Define enforceable consequences for online + in person harassment

I'm so sorry this is happening to you.

I believe the immediate step should be to take any legal action available, and action through twitter's support that may be available.

I am not completely convinced that this is a matter for the Drupal community, although I may be completely wrong. I think it's first and foremost an online problem. I'm hoping that either legal or twitter means can resolve it.

Yes, some legal or Twitter means could/should be taken.

But it also seems like this person probably deserves to be banned from using *.drupal.org as he has apparently harassed multiple women in our community, even if he didn't specifically harass them at a DrupalCon or on Drupal IRC channels or on *.drupal.org. He's preying upon our mutual connections to Drupal and that should be sufficient. [Note: I do not know the whole story so I will leave the final judgment, of course, to the hopefully soon-to-be-formed community governance working group.]

I'd personally like to addd that I think harassment should be explicitly noted in the Drupal CoC http://drupal.org/dcoc
If Drupal is to be a diverse community (and I'd like to think that we want people of all walks of life!) then there needs to be clear notes about what constitutes harassment and how it is dealt with. Ideally in the above situation, it'd be easy to copy the URL and say 'that's not Drupal-ly, not acceptable' thus making it a community rule rather than just personal opinions. I'd argue that communities like this aren't reddit, they do have work and IRL components so should be held accountable as such (even if it is only by being clear about what's not OK in terms of conduct).

I'm just saying there are limits to what any community can take on as far as enforcement. These situations happen with various types of contact, and the means of contact (the means by which an evil person chooses their victim) is not necessarily responsible for the result.

If you have not already contacted Twitter, please do not assume their response. They should at least be able to kill his account.

If you have not already researched legal recourse, please do research it. I believe it's a crime to stalk people from places in the US just as it would be from Canada.

This IS a matter for the Drupal Community.

And, as a community elected "Director at Large" I am taking it very seriously on 2 counts.

1 - this incident in particular, and that matter is being handled privately
2 - issues like this in general. We need to make sure we have clear guidelines on what to do, when to do it, and how to escalate.

For anyone who is tempted to blame the victim, please don't.

For people who suggest it just needs to be handled by the law, that's actually not helpful. Online harassment is not yet being adequately handled by most legal jurisdictions, and law enforcement has a bad reputation for dismissing legitimate harassment complaints.

And for the pessimistic who think nothing can be done, please see
http://skeptools.wordpress.com/2011/08/17/case-study-notorious-spammer-b...

@rfay... Let's step back a bit and think about this in general.

If someone who is a member of the Drupal community is behaving in a way that is defined as inappropriate by the Drupal COC towards people who are also members of the Drupal community, and the only obvious/apparent connection between the offender and offendees is their membership in the Drupal community (i.e., they're not living in the same town, members of other organizations in common, etc.), then it seems to me that it *is* (at least in part) a Drupal Community issue -- independent of what medium/venue was used for the bad behavior (Twitter, for instance, as in this case). It may also be a legal issue or a Twitter issue or whatever, and that part of it is not a Drupal Community problem to deal with -- but the Drupal Community Working Group ought to do what it can to deal with it (such as banning the user from drupal.org and DrupalCons).

I guess I think that every time the community extends its governance, it has to consider the cost of doing that. It's like the national debt. You have to figure out a way to pay for things. Although we're moving forward, we don't yet have the "juice" to "fund" just our basic governance needs yet (things like technical decisionmaking processes, community issues, etc.). So to expand our governance before it's even started is a big issue. Ironically, at the exact same time as this issue was posted, #1815278: Inclusion in Drupal Community Events was posted, which wants us to police the public commercial activity of member Drupal shops based on choices of political correctness.

I don't at all disagree that this is a horrible thing. I don't at all disagree that the person is awful. I want them to be prevented from doing online harassment again. Unfortunately, the fact that they chose a victim based on on a community they supposedly belong to does not make that community responsible for the resolution. We are not a government which has enforcement capabilities against individuals.

If a stalker chooses a victim at the supermarket, that does *not* make the supermarket responsible for all of the followup. I claim this is a similar paradigm. These things fall to the civil and criminal enforcement facilities of our governments. And, yes, they're behind the curve on this sort of thing, although some of them are catching up now.

Note that since this issue was posted as a governance issue and is about defining processes, I'm responding to it that way. Ariane has explained the *need* for change based on her experience. But she didn't phrase this issue in terms of her experience or dealing with her experience. That's why I've replied with regard to process, scope, and governance. I still disagree that we should just accept this as a part of our scope of governance just because it's bad. But I would love to see Ariane get some justice here, and am not commenting on her exact case.

BTW, @arianek, have you tried tweeting a request for support to Twitter?

I think it's important to separate the merits of this specific issue from the title of the issue. The title is pretty clear and I think it's hard to argue with it.

What should someone do if they feel that the DA and/or d.o webmasters should take action based on some inappropriate behavior (whether that behavior was online or at a community event)? We can block people. We can make a reasonable effort to prevent them from attending events and indeed our code of conduct for events has a big TBD about how to report situations that would say "I need help making sure that person X doesn't show up!!!!" So, maybe consider this a specific example that helps us remember TBD means it needs to be D!

Basically: why doesn't the code of conduct show up in this search? It needs to be there with the contact info filled in.

greggles++

Can we please leave the personal circumstances that lead to reporting this issue, OUT of this issue? That is now being handled privately.

I believe this issue is to explore how we handle this as a community, and develop a solution we can codify and use again should the need arise.

Tim was kind enough to point out that my search has a typo. Oops.

So, that feels like it partially answers the question, but it doesn't handle how to deal with something like this as it relates to d.o itself.

I think that there should absolutely be a mechanism within Drupal governance to safely address issues of harassment within the community--a safe, well-defined mechanism.

What makes Drupal superior to other online communities (in my personal opinion and experience) is that our community's prominent members, male and female, do not tolerate harassment and will speak up respectfully when they see someone else being treated inappropriately. Even with that support from individual community members, though, even with the trust that one's concerns are taken seriously... being in a harassment situation within the community still results in feelings of helplessness, powerlessness, and fear, and thinking "I don't know what to do" over and over again.

Having a documented way to report and address concerns within the community gives victims something that is in their control, a next step to take, and the confidence that the burden isn't theirs alone.

If you, as a manager, had an employee come to you and say s/he was being harassed by another employee, would you advise him/her to go to the police? Yes, you would, depending on the severity. But you would also help him/her with that step, and additionally explore disciplinary action against the harasser within the company. Drupal is not liable, but we should still take responsibility for protecting people in Drupal spaces, both online and physically.

+1 to needing a policy and a process. The fact that these incidents have happened over several years, and are still happening, is indication of the need. I note that this does not mean that the Drupal community is bad or guilty.

If a stalker chooses a victim at the supermarket, that does *not* make the supermarket responsible for all of the followup. I claim this is a similar paradigm.

Actually, I would say that a supermarket that cares about its customers will follow up, will take action, will have the harasser booted from the store. As long as the customer is in the store, any supermarket that gives a damn will take steps. And it may even contact the authorities.

By the same token, any member of the community should feel safe within the community. Yes, it gets fuzzier when people are griefing and harassing people in other media like Twitter, but that doesn't mean the community can't take note and ensure that such behavior by that individual or group doesn't bleed into the community.

What is the community? At the very least, people while participating in *.d.o, IRC, Drupal events (not just DrupalCons), meet-ups. And these are probably overlapping circles of influence. For example, if someone acts like a creep at a meetup, it may indicate action in online presence, especially if the behavior continues there. But how enforceable is a community action on a meet-up? Still, it's worth stating goals and standards, and some sort of process so that all members can feel safe.

Our community benefits from diversity. The more we as a community tolerate or ignore behavior that diminishes that diversity, the more we as a community diminish ourselves.

I have no idea how to go about solving this, but agree that we can do better than we do now. I know that's not much better than a +1, but seems worth noting that I'm fer it.

Hm. I think rfay's comments are being mischaracterized a bit here. He is essentially posing the question, "What do we want the scope of Drupal's Community Working Group to be?" And I think that this is a fair question to ask, divorced from this specific incident, which is being dealt with through other channels, since we don't have a Drupal Community Working Group yet. (A charter for it is being drafted right now, however, and should be shared for community comment soon.)

* Does its scope cover incidents that take place off of Drupal.org?
* Does its scope cover incidents that happened in "meat space"? (e.g. meetups)
* Does its scope cover incidents that cross-over into legal jurisdiction?
* Does its scope include the ability to "perma-ban" a user from Drupal.org? If so, what's the threshold at which this is an acceptable course of action?
* Does its scope include the ability to "perma-ban" a user from Freenode? If so, what's the threshold at which this is an acceptable course of action?
* Does its scope include the ability to administer punishment in "meat space," such as banning from Drupal events? If so, what's the threshold at which this is an acceptable course of action?
* Does its scope include an appeals process for the accused? If so, what does this look like?

I think there are some compelling arguments laid out here that the CWG's scope should be as wide as possible to cover all incidents, even the "nuclear" ones, in order to preserve the awesome community that brings us all here together. But we should consider the answer to these and other questions very carefully, as they have tremendous community impact.

Webchick's response is very well put. I don't think anyone is saying that this is or is not the kind of situation that we should or shouldn't address, just that this group doesn't even exist yet, and we have to be extremely careful about the scope we decide to accept. Both from a perspective of not wanting to over (or under) reach, and from the perspective of what burden can be reasonably handled by a group of people (we don't even know yet how many.) Honestly, when this issue was first posted, my gut reaction was that this isn't something we can or should have any control over, and if I had been at my computer at the time I may have posted just as much. However reading over these messages and thinking on it for a time, my feelings may be changing. Remember this process is just that - a process. We all need to be able to feel safe about talking this out (although I also understand this is a very emotional issue.) Hard things are hard.

As far this specific situation, since this individual is using the word 'Drupal' in their twitter username (and assumedly elsewhere) is one potential recourse to report the user to Dries under the trademark policy? I realize that, to some extent, will make it worse (you've basically just kicking him to a new username where he is less visible) but on the other hand it sends a message, it is something that has real consequences (I know I wouldn't want to lose my online identity) and it is something Dries can do as a personal decision rather than us setting a precedent as a group that, again, just barely has a draft of their charter. I fully understand also, that this is essentially like saying 'Lets punt it' and I understand that is frustrating. I'm just trying to find something that can be done, clear action to be taken, right now, in the context of a policy that is already in place.

Should we henceforth try to avoid discussing the specific incident, and people involved in that incident?
Think of it as now "before the courts"?

Let's focus on developing some guidelines instead.

I propose we start with our process for reporting Security issues,
http://drupal.org/node/101494
to the point we also define threat levels, like the security risk levels.
Threat to physical safety,
Threat to sense of safety in the community,
etc.

Thoughts?

RE #4

We definitely have to patch the DCOC about harassment specifically. The DrupalCon code says

When we need it, we ask for help

We do not tolerate harassment of conference participants in any form. If you feel threatened or violated as a result of intimidating, harassing, abusive, discriminatory, derogatory or demeaning conduct, please immediately notify a conference staff member. Likewise, please immediately notify a staff member if you notice that someone else is being subjected to such behavior.

http://sydney2013.drupal.org/community/code-of-conduct

But the basic code does not contain anything specifically about harassment.

Here in BC, we have been shocked by the suicide of Amanda Todd : http://www.cbc.ca/news/canada/british-columbia/story/2012/10/14/bc-amand...

Cyber-bullied for years. And it's been a question in my mind all week - what's the difference between kids bullying/harassment and adults? Why are 'we'(generic term, not meant to imply *this* community specifically) less enraged when adult women are bullied/harassed?

For children, for women, men for ADULTS...the message is the same. You are either FOR or AGAINST the actions of an individual. These actions made our friend feel afraid. If we ignore it, we are tolerating it. Tolerance can be misinterpreted by both sides.

I've been proud to see senior individuals of this community vocalize their lack of support (especially male peers), and I hope that we don't get too hung up on the mechanics/documenting of right and wrong, because clearly as people (mothers, fathers, sisters, daughters) we know what the right response is.

I favor having a process. In the same way most US businesses have anti-harassment policies (many of which cover employer-related events outside the workplace), it would be helpful to have a process to deal with incidents of harassment.

Bullying or Harassment (words of value)

Assigning to self.

First two steps are the following tasks.

Tasks.
1. Add an anti-harassment clause to the standard Drupal Code of Conduct.
(first figure out where to post an issue to do that)

2. Draft a guide on how to report, escalate and respond to harassment issues, using "How to report a security issue" as a loose guide, including drafting threat levels.
http://drupal.org/security-team/report-issue

3. Put this issue on the table to be considered by the community working governance group.

+1 on a proper policy and then a process to enforce that policy. We should never be in a position where a member of our community decides to retreat and not participate because of harassment.

I'm all for doing as much as we can to protect community members from this type of behavior and creating a safe, inclusive environment. I also agree with some of the sentiments expressed by others that there are very difficult decisions to make here.

In addition to the scope questions webchick posted in #19, I would add these two:

* Does its scope cover incidents where the accused targets a victim who is not a member of the Drupal community?
* Does its scope cover incidents which happen outside of Drupal events and meeting places? (i.e. an incident which occurs at a local jquery meetup, where both users have d.o accounts)

I think we all agree that the incident which sparked this issue being created was inappropriate and completely uncalled for, but also agree with @kattekrab that we should shift the focus of this conversation to developing a set of guideline guidelines, and then after those guideliens are developed we can make the decision about whether or not to retroactively apply them.

One more follow-up to #19.

We should also consider the answers to these questions with the context/background that whoever makes up the CWG will not, in all likelihood, be people with any kind of professional conflict resolution experience, nor people who are paid to do this work. They will most likely be community volunteers who have "merely" demonstrated the ability to stay even-keeled in heated discussions and consistently show care and empathy towards others. And most likely, they will already have plenty of other community responsibilities since the CWG members need to be highly trusted by their peers. I believe this basic resourcing issue is what rfay was referring to with his "debt" allegory.

I don't think this negates in any way the arguments made by linclark, xjm, and others. But it hopefully provides a realistic grounding for the discussion about what we do and do not want such a group taking on.

I think the Code of Conduct should be amended to include incidents of harassment, sexual or otherwise. My preference would be zero tolerance, but some would argue that there might be degrees of severity where zero tolerance would be too harsh.

I do think if an incident happens between two Drupal community members, regardless of whether it is on d.o, it should come under the purview of community conduct. What is the point of calling it a community if it cannot make its members feel safe?

beeradb -- In addition to the scope questions webchick posted in #19, I would add these two:

* Does its scope cover incidents where the accused targets a victim who is not a member of the Drupal community?
* Does its scope cover incidents which happen outside of Drupal events and meeting places? (i.e. an incident which occurs at a local jquery meetup, where both users have d.o accounts)

I think in these cases, community support for the victim would be best. Sometimes a person just needs to know that people are behind her/him.

Perhaps a mechanism for redress, ie: apology, agreement to either avoid the victim online/offline, or adjust online behavior and con behavior - contingent on victim agreement.

IMHO while discussing scope questions I think it's also important to define who are community members and when we consider that community member is actually wearing Drupal community member hat i.e. acting as a part of Drupal community.

In already mentioned (and somehow mistakenly characterized) #1815278: Inclusion in Drupal Community Events issue I provided suggestion how to define it:

• Drupal community member is someone who has a drupal.org account with some history behind it i.e. person / company behind this account actually proved existence with any kind od activity @ *.drupal.org - this is also including any kind of real life activity e.g. event organization visible at GDO, etc.
• Drupal community member is acting as a part of the Drupal community only if he / she is acting when there is Drupal word associated. This is including virtual places as *.drupal.org, *drupal*.* and any event that has Drupal word in it.

My $ 0.02.

For reference, I thought I'd see how Wikipedia (where I also add stuff), copes with it:
http://en.wikipedia.org/wiki/Wikipedia:Civility
http://en.wikipedia.org/wiki/Wikipedia:Harassment

As you might expect, they have to do into a lot more detail than might be necessary in a Drupal context, it's still generally relevant reading.

Yes. This. http://en.wikipedia.org/wiki/Wikipedia:Harassment#Dealing_with_harassment

That's what I hope and expect the Community Governance Working Group can help create (though I think it should extend to behaviors beyond harassment).

Great!

Thanks for pulling up the wikipedia ref - that's really useful.

Anyone aware of other resources like this that we can draw from?

I'm hopeful we'll be able to build a robust process for the Drupal community, especially if we can iron out some of the usual wrinkles before we begin.

Hi

http://geekfeminism.wikia.com/wiki/Conference_anti-harassment/Policy states a Conference based anti-harrassment policy which might also be a useful reference. Similar has been adopted by the Debian and Ubuntu communities for conferences and the UK London Perl Mongers for both social and technical meetings.

Not to clear how the Debian policy guidelines deal with on-line harassment, through whatever mechanism - IRC, mail, twitter, FB etc,

But I am definitely a +1 on guidelines being developed that give people; moderators, group leaders and targets, a process to deal with the kind of person who perpetrates harassment and intimidation. It's not going to stop such people existing but it may go some way to exclude them from the community and indicate to others that this behaviour is not tolerated.

For folks in this thread, here's the draft of the Community Working Group charter #1822314: Draft charter for the Community Work Group. This covers the "process" part without necessarily the "consequences" part, yet.

http://drupal.org/node/1822314#comment-6658118
comment on the CWG draft charter thread that it does not adequately cover issues of harassment and bullying.

Proposal we add specific clause stating we do not tolerate bullying and harrassment to the DCOC and that the CWG should uphold the DCOC.

http://groups.drupal.org/dcoc#comment-842833

We will not tolerate bullying or harassment of any member of the Drupal community.

If you feel threatened or violated as a result of intimidating, bullying, harassing, abusive, discriminatory, derogatory or demeaning conduct, please speak up and ask it to stop. If you are fearful of speaking do not feel that you can speak up, contact the Community Working Group immediately with evidence of the incident. Incidents of bullying and harrassment can be reported privately and will be treated seriously and discretely.

Please speak up if you notice someone else being subjected to such behaviour. Refer people to our code of conduct and point out such behaviour is unwelcome.

EDITED: amendment suggested http://groups.drupal.org/dcoc#comment-843218

subscribe

I think the DCOC adjustment sounds great, but we need to get the CWG established in order to have a body that's actually empowered to make such adjustments to the DCOC.

Moving to the new Drupal Community Working Group issue queue.

We really need to get this patch applied to the code of conduct. But not sure how to actually make that happen... so unassigning from myself.

Added an issue for the content working group

#2067721: Amend code of conduct: We won't tolerate bullying or harassment

Updating to remove details of specific incident for safety and clarity.

I don't think D.o Content WG needs to be involved here. Maintaining Code of Conduct is specifically in the Community WG duties, according to the charter. So if you as a WG agreed on what needs to be changed, you should go ahead and edit https://drupal.org/dcoc. If you don't have permissions to edit that page, please open an issue in Webmasters queue and we'll fix that.

Thanks @tvn - I don't have access to edit that page - so I thought I needed to ask content group to do it for me. Didn't occur to me to ask for access to edit the page itself! D'oh!

:)

@kattekrab : Added you to the "Full HTML user" role, so you should now be able to edit "locked" pages like the dcoc.

Thanks for working on this issue!
-Derek

@dww Oh thank you :)

and in that case can I trouble you to close (fixed) this one?
#2067747: Upgrade Kattekrab's privs

Sorry, wrong timezone. ;) I was already asleep when you asked, but I just replied there to confirm.
#2067747-3: Upgrade Kattekrab's privs
Cheers,
-Derek

OK, the Code of Conduct has now been updated with more-or-less the text at #39. See #2067721: Amend code of conduct: We won't tolerate bullying or harassment for more details.

While we have made a strong statement now that bullying and harassment is not tolerated, and point people to a way to report it, we don't yet have a plan for enforceable consequences. So leaving this as "active" for that, although I'm wondering if we should close this out and discuss that in a thread that's not already 50 replies.

#1493430: [meta] Develop a conflict resolution process for community issues

The enforceable consequences bit should be part of the overall complaint / conflict resolution process. No?

Fix for trivial wordsmithing issues.

Step 1: Define a clear reporting process

An incident report form has been drafted.

Suggestions and corrections should go in this issue: #2112015: Create an incident report template

The form is now live at
https://drupal.org/governance/community-working-group/incident-report

I've removed "a clear reporting process" from the title, because we've now got the incident report form in place - we'll still need to publicise it... but it's there.

We also still need to work on the enforceable consequences piece of this puzzle, but that's in train as we evaluate the Django communities processes for this.

The Code of conduct has been amended, an incident report form is in place... so we're getting there, but this is a big issue. It would be good to break this down into smaller solveable chunks if we can?

The Community Working Group has now come up with a draft conflict resolution policy using the Django enforcement manual as a guide. We are now closing this issue and seek specific feedback on the proposed draft here: #2227717: Proposed Conflict Resolution Policy.