[diversity] On the RIPE community CoC

Hello all,

At the last RIPE meeting, we talked about our Code of Conduct. I offered to
send a good example. I’ve since also actually reported a CoC incident in the
RIPE community, and want to share some thoughts on that experience.

Sending a CoC example took some time, as I’ve been refactoring and improving
the CoC for the Write the Docs community. Our new CoC is:
http://www.writethedocs.org/code-of-conduct/
http://www.writethedocs.org/code-of-conduct-response/
And these are the most significant changes:
http://www.writethedocs.org/blog/new-community-coc-2019/
I’m happy to further explain the decisions behind it,
if you have any questions.

I will not share the full details of the incident I reported in the RIPE
community, because I prefer not to be identified as the reporter. About
four months have passed since my report, and I have not received any reply
from the wg chairs or the RIPE chair, who are the designated contacts,
other than two notes that it was being worked on. I initially reported to
the relevant working group chairs, and then escalated to the RIPE chair,
as documented in the RIPE community CoC. To my knowledge, no action has
been taken.

My general impression is that none of the people listed as CoC contacts in
any part of the RIPE community are able to effectively take action on a CoC
incident. Either because this is explicitly not part of their task (trusted 
contacts) or, I suspect, they lack any kind of resources or possibly time
to handle an incident. That is *not* a failure on the part of any of these
people individually, but rather caused by a flawed and mostly absent process
and mandate to act.

In addition, confidentiality of CoC reports is violated in every single report.
Both wg chair mailing lists and the trusted contacts address are moderated by
NCC staff, which means an unknown person(s) can also see the report, and
reporters are not made aware of this in advance. This can have severe
consequences, and makes reporting unsafe. The RIPE chair doesn’t seem to
have any publicly listed contact address at all.

Personally I feel that the ability of the RIPE community to handle a CoC
incident is so abysmal, that we would be better off not publishing one at
all, as we are now creating a false sense of security.

I should also note that this was a fairly minor incident, pretty much the most
trivial kind of incident a CoC contact has to deal with. The consequences of
the lack of ability to respond properly could be very severe in case of a more
serious incident - which have taken place in the RIPE community as well.

The updated Code of Conduct for Write the Docs, along with our response guide,
handles many of these concerns specifically, so I suggest you have a look at it,
and see how it can be adopted for the RIPE community. However, in order to have
an effective CoC process, it will also require setting up one or more response
teams, which can be contacted privately, with publicly listed membership, and
most importantly, a mandate to act. Including, if needed, immediate removal of
a community member, including those in a position of power.
From my personal experience, this is a quite rare measure, but it needs to be
on the table for the CoC to be effective.

I’m not sure what the process would be to continue with this, or how others
feel - I’m curious to hear your ideas. But the apparent fact that the RIPE
community is currently unable to handle even the most trivial CoC reports,
makes it inherently unsafe.

Sasha