Draft RIPE Code of Conduct: Process and Consequences

Status of This Document

This is a draft document prepared by the Code of Conduct Task Force for review by the RIPE community. It is based on similar documents developed by the Python and Mozilla communities.

Introduction

This document describes the process to be followed by the Code of Conduct (CoC) Team when handling reports. The same process applies equally to everyone who participates within the RIPE community.

How the Code of Conduct Team Relates to the Rest of the RIPE Community

Everyone who organises activities or fills a role within the RIPE community has a responsibility to make sure that people understand what is appropriate behaviour. However, only the CoC Team is responsible for handling reports and making decisions about outcomes.

WG chairs are responsible for their respective mailing lists and WG sessions in a proactive way. In contrast, the role of the CoC Team is a reactive one – it will only act once a report has been submitted. As this is likely to be more complicated in practice, establishing who has the final authority in every case does not seem helpful. Instead, it is expected that the WG chairs and the CoC Team will liaise as needed and that the two groups will maintain a cooperative relationship.

Process Steps

This section describes the steps the CoC Team will take when handling reports.

1. Report is Submitted

People can submit reports electronically or in person. They will receive confirmation that the CoC Team has received their report and it is being reviewed. When a report is made in-person, the CoC Team member who receives the report will make sure it is properly entered into the system.

The member of the CoC who receives a report will be responsible for forming an assessment group to handle the report. The purpose of this triage step is to make sure the report is not seen by more people than necessary.

2. Assessment Group is Formed

This smaller group should consist of three people: two members of the CoC Team and one RIPE NCC staff member who is appropriately qualified. The member of the CoC Team who initially received the report would preferably be one of the two CoC Team members in this group.

Before assessing a report, CoC Team members will consider whether there are potential conflicts of interest. Reviewing the names of the people involved should be enough to determine whether this is the case. Any members of the assessment group who see a potential conflict of interest will recuse themselves so that someone else can take their place.

3. Report is Assessed

Depending on the nature of the report, elements of the assessment process may include (but are not limited to):

• Contacting the subject of the report to hear their side of the story
• Obtaining reports from witnesses
• Reviewing any relevant materials (photos, videos, screenshots, messages, emails, etc)
• Consultation with others as appropriate
• Group discussion and assessment of the evidence

The role of the RIPE NCC staff member in the group is to provide administrative and legal support to the volunteers on the CoC Team as needed. Members of the CoC Team will do their best to be discreet when assessing reports.

4. Decision is Made

Once the assessment group feels that it properly understands the reported incident, it will decide whether this represents a breach of the Code of Conduct. If the group believes that a breach has taken place, it will agree on a course of action.

When deciding on the appropriate actions, the group will consider a range of factors, such as the severity of the breach, its impact on others, and any past incidents involving the same person.

In cases where the group believes that strong consequences should be applied, such as expelling someone from a RIPE Meeting, it may notify or seek input from other parties, such as the RIPE NCC’s Events Team or Legal Department. However, while it might seek input from other parties, only the assessment group is responsible for making a final decision.

Once the group has made its decision, the relevant parties will be notified of the outcome as appropriate. In all cases, both the person who made the report and the subject of the report should be informed.

If the group decides that strong actions should be taken, it will inform the RIPE Chair Team and the RIPE NCC before they are implemented.

5. Required Actions are Taken

Once the assessment group has decided on next steps, it will arrange for them to be implemented as soon as is practical and appropriate. Depending on the outcome, the RIPE NCC may need to take certain actions and the staff member who supported the assessment group will be responsible for making sure this is done. They will report back to the CoC Team as appropriate.

People who dispute the outcome of a report can contact the CoC Team to make an appeal. In this instance, a different group of CoC Team members must review the case. The request for an appeal will probably not prevent certain consequences from being applied. For example, someone who is ordered to leave the RIPE Meeting will not be able to remain at the meeting while their appeal is being considered.

6. Decision is Recorded

The RIPE NCC will maintain a record of all assessments made by the CoC Team. Any personal data contained in these assessments will be stored and processed according to the relevant European data protection regulations, for the periods and purposes described below.

Personal data will be retained for the following purposes:

• For the RIPE NCC to maintain records that allow it to implement any actions required as part of the CoC Team’s decisions
• For the CoC Team to review past behaviour of individuals when deciding on actions (i.e. in the event of repeated breaches of the CoC, or repeated invalid reports from or about the same person).

Regarding the periods for which personal data will be retained, a distinction is made between ‘minor’ and ‘major’ breaches of the CoC. A major breach is defined as a case where the RIPE NCC is required to implement an action. Examples could include revoking someone’s RIPE Meeting badge or removing them from a mailing list (numbers 4-8 and 3-6 on the first and second lists of potential consequences in the next section).

In the event of a minor CoC breach, or if a report is not considered to be a breach of the CoC, personal data will be retained for a period of 18 months. For major breaches, personal data will be retained for 36 months. In cases where actions are applied for a period that exceeds 36 months (e.g. banned from attending RIPE Meetings for five years), personal data will be held for only as long as these actions must be maintained.

Assessments will also contain the personal data of the people who made the report and any witnesses. This will be retained according to this 18/36 month timeframe depending on whether the report is related to a minor or major CoC breach. In the case of longer-term actions that exceed these periods, the personal data of these other parties will not be kept for an extended period. In the case of an appeal, the personal data of all parties will be retained until the conclusion of the appeal process. This would be to allow the CoC Team to inform relevant parties of any outcomes and to follow up if more information was needed.

Once the period for which personal data may be kept has expired, it will be removed from any corresponding assessments. These assessments can then be stored indefinitely. This will allow the CoC Team to identify trends and to see what actions it has taken in previous cases. It will also allow anonymised statistics to be shared with the RIPE community for transparency. Statistics might include the number of reports submitted over a certain period, categories of reports, number of reports that resulted in actions being taken and a summary of actions taken, etc.

Potential Consequences of Breaching the CoC

This section outlines some of the possible actions that may be taken as a result of breaching the RIPE Code of Conduct. It is important to be clear that these are all examples and are not definitive lists. This is especially the case as not every form of participation is described, such as interactions via instant messaging or at virtual events. Both lists are ordered on a scale from least to most serious.

When deciding where on this scale a specific case belongs, the Code of Conduct Team will consider a number of different factors, such as whether that person has done anything similar in the past and how they have affected others. The CoC Team are empowered by the RIPE community to apply their best judgement when selecting a consequence for an action.

Meeting Sessions and Social Events

1. Asked to apologise
2. Removed from the room for a period of time to allow emotions to settle
3. Removed from the room for the remainder of a session
4. Removed from the meeting venue for the day
5. Removed from the social event for the remainder of the event
6. Removed from the meeting venue for the remainder of the meeting
7. Not allowed to attend future events for a period of time
8. Permanently banned from attending RIPE events

Note: in the case of virtual events, consequences would roughly correspond to their real-world equivalent. For example, someone might be asked to leave a conference call to calm down rather than leaving a physical room.

Mailing List

1. Asked to apologise Publicly told not to repeat a kind of post
2. Temporary ban from posting to the list
3. Permanent ban from posting to the list
4. Temporary ban from posting to any RIPE mailing list
5. Permanent ban from posting to any RIPE mailing list

Loss of Community Role

The procedures to remove people from various roles within the community are covered in the relevant RIPE Documents. The CoC Team does not have any additional powers in this regard, and so this is not a consequence it can apply. However, it may be the case that a person is no longer able to carry out their role after other consequences have been applied following a serious breach of the CoC, such as being banned from mailing lists or prevented from attending RIPE events.