Change the policy when receiving a report to [email protected]

[benjamingr]

Suggested by @Trott here #512 (comment) - since there are over 600 people with access to moderation and reports sometimes detail information of members it changes our process from:

• Open an issue in the moderation repo with some of the report info.

To:

• Disclose reports (upon request) to the TSC and CommComm

This reduces the visibility of CoC reports from ~700 people (org) to ~50 people (TSC, CommComm and moderation). Rich makes some of the compelling arguments here and I think the moderation team is in consensus regarding this change (but let's let this PR sit for a few days just to be sure).

cc @nodejs/moderation

If there is interest, we can add a clause suggesting anonymous publication of what Node.js did to deal with reports in the future.

[benjamingr]

Also since this is a governance change pinging @nodejs/tsc @nodejs/community-committee - the changes from your perspective are:

• Reports used to be posted after editing by moderation team members to the moderation repo. Reports were always shared with TSC/CommComm.
• Reports will now be made directly available unaltered to the governing bodies upon request instead.

Of course, the exception to this is if someone makes a report against a member in a governing body like the TSC/CommComm in which case - we will disclose information to the other members of said bodies.

[mcollina]

lgtm

[Trott]

Disclose reports (upon request) to the TSC and CommComm

Looking at the change itself, it looks like this is about disclosing the existence of the report to TSC and CommComm but not necessarily any particular details, which is 👍 by me.

[benjamingr]

@Trott the part I was hesitant about is: a lot of the reports we get are spam, some are meaningful.

I would not want to have a process that explicitly requires the moderation team to forward the racist spam bits to the TSC/CommComm.

Currently, there is a high level of trust and good faith between the moderation team and TSC/CommComm (at least that's my feeling) but we don't know if a year from now a different TSC might be suspicious of a different moderation team. I feel strongly that reports and how we handle them should be auditable, so even if there is a report we consider spam - I want the TSC/CommComm to know of its existence and to be able to audit our handling of it.

So the way I see it:

• Reports get sent to the moderation team.
• The moderation team does not open an issue.
• The moderation team representatives in the leadership bodies (currently you in the TSC and Tierney in CommComm) update these bodies regarding the report.
• These bodies may request to see the full report if they're interested. Even if the moderation team believes it spam.

I might just be overthinking this though 😅

[Trott]

@benjamingr I think you misunderstood me. Or maybe not. Regardless, I am absolutely in favor of erring on the side of keeping the contents of the reports confidential and NOT sharing them with TSC or CommComm by default. Sharing their existence? Yes, absolutely. "We received a CoC complaint this week and are investigating." But as to who submitted the complaint, etc.? No, no need to share that, generally.

I think you and I are in agreement, and if not, then mostly in agreement.

The moderation team representatives in the leadership bodies (currently you in the TSC and Tierney in CommComm) update these bodies regarding the report.

Also, Shelley is on the TSC and on Moderation.

[benjamingr]

I think we are in agreement, I was mostly just clarifying.

Also, Shelley is on the TSC and on Moderation.

I picked you and Tierney mostly because I saw you update the TSC in the meeting issues and Tierney updates the #log channel with "Updated CommComm until this line".

I like you, but I am not trying to pick favourite TSC/CommComm members 🙃

I am thankful we have you and Shelley in moderation (and would be happy if more TSC/CommComm members and project members in general volunteered to join).

[benjamingr]

Looks like this has a bunch of LGTM, I am going to merge (not sure what the merge waiting time policy is?) and let's revert and reopen if someone feels strongly about not doing this.