Subject: Re: Last Call: <draft-farrresnickel-harassment-05.txt> (IETF Anti-Harassment Procedures) to Best Current Practice

From: John Leslie <[email-masked]>
Date: Fri, 6 Mar 2015 11:37:24 -0500

Michael StJohns <[email-masked]> wrote:
> 
> Has either or both of the ISOC and IETF trust lawyers reviewed this,
> especially section 5?

   As of the start of yesterday's telechat, Jari held a DISCUSS awaiting
such a review.

> If so, would you please provide the written evaluation that indicates
> they see no issue with respect to IETF liability should the Ombudsman
> actually attempt to exclude someone from the face to face or online
> sessions?

   +1

> I'm still in great opposition to this document

   -1

> as I believe Section 5 provides too broad a palate of "remedies" without
> appropriate checks and balances on the system.

   +1

   I find it worrisome that a Respondent is prohibited from requiring
public review of the process which led to a decision to exclude him/her.
(Obviously the Reporter is entitled to privacy; but a person being
excluded should have some option to request that the exclusion be
publicly shown to not be arbitrary. This seems to be lacking.)

> It's unclear that what actual recourse the IETF has if the target of
> the remedies simply chooses to ignore the directions of the OBs.

   This, too: I fail to understand how an exclusion would be enforced.

>... Since this is targeted for a BCP, the supporting documentation needs
> to be part of the approval package.

   +0

   I think this last statement needs a public response.

--
John Leslie <[email-masked]>

---

From: Abdussalam Baryun <[email-masked]>
Date: Mon, 9 Mar 2015 12:01:09 +0200

The IESG stated draft-ref[1] has a text to encourage participants to report
harassing but may be it's not stated clearly in the draft. The statement
[1] mentions:
" Participants asked to stop any harassing behavior must comply immediately.

If you believe you have been harassed, notice that someone else is being
harassed, or have any other concerns, you are encouraged to raise your
concern in confidence with one of the Ombudspersons."
Therefore in section 4, suggest to amend (change last "may" to "should")

Old:

Any IETF Participant who believes that they have been harassed, or
that any other IETF Participant or group of IETF Participants has been
or may have been harassed, may bring the concern to the attention of
any serving Ombudsperson.

New:

Any IETF Participant who believes that they have been harassed, or
that any other IETF Participant or group of IETF Participants has been
or may have been harassed, should bring the concern to the attention
of any serving Ombudsperson.

Regards,

AB

On Friday, January 16, 2015, The IESG <[email-masked]> wrote:

>
> The IESG has received a request from an individual submitter to consider
> the following document:
> - 'IETF Anti-Harassment Procedures'
>   <draft-farrresnickel-harassment-05.txt> as Best Current Practice
>
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> [email-masked] <javascript:;> mailing lists by 2015-02-13. Exceptionally,
> comments may be
> sent to [email-masked] <javascript:;> instead. In either case, please
> retain the
> beginning of the Subject line to allow automated sorting.
>
> Abstract
>
>
>    IETF Participants must not engage in harassment while at IETF
>    meetings, virtual meetings, social events, or on mailing lists.  This
>    document lays out procedures for managing and enforcing this policy.
>
>    This document updates RFC 2418.
>
>
>
>
> The file can be obtained via
> http://datatracker.ietf.org/doc/draft-farrresnickel-harassment/
>
> IESG discussion can be tracked via
> http://datatracker.ietf.org/doc/draft-farrresnickel-harassment/ballot/
>
>
> No IPR declarations have been submitted directly on this I-D.
>
>
>

---

From: Sam Hartman <[email-masked]>
Date: Fri, 06 Mar 2015 12:48:46 -0500

I apologize for the late review.

First, I'd like to say  that there are many great things about this
document:

1) I think that
1) It is not overly specific; it understands we don't know everything
about how this process works yet.

2) It's clear how to report an issue.

3) It has more thought about conflict of interest than is typical for
the IETF.

4) It acknowledges that this an area where an ISOC appeal may end up
being the right answer and explicitly allows for that.  While I hope we
don't see such an appeal, I'm really happy that we're honest about the
possibility and permit that approach when needed.

I've reviewed Michael's concerns about section 5.
I agree that the team will need to  carefully consider what remedy is
appropriate.
However, I do believe that the options provided by section 5 are all
necessary and don't think we will succeed in doing a better job of
writing section 5 at this time.

I think there's significant legal liability involved here.  If the IETF
fails to act in a situation where there is harassment, we and our
participants may face significant liability.  If the IETF isn't careful
in how it acts, especially if it acts in a manner that disadvantages a
party, it may have significant liability for impacts on the standards
process's openness.  You actually have liability when you make
decisions.  That's kind of the point though. If we want to avoid
liability, we could close up shop.  I suspect folks would be happy to
move into the vacuum:-)

Yes, the IESG should get legal review.
Yes, we should not take unnecessary risks.
However, we should also commit ourselves both to avoiding harassment and
to an open standards process.  Both of those commitments involve legal
and other risk.

I do have two concerns about the draft:

1) Certain disclosures are necessary for the process to work.  As an
example it's probably necessary for a respondent to know that there has
been a report to properly investigate it.  The draft sort of anticipates
this sort of necessary disclosure.  However, if I were on the IESG or
involved in handling a complaint of harassment, I don't think the
current text would be adequate for me  to do my job.  Here are some
examples:

* Does the respondent get to know the identity of the reporter?  What
  about the subject?  Arguments against are the general language of
  confidentiality.  Arguments for are the mutually review statement, and
  the offer of mediation.  Also, it seems like it would be really hard
  to respond without knowing the identity of the subject.  However
  reporter seems more complex.

* How does this whole thing where the team recommends removing someone
  from a position of leadership work?  What level of detail can be
  shared with the IESG for removing a chair?

2) I am concerned that there's no effective mechanism to remove an AD,
IAOC member or IAB member under this BCP.  How do you possibly imagine
getting enough signatures for a recall petition?  How does that interact
with your confidentiality and the needs of the recall committee.  Please
talk to folks involved in the recent recall petition and consider how
much difficulty we had in a very clear-cut case.
If you believe the existing procedures are adequate, please add some
description of how something leading to recall might work focusing on
how confidentiality is approached.

---

From: Jari Arkko <[email-masked]>
Date: Mon, 9 Mar 2015 21:50:18 +0200

Hi Mike,

> Has either or both of the ISOC and IETF trust lawyers reviewed this, especially section 5?

We have asked for and received from outside counsel and the ISOC insurance folks a risk assessment. 

For what it is worth, we’ve been told that there’s probably also (more) risk associated with not having this procedure in place :-)

In any case, after a discussion and feedback we revised some of the text in Section 2 and 5.1. From my perspective we are ready to move forward.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Mon, 9 Mar 2015 22:14:37 +0200

Hi Sam,

First, I agree with the assessment in the first part of your message. See also my reply to Mike St. Johns. We've gotten the review, and I'm comfortable with the outcome.

Second, I agree that the issues that you mention in the second part of your message are challenging. But I think the document as it is takes a stand on those issues. We've given the Ombudsteam the responsibility to come up with internal procedures that preserves as much confidentiality as possible but allows them to properly investigate. And we did discuss the leadership-as-respondent issues during IESG Evaluation, and we concluded keeping these procedures and recall separate was best. Pete or Adrian can give details if you're interested.

I think the rest we have to see, and improve if that experience shows that change is needed. 

In any case, we’ve approved the document in the last IESG telechat.

Jari

---

From: Pete Resnick <[email-masked]>
Date: Mon, 9 Mar 2015 15:36:45 -0500

On 3/9/15 3:14 PM, Jari Arkko wrote:
> we did discuss the leadership-as-respondent issues during IESG Evaluation, and we concluded keeping these procedures and recall separate was best. Pete or Adrian can give details if you're interested.

The short answer is that the IESG generally thought that "crossing the 
streams" was a bad idea. Imagine that we do get to the particular point 
of horror, that someone in leadership has harassed someone in such a way 
that the Ombudsteam concludes the only appropriate remedy is that they 
are unable to attend future meetings or participate in list discussions, 
*and* that person refused to resign their post. Even if they keep the 
fact of the harassment confidential and simply said, "I will be unable 
to attend meetings in the future for personal reasons, nor will I be 
able to participate in WG list discussions, but I still wish to remain 
as AD", that's really plenty enough impetus for a recall committee to be 
formed and remove the person from their post.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: Nico Williams <[email-masked]>
Date: Mon, 9 Mar 2015 15:36:55 -0500

Have there been harassment cases in the IETF, using the definition
given in the I-D?

I'm thinking that most cases of harassment (here and elsewhere) are
either a) not sufficiently notable (people being jerks without causing
too much grief), or b) so notable as to merit civil or criminal law
action.  Clearly there's not much for us to do about (b), and doing
much about (a) seems unwarranted.  No doubt there is also a class (c)
of jerks who won't stop being jerks, but they risk either escalating
to legal action territory ((b)), or being ostracized.

IMO for type (c) cases there is a lot to say for using social stigma,
because otherwise we're just politicizing everything.  But perhaps we
have too much of (c), in which case a formal mechanism for dealing
with harassment becomes desirable.  This is partly why I ask the above
question.

Or perhaps we're trying to avoid ever getting to where (c) is a
problem?  Perhaps we have new participants who are demonstrating
heretofore-unparalleled skill at being jerks?  Or perhaps this is a
tick-the-box exercise (because other comparable organizations are
doing this?).

Also, I'm +1 to Michael StJohn's question about ISOC and IETF trust
legal review.

Finally, we certainly have cases where discussions get heated and some
participants end up using the sort of language that would be a
behavior problem and which yet does not meet the definition of
harassment given in the I-D.  The remedy generally is for someone
(anyone, often WG chairs, ADs, but not necessarily) to warn them
privately.  If that works well enough (I think it does), then why
wouldn't that also work for harassment as defined in this I-D, and if
it doesn't work well enough, then is the scope of harassment here too
narrow?

I'd rather continue using the social tools at our disposal as long as
possible.  Once we have formal tools we'll have to use them, which
will make the IETF somewhat less pleasant a forum.  Our hand can
always be forced here, and you can see I'm curious as to whether
that's what's happened.

BTW, I have observed participants at the hotel bar using language that
I consider inflammatory but which they don't, and which one might
consider to fall into the definition given in the I-D but which others
might not.  A common example that might test the given definition is
disagreement as to whether sharp criticism of country A's policies is
distinguishable from (and therefore permissible) harassment based on
the ethnicity/religion/... of the people of country A.  I don't really
want to see an official body of the IETF become embroiled in deciding
such matters.  It's all unpleasant, and I'd rather participants kept
these opinions to themselves.  But it happens, and I've a feeling that
the Ombudsteam will become one of those highly politicized bodies, to
our collective detriment.  In the worst case I can see civil lawsuits
(e.g., defamation) resulting, which is one reason to want the lawyers
of the entities whose pockets might be affected to review this!

Nico
--

---

From: Michael StJohns <[email-masked]>
Date: Mon, 9 Mar 2015 16:42:52 -0400

It would be useful to distribute that written assessment from the insurance and liability folks to the list or at least publish it.  The questions they answered are not necessarily the right questions and a simple binary indication of "we're all good" absent context isn't really informative or meeting the general goals of transparency the IESG is supposed to be upholding.  

Later, Mike

And seriously, I asked this question months ago.  

Sent from my iPad

> On Mar 9, 2015, at 15:50, Jari Arkko <[email-masked]> wrote:
> 
> Hi Mike,
>

---

From: Nico Williams <[email-masked]>
Date: Mon, 9 Mar 2015 15:44:06 -0500

> For what it is worth, we’ve been told that there’s probably also (more) risk associated with not having this procedure in place :-)

That's probably difficult to estimate given the international reach of
the IETF (should counsel review the civil laws of... every country
from which we have participants or where the IETF meets? certainly
not).

I'm not sure that not having a procedure for dealing with harassment
as defined is sufficient to cause significant risk of civil lawsuits,
but certainly not handling complaints about such harassment could -and
very likely would- be.  This is probably justification enough for
having such a procedure, or at least for having one we can publish in
a hurry if we needed it.  (Perhaps that happened here?  I don't know.)

Nico
--

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 10 Mar 2015 10:00:07 +1300

> Have there been harassment cases in the IETF, using the definition

We'll never know, because there was no procedure in place to handle them.
I have certainly heard anonymous stories of unpleasant behaviour.

On 10/03/2015 09:42, Michael StJohns wrote:
> It would be useful to distribute that written assessment from the 
> insurance and liability folks to the list or at least publish it.

In general I am all for such transparency. But actually, I don't
think it would serve the IETF well in this case to publish the
analysis of hypothetical litigation - it would simply feed free
legal advice to hypothetical litigators.

    Brian

---

From: Nico Williams <[email-masked]>
Date: Mon, 9 Mar 2015 18:28:14 -0500

On Mon, Mar 9, 2015 at 6:27 PM, Sam Hartman <[email-masked]> wrote:
> Would specific examples help you understand the situation enough that
> it's worth bringing them up?

No, your word is enough for me, Sam.

Nico
--

---

From: Pete Resnick <[email-masked]>
Date: Mon, 9 Mar 2015 22:18:47 -0500

On 3/9/15 6:20 PM, Sam Hartman wrote:
>>>>>> "Pete" == Pete Resnick<[email-masked]>  writes:
>>>>>>              
>      Pete>  The short answer is that the IESG generally thought that
>      Pete>  "crossing the streams" was a bad idea. Imagine that we do get
>      Pete>  to the particular point of horror, that someone in leadership
>      Pete>  has harassed someone in such a way that the Ombudsteam
>      Pete>  concludes the only appropriate remedy is that they are unable
>      Pete>  to attend future meetings or participate in list discussions,
>      Pete>  *and* that person refused to resign their post. Even if they
>      Pete>  keep the fact of the harassment confidential and simply said,
>      Pete>  "I will be unable to attend meetings in the future for
>      Pete>  personal reasons, nor will I be able to participate in WG list
>      Pete>  discussions, but I still wish to remain as AD", that's really
>      Pete>  plenty enough impetus for a recall committee to be formed and
>      Pete>  remove the person from their post.
>
> OK, well, that seems kind of inconsistent with the current text that
> talks about recommending someone not be in a leadership position.
>    

The current (version -06) text does not talk about recommending someone 
not be in a leadership position. That text got removed after IESG 
Evaluation before approval.

> Also, there's another concern.  Imagine sexual harassment on the part of
> ADs in in-person interactions.
> [...]
> In some ways this approach forces the ombudsteam to exclude someone from
> a meeting rather than what might be a lesser penalty  of removing them
> from a leadership position.
> Do you want to force that?
>    

First of all, a remedy as "penalty" is addressed in Section 5.1. The 
*existence* of potential remedies can act as a deterrent, but the 
*imposition* of a remedy is "to try to make sure that the incident does 
not escalate and to ensure that a similar situation is unlikely to occur 
with the same Respondent in the future" and specifically "is not to be 
imposed for the purposes of retribution." Given that, and given that 
section 5 says quite clearly that the remedies are a range, and can be 
as simple as "discuss the situation with the Respondent and come up with 
a plan such that there is no repeat of the harassment", it's not clear 
to me that removing someone from a leadership position is a useful 
remedy, likely to prevent future incidents, that other remedies (less 
drastic than exclusion from meetings) would not more readily accomplish. 
So I don't see any way in which this "forces" the Ombudsteam to exclude.

> I think that most of my concerns would be addressed by adding a
> statement indicating that the ombudsteam SHOULD maintain a procedure
> explaining  how they resolve conflicts between the desire for
> confidentiality and the disclosures necessary to do their jobs.
>
> To me that statement accomplishes two things not present in the current
> text:
>
> 1) It acknowledges that there are such conflicts; I read the current
> text and I see a bunch of stuff about absolute confidentiality, with no
> acknowledgement that it can't quite be absolute.
>
> 2) Indicates where people can look to see current thinking on resolving
> the conflict.
>    

Section 4.1 requires the Ombudsteam to document its operational 
practices. Should something like this be needed, I would expect it to be 
a part of that documentation. You will also note that 4.1 says:

       In all cases the Ombudsteam will strive to maintain
       confidentiality for all parties including the very fact of contact
       with the Ombudsteam.

"Strive to maintain" not not seem to be about "absolute 
confidentiality", as you put it, so it's not clear what else needs to be 
acknowledged in the text.

pr

---

From: Stewart Bryant <[email-masked]>
Date: Tue, 10 Mar 2015 08:46:09 +0000

> In any case, after a discussion and feedback we revised some of the text in Section 2 and 5.1. From my perspective we are ready to move forward.
Jari,

In section 2 you have

    "race, gender, religion, age,
    color, national origin, ancestry, disability, sexual orientation, or
    gender identity."

If I look at the various lists I see in the EU, I see that you
have omitted:disability, marriage and civil partnership,pregnancy
and maternity, and gender reassignment. Why are these omitted?

Additionally it is common to see religion or belief rather
than just religion. I assume that this is to cover the case
of discrimination against non-believers.

Finally not in most lists but gaining traction is obesity
discrimination.

Whilst you have catch-all text, not including the complete set of
commonly agreed criteria risks the IETF presenting the image
that those forms of discrimination are somehow less important,
provides scope for aRespondent to escape appropriate sanction,
and may cause aReporter to be reluctant to put forward
a legitimate complaint in these regards.

- Stewart

---

From: Sam Hartman <[email-masked]>
Date: Mon, 09 Mar 2015 19:20:22 -0400

>>>>> "Pete" == Pete Resnick <[email-masked]> writes:

    Pete> On 3/9/15 3:14 PM, Jari Arkko wrote:
    >> we did discuss the leadership-as-respondent issues during IESG
    >> Evaluation, and we concluded keeping these procedures and recall
    >> separate was best. Pete or Adrian can give details if you're
    >> interested.

I really do find the current text deeply broken and don't think I
understand it well enough that I could reasonably participate in any of
the roles outlined by the process.  Which to me seems to be a fairly
major fairness issue.

Also, there's another concern.  Imagine sexual harassment on the part of
ADs in in-person interactions.
First, if you think that doesn't happen, I'll be happy to share specific
instances where I was the target of such harassment (without names of
course) so we can get a public discussion of the sorts of things that do
happen.
I don't think situations involving me were sufficient that someone
needed to be excluded, but others may have experienced more serious
situations.
In some ways this approach forces the ombudsteam to exclude someone from
a meeting rather than what might be a lesser penalty  of removing them
from a leadership position.
Do you want to force that?

Without something along these lines or a lot more work, I think this is
really very broken.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 09 Mar 2015 19:27:01 -0400

>>>>> "Nico" == Nico Williams <[email-masked]> writes:

    Nico> Have there been harassment cases in the IETF, using the
    Nico> definition given in the I-D?

    Nico> I'm thinking that most cases of harassment (here and
    Nico> elsewhere) are either a) not sufficiently notable (people
    Nico> being jerks without causing too much grief), or b) so notable
    Nico> as to merit civil or criminal law action.  Clearly there's not
    Nico> much for us to do about (b), and doing much about (a) seems
    Nico> unwarranted.  No doubt there is also a class (c) of jerks who
    Nico> won't stop being jerks, but they risk either escalating to
    Nico> legal action territory ((b)), or being ostracized.

Yes.  First, it's important for us to have a policy for dealing with
cases that also involve legal issues.  You can run into real liability
as an organization for not having internal procedures and forcing
everything to be legal.

However, I have experienced harassment and have heard stories where
legal action would be inappropriate but where remedies in section 5 of
the draft would be important.

---

From: James Woodyatt <[email-masked]>
Date: Tue, 10 Mar 2015 11:38:06 -0700

I'd like to second Mr. Bryant's general remarks, and ask that we diligently
recognize a more inclusive list of the forms of discrimination in this pass
so as to avoid the tiresome spectacle of litigating over amending the list
to be more inclusive later.

On the minor matter of possibly changing "religion" to "religion or belief"
I want to say that my preference— as someone whose inclusion seems to be
the intent of the change— is that we not do it. It's a slippery phrase, and
I don't like it. I can see why some other organizations might need it, but
I feel pretty confident that IETF is not, and will never be, the sort of
place where a clear distinction in the official text needs to be explicitly
recognized at the expense of economy of language. I would be sad to
discover that I'm wrong in that judgment.

On Tue, Mar 10, 2015 at 1:46 AM, Stewart Bryant <[email-masked]> wrote:

> have omitted: disability, marriage and civil partnership, pregnancy
> provides scope for a Respondent to escape appropriate sanction,
> and may cause a Reporter to be reluctant to put forward

-- 
james woodyatt <[email-masked]>
Nest Labs, Communications Engineering

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 10 Mar 2015 21:23:19 -0000

James, 
 
>From my perspective you have (while agreeing with Stewart) opened up exactly the problem we need/want to avoid. That is, Stewart has suggested an additional category to include in the list of forms of discrimination yet you would like to debate it.
 
The concern I have is that the potential list that Stewart has suggested is short compared to the list I could suggest. Yet each new addition could be open to lengthy debate (you'll notice that far more august bodies than ours burn very large numbers of hours debating these things, yet none comes up with an identical list).
 
What we intended to do with the list was:
- reference the IESG statement, but provide a definition in this document
- provide some examples, but not be definitive
- provide a catchall (viz. 
   Any definition of harassment prohibited by an applicable law can be
   subject to this set of procedures.)
 
There are two things to avoid:
 
1. Long discussions about what is and is not harassment in the formation of this document. We have given the Ombudsteam the scope for training and judgement: let them do their job.
 
2. Failure by omission. Suppose we make a longer and more comprehensive list: will we then describe that list as definitive? If we do, what happens to the thing we accidentally omit? Does that then become acceptable behaviour for some lawyer (or equally pedantically minded person)?
 
Hence, I am not convinced by either your argument or Stewart's, and continued consideration of the topic only seems to serve to make me more convinced that the current approach is right.
 
Thanks,
Adrian

From: ietf [mailto:[email-masked]] On Behalf Of James Woodyatt
Sent: 10 March 2015 18:38
To: [email-masked]
Cc: IETF Discussion List
Subject: Re: Last Call: <draft-farrresnickel-harassment-05.txt> (IETF Anti-Harassment Procedures) to Best Current Practice
 
I'd like to second Mr. Bryant's general remarks, and ask that we diligently recognize a more inclusive list of the forms of discrimination in this pass so as to avoid the tiresome spectacle of litigating over amending the list to be more inclusive later.
On the minor matter of possibly changing "religion" to "religion or belief" I want to say that my preference— as someone whose inclusion seems to be the intent of the change— is that we not do it. It's a slippery phrase, and I don't like it. I can see why some other organizations might need it, but I feel pretty confident that IETF is not, and will never be, the sort of place where a clear distinction in the official text needs to be explicitly recognized at the expense of economy of language. I would be sad to discover that I'm wrong in that judgment.

 

Jari

Jari,

In section 2 you have

 

- Stewart

---

From: Jari Arkko <[email-masked]>
Date: Tue, 10 Mar 2015 23:59:25 +0200

I wanted to say that I’m in agreement with Adrian on this. Ultimately,
no list will be complete, some judgment needs to apply, and I
think we’ve covered this in the text better than if we attempted
to expand the list.

(And I am, of course, in agreement with Stewart that things that
he lists are definitely important and certainly should not be misused
in any professional discussion.)

Jari

---

From: Jari Arkko <[email-masked]>
Date: Wed, 11 Mar 2015 00:03:33 +0200

Mike, Brian,

> legal advice to hypothetical litigators.

I have asked if we can provide a short statement about this,
while keeping in mind the concern that Brian correctly raises.
Stay tuned.

Jari

---

From: James Woodyatt <[email-masked]>
Date: Tue, 10 Mar 2015 15:28:21 -0700

I'm persuaded that further debate could do more harm than help, and I don't
want to open up further debate that would harm the effort to adopt a good
policy. I'm confident that an ombudsteam can use good judgment to be
sufficiently inclusive whatever the policy lists in the text.

---

From: Stewart Bryant <[email-masked]>
Date: Wed, 11 Mar 2015 09:45:27 +0000

Jari

I fail to see why the IETF which has no significant expertise
in this area has chosen to make up its own list rather than
using one put together by professionals.

I did not just think up those additional items, they are part
of a list that experts on the subject put together for
example:

http://www.legislation.gov.uk/ukpga/2010/15/contents

However given the degree on integration on this subject I
am sure it will align with EU position on the subject.
This is very much a case where we should use the more
encompassing list rather than an abbreviated one.

The most glaring omission from the IETF list is of course
disability.

- Stewart

---

From: Yoav Nir <[email-masked]>
Date: Wed, 11 Mar 2015 15:41:36 +0200

> On Mar 11, 2015, at 11:45 AM, Stewart Bryant <[email-masked]> wrote:
> 

This kind of list is always based on bad experience. Such lists never include blood type or hair color for the simple reason that these attributes have not been used as a basis for discrimination or harassment (dumb blonde jokes aside). 

This particular list is based on the experience in Europe, perhaps even more specifically in the UK. The experience within the IETF may be far different.

Is there age discrimination in the IETF? Does age need to be a protected characteristic? I could honestly ask the same question for most of the other characteristics in that list.On the other hand that list does not include characteristics such as employment and nationality that are very likely to come up in the IETF.

We’ve had a call to remove a chair in the IRTF based on his employer last year, and people are often judged based on how “cool” their employer is (Google and Cisco are cool. Microsoft? Not so much) as well as based on their country (Russia is not cool right now. Finland always is)

So I don’t think that list is appropriate for us.

Yoav

---

From: Randy Bush <[email-masked]>
Date: Wed, 11 Mar 2015 22:56:12 +0900

> Such lists never include blood type 

http://en.wikipedia.org/wiki/Blood_types_in_Japanese_culture

---

From: Stewart Bryant <[email-masked]>
Date: Wed, 11 Mar 2015 17:21:50 +0000

> This particular list is based on the experience in Europe, perhaps even more specifically in the UK. The experience within the IETF may be far different.
I would be interested to know which countries have a reduced list 
because of intrinsically better behavior as opposed to the enshrinement 
of unacceptable behavior into law? The point about the characteristics 
is that they are fundamentally human and thus highly likely to be 
applicable.
>
> Is there age discrimination in the IETF? Does age need to be a protected characteristic?
Now that is a really interesting question isn't it. I suspect that there 
is and thus it does.

> I could honestly ask the same question for most of the other characteristics in that list.On the other hand that list does not include characteristics such as employment and nationality that are very likely to come up in the IETF.
>
I have no objection to the lengthening of the list, although I note that 
at one level employer discrimination is fundamental to our operation in 
that we often decline someone who might be the better chair or AD on 
affiliation grounds in order to achieve an affiliation balance.
> So I don’t think that list is appropriate for us.
Well note that many of those items are actually on the list already, and 
to list one that is  not, but which I explicitly raised, there is the 
issue of disability discrimination and I do not see how that can be 
tolerated?

- Stewart

---

From: "Adrian Farrel" <[email-masked]>
Date: Wed, 11 Mar 2015 17:30:35 -0000

Stewart, I do wish you would reference the document before launching into your
critique.

There is nothing in this document that constitutes the IETF making up "its own
list".

The text of the document, makes an observation about the IESG statement at
http://www.ietf.org/iesg/statement/ietf-anti-harassment-policy.html.
This statement was made on 2nd November 2013 while you were serving on the IESG.

The text then says that the document "adopts the general definition, but does
not attempt to further precisely define behavior that falls under the set of
procedures..."

In other word, this document does not provide a list of categories that maybe
considered grounds for harassment. So your assertion is not founded.

I understand that you have good reason to believe that the list at
http://www.legislation.gov.uk/ukpga/2010/15/contents is well considered and
reasonable. People coming from other cultures might consider it missing many
categories while others might consider some of the categories it includes to be
outrageous! 

Unless we are going to build a full and water-tight definition of harassment and
obtain IEFT consensus on it *before* adopting any anti-harassment processes and
appointing a team to handle any complaints, I suggest we need to move ahead with
the document as it is. Personally, I would be pleasantly surprised if a body as
culturally diverse (and opinionated) as the IETF could come to consensus on such
a definition in any short period of time given (as you note) the IETF "has no
significant expertise in this area."

Perhaps a way forward here would be for us to all support this document and for
a further document to attempt to give a more precise definition as advice and
guidance to the Ombudsteam. If you would like to start a draft on that and run
it through the consensus process, we might all benefit from it.

Best,
Adrian

---

From: Pete Resnick <[email-masked]>
Date: Thu, 12 Mar 2015 07:10:58 -0700

On 3/12/15 6:08 AM, Sam Hartman wrote:
> Hi.
> I wanted to follow up after some off-list discussions with Pete.  I do
> not mean to imply that Pete agrees with these issues; we discussed some
> ways of addressing them below, and I give Pete credit for ideas that are
> his.  However, Pete did not express an opinion about whether I had
> identified issues that required resolution, simply worked to find
> solutions.
> Thanks for a really helpful discussion.
>    

We did have a really good discussion. Unfortunately, we didn't get to 
complete that discussion, so there were a couple of points that remain 
outstanding below that I think are some basic misses. Hopefully they can 
be addressed straightforwardly.

There are two basic issues: Confidentiality, and removal from offices.

On confidentiality:

> the first
> relates to confidentiality and both Pete and I believe this is easy to
> address.
>    

We do, which is why I find:

> I think the text about confidentiality is highly problematic.

A bit of a weird thing to say. Sam's concern really comes down to 
softening "strict confidence" to something like "as strict confidence as 
practically possible" and adding a single line:

> So, I propose that  the list of items that the ombudsteam needs to
> document in their procedures should be expanded to include "Description
> of the current thinking of when disclosures of confidential information
> are made in the process and to whom."
>
> I'm sure the wording can be improved.
>    

I don't think that changes the intent of the document at all, and I'm 
comfortable (it's up to Jari) to add that during AUTH48 or as an RFC 
Editor Note.

So I think this one is straightforward.

As for the second issue, I think there's a basic piece that's missing in 
Sam's analysis, which we didn't get a chance to talk about offline:

> When I heard that the IESG added text saying that the ombudsteam cannot
> remove a leader, I felt a great anger.  How could they do that?

The IESG *didn't* do that. Your premise is incorrect. The text that says 
that the ombudsteam cannot remove a leader has been in there since -03 
due to public discussions. That bit was agreed to long ago and it has 
not been changed. What got changed during IESG Evaluation was to 
eliminate the one piece of text that said that the ombudsteam can 
*recommend* removal. The IESG did that because it was realized that the 
Ombudsteam *couldn't* recommend removal without revealing confidential 
information.

I'm not inclined to respond to the rest of Sam's comment here, since I 
think the issue that he bases it on does not exist. I don't think that 
at this point, after Last Call and after IESG Evaluation, this issue 
should be re-opened unless Sam feels that the change the IESG made 
(i.e., the removal of the idea that the Ombudsteam can recommend 
removal) changes the whole intent in such a way that it must be 
re-visited. That's between Sam and Jari. But I think the bigger concerns 
that Sam brings up simply don't apply here.

As Sam said, we ran out of time when we were chatting offline. I'll try 
to get back with him and see if we can determine what, if any, issues 
remain and hopefully we can bring some shared understanding to the list.

pr

---

From: Jari Arkko <[email-masked]>
Date: Thu, 12 Mar 2015 16:34:15 +0200

Sam,

Cutting to the 2nd item, i.e., what effect the ombudsteam might have on leadership.

I understand your concern Sam. Do you have a suggestion on how that should be addressed? As an aside, I think we all agree that leadership that misbehaves needs to be removed. The debate is about the mechanics - whether those indirect through effects of action from the ombudsteam, indirect via their recommendation, or more direct.

jari

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 12 Mar 2015 10:01:38 -0500

Sam,

On Mar 12, 2015 9:34 AM, "Jari Arkko" <[email-masked]> wrote:
> I understand your concern Sam. Do you have a suggestion on how that
should be addressed? As an aside, I think we all agree that leadership that
misbehaves needs to be removed. The debate is about the mechanics - whether
those indirect through effects of action from the ombudsteam, indirect via
their recommendation, or more direct.

I just wanted to confirm that the IESG talked about the "recommendation to
remove" seriously, and IIRC, we couldn't figure out WHO the Ombudsteam
would make a recommendation to, much less what they might say.

It seemed cleaner to me, to say "the community already has an
IETF-consensus way to remove anyone in I-star leadership using a recall,
why not use that, instead of coming up with some other mechanism after IETF
Last Call?"

I am open to the possibility that this was the wrong answer. I've been
wrong before.

I look forward to understanding what people think better than I do today.

Spencer

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 12 Mar 2015 15:10:32 +0000

> I look forward to understanding what people think better than I do today.

FWIW, I think we made the correct call in terms of keeping two
different bits of process (ombudsteam and recalls) separated,
but also accept that that might look entirely wrong to those
outside the IESG, and I think we should take Sam's concern
seriously as input on that.

So better wording would be good, and if that needs another LC
to get community input on it, then that's ok too if we can
constrain that additional LC to the things that have changed.

S.

PS: I've yet to properly read Dave's review, so not sure if
there's stuff there that needs to be similarly addressed.

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 12 Mar 2015 10:13:52 -0500

> seriously as input on that.

Exactly. And said better than I tried to say it.

---

From: Sam Hartman <[email-masked]>
Date: Thu, 12 Mar 2015 09:08:58 -0400

Hi.

First, I'm really happy that the IETF is  doing this work.  I hope to
work in an IETF that takes a strong stand against harassment (and as
Dave points out bullying).  I believe the general approach in this draft
is sound, and I am happy thinking about that basic approach.

However, reading this draft, I'm filled with sadness, disappointment and
worry when I think about some of the details.  I do not think this draft
is ready and I think we have some more work to do.  I don't support the
idea that what we have is good enough and we should run with it and
incrementally improve later.  Also, after reading Dave Crocker's review
and discussing with him off-list, I think he has points that critically
need to be considered.  In particular, Dave's point about distinguishing
interpersonal difficulty from harassment and not focusing on asking
subjects to act differently in the case of harassment seems important.

Here are my specific concerns restated.  I have two concerns; the first
relates to confidentiality and both Pete and I believe this is easy to
address.  The second is likely to get a very strong emotional reaction,
so  I'll put it at the end.

I think the text about confidentiality is highly problematic.  We all
seem to agree that their are tradeoffs between confidentiality and
getting a job done.  As an example, everyone I've talked to seems to
agree that when a detailed investigation takes place, the respondent is
going to find out that some report is made.

If I were going to participate in this process, I would want to better
understand what information would be disclosed to whom.  At what point
in the process is the respondent likely to find out?  Will they find out
the identity of the reporter?  The subject?  Many similar questions
exist.  I don't expect this document to answer these questions.  I think
the ombudsteam has an obligation to answer these questions and failure
to write down answers to the questions means the process is very unfair.
Whether I want to report or disclose information may depend on who will
learn that information. 
So, I propose that  the list of items that the ombudsteam needs to
document in their procedures should be expanded to include "Description
of the current thinking of when disclosures of confidential information
are made in the process and to whom."

In addition, " All information brought to the Ombudsteam shall be kept
in strict confidence." is too strong.  The later sentence about striving
for confidentiality is more accurate and believable.
Pete seemed to believe that the above sentence might be intended to be
scoped to some narrow purpose.  It needs to be changed in some way.

----------------------------------------

When I heard that the IESG added text saying that the ombudsteam cannot
remove a leader, I felt a great anger.  How could they do that?  I
explored that feeling and realized that I was deeply disappointed, sad
and afraid.  I hoped that our leadership would commit to holding
themselves to high standard and would be committed to resolving problems
when our leaders engage in harassing behavior.

However, what I hear when I read that change is the IESG has decided to
exclude itself and its appointments of working group chairs from review
of the ombudsteam.  On knowledge and belief, I assert that that IESG
members have engaged in harassing behavior over the years and there are
ongoing problems involving working group chairs.  I'm relieved
that I personally have not been subjected to behavior for which removal
from a leadership position would be an appropriate remedy.  However,
given that harassment does happen within our leadership, it seems likely
that removal will sometimes be the right approach.

I suspect the IESG intends me to hear something else.  Pete says that is
the case.
That doesn't matter; the statement is so loud that anything you may have
tried to say is lost in the shouting of my emotional reaction.  The IESG
had a chance to embrace the idea that our leadership is accountable and
chose for whatever reason to step away from it.  I've asked others to
review the change and the reaction I got was a strong negative emotional
reaction that the IESG would not support a viable mechanism for removing
a leader.

Pete proposes that the ombudsteam could effectively exclude a leader by
preventing them from attending meetings.  There's nothing in the
document that suggests this is how to remove a leader.  If I were
subjected to that remedy, I'd make an appeal that the ombudsteam had
taken on power specifically denied to them by trying to remove me from
my leadership position.  I suspect some ombudsteam members will be
uncomfortable given the language in the document trying to effectively
remove a leader.

The emotional effect on subjects and reporters who read this
document and find their need for a chance at redress is denied is huge.
I am in the strongest possible disagreement with this text and the
process that lead to it.

The IESG is highly conflicted with regard to the question of remedies
applied to IETF leadership.  Having such a remedy be removed as a
decision taken by the IESG is entirely inappropriate.  Yes, the previous
text was broken, and the document couldn't have been approved with it
present.  However, the IESG took on the decision of whether to fix the
text or remove it themselves.  The IESG decided to replace that text
with a positive statement denying the ombudsteam the ability to remove
leaders.  Even if you intended something else, the IESG took an
affirmative stand that partially exempts our leadership from the
anti-harassment process.

I believe this issue must be fixed in the document.  I believe the IESG
has a significant conflict-of-interest with regard to this issue and has
displayed a lack of sensitivity to that conflict in the process it has
used to date.  I request the IESG be sensitive to this conflict and
adopt a procedure that might be even more sensitive to the issue than
usual because it has already displayed a lack of sensitivity.

With regard to the specific question of how do you provide a way to
address leaders that need removal, Pete and I tried to brainstorm
solutions.  However we ran out of time because I needed to run off to
another meeting.

---

From: Sam Hartman <[email-masked]>
Date: Thu, 12 Mar 2015 10:20:46 -0400

>>>>> "Pete" == Pete Resnick <[email-masked]> writes:

    Pete> So I think this one is straightforward.

Agreed.

    Pete> As for the second issue, I think there's a basic piece that's
    Pete> missing in Sam's analysis, which we didn't get a chance to
    Pete> talk about offline:

    >> When I heard that the IESG added text saying that the ombudsteam
    >> cannot remove a leader, I felt a great anger.  How could they do
    >> that?

    Pete> The IESG *didn't* do that. Your premise is incorrect. The text
    Pete> that says that the ombudsteam cannot remove a leader has been
    Pete> in there since -03 due to public discussions. That bit was
    Pete> agreed to long ago and it has not been changed. What got
    Pete> changed during IESG Evaluation was to eliminate the one piece
    Pete> of text that said that the ombudsteam can *recommend*
    Pete> removal. The IESG did that because it was realized that the
    Pete> Ombudsteam *couldn't* recommend removal without revealing
    Pete> confidential information.

I read and reviewed 05 as a document that intended to have a plausible
way forward for removing leaders.  The IESG alone changed that to a
statement that leaders cannot be removed.

I'm sorry I did not clearly state my concern, but that transition from a
document that tries to support removing leaders but has a buggy
mechanism to one that does not support leaders has all the problems I
describe.

More over, the inability to remove leaders seems to be a inadequacy of
the procedures in the sense of RFC 2026 6.5.1 and 6.5.3.
This message is not any sort of formal process; it is simply a posting
to the ietf list.
However, my disagreement is that strong.

---

From: Nico Williams <[email-masked]>
Date: Thu, 12 Mar 2015 22:05:39 -0500

> subjects to act differently in the case of harassment seems important.

Yes, this.  Harassment is the sort of thing that's difficult to be
objective about in every case.  I hope we don't formalize this too
much, else it will be too easy to ostracize good people who
unintentionally offended someone.

Regarding confidentiality, I'll simply point out that at the limit,
when a legal process is involved and discovery is triggered (and
testimony) there is no confidentiality.  We shouldn't promise that
which we can't deliver.  This should be pretty obvious, I'd think.

As to removal, as long as there is a process for removal, whether the
ombusteam itself decides it or not is not that important to me.

Cheers,

Nico
--

---

From: Stewart Bryant <[email-masked]>
Date: Fri, 13 Mar 2015 11:40:12 +0000

> This statement was made on 2nd November 2013 while you were serving on the IESG.
Not withstanding that, my position is and always was that the IETF is not
a competent body when it comes to compiling this list and that we should
use a list, or perhaps the union of a number of lists, compiled by those
with the expertise.

The alternative risks creating very messy loopholes.
> categories while others might consider some of the categories it includes to be
Indeed that is a concern, and there is no way around asserting the set. Any
other approach risks a dispute of the form "but that is permitted (or maybe
even required) in my culture".
> it through the consensus process, we might all benefit from it.
Another way is to look at how other multi-national multi-cultural 
organizations
address this. For example what is the UN (i.e. ITU, UNHCR ... ) policy 
in this
regard?

- Stewart

---

From: Pete Resnick <[email-masked]>
Date: Fri, 13 Mar 2015 14:04:04 -0700

Speaking only for myself:

On 3/13/15 12:34 PM, Sam Hartman wrote:
> old:
> (The Ombudsteam can not impose that a Respondent
>        who is in a IETF management position be removed from that
>        position.  There are existing mechanisms within IETF process for
>        the removal of people from IETF management positions that may be
>        used as necessary.)
>
> new:
> The Ombudsteam MAY ask a respondent to consider resigning from an IETF
> management position.  The Ombudsteam May remove a respondent from a
> working group  or document editor position.  While this document does
> not create additional procedures permitting a nomcom appointee be
> removed, the Ombudsteam can exclude a respondent from meetings and
> mailing lists and other activities, making it impossible for them to
> carry out their appointed tasks.
>    

- With regard to NomCom appointed positions, this is just fine, and in 
fact what the current text intended, while making it perfectly clear 
what was intended.

- I am ambivalent about the Ombudsteam being able to remove someone from 
a WG (editor/secretary/chair) position. While it certainly doesn't get 
into the morass that we do with NomCom-appointed positions, it seems to 
me that it's still a bit of "crossing-the-streams", and as far as I can 
tell the same kinds of things that can be done for NomCom-appointed 
positions (ask them to consider resigning their position, exclusion from 
meetings / mailing lists, etc.) would have equal effectiveness. So, I'm 
not sure it's necessary. But as I said, I'm ambivalent.

As for the thought experiment on how a recall might go after such an 
incident: I am certainly more sanguine than Sam. Presuming an incident 
where the Ombudsteam decides that an AD can no longer participate in 
meetings and mailing lists (already I would hope a *highly* unusual 
circumstance) *and* the AD goes haywire and refuses to relinquish their 
title (even more unlikely) *and* the "two sides" try to get their 
friends on the recall committee, *and* these supposed friends agree to 
participate in such a thing (I have a hard time imagining any of the 
people I know in the IETF being willing to do so), we still have the 
case that the (hopefully sane) ISOC-President-appointed recall committee 
chair is going to tell the committee, "Look, we are not deciding whether 
this person can start participating in meetings or on mailing lists 
again. They can't and that's not going to change. The only question is 
whether they get to keep their office in light of that fact." If at that 
(almost unimaginable) point a sufficient number of people on the recall 
committee are willing to be so destructive to the IETF that they are 
willing to participate in leaving the person in the position, I think 
I'm willing to live with the IETF going *boom*.

pr

---

From: Spencer Dawkins <[email-masked]>
Date: Fri, 13 Mar 2015 20:39:22 -0500

> Speaking only for myself: 

Oh, yes. Spencer is also speaking only for myself.

> fact what the current text intended, while making it perfectly clear 

I don't strongly object to the "MAY ask a respondent to consider 
resigning", although I'm somewhat on the fence between

- If that's the right thing to do, I'd hope the Ombudsteam would do the 
right thing, whether the procedures included this MAY or not, and

- I'm not getting how involved the community expects the Ombudsteam to 
be in repairing the situation.

I agree with Pete that the rest of the text is more clearly saying what 
I thought the text said.

> - I am ambivalent about the Ombudsteam being able to remove someone 
> from a WG (editor/secretary/chair) position. While it certainly 
> doesn't get into the morass that we do with NomCom-appointed 
> positions, it seems to me that it's still a bit of 
> "crossing-the-streams", and as far as I can tell the same kinds of 
> things that can be done for NomCom-appointed positions (ask them to 
> consider resigning their position, exclusion from meetings / mailing 
> lists, etc.) would have equal effectiveness. So, I'm not sure it's 
> necessary. But as I said, I'm ambivalent. 

I don't actually know much about what ferresnickel talked about that 
didn't make it into the draft and subsequent discussion within the IESG, 
but the discussion I was involved in was focused more on excluding from 
meetings than from mailing lists, and we noted that the IETF actually 
has running code experience with ADs who aren't able to attend multiple 
IETF meetings in a row, and Nomcoms returned at least one AD in that 
situation for another term.

If the community thinks that if you're excluded from meetings, you're 
also excluded from mailing lists, that's pretty much fatal for any IETF 
management position I've ever served in (WG draft editor, WG chair, IAB 
member, and AD). So, that's definitely worth discussing.

And yeah, we spent more time trying to figure out what to do with Nomcom 
appointed positions than with anything else, so definitely worth discussing.

> circumstance) *and* the AD goes haywire and refuses to relinquish 
> their title (even more unlikely) *and* the "two sides" try to get 
> their friends on the recall committee, *and* these supposed friends 
> agree to participate in such a thing (I have a hard time imagining any 
> of the people I know in the IETF being willing to do so), we still 
> have the case that the (hopefully sane) ISOC-President-appointed 
> recall committee chair is going to tell the committee, "Look, we are 
> not deciding whether this person can start participating in meetings 
> or on mailing lists again. They can't and that's not going to change. 
> The only question is whether they get to keep their office in light of 
> that fact." If at that (almost unimaginable) point a sufficient number 
> of people on the recall committee are willing to be so destructive to 
> the IETF that they are willing to participate in leaving the person in 
> the position, I think I'm willing to live with the IETF going *boom*.

So, confidentiality ...

If an AD who has been excluded from meetings says "I won't be in Dallas 
for personal reasons", unless the AD lives 2.6 miles from the IETF 
meeting hotel (this time, I do), maintaining confidentiality is fairly 
realistic.

If we're talking about excluding ADs from mailing lists, we've lost 
that. ADs who can't send e-mail to the IESG mailing list would be 
fabulously visible to the rest of the IESG. ADs cc: a lot of mailing 
lists on almost everything we engage in, and if every WG chair has to 
forward my comments and discuss ballots on every draft because I'm 
excluded from their mailing lists ... done.

At least, that's the way it looks to me, speaking only for myself.

Spencer

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 14 Mar 2015 17:34:01 +1300

On 14/03/2015 14:39, Spencer Dawkins wrote:

...
> If the community thinks that if you're excluded from meetings, you're also excluded from mailing lists, that's pretty much fatal
> for any IETF management position I've ever served in (WG draft editor, WG chair, IAB member, and AD). So, that's definitely
> worth discussing.

I think it is necessary to treat these two things as orthogonal. If someone
has been misbehaving in personal dealings with one or more individuals,
that is very different from misbehaving in public on a mailing list. So I
don't see why sanctions intended to prevent* face-to-face personal
dealings would naturally carry over into sanctions that prevent public
mailing list misbehaviour. Also, we already have the latter, and running
code to show that they are implementable (unlike the recall procedure).

*The draft states that the "purpose of the anti-harassment policy is to
prevent all incidents of harassment in the IETF... any remedy is imposed
to try to make sure that the incident does not escalate and to ensure that a
similar situation is unlikely to occur with the same Respondent in the future."

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 14 Mar 2015 17:54:58 +1300

I just noticed that the draft uses the phrase "IETF management position"
without defining it. I think that is in itself a bug.

Does it mean "a position which under the rules of BCP10 is
potentially subject to a Recall"?

Or does it also include people appointed by ADs (WG chairs
and secretaries, Directorate members)?

This needs to be clarified. And they are two very different cases.

For the AD appointees, common logic would suggest that the Ombudsteam
be allowed (not obliged) to inform the AD, in confidence of course.

For the recallable positions, the situation is much more tricky
because a recall petition needs 20 signatories and is announced.
Let's get real : if that happens, the confidentiality *will* be
breached.

   Brian

---

From: joel jaeggli <[email-masked]>
Date: Sat, 14 Mar 2015 10:06:58 -0700

> Let's get real : if that happens, the confidentiality *will* be

I don't think we can know that a priori.

Our previous experiment with the recall process involved unavailability,
not some causal condition. I don't think there's particular merit in
spelling out how a recall will be iniatiated, as that is dictated by
circumstances and the power to do is vested in nomcom qualified individuals

   At any time, at least 20 members of the IETF community, who are
   qualified to be voting members of a nominating committee, may request
   by signed petition (email is acceptable) to the Internet Society
   President the recall of any sitting IAB, IAOC, or IESG member.

...

   The petition must include a statement of justification for the recall
   and all relevant and appropriate supporting documentation.

---

From: John C Klensin <[email-masked]>
Date: Sat, 14 Mar 2015 14:54:36 -0400

--On Saturday, March 14, 2015 10:06 -0700 joel jaeggli
<[email-masked]> wrote:

>> For the recallable positions, the situation is much more
>> tricky because a recall petition needs 20 signatories and is
>> announced. Let's get real : if that happens, the
>> confidentiality *will* be breached.
> 
> Our previous experiment with the recall process involved
> unavailability, not some causal condition. I don't think
> there's particular merit in spelling out how a recall will be
> iniatiated, as that is dictated by circumstances and the power
> to do is vested in nomcom qualified individuals

Joel,

First, we've had no previous experience with the "recall
process".  The example I assure you are referring to was one in
which commitments to sign had been collected and it was clear
that the recall process would be initiated if the individual
involved did not resign, but he did.   I'm aware of another case
or two in which it was made clear to the person involved that
signature commitments were being collected and that led to a
change in behavior and/or a resignation.  At no point was the
ISOC President handed petitions and asked to hand them to the
Secretariat for verification and to appoint a Recall Committee
Chair. 

More important to Brian's point about confidentiality, you
didn't read quite far enough.  The paragraph immediately after
the one you quoted (from RFC 7437) reads:

	"The petition and its signatories must be announced to
	the IETF community."
	
Since the petition has to disclose the justification for the
recall and that petition has to be announced, confidentiality
about the target and the issue is, as far as I can tell, public
at that point.  Whether the situation can be kept private during
the signature-gathering process is an issue of things that can
be kept secret at the earlier stage if 20 people with no
obligation of secrecy know about it is interesting, but not
ultimately important.   I suppose the Secretariat could
"announce" the petition by saying "Lo, a petition has been
received and here are the people who signed it" without
disclosing either the target name or the justification, but I'd
guess the community would have a lot of trouble with that.  At a
minimum, I'd assume there would be an immediate effort to find
out who gave the Secretariat those instructions followed by an
appeal.

So, referring back to my earlier note, the recall process lacks
confidentiality about what is going on (although not about the
Recall Committee's investigation once it starts), is guaranteed
to be slow enough to cause damage to the community and the
successful functioning of the IESG, and generally is not
appropriate (at least without modification) to a situation in
which the Ombudsteam has already investigated the situation,
found that there was a problem, tried to cure the problem
through discussion and counseling, concluded that it has failed,
and concluded that significant restrictions or removal from a
position are appropriate.

best,
    john

---

From: joel jaeggli <[email-masked]>
Date: Sat, 14 Mar 2015 12:07:55 -0700

On 3/14/15 11:54 AM, John C Klensin wrote:
> involved did not resign, but he did.

You are incorrect, the process was initiated.

http://www.ietf.org/mail-archive/web/ietf-announce/current/msg10887.html

It was not necessary for it to run to completion.

...

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 15 Mar 2015 08:08:36 +1300

Sam,

On 15/03/2015 05:12, Sam Hartman wrote:
>>>>>> "Brian" == Brian E Carpenter <[email-masked]> writes:
> 
>     Brian> On 14/03/2015 14:39, Spencer Dawkins wrote:
>     Brian> ...
>     >> If the community thinks that if you're excluded from meetings,
>     >> you're also excluded from mailing lists, that's pretty much fatal
>     >> for any IETF management position I've ever served in (WG draft
>     >> editor, WG chair, IAB member, and AD). So, that's definitely
>     >> worth discussing.
> 
>     Brian> I think it is necessary to treat these two things as
>     Brian> orthogonal. If someone has been misbehaving in personal
>     Brian> dealings with one or more individuals, that is very different
>     Brian> from misbehaving in public on a mailing list. So I don't see
>     Brian> why sanctions intended to prevent* face-to-face personal
>     Brian> dealings would naturally carry over into sanctions that
>     Brian> prevent public mailing list misbehaviour. Also, we already
>     Brian> have the latter, and running code to show that they are
>     Brian> implementable (unlike the recall procedure).
> 
> Under your reading of 06, does the Ombudsteam have the ability to
> exclude someone from a mailing list?

I think they do, because of the following text:

      At the other end of the spectrum the Ombudsteam could decide that
      the Respondent is no longer permitted to participate in a
      particular IETF activity, for example,...

Exclusion from meetings is only given as an example, so exclusion from
mailing lists is not ruled out. All I'm saying is that it's orthogonal
to meetings. Since "a remedy is not to be imposed for the purposes of
retribution" it should presumably not be imposed if it's irrelevant to
the misbehaviour.

   Brian

---

From: John C Klensin <[email-masked]>
Date: Sat, 14 Mar 2015 17:28:33 -0400

--On Saturday, March 14, 2015 12:07 -0700 joel jaeggli
<[email-masked]> wrote:

>> process".  The example I assure you are referring to was one
>> in which commitments to sign had been collected and it was
>> clear that the recall process would be initiated if the
>> individual involved did not resign, but he did.
> 

You are correct.  My apologies.  It was, as I think you pointed
out, never fully initiated to remove someone for bad behavior or
malfeasance.

The main point of my note, however, remains that the recall
process --at least past the point of the Secretariat approving
petitions and announcing the petition and signer-- is
inconsistent with claims of confidentiality.

    john

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Sun, 15 Mar 2015 05:17:43 +0000

> On Mar 13, 2015, at 9:54 PM, Brian E Carpenter <[email-masked]> wrote:
> 

Hmm. AFAIK, a WG secretary is appointed by the chair, not the AD, or at least not necessarily the AD. And we could discuss, if we really wanted to descend into the pit of despair, scribes...

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 16 Mar 2015 08:07:31 +1300

> Hmm. AFAIK, a WG secretary is appointed by the chair, not the AD, or at least not necessarily the AD. And we could discuss, if we really wanted to descend into the pit of despair, scribes...

Actually, RFC 2418 leaves it unclear who appoints a WG Secretary. I think
it's been common for WG Chairs to get an OK from the AD, at least. But your
point is taken: what needs clarifying is whether the term "management position"
includes all appointees, as well as positions filled by the NomCom.

   Brian

---

From: joel jaeggli <[email-masked]>
Date: Sun, 15 Mar 2015 12:45:51 -0700

> includes all appointees, as well as positions filled by the NomCom.

The transitive property of chairs serving at the discretion of the AD
makes the question of downstream appointment authority moot.

...
   The Area
   Director must agree to the specific people performing the WG Chair,
   and Working Group Consultant roles, and they serve at the discretion
   of the Area Director.
...

---

From: Dave Crocker <[email-masked]>
Date: Sun, 15 Mar 2015 13:08:04 -0700

On 3/15/2015 12:07 PM, Brian E Carpenter wrote:
> Actually, RFC 2418 leaves it unclear who appoints a WG Secretary.

Ralph Droms and I recently undertook to bring RFC2418 up to current IETF
practices.

It surfaced a number of questions that we couldn't answer, such as the
above.

The draft was just issued as an I-D:

     http://datatracker.ietf.org/doc/draft-crocker-rfc2418bis-wgguidelines/

Folk will note a rather large number of listed Open Issues.  These will
need resolution by the community.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Dave Crocker <[email-masked]>
Date: Sun, 15 Mar 2015 13:18:59 -0700

> Ralph Droms and I recently undertook to bring RFC2418 up to current IETF

To save further folk time and effort trying to compare RFC2418 with
draft--2418bis:

   0.  The document cites the 'nature' of the changes it made.  There is
no intent -- and I believe no content -- that changes any existing
practice; to the contrary the intent was to better document current
practice.

   1.  In textual terms, changes to the document are massive.  A diff
isn't possible.

   2.  No, I didn't maintain a log of specific changes.  Yes, that means
the document requires a completely fresh read.

   3.  The approach in making the changes had these goals:

   *  The previous document has a bunch of IETF tutorial material, as
background to the document's substance.  There is now more and maybe
better text the IETF uses.  We've replaced such text with pointers to
the other web pages and documents.

   *  The document expands upon various common and/or desirable
practices that are established in the IETF but possibly not treated as
thoroughly in the previous version.

   *  The document moves things around quite a bit, so that a newbie can
learn the meat of working group operation, separate from the surrounding
IETF formalities (bureaucracy). The intent is for the document to
function better both as introduction and for reference.

   *  The document adds information, such as pointers to new tools and
documents, that have become integrated into working group life.

   *  The document draws a line between what is formally required,
versus what is common or otherwise permitted.  So it teaches a 'core'
and then quite a few 'options'.

---

From: Sam Hartman <[email-masked]>
Date: Fri, 13 Mar 2015 15:34:47 -0400

>>>>> "Jari" == Jari Arkko <[email-masked]> writes:

    Jari> Sam, Cutting to the 2nd item, i.e., what effect the ombudsteam
    Jari> might have on leadership.

    Jari> I understand your concern Sam. Do you have a suggestion on how
    Jari> that should be addressed? As an aside, I think we all agree
    Jari> that leadership that misbehaves needs to be removed. The
    Jari> debate is about the mechanics - whether those indirect through
    Jari> effects of action from the ombudsteam, indirect via their
    Jari> recommendation, or more direct.

OK.  So my understanding is that you believe that we have consensus that
leadership that harasses need to be able to be removed, but we don't
have a workable solution and we don't want to block the current effort
on that.

If so, let's find a clean way of deferring that, and see if we can get
people interested in working on the problem and coming up with a
proposal.

I'd like to take a stab to see if I understand what we do have consensus
on:

old:

new:

Rationale  for the above:

I think we should split handling of chairs and wg-level positions from nomcom stuff.
The discussion to date seems to have focused on nomcom-level
appointments, and we apparently don't have consensus to make changes to
that in this document.
However, I think we should carefully ask ourselves how we handle chair
harassment.
Recommending to the AD seems like the wrong approach.  The AD isn't
going to be in a position  to know the facts, the AD is not going to be
trained in harassment.  As a manager I've sometimes been told by HR that
I had to take certain actions; sometimes I agreed, sometimes I wished I
had other options.  However, sometimes the interest of (in that case the
company, in this case the IETF) to avoid harassment are more important
than an individual manager's preference.
So, I'd like to float the idea that the Ombudsteam is in the best
position to make harassment-related removals at that level.

I've removed the sentence saying that the Ombudsteam cannot make
leadership removals because it's too easy to read that as an affirmative
statement against leadership removals.  Instead, I've floated a specific
instantiation of the idea that the Ombudsteam does have the power to
make it impossible for a leader to do their job.  I think it's important
to confirm we have consensus on this point.  It would be a huge mess for
the Ombudsteam to try and do that and to discover we didn't have
community support for that.  In effect I'm arguing that it's important
enough to make sure we're on the same page here that we float specific
text for this issue and confirm it doesn't attract unresolvable
objections.  Pete has said on-list and in private discussions that he
believes their is support for the Ombudsteam choosing remedies like
this.

I've removed the sentence talking about the existing procedures for
removal.  To respond to Stephen, Spencer and Nico, our existing recall
procedure is entirely inadequate to the task.

Let's have a thought exercise.

First, we have a confidentiality problem.  It's unclear how the
Ombudsteam even gets in the position to say something leading to a
recall petition.  Let's imagine that somehow they get consent from the
subject (and decide they don't need consent from the respondent) and
make a statement like "We, the Ombudsteam assembled do hereby request
and implore the community to recall Sam Hartman for harassment related
reasons."

Imagine what happens next.  We have a flame fest where some people are
demanding more information so they can evaluate whether to sign the
recall petition, and others debate my qualifications in public.  We've
had a recall petition in recent memory.  Even in a situation where there
was strong agreement that the leader was not performing the job, it was
difficult to get signatures.  I claim this situation would be worse.
I'd be speaking up saying that I was sensitive to concerns raised and
I'd of course improve.  I bet you'd never get the recall petition
signed.

But let's imagine still further than you somehow get a recall petition
signed without a bunch of details becoming public.
OK, now we seek volunteers for a recall committee.  Of course I go to
all my supporters and beg them to volunteer so I get a fair hearing.
The subject and reporter probably do the same.  For extra fun let's
imagine that the subject volunteers.

So a committee is seated including some of my best friends/supporters,
the subject and some of their supporters and one or two people there
because they thought volunteering was good.
At the first meeting the committee asks for details and the Ombudsteam
regretfully informs them that they cannot provide any because of
confidentiality reasons.

OK, so while we're imagining things let's further imagine that somehow
the committee and Ombudsteam reach some agreement by which the
Ombudsteam can share all their internal investigation information with
the committee.  Now we're simply faced with a biased set of folks with
no harassment training trying to make a critical decision.  There will
be debates and second-guessing of the Ombudsteam's approach, there will
be  a huge mess.  When one side or the other goes to their lawyer and
points out this entire process is unfair, there's going to be a lot of
sympathy and a lot of action on contingency and the lawyers make out
big.

But perhaps Stephen and Nico are proposing we bypass the Ombudsteam
entirely.  So, we have a subject and reporter begging the community to
sign a recall petition giving them enough details of the harassment that
the community members can make up their own decisions.  That's hugely
broken on a number of fronts.  The subject will almost certain to be
subjected to additional harassment.  Even if successful you're left with
the biased committee of untrained volunteers trying to do their own
original investigation.

For these reasons I think it entirely inappropriate to claim our
existing procedures are adequate to the task.  I think there are
significant problems with the Ombudsteam making it impossible for a
leader to do their job too.  However, it may be something we have
consensus on today, and it allows us to get a procedure in place while
we work on something better.

--Sam

---

From: Sam Hartman <[email-masked]>
Date: Sat, 14 Mar 2015 12:12:36 -0400

--Sam

---

From: John C Klensin <[email-masked]>
Date: Sun, 15 Mar 2015 19:15:03 -0400

--On Monday, March 16, 2015 08:07 +1300 Brian E Carpenter
<[email-masked]> wrote:

>...
> Actually, RFC 2418 leaves it unclear who appoints a WG
> Secretary. I think it's been common for WG Chairs to get an OK
> from the AD, at least. But your point is taken: what needs
> clarifying is whether the term "management position" includes
> all appointees, as well as positions filled by the NomCom.
>...

Given the context in which this came up, it is also important to
note that the set of people who can, in theory, be recalled (who
might plausibly be "management") is not the same as the set of
people appointed by the Nomcom (some of whom might, I suppose,
not be)/

    john

---

From: Barry Leiba <[email-masked]>
Date: Mon, 16 Mar 2015 10:02:37 -0400

> people appointed by the Nomcom (some of whom might, I suppose,

That point, at least, is easy to take care of by referring to them not
as "appointed by NomCom," but as "subject to the recall procedures in
RFC 7437," which procedures now include all sitting IAOC members,
including those not appointed by the NomCom.

Barry

---

From: John C Klensin <[email-masked]>
Date: Mon, 16 Mar 2015 12:49:53 -0400

(distro trimmed)

--On Monday, March 16, 2015 10:02 -0400 Barry Leiba
<[email-masked]> wrote:

>> Given the context in which this came up, it is also important
>> to note that the set of people who can, in theory, be
>> recalled (who might plausibly be "management") is not the
>> same as the set of people appointed by the Nomcom (some of
>> whom might, I suppose, not be)/
> 
> That point, at least, is easy to take care of by referring to
> them not as "appointed by NomCom," but as "subject to the
> recall procedures in RFC 7437," which procedures now include
> all sitting IAOC members, including those not appointed by the
> NomCom.

Agreed.  While I still believe the problems are more
fundamental, that small issue does need fixing and that would be
a reasonable fix.

   john

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 16 Mar 2015 12:33:40 -0700

On Sun, Mar 15, 2015 at 12:07 PM, Brian E Carpenter <
[email-masked]> wrote:

> > Hmm. AFAIK, a WG secretary is appointed by the chair, not the AD, or at
> least not necessarily the AD. And we could discuss, if we really wanted to
> descend into the pit of despair, scribes...
>

Without diving into definitions in BCPs (translation: "I have not read your
document lately but I do have an opinion"), I wouldn't consider a WG
Secretary to be a "management position".  Unless I'm mistaken, that role
involves recording and tracking the progress of things, without actually
having the power to make decisions or approve things.  That authority rests
ultimately with the WG Chairs; those I do consider to be (lowest-level)
management roles.

-MSK

---

From: Dave Crocker <[email-masked]>
Date: Mon, 16 Mar 2015 13:02:40 -0700

On 3/16/2015 12:33 PM, Murray S. Kucherawy wrote:
> Without diving into definitions in BCPs (translation: "I have not read
> your document lately but I do have an opinion"), I wouldn't consider a
> WG Secretary to be a "management position".  Unless I'm mistaken, that
> role involves recording and tracking the progress of things, without
> actually having the power to make decisions or approve things.  That
> authority rests ultimately with the WG Chairs; those I do consider to be
> (lowest-level) management roles.

There's an essential distinction worth making a clear choice about.

Some positions have formally-imparted authority.  Others might have
little or no formal authority, but have quite a bit of actual leverage
in practice.

ADs and Chairs and IAOC folk are examples of what would typically be
called 'management'.

Formally, document writers (authors and editors) and note-takers
(secretaries, scribes, etc.) have no authority.  Everything they do is
at the will of chairs and the wg.  In practice, of course, they can be
enormously influence, swaying the substance of content.

Calling such folk "management' is a bit awkward, however, since their
roles are not usually described that way in the rest of the world.

Perhaps the language should, instead refer to anyone with an explicitly
assigned role?

d/

---

From: John C Klensin <[email-masked]>
Date: Mon, 16 Mar 2015 16:21:41 -0400

(trimming again)

--On Monday, March 16, 2015 13:02 -0700 Dave Crocker
<[email-masked]> wrote:

>...
> Calling such folk "management' is a bit awkward, however,
> since their roles are not usually described that way in the
> rest of the world.

And this is the reason by a "subject to recall" formulation like
the one Barry suggested is really crisp and unambiguous.  Of
course, it we really do want that rule to reach to WG Chairs
(who are really easy to remove if confidentiality does not get
in the way because they serve at the pleasure of ADs), then a
more complex formulation is needed (although, in the spirit of
Barry's comment, "anyone subject to recall plus WG Chairs" would
work).

> Perhaps the language should, instead refer to anyone with an
> explicitly assigned role?

That would probably work for me.  But I think that, before
adopting it, people should review the recent effort to make the
WG Secretary role much more "explicitly assigned" and figure out
if they would like this rule if that, or the next such effort,
had gone a different way.

I'm still more worried about the principle of exempting people
whose positions, if abused in a harassing-type fashion, could
cause far more damage that that of the typical out-of-control
IETF participant, from being quickly removed from those
positions if their behavior cannot otherwise be mitigated.

     john

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 16 Mar 2015 16:32:50 -0400

Hi,

(I've trimmed some cc:s)

> Perhaps the language should, instead refer to anyone with an explicitly

I really dislike this suggestion.  If someone who has no formal
authority and serves at the pleasure of the relevant WG chairs is
abusing their position of influence, the right thing to do is not to
expand the definition of Official Role-Holder.  The thing to do is to
complain to the people who _do_ have official authority and use the
processes we have.  

For the obvious problem with expanding the relevant class to
"influential persons" is that the very next thing we must do is
include anyone who happens to have influence by virtue of their long
service, authoritative viewpoints on a topic, past service in
"management", lengthy list of RFCs, or whatever.  Once we do that,
we're well into the developing multiple classes of participants as an
official part of our processes.  I think that would be a terrible
precedent to set.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Mon, 16 Mar 2015 13:37:54 -0700

On 3/16/2015 1:32 PM, Andrew Sullivan wrote:
> If someone who has no formal

That's sounds entirely appealing.

However I'm not clear about the pragmatics, given the the Ombud, or
whoever makes the request, has confidentiality requirements that limit
what they can say to the person with the authority to remove the
miscreant...

d/

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 16 Mar 2015 16:46:16 -0400

> what they can say to the person with the authority to remove the

Someone who has no formal authority but is influential has two ways to
make that influence effective:

1.  Lobby in private, saying nasty things about someone or whatever to
someone who _does_ have authority.  In that case, the abuse-redress
procedure actually needs to go after the person with the actual power,
because that's what's being exercised.

2.  Be abusive in public.  In this case, the official office-holder
either needs to do something or else, again, be implicated in the
abuse.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Mon, 16 Mar 2015 14:27:29 -0700

> make that influence effective:

Sorry for my confusion, but I thought the issue concerned the powers of
an Ombud to remove someone.

For those folk directly under Ombud authority, the document defines that
authority and process.

For those /not/ directly under Ombud authority, the question is how an
Ombud can effect the desired change without violating confidentiality
strictures.

d/

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 16 Mar 2015 17:32:59 -0400

> either needs to do something or else, again, be implicated in the

I had avoided reading this draft until now, because things like this mostly 
end up making me angry when I read them, but this thread finally put me over 
the edge to read the draft.

Having read the draft for the first time, I'm completely lost about what it 
covers.  I have a hard time envisioning non-disruptive harassment.  If someone 
is being harassed, I have a hard time believing it won't be detrimental to 
their IETF participation.

I think the draft is very vague about what it covers and provides no guidance 
on how to know how one "determines that harassment has taken place".

There's no way to know what abusive is, so how can one know how to avoid this.  
I've said negative perhaps even nasty things about people involved in the IETF 
in private, but as far as I know, they were all true.  Am I a harasser now?

Scott K

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 16 Mar 2015 17:46:20 -0400

> an Ombud to remove someone.

Yes, and I'm suggesting that there are two possibilities.  One is that
the ombuds needs to investigate the case fully, and in the event that
the appointed officially-powerful person is not exercising that duty
correctly then the ombuds is in a position to remove that person
anyway.  The other is that there is no confidentiality problem because
things are happening in the open (in such cases, there may still be
scope for the ombuds to act, but there is no particular problem
arising from confidentiality provisions).

> Ombud can effect the desired change without violating confidentiality

See above.  There is, of course, a third case, which is where nobody
has raised any issue with the relevant WG chairs or AD.  I rather hope
we are not suggesting that the ombuds system becomes a replacement for
the usual escalation.  That's anyway not how I read the document.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Mon, 16 Mar 2015 14:57:00 -0700

> arising from confidentiality provisions).

Public vs. private is entirely orthogonal to 'formally powerful' vs.
'has leverage but no formal authority'.

By way of example:

   A document writer has made statements to a participant that violate
the boundaries acceptable to the Ombud team.  The statements were made
in private, but have been sufficiently verified. The Ombud feels that
the document writer needs to be removed from any position of leverage in
the IETF, other than "regular participant".

   Currently, it's the Chair(s) who have the authority to remove that
person, not the Ombud.  But confidentiality constrains the Ombud
possibly from making the request and certainly from explaining why.

d/

ps.  Extra credit:  Note that the confidentiality thing prevents any
sort of persistent application of a decision.  There's no way to bar
someone from being a document writer going forward, even if we figure
out how to handle the immediate situation.

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 17 Mar 2015 11:52:42 +1300

On 17/03/2015 10:57, Dave Crocker wrote:
...
> possibly from making the request and certainly from explaining why.

Right. And the only solution that I can see is what would happen
inside a company in such a situation: extend the envelope of the
confidential discussion to include the person(s) with that
authority.

    Brian

---

From: Sam Hartman <[email-masked]>
Date: Tue, 17 Mar 2015 10:07:22 -0400

>>>>> "Andrew" == Andrew Sullivan <[email-masked]> writes:

    Andrew> I really dislike this suggestion.  If someone who has no
    Andrew> formal authority and serves at the pleasure of the relevant
    Andrew> WG chairs is abusing their position of influence, the right
    Andrew> thing to do is not to expand the definition of Official
    Andrew> Role-Holder.  The thing to do is to complain to the people
    Andrew> who _do_ have official authority and use the processes we
    Andrew> have.

Having worked with ADs in the past and understanding my own tendencies,
we would tend to second-guess the Ombudsteam.
Unless you want ADs conducting independent investigations after the
Ombudsteam has already done its work, don't ask ADs to make the
decisions about chair removal.

I think making the Ombudsteam interact with chairs for doc editor
removal is highly problematic; it seems very likely that some chairs
will not handle things appropriately.

I agree with Dave Crocker here.

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Tue, 17 Mar 2015 16:46:44 +0000

Someone else suggested “subject to the recall procedures”; I second that. Consider, if you will, what the process for removing a document author would actually be? I think it would, perhaps, be an appeal, not a recall.

> On Mar 16, 2015, at 1:02 PM, Dave Crocker <[email-masked]> wrote:
>

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 18 Mar 2015 08:13:06 +1300

On 18/03/2015 06:32, Sam Hartman wrote:
>>>>>> "Fred" == Fred Baker (fred) <[email-masked]> writes:
> 
>     Fred> Someone else suggested “subject to the recall procedures”; I
>     Fred> second that. Consider, if you will, what the process for
>     Fred> removing a document author would actually be? I think it
>     Fred> would, perhaps, be an appeal, not a recall.
> 
> An appeal is clearly also the wrong approach for dealing with
> harassment-related complaints.
> 
> I continue to believe that it's desirable to allow the Ombudsteam to
> remove anyone who is not subject to a recall procedure.

It's hard to fault that logic. But we are kidding ourselves if we
think that confidentiality will always be preserved in that case.

There is running code. Where I live (New Zealand), there is very
strong legal support for "name suppression" by a court. It's quite
common for "a prominent New Zealander" to be charged with, and
convicted of, a serious offence against another person but to retain
name suppression, and it's a crime to reveal that name in any way.
But this is a small country, and if you are interested, it generally
takes about 5 minutes with Google to find the name. If I cited examples,
I'd be breaking the law. The IETF is an even smaller country.

A side effect is that victim's names sometimes leak too. I'm afraid
that is an unavoidable risk, but it means that the solution becomes
part of the problem.

  Brian

---

From: Sam Hartman <[email-masked]>
Date: Tue, 17 Mar 2015 13:32:01 -0400

---

From: Pete Resnick <[email-masked]>
Date: Wed, 18 Mar 2015 12:52:24 -0500

> confidential discussion to include the person(s) with that

I think we have now circled back to the reason the original text ended 
up in the document in the first place:

We really want the Ombudsteam to be as confidential as possible. That's 
certainly important for the Respondent, for whom public accusations can 
be destructive and could bring legal liability for both them *and* the 
IETF, but I think the most important reason for confidentiality is for 
the sake of the Subject: Being the recipient of sexual, racial/ethnic, 
or other sorts of harassment (in contrast to most other sorts of bad 
behavior) can be embarrassing and shaming for the recipient, and can 
make one the object of all sorts of horrible negative comments. Of 
course, it would be perfectly lovely if we lived in a world where 
comments along the lines of "she was asking for it" or "he's just being 
overly sensitive to any comment about race" or "she seemed to be happily 
participating in it" were not the first things out of people's mouths, 
but we don't live in that world. And it would be nice if people did not 
look upon the targets of harassment as victims to be pitied, but they do.

Because of that, the best thing to do is to limit as much as possible 
the number of people who get exposed to the information about the 
incident. In the current text, even in the most extreme cases of 
remedies (e.g., removal from a meeting), the only people -- beyond the 
Ombudsteam -- that need to be made aware of the imposition of a remedy 
are people who are under contract to the IAOC/ISOC (i.e., the 
secretariat), which means that some level of confidentiality can be 
contractually imposed. As soon as we give the ability to the Ombudsteam 
to remove someone from an appointed position (NomCom-appointed or 
otherwise), members of the open volunteer community are going to have to 
be made aware of the existence of the remedy, whether it's the entire 
IESG ("This person can no longer be a chair for any WG"), the IAB ("This 
person can no longer be confirmed as an AD") or others. Maybe we want to 
go through the exercise of trying to figure out what sorts of 
confidentiality "envelopes" we want to have and examine how this 
document interacts with 2026, 2418, and 7437, but it's not going to be a 
pleasant exercise.

The thing I like about the original text, and reason that I'm OK with in 
Sam's text, is that it limits how many people need to know the result; 
the Ombudsteam removes the person from the situation that is causing the 
problem (from a mailing list or a meeting in the extreme case), but can 
only tell the Respondent that it would be a good idea to resign at that 
point. If things go the right way, the person resigns and the outcome is 
identical to having the Ombudsteam remove them (with potentially less 
people having to be told). If things go badly and they refuse to resign 
and instead make a stink, the outcome doesn't seem all that much worse 
than the stink such a person will make after the Ombudsteam summarily 
dismisses them from their position. And again, it avoids the Ombudsteam 
having to figure out who in the community needs to be told, and what 
particular details they need to know.

pr

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 18 Mar 2015 16:09:26 -0400

>particular details they need to know.

Since the accused can't be kept quiet, is it realistic to have a document that purports to provide confidentiality? Unless the identity of the accuser and the alleged victim are unknown to the accused (which would create its own set of problems), the process can't really be called confidential. 

Scott K

---

From: Christian Huitema <[email-masked]>
Date: Wed, 18 Mar 2015 21:15:29 +0000

> Since the accused can't be kept quiet, is it realistic to have a document that
> purports to provide confidentiality? Unless the identity of the accuser and the
> alleged victim are unknown to the accused (which would create its own set of
> problems), the process can't really be called confidential.

+1

This kind of process only remains confidential if it is somewhat consensual, both the plaintiff and the accused agree that the settlement is fair, and both agree to leave it at that. We will see escalation if either party believes that the result is unfair, e.g., that the plaintiff's complaint was not taken seriously enough, or conversely that the accused was not given due process. In that case, either party could take the IETF to court, and the whole affair will become very public.

This is not idle speculation. We do see escalations against universities for their treatment of assumed sexual improprieties, resulting in some cases in millions of dollars in settlements. There are plenty of lawyers who see "amateur justice" as an opportunity for lucrative settlements.

-- Christian Huitema

---

From: John C Klensin <[email-masked]>
Date: Thu, 19 Mar 2015 01:29:58 -0400

--On Wednesday, March 18, 2015 12:52 -0500 Pete Resnick
<[email-masked]> wrote:

>...
> We really want the Ombudsteam to be as confidential as
> possible. That's certainly important for the Respondent, for
> whom public accusations can be destructive and could bring
> legal liability for both them *and* the IETF, but I think the
> most important reason for confidentiality is for the sake of
> the Subject: Being the recipient of sexual, racial/ethnic, or
> other sorts of harassment (in contrast to most other sorts of
> bad behavior) can be embarrassing and shaming for the
> recipient, and can make one the object of all sorts of
> horrible negative comments. Of course, it would be perfectly
> lovely if we lived in a world where comments along the lines
> of "she was asking for it" or "he's just being overly
> sensitive to any comment about race" or "she seemed to be
> happily participating in it" were not the first things out of
> people's mouths, but we don't live in that world. And it would
> be nice if people did not look upon the targets of harassment
> as victims to be pitied, but they do.

> Because of that, the best thing to do is to limit as much as
> possible the number of people who get exposed to the
> information about the incident. In the current text, even in
> the most extreme cases of remedies (e.g., removal from a
> meeting), the only people -- beyond the Ombudsteam -- that
> need to be made aware of the imposition of a remedy are people
> who are under contract to the IAOC/ISOC (i.e., the
> secretariat), which means that some level of confidentiality
> can be contractually imposed. As soon as we give the ability
> to the Ombudsteam to remove someone from an appointed position
> (NomCom-appointed or otherwise), members of the open volunteer
> community are going to have to be made aware of the existence
> of the remedy, whether it's the entire IESG ("This person can
> no longer be a chair for any WG"), the IAB ("This person can
> no longer be confirmed as an AD") or others. Maybe we want to
> confidentiality "envelopes" we want to have and examine how
> this document interacts with 2026, 2418, and 7437, but it's
> not going to be a pleasant exercise.

Pete,

This seems entirely reasonable and quite appropriately
idealistic, but it seems to me that there is a turning point
between "persuade offender to understand the problem and stop
offending" and "protect present and future victims from the
offender by restricting the offender's action, presence, and
behavior".   Once that corner has to be turned (and I hope that
will be rare or less often), measures that try to maintain
confidentiality about what is being done and why are likely to
be indistinguishable from "cover up", whether that is the intent
or not.

> The thing I like about the original text, and reason that I'm
> OK with in Sam's text, is that it limits how many people need
> to know the result; the Ombudsteam removes the person from the
> situation that is causing the problem (from a mailing list or
> a meeting in the extreme case), but can only tell the
> Respondent that it would be a good idea to resign at that
> point. If things go the right way, the person resigns and the
> outcome is identical to having the Ombudsteam remove them
> (with potentially less people having to be told).

If things go the right way, the Respondent corrects his or her
behavior, apologizes if appropriate, and never offends again.
By the time there needs to be even a discussion within the
Ombudsteam about removing someone from something, either things
have failed to go the right way and the issue has become about
protecting the community from expected future bad behavior or we
are entirely into the sort of punitive situation you are trying
to avoid.

>  If things go
> badly and they refuse to resign and instead make a stink, the
> outcome doesn't seem all that much worse than the stink such a
> person will make after the Ombudsteam summarily dismisses them
> from their position. And again, it avoids the Ombudsteam
> having to figure out who in the community needs to be told,
> and what particular details they need to know.

Pete, we've got a community that is pretty good at figuring
things out, even at getting sucked into conspiracy theories and
figuring things out that might not be true.  So consider two
scenarios which seem to be feasible:

(i) A WG Chair is removed.  When people ask what happened, the
relevant AD claims no knowledge of the issue or claims that the
reason the person stepped down is confidential and the
sitting/remaining co-chair claims ignorance (probably
truthfully, unless she was interviewed by the Ombudsteam).  The
former chair refuses to discuss the situation.  How long do you
think it takes for the speculation to start?  Do you think the
IETF community would believe "decided to spend more time with
his family" when the Respondent denies it?  Moreover what is the
risk of damage to the personal and professional reputations of
completely innocent people who step down as WG Chairs for
personal confidential reasons that have absolutely nothing to do
with harassment because the very existence of this policy and
procedures causes speculation and vicious rumors to start?
Forcing such people to publicly disclose the reasons why they
stepped down to defend themselves from such rumors would be,
itself, a form of harassment.  As an exercise, tell me who
should be a Respondent.

(ii) Someone is removed from a mailing list by the Secretariat.
The drop in participation is observed and people ask why.
Incorporating your first paragraph above by reference, the
Respondent answers questions by saying "that <expletive> Joe
Blow couldn't take a joke, accused me or harassment, and the
oversensitive and excessively politically correct Ombudsteam
kicked me off".  The Subject has just been outed, despite the
language in the spec about confidentiality.  The Ombudsteam is
going to do what?  Hint 1: Any response would be punitive, not a
remedy and corrective.  Hint 2: A recall of an IETF participant
who is not a member of the IAB/ IESG/ IAOC is a little hard. 

IMO, in either of those scenarios and remembering that removal
or blocking of any sort really are measures that gets applied
only after education and counseling have failed (or punitively),
it is not clear to me that attempts at confidentiality are worth
it... and that they might have bad as well as useful
consequences.

   john

---

From: Jari Arkko <[email-masked]>
Date: Thu, 19 Mar 2015 10:03:37 +0000

I wanted to recap where we are with respect to the topic
of incidents handled by the ombudsteam affecting roles
that people have in the IETF.

First off, I think we have broad agreement that we need
to deal with this better than version -06 of the document
does, and that misbehaving leadership needs to be
removed. The debate has been about the specific
mechanics of doing that, and clearly -06 was not up
to the task, as well as leaving a bad impression.
I’m sorry. We are now in the process of seeing how to
correct that.

I would like to get to the specific proposals. Sam
suggested one way of dealing with this, copied below.

I personally like this text. There are some variations of
the general approach, I think Pete argued for a similar
treatment of WG chairs and nomcom-appointed
positions. I could live with that as well.

However, there is clearly another class of approaches
to solving this. We could specify the mechanics of
ombudsteam initiating or running the recall process,
or providing the ombudsteam the authority to terminate
appointments. I think this type of an approach is also
possible, but would tie into our nomcom and recall
processes in a quite close manner. The details would
have to be specified, and of course, the resulting system
should still be workable, safe, etc. from overall IETF
perspective. Does anyone have a proposal in this
space, or believe we should take this path?

Or are there other approaches not listed in this
e-mail?

So at this point I would like to ask if people are
comfortable with Sam’s proposal or if other
proposals are forthcoming and/or people believe
that another approach is needed. Concrete
text proposals would be appreciated.

---

From: "Scott O. Bradner" <[email-masked]>
Date: Thu, 19 Mar 2015 07:16:33 -0400

>> carry out their appointed tasks.

might want to be clear that this includes mailing lists such as the private IAB, IESG or IAOC lists and meetings
such as the teleconferences or face-to-face meetings of such groups  (assuming that is the intention,
if it is not then that should be made clear instead)

Scott

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 19 Mar 2015 11:30:39 +0000

On 19/03/15 10:03, Jari Arkko wrote:
>> new: The Ombudsteam MAY ask a respondent to consider resigning
>> from an IETF management position.  The Ombudsteam May remove a
>> respondent from a working group  or document editor position.
>> While this document does not create additional procedures
>> permitting a nomcom appointee be removed, the Ombudsteam can
>> exclude a respondent from meetings and mailing lists and other
>> activities, making it impossible for them to carry out their
>> appointed tasks.

I'm quite uneasy with us saying that the Ombudsteam may remove
editors or similar, and especially with us saying that but not
saying how it might be done in practice. I also think we ought
not be so focused on remedies that involve role-changes, since
I think less dramatic remedies will be far more common (or I
hope so).

I'd therefore suggest we focus more on what the Ombudsteam are
allowed to communicate, so I'd suggest:

NEW new:

"
The Ombudsteam MAY ask a respondent to consider resigning from an IETF
management position or from a working group  or document editor
position.

To the extent required in order to ensure a remedy in encforced, the
Ombudsteam are allowed to (where absolutely necessary) reveal some
details of their investigation. In doing so, the Ombudstream must
only reveal details that the Subject or Reporter agree may be
revealed. The intent here is to allow the Ombudsteam flexibility
in how they get remedies enforced - in practice, in order to
enforce some remedies whilst preserving as much confidentiality
as possible, (in particular for a Subject) the Ombudsteam may need
to convince someone not involved in the situation that e.g. a change
in role or organisation is needed.

While this document does

"

I'd be fine with any wordsmithed version of the above that avoids
getting into too much mechanical detail.

Cheers,
S.

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 19 Mar 2015 08:20:24 -0400

> allowed to communicate, so I'd suggest:

[&c.]

I am much more comfortable with the direction Stephen is suggesting.
I do understand the concerns about harassment and so on, but that must
be reasonably balanced against completely remaking all our procedures
through the back door of the ombudsteam.  Most importantly, I think,
we must retain the tradition of avoiding too much specification of
mechanical detail and of trusting appointees' judgement when adhering
to principles.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Eliot Lear <[email-masked]>
Date: Thu, 19 Mar 2015 14:40:37 +0100

Hi Jari,

I've been following this discussion for some time, and while I agree
that it is important to protect people from harassment, it is also
important for the community to be able to hold decision makers
accountable for their decisions.  This draft puts too much power in the
hands of people who are not appointed by the community.  While I truly
do understand the need to scale the function of the AD, this is a case
where I believe the community expects them to take responsibility for
excluding someone from some or all of our processes.  I am happy for the
ombudsman team to have responsibility for providing you guidance, but
the decision to exclude someone or not should be exclusively in the
hands of someone who cannot be recalled.

To that end...

> Or are there other approaches not listed in this

Yes.  The change here would be that the lead ombudsman may recommend
corrective action, but that person must do so to an area director who is
in an appropriate position of authority to rectify the matter, up to and
including excluding someone from an activity.

In the case where an area director, IAB member, or IAOC member stands
accused or has a conflict of interest, they must remove themselves from
the proceedings.

In this way, accountability to the community for the function is
directly maintained.  To be clear, this balances confidentiality against
accountability,  Both are important.

Eliot

---

From: Pete Resnick <[email-masked]>
Date: Thu, 19 Mar 2015 09:05:49 -0500

On 3/19/15 8:40 AM, Eliot Lear wrote:

> Yes.  The change here would be that..

Jari can speak for himself when he gets off of the plane, but I do not 
believe his intention was to re-open the structure of the entire 
document. As co-editor, I can say that I would not be happy trying to 
implement such a change.

pr

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 19 Mar 2015 14:09:29 -0000

I completely support the aims of Sam's text, but doubt the practicality.

For example, if the Ombudsteam decides to remove someone from a WG chair
position, how will this actually work? Will they tell the AD "this person is no
longer a WG chair" and will the AD be supposed to say "Ah, that was the
Ombudsteam speaking, so I had better react by, for example, not instantly
reappointing them"?

The -05 text had...

     The Ombudsteam can recommend, but can not
      impose, that a Respondent who is in a IETF management position be
      removed from that position.  There are existing mechanisms within
      IETF process for the removal of people from IETF management
      positions that may be used as necessary.

I stand by that text and I believe it achieves everything that is desired
without:
- needing any changes to existing processes
- needing any more lapses in confidentiality than Sam's proposal.

It is, of course, vague. But let's look at some cases:

1. Document editor.
"Hello WG chairs, we are the Ombudsteam and we ask you to remove Adrian from
editing draft-ietf-foo."
The WG chairs will know what that means and don't need to know any more details.
What is the difference between this and Sam's proposal?
- We do not need to update the text about who hires/fires document
   editors
- We have to trust WG chairs to understand that the Ombudsteam would not
   ask if there wasn't good reason.

2. WG secretary.
Ditto case 1

3. WG chair
"Hello AD, we are the Ombudsteam and we ask you to remove Adrian from chairing
the FOO WG."
The AD will know what that means and doesn't need to know any more details.
What is the difference between this and Sam's proposal?
- We do not need to update the text about who hires/fires WG chairs
- We have to trust ADs to understand that the Ombudsteam would not
   ask if there wasn't good reason.

4. IESG, IAB, IAOC
Here I think a little more is needed.
Requiring a 20 person petition requires that 20 people know of the case and
possibly agree with the Ombudsteam.
That is a possibly a step too far.
I think we should allow 
- the Ombudsteam to directly petition the ISOC President
- the fact of the petition to be published
- the recall committee to listen to the Ombudsteam and trust them, maybe
   asking for an outline, but not demanding full details

I *do* agree that asking someone to resign is a good first step. I am slightly
suspicious that someone who harasses to the extent that this remedy is judged
appropriate would probably not choose to resign. But running code will expose
that.

Thanks,
Adrian

> -----Original Message-----
> From: ietf [mailto:[email-masked]] On Behalf Of Jari Arkko
> Sent: 19 March 2015 10:04
> To: IETF Discussion List
> Subject: Sam's text and way forward on the last call of draft-farrresnickel-
> harassment-05.txt
> 
> I'm sorry. We are now in the process of seeing how to
> correct that.
> 
> comfortable with Sam's proposal or if other
> Here's Sam's proposal:
> > I think we should split handling of chairs and wg-level positions from
nomcom
> stuff.

---

From: Stewart Bryant <[email-masked]>
Date: Thu, 19 Mar 2015 14:29:46 +0000

Something nagging in the back of my mind is that in
the opacity of this process there is scope for abuse
by the Ombudsteam. This is particularly problematic
where the Ombudsteam can opaquely remove people
from IETF office. I suspect that it would probably be less of a
problem if the Ombudsteam were Nomcom appointees
rather than IETF chair appointees.

- Stewart

---

From: Jari Arkko <[email-masked]>
Date: Thu, 19 Mar 2015 14:40:40 +0000

> 
> Jari can speak for himself when he gets off of the plane, but I do not believe his intention was to re-open the structure of the entire document. 

That’s right.

Anyway, I’m reading the responses far too quickly to provide
good feedback yet on what Eliot said. And I need to close
the laptop in a few minutes. 

But to explain: we have to solve the issue that had
been raised, and there are some alternative ways
to do that. I have a strong preference to staying with
the current document structure. Part of my goal in
sending out the initial message was to gauge if we are
happy with the type of text that Sam proposed, or
whether people believe bigger surgery is needed.
I think some of the alternative designs may have
issues beyond needing more time to edit, but
for the moment we should put that aside. I was
trying to determine if there are other proposals than
Sam’s on the table.

Jari

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 19 Mar 2015 14:45:28 +0000

Hi Stewart,

On 19/03/15 14:29, Stewart Bryant wrote:
> I suspect that it would probably be less of a

I think the ombudsman role is such that we'd prefer
that when we find a good one, and have trained them
in the complexities of the role, then we'd like to
keep that him or her doing the job more or less for
as long as we can. Contrariwise, if we end up with
an out-of-control ombudsman then I think we need to
fix that very quickly.

So, having the IETF chair pick 'em and fire 'em as
in the current draft is better I'd say.

S.

---

From: Eliot Lear <[email-masked]>
Date: Thu, 19 Mar 2015 16:01:07 +0100

You asked, Jari.

The more power you vest in someone the more they should be accountable
to the community.  Removing someone from an activity is a pretty
momentous activity.  Making ADs unable to function as ADs or WG chairs
unable to function as chairs is a big deal.  It may impact peoples'
livelihoods.  The same holds for people who are intimidated or harassed
into taking actions they would not otherwise take.  The community needs
to be able to hold people accountable for those decisions (or lack thereof).

Eliot

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 19 Mar 2015 10:37:41 -0500

Fwiw ...

> - needing any more lapses in confidentiality than Sam's proposal.

So, I also read the -05 version, in addition to a few others.

What was confusing to me, in that text, was " the Ombudsteam can recommend
..."

I asked "recommends to whom?"

My understanding when we were noodling on -05 was that we were really
pushing on maintaining confidentiality, to the point that the Ombudsteam
would not tell a WG chair or individual AD that Spencer-not-an-AD needs to
be removed.

If we are ok with that happening, to the least extent possible, I will stop
asking snippy questions.

> Here I think a little more is needed.

Oh, I'd agree. My thought was, that we shouldn't special-case more than we
must, so since we have a recall procedure, (try to) use it at least once
and see what breaks.

I saw a note, and I'd have to look at some email threads to see who else
was cc-ed, doing the math on how long it takes to run a recall through to
"Spencer is no longer an AD", and coming up with an estimate of 3-5 months.
My quick take was that the estimate was likely close.

But if that's the case, I'm not sure why fixing the recall process wouldn't
make about as much sense as special-casing anything here.

> appropriate would probably not choose to resign. But running code will
expose

Yes, and speaking as a retired process weenie, I'm not sanguine that we
would be coming up with more tweaks that will address the first problem we
encounter in practice. Running code good.

So what I'm wondering, is whether starting with either -05 or -06 is worse
than what we have in place now ...

Thanks,

Spencer

---

From: Michael StJohns <[email-masked]>
Date: Thu, 19 Mar 2015 11:39:36 -0400

>to be able to hold people accountable for those decisions (or lack thereof).

I'm going to agree strongly with Elliot and highlight something:

"The COMMUNITY needs to be able to hold people accountable...."   This means, that its just not the Chair, the IESG or the IAOC's wheelhouse, but the rest of us get a say, especially if the Chair, IESG or IAOC is excluding itself from applicability.

I made a suggestion elsewhere - I'm going to make it again.  We, as techies, are not even remotely qualified to be given the power of "life" and "death" in terms of excluding people from participation ("it may impact people's livelihood")  and adhoc training will not rectify this.

Please, can we hire professionals?  Set the parameters, set the penalties (and have them apply to all); let the professionals deal with any issues that come up within those parameters; not involve the membership in any accusations of cross company, cross country, cross culture bias; and avoid internal witch hunts.

Mike

---

From: John C Klensin <[email-masked]>
Date: Thu, 19 Mar 2015 12:45:02 -0400

> rather than IETF chair appointees.

Of course, that presumes that the Nomcom is qualified to
evaluate the skills of an Ombude volunteer and can do so without
getting tied up with company biases, different levels of
conviction about the importance of the issues within the Nomcom,
etc.  Finding an appropriate team may actually require a fair
amount of searching and recruiting (something that the draft, at
least as I read it, now contemplates) rather than making
announcements and waiting for volunteer applicants.  The Nomcom
fairly clearly has the ability to do that sort of recruiting,
but I think it has been a long time since one has used it.  

I'm even worried a little about the IETF Chair wrt the expertise
and sensitivities required -- "experienced in HR management" has
never been an important job requirement that the Nomcom is
expected to including high on its list of considerations, at
least AFAIK -- but I think the odds are better than asking the
Nomcom to do the job.

To generalize a bit from this, I think it is really important to
look at these various solutions by working through scenarios
about how they would work in practice.  For example, independent
of any of its other issues, the recall procedure just takes too
long (see below).  Although allowing the Ombudsteam to initiate
a recall without gathering signatures would help, it wouldn't
help very much and the community's instinct (unless the recall
action was intended as punishment), would, IMO, closely parallel
what has happened in the past: if taking the first steps does
not result in a resignation, then it has typically been just
less painful to wait for the next Nomcom cycle and try to supply
enough information there to prevent reappointment.

Even more generally, I think failure to think clearly about the
steps an Ombudsteam would likely take in dealing with a
Respondent once it was clear that there had been a problem
(nothing we should try to specify or risk overspecifying) is
causing us to lose sight of important aspects of the situation
in favor of concentrating, perhaps in the IETF tradition, on
what had better be an edge case.  In this particular situation,
I think that edge case is important and needs to be sorted out,
but only in context with that more basic expected sequence of
events.  See separate note in the original thread, forthcoming.

--On Thursday, March 19, 2015 10:37 -0500 Spencer Dawkins at
IETF <[email-masked]> wrote:

> I saw a note, and I'd have to look at some email threads to
> see who else was cc-ed, doing the math on how long it takes to
> run a recall through to "Spencer is no longer an AD", and
> coming up with an estimate of 3-5 months. My quick take was
> that the estimate was likely close.

I think it was my math.  Feel free to either forward the
analysis to the list or ask me to do so if you think that would
be helpful.

> But if that's the case, I'm not sure why fixing the recall
> process wouldn't make about as much sense as special-casing
> anything here.

Yes, although whether fixing the recall process would also
address some of the issues that have been raised here is very
important.  For example, one of the main protections (as well as
one of the risks) in the recall process is that the identity of
the person for whom recall is being contemplated and the reasons
why and the petition signatories/endorsers are exposed to the
community even before the recall committee is selected and, as I
read it, probably before volunteers for that committee are
sought.  That may be good or bad, but it is completely at
variance with any notion of confidentiality.  

best,
    john

---

From: Ted Faber <[email-masked]>
Date: Thu, 19 Mar 2015 10:49:02 -0700

> to be able to hold people accountable for those decisions (or lack thereof).

I think this is an important principle to preserve.  I don't know that I
want to go as far as Mike St. Johns is suggesting, but his position has
considerable merit as well.

Even in institutions with strict chains of command/authority it is
difficult to put meaningful, fair procedures in place to handle
harassment.  For them to be meaningful and fair in the IETF you have to
connect the authority to the community as Eliot is underlining above.

-- 
Ted Faber
http://www.isi.edu/~faber           PGP:
http://www.isi.edu/~faber/pubkeys.asc
Unexpected attachment on this mail? See
http://www.isi.edu/~faber/FAQ.html#SIG

---

From: George Michaelson <[email-masked]>
Date: Fri, 20 Mar 2015 04:07:09 -0500

On Thu, Mar 19, 2015 at 10:39 AM, Michael StJohns <[email-masked]>
wrote:

> "The COMMUNITY needs to be able to hold people accountable...."   This
> means, that its just not the Chair, the IESG or the IAOC's wheelhouse, but
> the rest of us get a say, especially if the Chair, IESG or IAOC is
> excluding itself from applicability.
>
> I made a suggestion elsewhere - I'm going to make it again.  We, as
> techies, are not even remotely qualified to be given the power of "life"
> and "death" in terms of excluding people from participation ("it may impact
> people's livelihood")  and adhoc training will not rectify this.
>
> Please, can we hire professionals?  Set the parameters, set the penalties
> (and have them apply to all); let the professionals deal with any issues
> that come up within those parameters; not involve the membership in any
> accusations of cross company, cross country, cross culture bias; and avoid
> internal witch hunts.
>
> Mike
>
> I agree with Michael. My early posts on this topic in previous years were
to the same sentiment: all kinds of bodies in the public eye have
harassment process, and I believe they go to competent agents who
specialise in this field, and get clue.

Why do we always pretend the IETF process is the best process for
everything? I'm pretty sure when we stop doing emails and critique of
drafts, we do things which engage with real-world activity which depend on
competent professionals. I do it all the time. I don't expect to be able to
fix every problem by invoking some ritualized process simply because I have
that process.

We need to stop recursing over this and get skills in.

-George

---

From: Jari Arkko <[email-masked]>
Date: Fri, 20 Mar 2015 13:23:00 -0500

I agree with the points from Scott, Christian, and you John that it is
possible that confidentiality is not maintained on a case involving
a continuously bad actor. (Assuming we get to such a bad situation
to begin with, which I hope we wont.)

My question to you though is what effect do you believe that observation
should have on our procedures? Are you suggesting that they should
not by default be confidential?

Jari

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 21 Mar 2015 07:46:10 +1300

> to begin with, which I hope we wont.)

In fact I think it's stronger. It's not just possible, it's virtually
certain that a persistent bad actor will be outed by gossip. And that
puts the privacy of the victim(s) at real risk.

> not by default be confidential?

No. But maybe the lawyer should craft a phrase to avoid liability if
there is a leak.

   Brian

---

From: joel jaeggli <[email-masked]>
Date: Fri, 20 Mar 2015 11:52:57 -0700

> to begin with, which I hope we wont.)

Existing policy has addressed the problem of visibly bad actors in the
past[1]. There no reason to expect that they won't do so in the future
(nor should we abrogate responsibility for doing so). One can imagine a
scenario where ombudspersons and community  participants are
independently pursing amelioration of a problem. there doesn't seem to
be a reason why the acitivities would not occur independently  in such a
case.

> not by default be confidential?

[1] - http://www.ietf.org/mail-archive/web/ietf/current/msg38293.html

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 20 Mar 2015 15:41:51 -0400

> No. But maybe the lawyer should craft a phrase to avoid liability if

Don't promise confidentiality where you can't provide it.  That should solve 
the problem.

It's not limited to 'bad actors'.  I'll tell you in advance that if I'm ever 
accused of anything, the resolution won't be private.  I suspect that's true 
for others as well.

Scott K

---

From: Nico Williams <[email-masked]>
Date: Fri, 20 Mar 2015 14:44:00 -0500

> Let's get real : if that happens, the confidentiality *will* be

Thanks for noticing this.  We can't promise much confidentiality when
outcomes are public.  We should promise no more confidentiality than
we're required to by applicable law or than would be afforded by a
legal proceeding, except in the case where outcomes can be kept
private (mainly: successful mediation).  Due process too limits the
degree to which we can promise confidentiality.

As I see it, if I complain about harassment to the Ombudsteam then
they owe me confidentiality for my complaint if mediation succeeds.
Respondent may not get all the details and might be enjoined to afford
me confidentiality as well to avoid more public outcomes.  Beyond that
is a slippery slope that ends with all laundry in public at the most
extreme (legal discovery).

Nico
--

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 20 Mar 2015 15:52:43 -0400

> extreme (legal discovery).

How do you think the IETF could enjoin someone from speaking publicly?  At 
least in the US, prior restraint of speech is not commonly legal.

Scott K

---

From: Nico Williams <[email-masked]>
Date: Fri, 20 Mar 2015 14:55:57 -0500

Thank you, that's well-reasoned.

In the event of a non-public harassment event and subsequent report,
the Ombudsteam can promise confidentiality to the Reporter, Subject,
and Respondent.  If mediation succeeds, confidentiality can be had for
all and as to all details, and if need be the participants can be
enjoined to keep the matter confidential.  When mediation is
insufficient (e.g., Respondent refuses to cooperate, repeats the
harassment, goes public) all bets are off but the Ombudsteam can and
should continue to afford confidentiality to such details as need not
and have not been made public, and should withhold public commentary
even when such details are made public by others.

Even for public harassment events, the Ombudsteam should promise
confidentiality as to private discussions involving the Ombudsteam
about that event, with the same caveats as above.

Nico
--

---

From: John C Klensin <[email-masked]>
Date: Fri, 20 Mar 2015 17:46:11 -0400

--On Friday, March 20, 2015 13:23 -0500 Jari Arkko
<[email-masked]> wrote:

> I agree with the points from Scott, Christian, and you John
> that it is possible that confidentiality is not maintained on
> a case involving a continuously bad actor. (Assuming we get to
> such a bad situation to begin with, which I hope we wont.)
> 
> My question to you though is what effect do you believe that
> observation should have on our procedures? Are you suggesting
> that they should not by default be confidential?

I think the draft outlines a process that should, in the hands
of the right people with the right professional skills (see
Mike's comments) work rather well for careless or insensitive
offenders who do things in the IETF that, on reflection, they
can be persuaded they should not be doing.  I thing a
confidential process is completely consistent with that.

If that fails, I think, first, that the neutral "respondent" is
no longer appropriate and we should be using terms like
"offender".    Whether "offender" gets qualified with terms like
"persistent", "obstinate about the correctness of his or her
behavior", "unrepentant" or other words may or may not be
relevant depending on the particular issues (and, by the way,
those applicable/local laws). Because of that I think we get
into a process, whether it involves the Ombudsteam, Recall, Post
Rights actions, and/or something else, that involves either
preventing another repetition whether the offender agrees or not
or protecting the community from the effects and consequences of
the offender's behavior, typically both.

To a considerable extent, I believe that once that line is
crossed, the presumption must be that the harassment is
interfering with the IETF getting work done and we are all
victims.

At that point, I think the most important role of the Ombudsteam
(one that, by the way, requires an even higher level of
professionalism than the "normal" case) is to work with
Reporter-victims, and, when appropriate, with the IESG and
potentially Counsel on behalf of community-victims to determine
whether the advantages of taking further steps --steps in which
confidentiality is ultimately not going to be possible and may
be less desirable-- to the community and individual victims
exceed the disadvantages of, e.g., risking disclosure of victim
identities, community gossip. etc.   I think we need to accept
something that others have said in different ways: when we start
doing things like blocking someone's ability to participate, it
better be done via and open process with the guarantees that
only openness at critical stages can bring.

   best,
   john

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 20 Mar 2015 17:55:02 -0400

> only openness at critical stages can bring.

This description presumes false or incorrect reports don't happen.  Just 
because the respondent doesn't fall all over themselves to recant, doesn't 
mean they've done anything wrong.

Scott K

---

From: Abdussalam Baryun <[email-masked]>
Date: Sat, 21 Mar 2015 08:29:03 +0200

At least one RFC in IETF should clarify the management positions as we got
use to, as any organisation has. I think in IETF the management position
are IETF-Chair, WG Chairs and ADs (i.e. those who make decisions that
manage sessions/drafts). Secretaries are not managers, because they don't
make decisions within the organisation. However, this new draft is adding a
new management-position in IETF which is the Ombudsman.

AB

---

From: Sam Hartman <[email-masked]>
Date: Mon, 23 Mar 2015 11:15:32 -0400

Hi.

First, a minor point got lost between my original text and the long
discussion between that and Jari's message, but I think it's one that is
important.
There are more people subject to recall than appointed by nomcom.  In
particular there are IAB and IESG appointees to the IAOC.

So, in my text, I think talking about people subject to recall would be
better than people subject to  nomcom appointment.

Beyond that, the critical thing in this issue to me is that this
document provide a set of procedures sufficient to maintain a fair and
open standards process in the sense of RFc 2026 section 6.5.3.  I
believe that harassment including harassment by IETF leaders is a
problem that acts against a fair and open standards process.  I am not
aware of harassment conducted by the sitting IESG, nor am I aware of
harassment by an IESG, IAB or IAOC mebmber that I personally believe
would have been best addressed by removing that member.  However, I'm
aware of enough that I believe that a procedure for removing leaders
that we have confidence in is a critical element of this document.
If potential subjects of the procedures outlined in section 4 don't have
confidence in such a procedure, I think they will not have sufficient
confidence in the procedures that they can adequately maintain a fair
and open standards process.

So, I expect to be able to read this document and understand how in
sufficiently serious cases a leader would be removed and have confidence
in that.

>From my standpoint, the text I proposed was a compromise I'm barely
happy with with regard to individuals subject to recall.  I don't think
that excluding I* members from activities is the right approach when
what the Ombudsteam wishes they could do is remove that individual.  I
think it's the best we can do without a lot more work.

I'd like to respond to some of the specific alternatives.  I believe all
the alternatives below have substantial unresolved objections in the
sense of RFC 7282.  

Ombudsteam Starts Recall

In a private message I received a proposal that the Ombudsteam be given
the power to start  a recall committee without collecting signatures.
The committee would review the case and make a decision.  Ah, I see
Adrian did propose some version of that on-list too.

John Klensin, Brian Carpenter, myself and perhaps Dave Crocker have all
raised objections that the recall process is unlikely to work in cases
of harassment.  We've each discussed problems with the committee itself
both in terms of fairness and confidentiality of information provided by
subject and reporter.

Pete provided a response to my criticism of the committee process.  His
response depended specifically on the committee not investigating the
details of the harassment, but only on deciding whether to remove
someone who had already been excluded from all their activities
specifically without gaining any details of the harassment at all.

That response is inapplicable to the situation we're dealing with in
this alternative where the committee is specifically charged with
holding the Ombudsteam accountable.  More over, as we've seen in this
discussion, enough of our community strives to find some accountability
mechanism, I have high confidence that any committee would try and
sanity check/review an Ombudsteam's decision.  Doing that leads directly
to the problems I and others described.

                               Text in 05

Adrian proposed going back to the text in 05 that talks about the
Ombudsteam recommending that someone be removed.

In his message he asked 

>Ombudsteam speaking, so I had better react by, for example, not instantly

So, first, I think the job of BCPs is to set general policy and it's the
job of our teams especially including the IAOC and IESG (and for this
BPC the Ombudsteam) to put together procedures that implement this
policy.
I don't think this document should specify these procedures.
Were you asking whether there are possible procedures that could
credibly implement the Ombudsteam removing a working group chair.

My answer is that yes, I believe what you sketch above  would be
credible.  I trust the IESG to be able to put together procedures for
dealing with the Ombudsteam removing a chair.  I suspect that if the
community gives this authority  to the Ombudsteam,  the ADs would do
their part.

Adrian goes on to discuss the language  regarding recommending removal
and explores how it would work in practice.

>What is the difference between this and Sam's proposal?

The difference is that we have not given the Ombudsteam the authority to
remove, only the authority to recommend.
In my proposal, a wg chair who says "I refuse," is violating an
established BCP.  I can go appeal that decision under 6.5.2, I can go
question the fairness of the process in that WG.

I read Adrian's text to give the WG chair the power to review the
recommendation and to decide whether they agree with it.

I have fairly high confidence that many WG chairs  without significant
additional information would not be willing to remove the editor.

As a subject, I would not trust the process because I would not believe
that there was an adequate remedy to get an editor removed.

The problem is the same for interacting with ADs to get a WG chair
removed.

>in role or organisation is needed.

When I read that text, I get the impression that Stephen, a sitting AD
would not take a recommendation to remove a chair without sufficient
detail to let him make his own evaluation.

In my opinion, Stephen  is an incredibly effective security AD.  I think
he's exactly the kind of person I hope the nomcom appoints in that role.

However, I don't think Stephen is qualified to judge harassment issues,
and based on my interactions with him, I feel fear and aprehension when
I think about the possibility that my concerns as a subject and my
ability to feel safe in the organization might depend on him reviewing
an Ombudsteam recommendation to remove a chair in his area.
I bring this up to say that even for excellent ADs the job description
is very different and that having ADs review  these recommendations does
not provide an effective path to remove leaders sufficient to provide a
fair and open standards process.

I know I've raised the unsuitability of IESG members to review
harassment decisions in the past.  I believe that John Klensin and Dave
Crocker and others have also done so.  To me this remains a substantial
unresolved objection.

                         Stephen's Alternative

Stephen's text also suffers from  asking WG chairs and ADs to review the
Ombudsteam's decisions regarding removal.
The same arguments and open objections apply from Adrian's text.

                           Consensus Question

Some of the discussion I'm seeing suggests that the consensus behind
excluding people from activities sufficient to make it impossible for
them to do their jobs may not actually be there.
We see a lot of discussion about holding the Ombudsteam accountable at
the individual decision level.  I wonder why we seem more comfortable
allowing people to be preventing from doing their jobs than we are
allowing them to be removed.  I understand Pete's reasoning here, but
some of the other  messages on the list would seem to apply equally to
exclusions and removals.

                             Dave's Review

In the substantial unaddressed comments area, Dave Crocker published a
review that brings up some fairly important issues.  I have not seen
discussion sufficient to believe we could have an informed consensus
that we've resolved any of the issues he brought forward.

--Sam

---

From: "Adrian Farrel" <[email-masked]>
Date: Mon, 23 Mar 2015 15:39:55 -0000

> that we've resolved any of the issues he brought forward.

You're right.

Dave and I have a very substantial private thread trying to arrive at the nub of
his concerns and to  reach some understanding of potential resolutions.

While we could have conducted this on the list, my most recent email to him
(with embedded quoted text, etc.) reached 67 pages on my laptop. I think the
list doesn't need that, but looks for us to summarise resolution when we get
there.

Adrian

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Mon, 23 Mar 2015 10:46:33 -0500

Hi, Sam,

I cannot overemphasize enough that I'm speaking as one AD here, and by "one
AD" I mean that I haven't discussed this with anyone else on the IESG ...

> both in terms of fairness and confidentiality of information provided by

Right. That's what I think I've seen.

If I'm reading this part of the conversation accurately, at least some of
those people are objecting that the recall process is unlikely to work in
any case.

If I needed to be recalled, I'm not sure it matters much why I need to be
recalled (harassment, or some other reason).

If the vast majority of the community thinks the recall process would work
perfectly if we ever tried to use it running to completion, all they have
to do is say so.

But if that's not the case ... I would encourage people to think about
fixing the recall process more broadly.

I understand that some of the mechanics may very well be different for
harassment, but I would encourage people to make the process work in the
general case, and then start making changes to accommodate the ways that
harassment is different.

Maybe it's not possible to have a process for harassment removals that
looks anything like recalls for other reasons, but I would encourage the
community to special-case as little as possible here.

Speaking only for myself, of course.

And I'm here all week, if people want to corner me in the hall and talk. Or
something.

Spencer, who suspects that both Adrian and Pete can sign a recall petition
for me on Thursday morning, if that was the right thing to do :D

---

From: Sam Hartman <[email-masked]>
Date: Mon, 23 Mar 2015 21:44:24 -0400

>>>>> "Spencer" == Spencer Dawkins at IETF <[email-masked]> writes:

>      John Klensin, Brian Carpenter, myself and perhaps Dave
 Crocker have all raised objections that the recall process
 is unlikely to work in cases of harassment.  We've each
 discussed problems with the committee itself both in terms
 of fairness and confidentiality of information provided by
 subject and reporter.

    Spencer>    Right. That's what I think I've seen.  If I'm reading
    Spencer> this part of the conversation accurately, at least some of
    Spencer> those people are objecting that the recall process is
    Spencer> unlikely to work in any case.  If I needed to be recalled,
    Spencer> I'm not sure it matters much why I need to be recalled
    Spencer> (harassment, or some other reason).  If the vast majority
    Spencer> of the community thinks the recall process would work
    Spencer> perfectly if we ever tried to use it running to completion,
    Spencer> all they have to do is say so.  But if that's not the case
    Spencer> ... I would encourage people to think about fixing the
    Spencer> recall process more broadly.  I understand that some of the
    Spencer> mechanics may very well be different for harassment, but I
    Spencer> would encourage people to make the process work in the
    Spencer> general case, and then start making changes to accommodate
    Spencer> the ways that harassment is different.  Maybe it's not
    Spencer> possible to have a process for harassment removals that
    Spencer> looks anything like recalls for other reasons, but I would
    Spencer> encourage the community to special-case as little as
    Spencer> possible here.  Speaking only for myself, of course.  

I'm very sympathetic to that, but I want us to have something that works
in practice now for harassment even if we make changes later and employ
abstraction once we figure out what the abstraction is.

For myself, I'm unconvinced that a recall for harassment reasons should
look at all like a recall for bad job fit.

Here are some reasons I find them different:

* The skill set necessary to fairly handle a harassment claim is very
  different than the skill set necessary to evaluate an I* member's
  performance.

* There are less confidentiality issues surrounding  a recall for bad
  job fit.

In addition, if I were going to reform the recall process, the kind of
reforms I'd generally propose would not help with harassment issues.
The main problem I have is that it's perhaps a bit too difficult too
collect signatures.  So, I'd look at proposals like the one John Klensin
authored a while ago to let sitting I* members sign recall petitions, or
possibly letting our leadership bodies remove one of their members
directly as an additional alternative to the recall process.

Honestly, it's a bit hard for me to evaluate because there's only been
one I* member I was convinced needed to leave their office.  In that
case we did eventually get a recall petition signed.  I've disagreed
with I* members in the past and a couple of times suggested to nomcom
that a change would be for the best, but even then I valued the smoothe
transition of using the normal nomcom process.

I hope we never need to remove someone from I* for harassment.
However,  part of the point of having this harassment policy is to help
people feel safe and secure participating in our standards process.

Knowing that adequate remedies exist is part of that.

I understand that from the respondent's standpoint being able to trust
that you'll be given a fair hearing is also part of the process.
However, were I to be a respondent I'd be more worried about the fair
hearing from the folks who could ban me from the meeting than whether I
got removed from an I* position.  We have to get fairness right for the
exclusions too.

---

From: Nico Williams <[email-masked]>
Date: Mon, 23 Mar 2015 21:52:56 -0500

> got removed from an I* position.  We have to get fairness right for the

I think fairness for exclusions is much more important than for
removals, for the following reasons:

 - Tolerating I* members who harass is much harder than tolerating any
   other participants who harass.  The latter one might be able to
   ignore for the duration of the process, but the former, one might
   have to continue to interface with in order to do business.

 - I* members represent the IETF.  Unacceptable behavior by them is
   therefore more harmful to the IETF than similar behavior from plain
   old participants.

 - I* members sign up for it with much more "oomph" (funding, time
   commitment, ...) than most other volunteers.  I* members should get
   more training, they are fewer in number, talk to each other more,
   should be more aware, and have less in the way of acceptable excuses
   than non-managers.

   I* memberships come with prestige and some fame within and around the
   IETF.  This is a valuable thing; abuse of it is all the more
   upsetting than mere boorsish behavior by anyone else might be.

 - Conversely, many participants may have had less training about
   harassment and so might get a pass once where a manager might not.
   Their actions and words are less disruptive, and so on.

 - Removal might not come with exclusion.  Removal is more urgent when
   the issue is harassment by someone in a position of authority.

   Therefore the two remedies must be considered somewhat independently,
   and of the two I do think exclusion is potentially worse than
   removal, especially given the proposed confidentiality guarantees!

 - Due to the proposed confidentiality guarantees, an I* member could
   resign and not reveal to their employer why they resigned, making
   plausible excuses ("it was too tiring", "I got bored", "I want to
   focus on my day job more", ...).  Whereas a non-manager who is
   suddenly unable to do their job will probably have a much harder
   time explaining the exclusion to their boss.

At the very least we need to consider a simple process for temporarily
replacing a WG's AD with another (ditto chairs).  And when the Subject
or Reporter are also I* members, then only prompt (for the duration of
the investigation at least) removal seems desirable.

Similarly, exclusion from physical meetings is more important than
exclusion from mailing lists (and jabber).  Similar reasoning leads me
to support a mechanism for at-least-temporary-but-immediate exclusion
from physical meetings.

I think one would have to behave quite badly and publicly in order to
merit immediate exclusion online.  But if someone did, then it would be
obvious for all to see.  (Or if the harassment takes place continuously
via off-list communication, well, it's really time to bring in law
enforcement.)

Online exclusion seems to be the remedy most in need of a fair process.

Nico
--