On 2023-01-19, at 15:37, Randy Bush <randy@psg.com> wrote:

i am saddened to say that i share sander's concerns and questions.

we have a serious problem, and not addressing it will have very unpleasant consequences for the ncc and for the community.

we have an issue in our community and people are discussing it. we discuss circumstances, investigation, outcome, and further actions. it is like talking about security incident in IT world. but it is not a security incident -- or rather it is, just not about computer systems security. it is one related to human security -- does one feel safe at the office and what happens if one feel threatened. we have elected representatives, code of conduct, and some long traditions of unrestricted communication. at the same time we do not seem to have a tradition of bringing justice to a human conflict. i am a mathematical graduate, i do prefer formulas, axioms and theorems and formal procedures to achieve goals and guarantee results. unfortunately in this case, its all about feelings, emotions, and human power - not KPIs and rules. if we cannot make our organization members to feel safe, we have failed as organization. for very long time, people were divided into classes and castes, nobility had more rights than peasants, knights were allowed to carry weapons, and women were not allowed to have property and vote. should the community have levels of power or levels of immunity that differ for different people? when one hires legal counsel, those are usually tasked to protect the liability of paying party. i am sure we have achieved that, with the cost being shifted to the membership, or perhaps later to the insurance company. this whole story does not make me feel right. if the non-decision takes a year, how long a decision does? or are we in post-decision state already? Board, please come out of comfort zone and act.

Hi Ondrej, First of all, thank you for your response. I know I’m not making life easy for you and the rest of the board, and I really appreciate the seriousness with which you have dealt with this.

I understand there are many questions about the investigation and I will do my best to answer them, bearing in mind that there are people's privacy to take into account and that all details of the investigation report cannot be revealed.

First, this has been an incredibly difficult experience for the RIPE NCC and in particular for the staff member concerned who made an allegation of bullying and intimidating treatment by an Executive Board member. We therefore took the matter very seriously and engaged the law firm BenninkAmar Advocaten to carry out a neutral investigation reporting to the rest of the board as announced on 17 May 2022: https://www.ripe.net/ripe/mail/archives/ncc-announce/2022-May/001574.html

The law firm we engaged is one that we have used in the past for conducting investigations and advising us on sanctions-related matters. The Board member under investigation was not involved in the decision to start the investigation, in choosing the law firm we engaged or the conclusion.

We have no doubt as to their independence throughout the investigation, especially as this was something we insisted upon when engaging them. All stakeholders interviewed were informed by the investigator of their right to engage their own counsel. Upon request, the legal costs for the Board member who was under investigation were covered by the RIPE NCC. The RIPE NCC made a claim for recovery of these costs from the Directors Liability Insurance.

Thank you, that gives me plenty of confidence! I fully support the NCC providing financial support for legal costs to everybody involved. Everybody has the right to get assistance to deal with complicated matters like this. I hope they used that counsel well to facilitate the proceeding of this investigation.

Our responsibilities extend to good governance of the RIPE NCC, including the well-being of the staff. These were our guiding principles in setting the scope for the investigating team. The independent investigator team was tasked to determine if any non-compliance with RIPE NCC internal policies took place or if any applicable laws were violated. The RIPE NCC internal policies include the RIPE NCC Code of Conduct and the RIPE NCC Whistleblower policy, which gives the reporter protection against unfair treatment. The RIPE NCC Code of Conduct is more extensive than the RIPE community Code of Conduct but the parts regarding bullying and harassment are essentially the same. The RIPE NCC Code of Conduct and Whistleblower Policy are both available at: https://www.ripe.net/about-us/staff/staff-policies

Thank you! I have been looking all over for those documents ever since I asked about them at the last RIPE meeting :)

We do regret how long it took to reach a conclusion. We would have preferred a quicker outcome but once we started this process we were committed to seeing it through. And now the investigation is complete. Of course, this does not mean that the matter is closed and in many ways it is only the beginning - there is work to be done.

I met with staff, together with the previous Executive Board Chair, to talk at length about the investigation and what we could have done better. We wanted to do this before we announced the outcome of the investigation publicly. We received lots of feedback that both the Board and Hans Petter will use to see how we can make improvements should we have similar cases in the future. It is clear that we can make changes that will benefit the RIPE NCC staff for the years to come.

The precedent set by this one is troubling. It is clear that staff members experienced distress because of the actions of this board member. It has also been determined that the investigation didn’t leave you anything actionable to do. This troubles me a lot. Apparently there is a type of behaviour that can cause great distress but that is not in violation of any policy. That is not right… As I don’t have the details of the report I can’t determine why that is, but it is something I urge the board to look at carefully, with an actionable result. The fact that a board member has been able to put pressure on staff members to such an extent that the staff don’t feel safe anymore is something that shouldn’t be possible. There should be a buffer/interface/etc between the board and the staff, such as management, senior management and the CEO. Of course this doesn’t mean that voluntary communication between board and staff should be forbidden! They all work for the same organisation and community, and open communication is essential. There were times when I was a Working Group chair when communication with NCC staff was very hard. That got fixed, and now we even have an official Registration Services presentation in the Address Policy Working Group and an Impact Analysis where the NCC can give feedback to proposals of the community. That is great! I don’t want to go back to the old days. But in this case it’s different: this incident has revealed that there can be a power imbalance between NCC board and NCC staff. The moment a staff member feels uncomfortable (for whatever reason), their managers should be able to step in and direct that communication through the official layers instead. It also just occurs to me that the same goes for community members. NCC staff has many times expressed to me that they feel they are working for the community, and that they hold that community in high regard. That means that community members directly communicating with staff can also have a power imbalance. So staff members should be protected from that when needed as well. In summary: board or community talking directly to staff is often great and is crucial for understanding each other, but it is a privilege for the board and community, not a right. The moment staff feel uncomfortable they should get the protection of their managers to shield them and to redirect communications through more official channels. Can I propose the above as an official RIPE NCC policy? We don’t have an NCC Internal Affairs Working Group, but I’m sure you know the correct way to process this! ;)

This has been a huge learning experience for us all. We have learned that our processes did not fully cover this situation when it arose. We need to do a lot of work as the Executive Board to see that appropriate measures are taken to prevent such a situation from recurring and to have those measures firmly in place should it happen again.

We also learned a lot from meeting the RIPE NCC staff and from hearing their concerns. Many of the concerns they shared with us are ones we share, so we are committed to addressing them. There are no real positives to be taken from this situation, but the overwhelming support we saw from staff for their colleague, who is clearly respected and admired by RIPE NCC colleagues and in the community, was something that gives us great encouragement.

I am so happy to hear that. A big thank you to staff for this, I know this is very important to the colleague in question. It also gives me the feeling that this colleague was justified in raising a complaint, that unfortunately isn’t structurally solved yet…

The changes we propose to make will of course be communicated to members and in some cases will even need their support at General Meetings. We strive to do better, and to do so we will ask for your help and your support. If we can make real changes to ensure the safety and well-being of the people who give so much to ensure the Internet works for us all, then some good might come from this experience.

Again thank you for all the effort you and other board members have put into protecting the health and safety of NCC staff. I am still worried about this case and possible future cases. As I said, the precedent is not good. I am worried when board members don’t take enough responsibility for their actions. Harm can easily be done even when not intended, and it would show character to publicly apologise in cases where it has already escalated to AGM level. Everybody makes mistakes, and that is ok. We shouldn’t put harsh consequences on mistakes, that only leads to a toxic environment where people are more worried about covering their arses than on doing good. Fixing any issues caused is key here. Taking this responsibility is something I expect from every board member and representative of this community. I realise that even if the investigation had shown a violation of the Code of Conduct there was very little the board could have done. The only way to take action would be for the members (us) to suspend or dismiss the board member, and that takes 2% of the members to propose it as an agenda item, and a supermajority to vote in favour. That immediately makes it a *very* public humiliation for the board member, potentially ruining their career. There is no such thing as a slap on the wrist, it’s all or nothing, and that also creates an unhealthy incentive to not take responsibility. Some things I have in mind as a member: - I expect decent behaviour from board members - I expect a varied board with different opinions - I expect board members to treat others with respect, even when disagreeing - I expect board members to make mistakes, and that’s ok - I expect board members to take responsibility for those mistakes - I expect board members to cooperate fully when issues occur - I would like for there to be more nuanced ways of dealing with violations of the above - I don’t want a single small issue to permanently harm a board member, they also deserve protection - I do want repeated issues to have consequences though, board members are not above the law/CoC/etc On top of this I would like a solution for the following misalignment: these issues are often internal to the NCC, but the appointment and removal of board members is up to the membership. Currently the members cannot take any issues into account when (re)appointing board members, and they wouldn’t even know when to ask for suspension of a board member when they cause problems for staff. On one hand there has to be confidentiality to protect people’s lives, but there also has to be enough information publicly available for the membership to base their votes on. Let me make it more concrete. This is one of the possible solutions that I am thinking about: Maybe we need a lightweight way for staff to indicate any uncomfortable situations to their managers, with a notification to the board of the occurrence and the request to take this into account in further dealings with staff. Such notifications should not be shared in public minutes to protect the board member. And only taking more serious action like a formal investigation when this occurs multiple (3 strikes?) times, with a suspension of the board member during the investigation, which would then be formally published in the public minutes. A “guilty" result of the investigation would cause automatic dismissal of the board member. That would provide a more gradual approach where a single incident doesn’t have hard consequences, but where only repeated incidents cause an automatic suspension with visibility to the voting members, and no need for complicated voting procedures for dismissal when the investigation warrants it. The members can use all of this information (without having to know any confidential internal NCC details) when deciding to reelect a board member. Anyway, in the spirit of structural improvement, I am curious if the opinions and expectations I stated above are shared amongst this membership, and if they are, I would like to know how to help the board in defining and implementing them. As a member I am partially responsible for putting board members in place, and when the people I voted to represent me act in a way I feel is not ok, I feel part of that responsibility too. And now for something completely different that I have been thinking about. No matter how hard we try to fix things, sometimes a conflict can’t be resolved and staff members leave the NCC. Having dealt with burn-out and depression in the past myself, I know how important it is to talk about it with friends, family and colleagues. To share experiences. I feel that as a community and an association we can set an important example here. When staff members leave, I assume there is some sort of confidentiality agreement or NDA in place? After all, NCC staff deal with an awful lot of confidential information! I want to ask the board to make sure ex-staff (current and future) can talk about their personal distress and its impact. That is vital to someone’s recovery and mental health. Don’t get me wrong, it shouldn’t be a license for slander and libel! I’m purely talking about letting them discuss their personal experiences. This community is all about the people in it, and NCC staff are part of our community, so let’s show them we care about their well-being. Anyway, if you made it this far, thank you for reading this wall of text. Making this community better means a great deal to me. Cheers, Sander

All, As a member of RIPE I do believe our community can do better on many fronts. However, hashing out the details and bashing volunteers on Telegram and email is not the way to improve things. I am grateful the Board sought external non-biased help. As expertise in this area does not fall with the scope of expectations I have for the Board. I hope everyone takes a moment to support these volunteers as they make changes to improve the community based on what they have learned here. And I hope every member considers the implications and importance of how you vote for our leaders, for better or worse they are generally there for 3 years and we need to trust them to make the right choices. This should never be a popularity contest. Tina Morris

On Jan 19, 2023, at 05:43, Ondřej Filip <exec-board-announce@ripe.net> wrote:

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

Dear Sander, all,

I understand there are many questions about the investigation and I will do my best to answer them, bearing in mind that there are people's privacy to take into account and that all details of the investigation report cannot be revealed.

First, this has been an incredibly difficult experience for the RIPE NCC and in particular for the staff member concerned who made an allegation of bullying and intimidating treatment by an Executive Board member. We therefore took the matter very seriously and engaged the law firm BenninkAmar Advocaten to carry out a neutral investigation reporting to the rest of the board as announced on 17 May 2022: https://www.ripe.net/ripe/mail/archives/ncc-announce/2022-May/001574.html

The law firm we engaged is one that we have used in the past for conducting investigations and advising us on sanctions-related matters. The Board member under investigation was not involved in the decision to start the investigation, in choosing the law firm we engaged or the conclusion.

We have no doubt as to their independence throughout the investigation, especially as this was something we insisted upon when engaging them. All stakeholders interviewed were informed by the investigator of their right to engage their own counsel. Upon request, the legal costs for the Board member who was under investigation were covered by the RIPE NCC. The RIPE NCC made a claim for recovery of these costs from the Directors Liability Insurance.

Our responsibilities extend to good governance of the RIPE NCC, including the well-being of the staff. These were our guiding principles in setting the scope for the investigating team. The independent investigator team was tasked to determine if any non-compliance with RIPE NCC internal policies took place or if any applicable laws were violated. The RIPE NCC internal policies include the RIPE NCC Code of Conduct and the RIPE NCC Whistleblower policy, which gives the reporter protection against unfair treatment. The RIPE NCC Code of Conduct is more extensive than the RIPE community Code of Conduct but the parts regarding bullying and harassment are essentially the same. The RIPE NCC Code of Conduct and Whistleblower Policy are both available at: https://www.ripe.net/about-us/staff/staff-policies

We do regret how long it took to reach a conclusion. We would have preferred a quicker outcome but once we started this process we were committed to seeing it through. And now the investigation is complete. Of course, this does not mean that the matter is closed and in many ways it is only the beginning - there is work to be done.

I met with staff, together with the previous Executive Board Chair, to talk at length about the investigation and what we could have done better. We wanted to do this before we announced the outcome of the investigation publicly. We received lots of feedback that both the Board and Hans Petter will use to see how we can make improvements should we have similar cases in the future. It is clear that we can make changes that will benefit the RIPE NCC staff for the years to come.

This has been a huge learning experience for us all. We have learned that our processes did not fully cover this situation when it arose. We need to do a lot of work as the Executive Board to see that appropriate measures are taken to prevent such a situation from recurring and to have those measures firmly in place should it happen again.

We also learned a lot from meeting the RIPE NCC staff and from hearing their concerns. Many of the concerns they shared with us are ones we share, so we are committed to addressing them. There are no real positives to be taken from this situation, but the overwhelming support we saw from staff for their colleague, who is clearly respected and admired by RIPE NCC colleagues and in the community, was something that gives us great encouragement.

The changes we propose to make will of course be communicated to members and in some cases will even need their support at General Meetings. We strive to do better, and to do so we will ask for your help and your support. If we can make real changes to ensure the safety and well-being of the people who give so much to ensure the Internet works for us all, then some good might come from this experience.

Best regards, Ondřej Filip RIPE NCC Executive Board Chair

...

On 17/01/2023 13:48, Sander Steffann wrote: Hi board,

I am looking at the minutes of board meeting 163, and I have a few questions.

The minutes state that "The investigation was tasked to identify whether there have been violations of the RIPE NCC Code of Conduct”. At the last AGM I asked if there was a Code of Conduct for board members, and as far as I remember there wasn’t any. So which Code of Conduct do you refer to here? If it is different from the RIPE Code of Conduct please provide either a link or the full text.

Looking at the RIPE Code of Conduct, which applies to all of us in this community, it identifies some examples of positive behaviour, like accepting differing viewpoints and experiences, being considerate and showing empathy towards others, especially when disagreeing or raising issues, and giving/receiving feedback or suggestions in a positive way. It follows with "Behaviours that undermine our values are unacceptable and will not be tolerated."

I have personally definitely seen behaviour contradicting the points mentioned above from the board member in question (and I have heard many others express the same) but apparently they ARE now being tolerated. Please explain this discrepancy between the Code of Conduct and the outcome of this investigation.

The goals of the Code of conduct are to help everyone feel safe and included and to make everyone aware of expected behaviour. As far as I can see we have failed on both accounts here…

Sincerely, Sander Steffann

PS: just to make sure, who actually performed the investigation? I assume it was a completely independent party with no previous, current or future ties to the RIPE NCC, financial or otherwise. Please confirm.

_______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/fergalc%40ripe.net

_______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/tinam%40amazon.com