Jurisdiction and Escalation Policy

[cblecker]

The creation of a CNCF Code of Conduct Committee will necessitate the creation of a policy around jurisdiction and escalation of issues between the varying responsible bodies, namely the CNCF Code of Conduct Committee, Linux Foundation Events team, and project-level Code of Conduct bodies.

A draft of this document has not yet been created, but the working group is still seeking feedback on considerations that should be taken into account. The interim CoCC group and LF Events will be creating a draft document for feedback, and when that draft is available this discussion will be updated with it.

If you have any considerations to highlight, please leave your comments in this discussion. Once consensus around points is reached, then PRs will be created to update the draft.

[tpepper]

I wonder if "escalation" is the wrong term, versus "transfer"? I suspect most cases will be transfer among peer jurisdictions, from where an incident was reported to a more appropriate jurisdiction for handling.

We did have some discussion of this area in Valencia at KubeCon/CloudNativeCon. Thinking back on that I believe we discussed:

We all expect transfers will happen (they already do and have for years). Separate from transfer though, there may still be a notion of escalation, especially if these bodies are not considered peers but part of a reporting hierarchy with some of the bodies subsidiary in authority to others. There are not easy answers here. It is a complex topic area and nobody seemed comfortable yet with establishing required "escalation" points or mechanisms, and many were quite uncomfortable with the notion.

For example if a community member takes issue with findings by one of the bodies? Or the community takes issue with the operations of one of the bodies to the point of considering a CoCC rogue, unprofessional, etc. What would be the appropriate recourse? Can a CoCC investigate itself? Or another body outside its normal jurisdiction (likely would require charter changes agreed and established vs role/scope of current bodies)? How would recusals work?

If the bodies are considered peers, perhaps there is a path to add an opt-in (once then binding?) peer review of the handling of an incident for a party who expresses a concern with an outcome or finding by one body which impacts them, or there is a concern by some with operationally how the outcome was reached by one body?

We do now have transparency reports being published which help demonstrate that investigations and accountability can happen, but the question remains open as to what one would do if they found fault in a published report.

[joannalee333]

@cblecker, @arun-gupta, and @dims, I'm working with the Interim CoCC on a proposed draft of the Jurisdiction & Escalation Policy. It may not be ready by February 8, but would be available sometime that week depending on when I can find a time when the committee is available to meet. So you may want to push the timeline out by a few days

[joannalee333]

@tpepper, good suggestion. The "Jurisdiction & Escalation Policy" has been renamed "Jurisdiction Policy"

[arun-gupta]

@joannalee333 sure, that makes sense. what would the new timeline be? do you want to submit a PR for the updated timeline?

[joannalee333]

@arun-gupta, I got the Interim CoC Committee's input on a draft last evening, so we're now back on the original timeline

[cblecker]

Passing on some additional feedback I've received:

• "The Project-level responders did not conduct a fair evaluation of the incident" -- Are there some additional examples of what would fall under this? This is a fairly broad point (possibly necessarily so), but some additional practical examples may demonstrate what types of circumstances would fall under this category
• Under "Central Recordkeeping and Notification", would the CNCF CoCC be requesting historical records from project level CoC bodies, or would this be go forward?
• Additionally, do we need some sort of data retention policy for the CoCC? For example, detailed evidence of an incident is kept for X period of time, and then will be destroyed. But certain summaries of incidents (such as people involved, or actions taken) would be kept for longer.

[joannalee333]

Thanks, @cblecker. I opened a PR to add another example (failure to provide the accused with the opportunity to be heard and present evidence where doing so could change the outcome) to address the first question.

Regarding the second question, although I think it would be helpful to have a central repository with high level summary of prior incidents in order to identify repeat offenders, I'd like to see what feedback the community has on this issue.

Regarding data retention policy, I'm hesitant to commit to a particular time frame because there may be situations where there are legal risks and the data would need to retained longer, and the length of time would vary based on the applicable statute of limitations for the types of legal risks and jurisdiction. If someone would like to submit a proposal on what a data retention policy would look like and how the CoC Committee could operationalize this without putting a lot of burden on them (especially since in some cases, they might be using external investigators who have their own data retention policies), we can definitely consider it.