Dear TF members, Here are the minutes from our last call. Cheers Kjerstin *** 28 September 15:00 (UTC+2) Attendees: Denesh Bhabuta, Athina Fragkouli, Antony Gollan, Brian Nisbet, Leo Vegoda, Salam Yamout Scribe: Kjerstin Burdiek Summary: The TF discussed how to handle the issue of data retention in several situations. To prepare for any possible legal actions against the RIPE NCC and CoC Team members, Athina said they could include indemnification clauses in the terms and conditions of meetings and suggested including similar language in the process documents. The group considered also extending the data retention period to cover the legal statute of limitations. The TF next discussed how to ensure shadow team members’ ability to access report data and decided to consider them full members of the CoC Team who were receiving more training while in reserve. Athina said she would look into whether training should be stated as one of the purposes for data retention. The group also discussed including an indemnification clause in the report webform to guarantee confidentiality and whether there should be such a clause for mailing lists too. The TF then went over their plans for RIPE 85, which included the CoC consultant giving a general presentation about CoCs in the community plenary and possibly answering questions at the Diversity in Tech session. The group would also prepare office hours for them to discuss the CoC with the community. The group decided to ask Mirjam if there was consensus on the documents ahead of RIPE 85. 1. Minutes The minutes from the last meeting were approved. 2. Agenda There were no changes to the agenda. 3. Actions -Athina to investigate data retention and potential court proceedings against the RIPE NCC and appeals. Athina said the RIPE NCC, as the implementer of the CoC Team’s decisions, had a liability waiver in the Terms and Conditions of events that would protect the organisation from lawsuits. The RIPE NCC would still need to demonstrate that it had acted according to the CoC decision, but data retention would not be required beyond evidence of the decision. There would also be an indemnification clause in the Terms and Conditions for the CoC Team. If someone sued anyway, the CoC Team members could choose to defend themselves by sharing relevant information about the case. She suggested including court proceedings as one of the purposes of data retention and to extend the time period of retention to cover the statute of limitations for a court case. Salam asked if Athina knew of any previous lawsuit against an organisation enforcing a CoC. Athina said she was not aware of one. Salam said this meant including protection against this in the process document would make it long and unwieldy for no reason. Athina said the TF still needed to be prepared. The arbitration process did say that its decisions could be challenged in court, although no one had done so yet. Leo asked Athina to look into how likely it was that they would need the extended data retention period. The TF should only add this if it was truly needed, as it would indicate to the community that lawsuits were likely. Salam said there was likely a very small risk of lawsuits. -Athina to check what case data the shadow team could, or should, have access to Leo reminded the TF that this was a suggestion from the CoC consultant. The shadow team was a backup team that followed cases so they could be trained as full team members. Athina said training was a legitimate reason to access data, so this should not be a problem for GDPR compliance. However, one problem could be that involving everyone in cases for training would make the whole team no longer impartial and unable to participate in appeals. The group discussed whether the CoC Team training would consist of hypothetical scenarios or reviewing real cases and decided it would be a mix of both. Antony said the shadow team would consist of people who had already been trained and were preparing to join the official CoC team. Athina asked whether the shadow team would then be considered part of the CoC Team. Antony said they would be, but some team members would sit in on a case and some would sit out. Those who had been accepted and trained would have to sit out if the team was already full. Athina asked if this meant they were all on the CoC Team, with some on a case and some being trained. Brian said there would be a certain number of people on the active CoC team, with some working on cases and others looking at appeals. There would also be a certain number of people who were trained and would be rotated into the active team when someone else left. It was this latter group who might be observing cases in order to be better trained for when they officially joined the team. They would still be bound by confidentiality. The group discussed in more detail why these team members were not on the active team and decided this could occur when the active team was full. Brian said these reserve members were also useful in case active team members left suddenly for reasons like burnout. Athina said this was why the CoC Team had a smaller assessment group reviewing reports. The group considered this and decided the shadow team was still part of the active team as there was no true limit to the team size. Leo asked if the TF should add training as a purpose of data retention. Antony said they should leave the text as it was since the TF now considered everyone a member of the team. Leo said they might want to specifically state that training was one purpose in order to be transparent to the community about when and why data might be retained. Athina said she did not think this was necessary as these would just be other team members looking at a case, but she would review this. -Antony to investigate what is practical in terms of consultant support at RIPE 85 and what the RIPE NCC would be prepared to support. Antony said the CoC consultant could be there for the whole week. Mirjam had suggested the consultant present in the community plenary, which Antony would prepare for. The consultant would also give face-to-face training to the Board at the meeting and could present at the Diversity in Tech session if there were questions remaining. Brian asked what the content of this presentation would be, as the TF did not want to start another discussion on the RIPE CoC. Antony said the presentation would be about implementing CoCs in technical communities in general. The consultant could use their experience to address people’s concerns. Brian said the consultant should be prepared for this to lead to a discussion of the RIPE CoC. Antony said if this happened, the session moderator could steer the conversation back to CoCs generally. But having the second CoC session might be unnecessary. Leo asked if this plan was definitely going ahead. Antony said it was as long as they had enough time to submit the proposal. If not, the consultant was still prepared to do the Diversity session. The TF should also have the CoC consultant at the office hours. -Leo to write down possible talking points for the office hours at RIPE 85 and share them with the TF. This action was marked as complete. There were already some responses to the document. -Antony to speak with the CoC consultant and other relevant parties about a possible CoC presentation at RIPE 85. This action was marked as complete per the previous discussion. 4. Data Retention Leo brought up a situation at DEFCON where someone challenged a CoC decision in court. The focus of the case had been on discovery regarding the reporter. He asked Athina if the TF should consider this. Athina said this was indeed a relevant CoC case. In the Netherlands, this was not a concern as the country was not a common law jurisdiction. But if the location of an incident was in such a common law jurisdiction, this would be something to consider. The TF could label private documents like reports as privileged and confidential to exclude them from discovery. Leo asked if the webform for reports should include text to that effect. The report would be reviewed by a member of the RIPE NCC Legal team to guarantee confidentiality. Athina said that if the form went to a lawyer, it was indeed privileged and confidential by default. However, in civil law, anything not public was private, making these reports confidential regardless. The TF should still review the webform and related documents as to whether they should add the phrase privileged and confidential. Leo asked Athina to review the scale of the risk here, such as how often RIPE Meetings had been in common law jurisdictions. 5. Indemnification Athina said they could ensure indemnity for team members in cases where the CoC Team had to apply sanctions by having a provision in the meeting terms and conditions. The question was whether they needed a similar clause for the mailing lists. Brian said the focus should be on meetings, which had more impact on people’s careers, as there were unlikely to be lawsuits about mailing list bans. Leo said mailing lists were likely to see less usage in the coming years anyway, so they may need to consider terms and conditions for different kinds of technology in the future. 6. RIPE 85 Leo shared questions Mirjam had asked about the TF’s plans for RIPE 85. He asked whether the TF should reserve time to discuss the process documents at the community plenary. Brian said he was not in favour of this as it would not start a fruitful discussion. Denesh agreed this was not a good use of time. Leo said recent discussions about the CoC on the MLs were out of scope for implementation, and the only relevant issues were some small details about the process and the wording. One was whether an accused person would get to share their side of events, which the CoC TF could make clearer in the document. Antony noted the document was not explicit that there would be more in-depth investigation and review, also involving the RIPE Chair, when deciding on serious consequences. Brian agreed there was still some work to do on the document, but a discussion at the plenary would not help with this. Antony said having the CoC consultant at the community plenary could inform later discussion on the list about the RIPE CoC. A specific RIPE CoC discussion alongside this general CoC presentation would not help with this. Leo noted the TF did not want the process documents on the community plenary agenda. Brian said Mirjam could at least mention them. Salam said it was important to discuss the basic concept of a CoC and how it was beneficial. But the CoC TF’s work was practically done, so they should not discuss the process documents specifically and should just answer community members’ questions. Brian said in his experience presenting the CoC to the community, there were some who would not accept it no matter what. The TF should not do any sort of public Q&A session. Salam suggested having a table for the TF at the meeting so community members could come and have discussions. Antony said the office hours could be the right space for this. Leo said this confirmed the need for office hours at RIPE 85. He asked Antony to find a slot at the meeting for this. The CoC consultant should be present for this, as well as someone from the TF. Leo would give Mirjam a summary of the TF’s discussion about final changes to the process documents and ask her if this was enough to declare consensus ahead of the RIPE Meeting or if revision was necessary. He asked whether they should have the CoC process discussion at the Diversity in Tech session. Brian said this could derail the session, so they would need to carefully coordinate with the session organiser on how to handle this. Antony said the discussion there could be a continuation of the broad conversation about CoCs, not the RIPE CoC specifically. Leo noted they would not need time allotted in the Diversity in Tech session. He asked if there was anything else the TF needed from Mirjam. Brian said it would be good for Mirjam to mention the CoC at the start of the plenary and that there would be a CoC Team at the next RIPE Meeting. 7. AOB There was no other business. 8. Actions -Athina to investigate the scale of risk that data might be needed in a court. -Athina to review language over data retention, training and the broader team. -Athina to evaluate the risk of discovery in common-law jurisdictions and what language is needed in communications templates. -Leo to contact the Diversity in Tech session organiser to say the TF would not need time for a discussion.