Incident Resolution Procedures

[cblecker]

The CNCF Code of Conduct Committee will require documented resolution procedures for incidents that they respond to.

The goal of this document will be to explain how to submit a report, policies regarding information sharing and confidentiality, how conflicts of interest are dealt with, and other procedures related to review, investigation, and resolution of an incident.

The current draft is available here: https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md

If you have feedback on this document, please leave your comments in this discussion. Once consensus around points is reached, then PRs will be created to update the draft.

[lumjjb]

Looks good! Have a couple comments

On submitting a report in person, I think it may be ambiguous who qualifies as a member of LF event staff to the general person, I feel like there's a chance that someone may mistakenly report something to a contract staff at the event, who may not know the right ways to make the issue known..

On reporting anonymously, it still doesn't feel anonymous given that it still goes through an individual. However, understand if there's likely spam or trolling through this medium.. I wonder if there's a way to do this through an anonymous form (alongside an authenticated email acceptance of policy).

Minor nit: The confidentiality policy seems to be hard to enforce with the way things are reported.. Given the full report is sent to [email protected], if the reporter is not aware of conflicts of interest, members with hard conflicts would see confidential information about the full report..

[TheFoxAtWork]

these are good comments and some have been previously discussed.

Regarding reporting in person and confusion around LF event staff from vendor/contracted staff - this is a good catch. There is potentially some indicators we could work through or document with the events team to more clearly distinguish them from vendor/contracted staff. In the interim, it may be beneficial to have a pre-determined location at all events where reports may be made in person.

Regarding anonymous reporting, yes we struggled with this too. We thought through an anonymous form, and it could work but given the open nature of the form (accessible to everyone) its is likely to receive spam. the counter balance is that using a form reduces the barrier to report, which could open up trolling. it would certainly standardize the information collected, but not all reports warrant the same information and we could run into other issues (input validation, text length, etc.) So there are tradeoffs and benefits. I can see something being made available as an option where the form simply generates an email to the alias (effectively a web form email).

on the confidentiality policy. Yes - and we dont ever really know the conflicts of interest that could be present until the report is received, either through email or even in person. Its something that should be considered, and i would also venture that selection for the Code of Conduct committee has some assumptive qualities about it beyond those expected in other community leadership roles due to the personal nature of the impact those decisions have. Those assumptive qualities should be defined publicly such that reporters feel comfortable - even with a hard conflict from a committee member - that what they report is protected, only used for the purpose it is intended, and does not further another's ends or ambitions. Some assumptive qualities that come to my mind (things i strive toward): trustworthiness, compassion, kindness, fairness, broader perspective than themselves, impartiality, accountability, and due consideration.

[cblecker]

The working group co-chairs share the concern about a webform being used for spam and/or trolling. The way the proposed incident response procedures are written today, the CoC can choose to investigate an incident even if a formal report isn't made, so informal reports (such as pseudonymous emails) can still be investigated.

The nature of a CoC complaint is such that the committee itself knowing who was involved and who reported things can help illuminate additional options to heal the situation using principals of restorative or transformative justice as outlined. However, not knowing who reported the incident doesn't in and of itself prevent the CoC from opening an investigation.

[joannalee333]

On submitting a report in person, I think it may be ambiguous who qualifies as a member of LF event staff to the general person, I feel like there's a chance that someone may mistakenly report something to a contract staff at the event, who may not know the right ways to make the issue known..

@lumjjb, thanks for your sharing your concern quoted above. I shared your comment with Angela, who manages the LF Events team, and learned the following:

• At all CNCF conferences, LF Events staff all wear t-shirts that clearly indicate they are a member of the Events team
• Most LF Events staff members are trained in Code of Conduct response and are able to receive and respond to CoC reports.
• The few LF Events staff who are not able to receive CoC reports will redirect any person who has a CoC concern to a staff member who is able to receive their report.

Hopefully this addresses your concern

[tpepper]

Comments as of 9871dc1

• Somewhere in https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md?plain=1#L91 should be an explicit mention of "confidentiality", ie: the nature and amount of information shared as per the "shall notify the accused person" needs to consider confidentiality. That may be implicit in the current wording, but imho it is better if retaining reporter confidentiality (and anonymity when requested) are critical goals. Since there is a whole section on Confidentiality Policy, this should be easily addressed by noting in this section that the notification which shall go to the accused person shall comply with the Confidentiality Policy.
• Symmetric with https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md?plain=1#L91 it feels important for https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md?plain=1#L165 to include notice to the accused of a completion/resolution determination.
• In the "self reporting" case at https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md?plain=1#L85, personally I like that this is an explicit potential avenue based on patterns I've seen in the ecosystem and industry. But also I perceive this to actually be a controversial provision. Has it seen much discussion, have the pros/cons been thoroughly explored, is this a consensus decision to go in this more proactive direction?
• In general needs hyperlinks, eg: "Jurisdiction and Escalation Policy"
• https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md?plain=1#L56 has a typo: "CC" vs "CoCC"

[tpepper]

An additional point to consider: In a volunteer community, it's usually not the norm to have a formal response time SLA, but some indication of typical first response time might be given so a reporter has an idea if their report might have gotten lost in a sea of notifications, eg: "The Code of Conduct Committee responds to all emails in a timely manner, usually within a few days."

[joannalee333]

@tpepper, thank you for your comments. I've opened a PR with edits to incorporate your feedback: #20 (comment)

[joannalee333]

@tpepper, I'm responding here to your comments that aren't addressed by the PR I opened.

• In the "self reporting" case at https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md?plain=1#L85, personally I like that this is an explicit potential avenue based on patterns I've seen in the ecosystem and industry. But also I perceive this to actually be a controversial provision. Has it seen much discussion, have the pros/cons been thoroughly explored, is this a consensus decision to go in this more proactive direction?

I supported the Interim CoC Committee in its preparation of the current proposed draft, so I can provide some insight on their thinking. The Interim CoC Committee discussed this issue and chose the wording very intentionally for https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md?plain=1#L85. They didn't think it would be good idea for a CoC Committee to open investigations on its own based on mere suspicion in a vast majority of situations situations, but in the event that the committee becomes aware of a "a serious continuing risk to community safety" through means other than an official complaint (e.g., if violent behavior takes place in a public forum), they wanted to make sure that the committee has the ability to investigate and respond.

Of course, feedback from the broader working group on this issue is welcome. And if any Interim CoC Committee members would like to further elaborate on the thinking behind the current language, please chime in.

• In general needs hyperlinks, eg: "Jurisdiction and Escalation Policy"

We'll add hyperlinks to other documents after the deliverables are finalized and migrated from the working group repo to the permanent CoC repo

[tpepper]

Thanks for the updates! :)

Reviewing the current draft (https://github.com/cncf/wg-coc/blob/main/coc-incident-resolution-procedures-proposed.md as of 80fc613) a few more comments:

• How to submit a report: The "may report a potential violation" might be better stated as "may report an incident". The language of conduct incident, conduct incident report, conduct incident investigation, and possibly then later following that the notion of a conduct violation determination and always through this not prejudging punitively versus biasing toward creating restoration and safety are important and deliberate word choices. As phrased, pre-judgement is encouraged. In the first have of the doc there are a handful of instances of the phrasing around violation or potential violation which are similarly less than crisp and which would be better stated as "incident".
• What information to include in your report: I'm getting hung up on "The portion(s) of the CoC you believe to be violated." Perhaps again it is simply the word "violated" and the extent to which that leads the situation in a punitive direction. For example the reporter is confident a violation occurred and is then simply looking for the CoCC to affirm and punish the violator. If the only incidents reported are ones with a clear violation relative to the (currently, subject to change, yet also intentional) ambiguous CoC terms, that also leaves a large grey area where the prospective reporter may be led away. The prospective reporter has a concern, but may not know for sure it is a violation, or either way wants to defer to an unbiased panel of experts to make a decision and find a constructive outcome for the community. The simple language of the document may lead those people, probably the majority of potential incident reporters, to feel that these conduct incidents don't rise to the level of CoCC involvement and they simply are left to fester until the pattern of incident boils over. This is a real world pattern and problem today.
• Investigation: In the context of prior discussion around incident, incident report, incident investigation, findings, remediation progression, I think here in the first paragraph which starts "...will investigate the report..." the inclusion of "...CoC Committee may engage an external professional investigator or mediator" is not appropriate. In my opinion, mediation between involved parties should only follow a completed investigation and findings. Certainly later in the final paragraph it would be reasonable to include, eg: "At this phase the CoC Committee may engage an external professional mediator to assist." This separation in the procedure feels important to lead a reader and prospective reporter to confidence that incident response and resolution are even handed and not pre-supposing outcomes.
• Notification to the Accused Person: In the evolution of this paragraph the content has become muddled, circular or self-contradictory even. It's almost reading like an operational decision tree and might be more clear if explicitly spelled out in relation to the phases of incident report, incident investigation, determination of findings, resolving actions. Or give yourselves a "comma" and "period" budget which is half what is currently in use such that it's a forcing function to simplify the sentences :)
• Missing section? From the investigation section we jump on to legalese around notification of the accused and in that we see mention of "determinations". And then we're in to the next major section on "Resolution". There was no description of how determinations are reached. Especially with an ambiguously worded CoC, the prospective reporter (previously instructed to detail what they believe is a CoC violation) nor the accused have any sense of how the CoCC interprets the CoC. I can imagine too much detail (same as why the CoC is ambiguous) being too constraining. But zero also feels insufficient. Perhaps something for a minimal section on incident findings and determination of violation which states simply that the CoCC is chartered with interpreting incidents relative to the CoC is sufficient. Perhaps a bit more might be informative, as in the later Resolution section with "Factors that the CoC Committee will consider". The Enforcement section of the CoC draft contains a small bit of wording in this direction.
• Accountability: As we commonly see complex scenarios without a simple start and end date, I'd suggest a bit more open ended wording here where you seem to be assuring forward freedom of operation. Eg: "...the CoC Committee may take further actions toward resolving the incident."
• Communicating the Results: Again this section points to the need for a determinations and findings section earlier. If that exists, then you have a point at which you can say an incident is considered to have determinations/findings when "the CoC Committee has completed its investigation and either (a) determined what remediation actions are needed to resolve an incident (including determining that the involved parties’ agreed-upon resolution is adequate) (b) or determined that the CoC was not violated and no remediation is needed." But that statement logically cannot mark the point as which an incident is resolved, because as per the prior section parties must fulfill their obligations related to resolution and it is acknowledge they might not always. The resolution point needs to be after not just findings, as currently written, but rather after required actions are fulfilled. This is a critical distinction to clarify. With it clarified perhaps this section actually can be removed in favor of the following one:
• Information Sharing: The notion of transparency reports need clarifying. What is a transparency report? Why are they useful? What is in them, ie: there should be some treatment of minimum required elements of a report stanza, or typical elements expected. How anonymity is ensured there should also be discussed. For a community oriented around git, the transparency report likely needs to be in git or similarly under version control. In my opinion, ideally the report is an immutable/append log so that retroactive revisions of a published report are visible.
• Confidentiality Policy: The distinction between "In some cases..." and "In rare situations..." feels odd. I would consistently use "In some cases..." because we cannot accurately presuppose that the subpoena case will be rare. The use of the word "rare" may overly assure a prospective reporter of the unlikelihood of public disclosure, versus simply noting a series of risks against which they must choose their path.
• No Retaliation: this section should be referenced in https://github.com/cncf/wg-coc/blob/main/code-of-conduct-proposed.md and retaliation is not currently. I will comment on this at Updates to the Code of Conduct #16
• Conflicts of Interest: This is a large and complex section which perhaps leads away from one of the unstated purposes here: Having a trusted set of subject matter experts who interpret the CoC relative to incident reports. Can it be simplified? Again on "determinations and findings" this section references the notion of a "right to vote" which is not described elsewhere. Even in this sections length and complexity and in consideration of the "right to vote", it is unclear if there is a notion of quorum. If conflicts get down to only one participant, there is no longer a "trusted set of subject matter experts" and that lack of number or diversity will likely weaken interpretations, findings, actions. And what happens when the complex process of disclosure and recusals leads to no available CoCC members?