teams may not be informed, though if they make specific
inquiries a fairly minimal statement might be given.


Discussion
Here I'll offer my own opinions, though many are not strongly held.  I
really want to foster discussion around the pros/cons as I don't think
that the answers to the questions I framed are necessarily completely
obvious.

I'll start with what I see as the largest controversy: the right of
the accused to face their accuser.  In almost all courts this is a
fairly universal right.  In private companies/organizations it tends
to be much less so.  The main benefit of keeping complaints
anonymous/private is that people will feel more free to come forward
with complaints without fear of retaliation.  The obvious downside is
that the accused feels the process is unfair since it is a black box
to them, and they may be less receptive to the legitimacy of concerns,
and indeed the anonymity might result in false claims since they're
harder to refute.

I suspect private organizations also tend to keep this stuff
confidential because it makes them harder to sue, and that concern
does apply to Gentoo to some degree.

Next, mandatory reporting:  I think we ought to give serious
consideration to it for a couple of reasons.  Companies often have
mandatory reporting, for example if somebody were to copy me on an
email that violates company policy around something like sexual
content, I could be fired merely for having been sent it but not
reporting it to HR, because I have people who report to me.  For
positions like Trustees/Officers of the Foundation I suspect that if
they're aware of a potential situation where Gentoo has some
liability, they would have a fiduciary duty to act on it.  That may or
may not apply to Council members as well.  There is another reason why
mandatory reporting might make sense: it avoids putting people in
leadership situations in a tricky situation where they feel like they
have to both keep something confidential and try to deal with a
serious problem solo, because they feel like it would be wrong to
ignore it.  With a mandatory reporting policy then people know
up-front that leaders are basically an extension of Comrel, and then
once the situation is handed off to Comrel the person it was disclosed
to can safely step away and let Comrel do its job.

Finally, when it comes to communicating outcomes of comrel actions, I
suggest keeping the distribution minimal.  If somebody is forced to
retire from a leadership role, then those who were a part of their
team probably should know.  If somebody is forced to retire from a
team then the team lead should be told.  I don't really see a ton of
value in communicating comrel actions widely in general.  The problem
with communicating things widely is that it makes it harder for the
person subject to the action to re-integrate themselves into the
community once any actions expire.  Also, there is less risk of
liability for defamation/etc if nothing is publicly communicated.  At
my own workplace there is really no distinction between somebody being
fired and leaving of their own accord as far as announcements to
coworkers and such are concerned.  Indeed, there is also usually
little distinction between being fired for cause or because you simply
are no longer needed when it comes to communication with the person
being separated either.

I'll go ahead and wind this down here as it already feels a lot longer
than I intended (perhaps the topic was still too broad, though I see
these items as being fairly related).  Again, the goal here is to spur
discussion and end up with policies that there is some kind of
community backing for, whether they end up being the status quo or
otherwise.  Ultimately whatever is decided upon should be documented
so that when somebody contacts Comrel they know up-front what will be
done with any information they provide, and so on.

So, whether you think this is great or the worst drivel you've ever
read, please do speak up...

--
Rich


-- 
Rich