Tag: anti-harassment

Posted on

No more rock stars: how to stop abuse in tech communities

This was co-written with Leigh Honeywell and Valerie Aurora, and was originally published on hypatia.ca. It’s also available en français sur repeindre.info.

Content note for discussion of abuse and sexual violence.

In the last couple of weeks, three respected members of the computer security and privacy tech communities have come forward under their own names to tell their harrowing stories of sexual misconduct, harassment, and abuse committed by Jacob Appelbaum. They acted in solidarity with the first anonymous reporters of Jacob’s abuse. Several organizations have taken steps to protect their members from Appelbaum, including the Tor Project, Debian, and the Noisebridge hackerspace, with other responses in progress.

But Appelbaum isn’t the last – or the only – abuser in any of these communities. Many people are calling for long-term solutions to stop and prevent similar abuse. The authors of this post have recommendations, based on our combined 40+ years of community management experience in the fields of computer security, hackerspaces, free and open source software, and non-profits. In four words, our recommendation is:

No more rock stars.

What do we mean when we say “rock stars?” We like this tweet by Molly Sauter:

Seriously, “rock stars” are arrogant narcissists. Plumbers keep us all from getting cholera. Build functional infrastructure. Be a plumber.

You can take concrete actions to stop rock stars from abusing and destroying your community. But first, here are a few signs that help you identify when you have a rock star instead of a plumber:

A rock star likes to be the center of attention. A rock star spends more time speaking at conferences than on their nominal work. A rock star appears in dozens of magazine profiles – and never, ever tells the journalist to talk to the people actually doing the practical everyday work. A rock star provokes a powerful organization over minor issues until they crack down on the rock star, giving them underdog status. A rock star never says, “I don’t deserve the credit for that, it was all the work of…” A rock star humble-brags about the starry-eyed groupies who want to fuck them. A rock star actually fucks their groupies, and brags about that too. A rock star throws temper tantrums until they get what they want. A rock star demands perfect loyalty from everyone around them, but will throw any “friend” under the bus for the slightest personal advantage. A rock star knows when to turn on the charm and vulnerability and share their deeply personal stories of trauma… and when it’s safe to threaten and intimidate. A rock star wrecks hotel rooms, social movements, and lives.

Why are rock stars so common and successful? There’s something deep inside the human psyche that loves rock stars and narcissists. We easily fall under their spell unless we carefully train ourselves to detect them. Narcissists are skilled at making good first impressions, at masking abusive behavior as merely eccentric or entertaining, at taking credit for others’ work, at fitting our (often inaccurate) stereotypes of leaders as self-centered, self-aggrandizing, and overly confident. We tend to confuse confidence with competence, and narcissists are skilled at acting confident.

Sometimes rock stars get confused with leaders, who are necessary and good. What’s the difference between a rock star and a leader? We like the term “servant-leader” as a reminder that the ultimate purpose of a good leader is to serve the mission of their organization (though this feminist critique of the language around servant-leadership is worth reading). Having personal name recognition and the trust and support of many people is part of being an effective leader. This is different from the kind of uncritical worship that a rock star seeks out and encourages. Leaders push back when the adoration gets too strong and disconnected from achieving the mission (here is a great example from Anil Dash, pushing back after being held up as an example of positive ally for women in tech). Rock stars aren’t happy unless they are surrounded by unthinking adoration.

How do we as a community prevent rock stars?

If rock stars are the problem, and humans are susceptible to rock stars, how do we prevent rock stars from taking over and hijacking our organizations and movements? It turns out that some fairly simple and basic community hygiene is poisonous to rock stars – and makes a more enjoyable, inclusive, and welcoming environment for plumbers.

Our recommendations can be summarized as: decentralizing points of failure, increasing transparency, improving accountability, supporting private and anonymous communication, reducing power differentials, and avoiding situations that make violating boundaries more likely. This is a long blog post, so here is a table of contents for the rest of this post:

Have explicit rules for conduct and enforce them for everyone

Create a strong, specific, enforceable code of conduct for your organization – and enforce it, swiftly and without regard for the status of the accused violator. Rock stars get a kick out of breaking the rules, but leaders know they are also role models, and scrupulously adhere to rules except when there’s no alternative way to achieve the right thing. Rock stars also know that when they publicly break the little rules and no one calls them out on it, they are sending a message that they can also break the big rules and get away with it.

One of the authors of this post believed every first-person allegation of abuse and assault by Jacob Appelbaum – including the anonymous ones – immediately. Why? Among many other signs, she saw him break different, smaller rules in a way that showed his complete and total disregard for other people’s time, work, and feelings – and everyone supported him doing so. For example, she once attended a series of five minute lightning talks at the Noisebridge hackerspace, where speakers sign up in advance. Jacob arrived unannounced and jumped in after the first couple of talks with a forty-five minute long boring rambling slideshow about a recent trip he took. The person running the talks – someone with considerable power and influence in the same community – rolled his eyes but let Jacob talk for nine times the length of other speakers. The message was clear: rules don’t apply to Jacob, and even powerful people were afraid to cross him.

This kind of blatant disregard for the rules and the value of people’s time was so common that people had a name for it: “story time with Jake,” as described in Phoenix’s pseudonymous allegation of sexual harassment. Besides the direct harm, dysfunction, and disrespect this kind of rule-breaking and rudeness causes, when you allow people to get away with it, you’re sending a message that they can get away with outright harassment and assault too.

To solve this, create and adopt a specific, enforceable code of conduct for your community. Select a small expert group of people to enforce it, with provisions for what to do if one of this group is accused of harassment. Set deadlines for responding to complaints. Conduct the majority of discussion about the report in private to avoid re-traumatizing victims. Don’t make exceptions for people who are “too valuable.” If people make the argument that some people are too valuable to censure for violating the code of conduct, remove them from decision-making positions. If you ever find yourself in a situation where you are asking yourself if someone’s benefits outweigh their liabilities, recognize that they’ve already cost the community more than they can ever give to it and get to work on ejecting them quickly.

Start with the assumption that harassment reports are true and investigate them thoroughly

Over more than a decade of studying reports of harassment and assault in tech communities, we’ve noticed a trend: if things have gotten to the point where you’ve heard about an incident, it’s almost always just the tip of the iceberg. People argue a lot about whether to take one person’s word (the alleged victim) over another’s (the alleged harasser), but surprisingly often, this was not the first time the harasser did something harmful and it’s more likely a “one person said, a dozen other people said” situation. Think about it: what are the chances that someone had a perfect record of behavior, right up till the instant they stuck their hand in someone else’s underwear without consent – and that person actually complained about it – AND you heard about it? It’s far more likely that this person has been gradually ramping up their bad behavior for years and you just haven’t heard about it till now.

The vast majority of cases we know about fit one of these two patterns:

  1. A clueless person makes a few innocent, low-level mistakes and actually gets called on one of them fairly quickly. Signs that this is the likely case: the actual incident is extremely easy to explain as a mistake, the accused quickly understands what they did wrong, they appear genuinely, intensely embarrassed, they apologize profusely, and they offer a bunch of ways to make up for their mistake: asking the video of their talk to be taken down, writing a public apology explaining why what they did was harmful, or proposing that they stop attending the event for some period of time.
  2. A person who enjoys trampling on the boundaries of others has been behaving badly for a long time in a variety of ways, but everyone has been too afraid to say anything about it or do anything about other reports. Signs that this is the likely case: the reporter is afraid of retaliation and may try to stay anonymous, other people are afraid to talk about the incident for the same reason, the reported incident may be fairly extreme (e.g., physical assault with no question that consent was violated), many people are not surprised when they hear about it, you quickly gather other reports of harassment or assault of varying levels, the accused has plagiarized or stolen credit or falsified expense reports or done other ethically questionable things, the accused has consolidated a lot of power and attacks anyone who seems to be a challenge to their power, the accused tries to change the subject to their own grievances or suffering, the accused admits they did it but minimizes the incident, or the accused personally attacks the reporter using respectability politics or tone-policing.

In either case, your job is to investigate the long-term behavior of the accused, looking for signs of narcissism and cruelty, big and small. Rock stars leave behind a long trail of nasty emails, stolen credit, rude behavior, and unethical acts big and small. Go look for them.

Make it easy for victims to find and coordinate with each other

Rock stars will often make it difficult for people to talk or communicate without being surveilled or tracked by the rock star or their assistants, because private or anonymous communication allows people to compare their experiences and build effective resistance movements. To fight this, encourage and support private affinity groups for marginalized groups (especially people who identify as women in a way that is significant to them), create formal systems that allow for anonymous or pseudonymous reporting such as an ombudsperson or third-party ethics hotline, support and promote people who are trusted contact points and/or advocates for marginalized groups, and reward people for raising difficult but necessary problems.

Watch for smaller signs of boundary pushing and react strongly

Sometimes rock stars don’t outright break the rules, they just push on boundaries repeatedly, trying to figure out exactly how far they can go and get away with it, or make it so exhausting to have boundaries that people stop defending them. For example, they might take a little too much credit for shared work or other people’s work, constantly bring up the most disturbing but socially acceptable topic of conversation, resist de-escalation of verbal conflict, subtly criticize people, make passive-aggressive comments on the mailing list, leave comments that are almost but not quite against the rules, stand just a little too close to people on purpose, lightly touch people and ignore non-verbal cues to stop (but obey explicit verbal requests… usually), make comments which subtly establish themselves as superior or judges of others, interrupt in meetings, make small verbal put-downs, or physically turn away from people while they are speaking. Rock stars feel entitled to other people’s time, work, and bodies – signs of entitlement to one of these are often signs of entitlement to the others.

Call people out for monopolizing attention and credit

Is there someone in your organization who jumps on every chance to talk to a reporter? Do they attend every conference they can and speak at many of them? Do they brag about their frequent flyer miles or other forms of status? Do they jump on every project that seems likely to be high visibility? Do they “cookie-lick” – claim ownership of projects but fail to do them and prevent others from doing them either? If you see this happening, speak up: say, “Hey, we need to spread out the public recognition for this work among more people. Let’s send Leslie to that conference instead.” Insist that this person credit other folks (by name or anonymously, as possible) prominently and up front in every blog post or magazine article or talk. Establish a rotation for speaking to reporters as a named source. Take away projects from people if they aren’t doing them, no matter how sad or upset it makes them. Insist on distributing high status projects more evenly.

A negative organizational pattern that superficially resembles this kind of call-out can sometimes happen, where people who are jealous of others’ accomplishments and successes may attack effective, non-rock star leaders. Signs of this situation: people who do good, concrete, specific work are being called out for accepting appropriate levels of public recognition and credit by people who themselves don’t follow through on promises, fail at tasks through haplessness or inattention, or communicate ineffectively. Complaints about effective leaders may take the form of “I deserve this award for reasons even though I’ve done relatively little work” instead of “For the good of the organization, we should encourage spreading out the credit among the people who are doing the work – let’s talk about who they are.” People complaining may occasionally make minor verbal slips that reveal their own sense of entitlement to rewards and praise based on potential rather than accomplishments – e.g., referring to “my project” instead of “our project.”

Insist on building a “deep bench” of talent at every level of your organization

Your organization should never have a single irreplaceable person – it should have a deep bench. Sometimes this happens through a misplaced sense of excessive responsibility on the part of a non-abusive leader, but often it happens through deliberate effort from a “rock star.” To prevent this, constantly develop and build up a significant number of leaders at every level of your organization, especially near the top. You can do this by looking for new, less established speakers (keynote speakers in particular) at your events, paying for leadership training, creating official deputies for key positions, encouraging leaders to take ample vacation and not check email (or chat) while they are gone, having at least two people talk to each journalist, conducting yearly succession planning meetings, choosing board members who have strong opinions about this topic and a track record of acting on them, having some level of change or turnover every few years in key leadership positions, documenting and automating key tasks as much as possible, sharing knowledge as much as possible, and creating support structures that allow people from marginalized groups to take on public roles knowing they will have support if they are harassed. And if you need one more reason to encourage vacation, it is often an effective way to uncover financial fraud (one reason why abusive leaders often resist taking vacation – they can’t keep an eye on potential exposure of their misdeeds).

Flatten the organizational hierarchy as much as possible

Total absence of hierarchy is neither possible nor desirable, since “abolishing” a hierarchy simply drives the hierarchy underground and makes it impossible to critique (but see also the anarchist critique of this concept). Keeping the hierarchy explicit and making it as flat and transparent as possible while still reflecting true power relationships is both achievable and desirable. Ways to implement this: have as small a difference as possible in “perks” between levels (e.g., base decisions on flying business class vs. economy on amount of travel and employee needs, rather than position in the organization), give people ways to blow the whistle on people who have power over them (including channels to do this anonymously if necessary), and have transparent criteria for responsibilities and compensation (if applicable) that go with particular positions.

Build in checks for “failing up”

Sometimes, someone gets into a position of power not because they are actually good at their job, but because they turned in a mediocre performance in a field where people tend to choose people with proven mediocre talent over people who haven’t had a chance to demonstrate their talent (or lack thereof). This is called “failing up” and can turn otherwise reasonable people into rock stars as they desperately try to conceal their lack of expertise by attacking any competition and hogging attention. Or sometimes no one wants to take the hit for firing someone who isn’t capable of doing a good job, and they end up getting promoted through sheer tenacity and persistence. The solution is to have concrete criteria for performance, and a process for fairly evaluating a person’s performance and getting them to leave that position if they aren’t doing a good job.

Enforce strict policies around sexual or romantic relationships within power structures

Rock stars love “dating” people they have power over because it makes it easier to abuse or assault them and get away with it. Whenever we hear about an organization that has lots of people dating people in their reporting chain, it raises an automatic red flag for increased likelihood of abuse in that organization. Overall, the approach that has the fewest downsides is to establish a policy that no one can date within their reporting chain or across major differences in power, that romantic relationships need to be disclosed, and that if anyone forms a relationship with someone in the same reporting chain, the participants need to move around the organization until they no longer share a reporting chain. Yes, this means that if the CEO or Executive Director of an organization starts a relationship with anyone else in the organization, at least one of them needs to leave the organization, or take on some form of detached duty for the duration of the CEO/ED’s tenure. When it comes to informal power relationships, such as students dating prominent professors in their fields, they also need to be forbidden or strongly discouraged. These kinds of policies are extremely unattractive to a rock star, because part of the attraction of power for them is wielding it over romantic or sexual prospects.

Avoid organizations becoming too central to people’s lives

Having a reasonable work-life balance isn’t just an ethical imperative for any organization that values social justice, it’s also a safety mechanism so that if someone is forced to leave, needs to leave, or needs to take a step back, they can do so without destroying their entire support system. Rock stars will often insist on subordinates giving 100% of their available energy and time to the “cause” because it isolates them from other support networks and makes them more dependent on the rock star.

Don’t set up your community so that if someone has a breach with your community (e.g., is targeted for sustained harassment that drives them out), they are likely to also lose more than one of: their job, their career, their romantic relationships, their circle of friends, or their political allies. Encouraging and enabling people to have social interaction and support outside your organization or cause will also make it easier to, when necessary, exclude people behaving abusively or not contributing because you won’t need to worry that you’re cutting them off from all meaningful work or human contact.

You should discourage things like: semi-compulsory after hours socialising with colleagues, long work hours, lots of travel, people spending almost all their “intimacy points” or emotional labour on fellow community members, lots of in-group romantic relationships, everyone employs each other, or everyone is on everyone else’s boards. Duplication of effort (e.g., multiple activist orgs in the same area, multiple mailing lists, or whatever) is often seen as a waste, but it can be a powerfully positive force for allowing people some choice of colleagues.

Distribute the “keys to the kingdom”

Signs of a rock star (or occasionally a covert narcissist) may include insisting on being the single point of failure for one or more of: your technical infrastructure (e.g., domain name registration or website), your communication channels, your relationship with your meeting host or landlord, your primary source of funding, your relationship with the cops, etc. This increases the rock star’s power and control over the organization.

To prevent this, identify core resources, make sure two or more people can access/administer all of them, and make sure you have a plan for friendly but sudden, unexplained, or hostile departures of those people. Where possible, spend money (or another resource that your group can collectively offer) rather than relying on a single person’s largesse, specialized skills, or complex network of favours owed. Do things legally where reasonably possible. Try to be independent of any one critical external source of funding or resources. If there’s a particularly strong relationship between one group member and an external funder, advisor, or key organization, institutionalize it: document it, and introduce others into the relationship.

One exception is that it’s normal for contact with the press to be filtered or approved by a single point of contact within the organization (who should have a deputy). However, it should be possible to talk to the press as an individual (i.e., not representing your organization) and anonymously in cases of internal organizational abuse. At the same time, your organization should have a strong whistleblower protection policy – and board members with a strong public commitment and/or a track record of supporting whistleblowers in their own organizations.

Don’t create environments that make boundary violations more likely

Some situations are attractive to rock stars looking to abuse people: sexualized situations, normalization of drinking or taking drugs to the point of being unable to consent or enforce boundaries, or other methods of breaking down or violating physical or emotional boundaries. This can look like: acceptance of sexual jokes at work, frequent sexual liaisons between organization members, mocking people for not being “cool” for objecting to talking about sex at work, framing objection to sexualized situations as being homophobic/anti-polyamorous/anti-kink, open bars with hard alcohol or no limit on drinks, making it acceptable to pressure people to drink more alcohol than they want or violate other personal boundaries (food restrictions, etc.), normalizing taking drugs in ways that make it difficult to stay conscious or defend boundaries, requiring attendance at physically isolated or remote events, having events where it is difficult to communicate with the outside world (no phone service or Internet access), having events where people wear significantly less or no clothing (e.g. pool parties, saunas, hot tubs), or activities that require physical touching (massage, trust falls, ropes courses). It’s a bad sign if anyone objecting to these kinds of activities is criticized for being too uptight, puritanical, from a particular cultural background, etc.

Your organization should completely steer away from group activities which pressure people, implicitly or explicitly, to drink alcohol, take drugs, take off more clothing than is usual for professional settings in the relevant cultures, or touch or be touched. Drunkenness to the point of marked clumsiness, slurred speech, or blacking out should be absolutely unacceptable at the level of organizational culture. Anyone who seems to be unable to care for themselves as the result of alcohol or drug use should be immediately cared for by pre-selected people whose are explicitly charged with preventing this person from being assaulted (especially since they may have been deliberately drugged by someone planning to assault them). For tips on serving alcohol in a way that greatly reduces the chance of assault or abuse, see Kara Sowles’ excellent article on inclusive events. You can also check out the article on inclusive offsites on the Geek Feminism Wiki.

Putting this to work in your community

We waited too long to do something about it.

Odds are, your community already has a “missing stair” or three – even if you’ve just kicked one out. They are harming and damaging your community right now. If you have power or influence or privilege, it’s your ethical responsibility to take personal action to limit the harm that they are causing. This may mean firing or demoting them; it may mean sanctioning or “managing them out.” But if you care about making the world a better place, you must act.

If you don’t have power or influence or privilege, think carefully before taking any action that could harm you more and seriously consider asking other folks with more protection to take action instead. Their response is a powerful litmus test of their values. If no one is willing to take this on for you, your only option may be leaving and finding a different organization or community to join. We have been in this position – of being powerless against rock stars – and it is heartbreaking and devastating to give up on a cause, community, or organization that you care about. We have all mourned the spaces that we have left when they have become unlivable because of abuse. But leaving is still often the right choice when those with power choose not to use it to keep others safe from abuse.

Responses

While we are not asking people to “cosign” this post, we want this to be part of a larger conversation on building abuse-resistant organizations and communities. We invite others to reflect on what we have written here, and to write their own reflections. If you would like us to list your reflection in this post, please leave a comment or email us a link, your name or pseudonym, and any affiliation you wish for us to include, and we will consider listing it. We particularly invite survivors of intimate partner violence in activist communities, survivors of workplace harassment and violence, and people facing intersectional oppressions to participate in the conversation.

2016-06-21: The “new girl” effect by Lex Gill, technology law researcher & activist

2016-06-21: Patching exploitable communities by Tom Lowenthal, security technologist and privacy activist

2016-06-22: Tyranny of Structurelessness? by Gabriella Coleman, anthropologist who has studied hacker communities

We would prefer that people not contact us to disclose their own stories of mistreatment. But know this: we believe you. If you need emotional support, please reach out to people close to you, a counselor in your area, or to the trained folks at RAINN or Crisis Text Line.

Credits

This post was written by Valerie Aurora (@vaurorapub), Mary Gardiner (@me_gardiner), and Leigh Honeywell (@hypatiadotca), with grateful thanks for comments and suggestions from many anonymous reviewers.

Posted on

Handling harassment incidents swiftly and safely

This article was written by me and originally published on the Ada Initiative’s website. It is republished here according to the terms of its Creative Commons licence.

As anti-harassment policies become more widespread at open technology and culture events, different ways of handling harassment incidents are emerging. We advocate a swift process in which final decisions are made by a small group of empowered decision makers, whose focus is on the safety of the people attending the event.

Open technology and culture communities, which often make decisions in a very public way, can be tempted to also have a very public and very legalistic harassment handling process, a judicial model, but we advocate against this. It prioritises other values, such as transparency and due process, over that of safety. Alternatively, because many members of such communities find ostracism very hurtful and frightening, sometimes they develop a caretaker model, where they give harassers lots of second chances and lots of social coaching, and focus on the potential for a harasser to redeem themselves and re-join the community.

But neither of these models prioritise safety from harassment.

Consider an alternative model: harassment in the workplace. In a well-organised workplace that ensured your freedom from harassment — a situation which we know is also all too rare, but which we can aspire to, especially since our events are workplaces for many of us — an empowered decision maker such as your manager or an HR representative would make a decision based on your report that harassment had occurred and other relevant information as judged by them, and act as required order to keep your workplace safe for you.

A well-organised workplace would not appoint itself your harasser’s anti-harassment coach, have harassment reports heard by a jury of your peers, publish the details of your report widely, have an appeals process several levels deep, or offer fired staff members the opportunity to have their firing reviewed by management after some time has passed.

Like in a well-organised workplace, we advocate a management model of handling harassment complaints to make events safer: reasonably quick and final decisions made by a small group of empowered decision makers, together with communication not aimed at transparency for its own sake, but at giving people the information they need to keep themselves safe.

The management model of harassment handling is that:

  1. you have a public harassment policy that clearly states that harassment is unacceptable, and gives examples of unacceptable behaviour
  2. you have a clear reporting avenue publicised with the policy
  3. you have an empowered decision maker, or a small group of decision makers, who will act on reports
  4. reports of harassment are conveyed to those decision makers when reported
  5. they consider those reports, gather any additional information they need to make a decision — which could include conduct in other venues and other information that a very legalistic model might not allow — and they decide what action would make the event safer
  6. they communicate with people who need to know the outcome (eg, with the harasser if they need to change their behaviour, avoid any people or places, or leave the event; volunteers or security if they need to enforce any boundaries)
  7. they provide enough information to the victim of the harassment, and when needed to other attendees, to let them make well-informed decisions about their own safety

Further reading

Creative Commons License
Handling harassment incidents swiftly and safely
 by the Ada Initiative is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
Based on a work at https://adainitiative.org/2014/07/23/handling-harassment-incidents-swiftly-and-safely/.

Posted on

Are your lulz low quality? Valerie Aurora is here to help

This article originally appeared on Geek Feminism.

Warning for mention of sexual assault, and extensive discussion of harassment.

In May, my GF co-blogger and Ada Initiative co-founder Valerie Aurora posted Handy tips for my Internet harassers on her blog. They included:

Threatening my job: Unfortunately, I am my own boss. Try emailing one of the Ada Initiative sponsors? Although they might take that as a sign that the Ada Initiative is doing important work and make another donation. Hmmmm. Maybe create a Yelp page for my file systems consulting business and leave bad reviews? Endorse me for CSS on LinkedIn?

Rape and death threats: Run spell check! There’s nothing more jarring than reading an otherwise creative and well-written death threat and then seeing “decapetate.” Also, chain-saws are so last year. Remember, Gmail won’t display images by default. P.S. I happen to know one of the members of Nirvana and your bright idea has already been done.

Why did she do such a thing, and what resulted? Geek Feminism obtained an exclusive tell-all interview.

Q. Have you received any harassment as a result of this post? Was its quality indeed improved?

Sadly, no. Part of the problem is that my friends loved it — I’ve never had so much positive feedback on a post — but they didn’t want to share it with other people online. I like to joke that it’s the ultimate in dark social since people only talk about it offline using vibrations in the air called “sound.” I think that my friends are more afraid of me being harassed than I am.

Q. The post is pretty out there! Why did you put this post up? What point are you trying to make?

“Self-doxxing” myself (thanks, Kate Losse for the term) was inspired in part by how incompetent and bad the online harassment that I’ve received has been. Most people doing online harassment are just trying to impress other online harassers, at the same time that what they are doing is, frankly, totally unimpressive. The reality is, anyone can spend $25 and get another person’s home address and a bunch of other personal information, but we act like it is some kind of amazing act of computer hacking. By showing how bad people are at online harassing, I’m hoping to remove some of the motivation for people to do the harassment, or at least make them spend more time on it before they get the reward of “so cool, bro!”

I was also inspired by Krystal Ball , who ran for U.S. congress in 2010. When her political opponents tried to slut-shame her into quitting her political campaign over “sexy photos” of herself that they published, she turned around and shamed THEM — both her opponent and the media outlets that published the photos. It was glorious, and it hit home for me: if we let the existence of sexy photo of a woman prevent her from serving in political office, then I and every woman born after 1990 were out of luck. Women’s representation in political office would go down.

Q. Should other people do this?

For most people, no, I wouldn’t recommend it. It was okay for me for a lot of reasons: I already went public about sexual abuse in my family, I’m white, I’m my own boss, I don’t have children or a partner, I have skills that are in high demand, I have lots of friends and a huge support network — my emotional, physical, and economic safety is pretty good. Most women have a lot more to lose.

However, I think it is a very good exercise to think about worst cases like this: what if the thing I am most afraid of other people finding out got published all over the Internet? Because a lot of times, that thing actually doesn’t reflect on you – the shame is on the person who did the original act or publicized a private matter. It can be healing to plan what you might do, even if you don’t actually go public with it yourself.

Q. Why won’t you accept my endorsement for CSS on LinkedIn? I taught you everything you know, dammit.

I’d hate to embarrass you by letting anyone else know that you are the source of my mangled <div>’s! [Ed: good point, well made.]

Q. When are you monetising this? How can investors contact you? How big is your Series A and at what valuation?

Actually, that is a great idea. Instead of vetting a political candidate and saying yes or no, you investigate them and then publish everything that might be a problem in a funny blog post.

Or better yet, here is my favorite idea: If I ever run for political office, I’m going to scan in all my embarrassing naked photos, then watermark them with the email addresses of various journalists. Then email them anonymously to said journalists. Then when the photos get published (it’s “news,” someone else would have, etc.), I can expose the specific person who decided that slut-shaming a candidate was “news” and put the shame where it belongs. Sexism-shaming as a service, SSaaS. I’m accepting funding now.

Posted on

Code of Conduct timeline and postmortem

This article originally appeared on Geek Feminism.

Last week, Geek Feminism announced we’ve adopted a Code of Conduct.

As Annalee said in that announcement, this comes long after adoption of codes in other communities, especially events:

You’ve been promoting Codes of Conduct for years. Why didn’t you adopt one of your own sooner?

We dropped the ball in a big way here. We’ve known for at least two years that we needed a Code of Conduct internally. We’re sorry for the inexcusable delay.

We thought it would be useful to other communities to discuss how this happened.

Timeline

May 2008: Skud founded the Geek Feminism wiki, two and a half years before anti-harassment policies and codes of conduct began to be promoted by geek feminists.

August 2009: Skud founded the Geek Feminism blog, more than one year before anti-harassment policies and codes of conduct began to be promoted by geek feminists. At the time of launch. the blog had a strong comment policy which remains in essentially the same form (albeit expanded since). We weren’t the first by a long way to have such a policy (in fact it was based fairly closely on that of Hoyden About Town) but this was at the time unusual among the technical blogs and forums that many of the original bloggers frequented.

November 2010: Warning for assault Nóirín Plunkett was assaulted at ApacheCon. Within the month, Valerie Aurora had released a draft anti-harassment policy for events and finalised it for events to adopt. This is the policy that is now maintained on the wiki.

I have not found any discussion of Geek Feminism adopting such a policy internally at this time, which isn’t surprising considering it was envisaged as being for in-person events.

Early 2011: there were person-to-person complaints within the Geek Feminism community that an individual within it is harassing people when Geek Feminism contributors meet up in person (as sometimes happens at conferences we attend and similar).

January 2012: AdaCamp Melbourne (the first event I know of run by Geek Feminism community members that occurred after the development of the event anti-harassment policy) has an anti-harassment policy.

July 2012: Blogger Nice Girl reported harassment at OSCON by attendees identifying as geek feminists and using terminology from our wiki. (We do not know the identities of these people.) In August, Skud wrote on the blog:

We are taking a few different steps to address the specific concerns raised. One is that we are reviewing our wiki pages to make sure that we have information on slut-shaming and that it is appropriately cross-linked with articles about sexualised environments at geek events to help reinforce/educate people that criticising an individual woman’s choice of clothing is very different from criticising (for instance) a business that uses booth babes as a marketing device.

The second thing is that we are setting up a process so that people can contact us if they experience harassment by someone associated with GF. This is a work in progress, especially since GF is (as mentioned) a loose affiliation with no official membership, and because we may be asked to deal with harassment that occurs outside our own spaces. However, if someone is harassing another person under GF’s name or in a way associated with GF, then we want to provide a private way for people to contact us, and respond appropriately.

On the same day, Skud wrote the first version of the wiki’s Slut shaming page.

At around this time, Skud founded Growstuff, reducing her available volunteer time; her participation in the blog and other Geek Feminism activities dropped drastically over the next few months.

July/August 2012: Emails about the harassment by a Geek Feminism member discussed earlier began to circulate among Geek Feminism bloggers, presumably with our awareness of internal harassment risks heightened by the public and private discussions of Nice Girl’s reports. More than one person reported feeling unsafe and no longer recommending our backchannels as safe spaces. Skud first became aware of these reports at this time.

Given the seriousness of a known harasser operating in a community central to anti-harassment policy promotion, it didn’t seem appropriate to wait for a policy and response group as mooted by Skud to be in place and instead Valerie Aurora spearheaded a letter asking this person to leave the community, which was signed by several others including myself. The person left our community.

After this, I cannot find any further internal discussion of an anti-harassment policy for approximately another year.

April 2013: Recognising her lack of availability for volunteering due to work commitments, Skud formally announced she was stepping down as a Geek Feminism administrator. There was a discussion about handing over various technical responsibilities but not (that I can find) about the anti-harassment status.

July 2013: I sent an email to the blogger backchannel reminding them that an anti-harassment policy is still to be developed. There was a short and inconclusive discussion.

October 2013: Annalee produced an early draft policy document with many unresolved questions, particularly who the policy was intended to apply to, and how reports would be resolved. Comments on the document were made by several community members.

November 2013: Rick Scott began to formalise existing editorial practice on the wiki in the Editorial guidelines page, which was revised over a few months by a small group of wiki editors. It is intended more to communicate norms to newcomers and onlookers than to protect wiki editors from each other.

January 2014: Discussion had died down on Annalee’s draft. I sent an email with some open questions but no one including myself follows up before May.

May 2014: Annalee produced a new draft anti-harassment policy and circulated it for discussion. Skud, Tim, Valerie and myself all commented and edited substantially. Annalee asked for consensus on adopting it, Valerie suggests she JFDI, and I ended up proposing a timeline through to late June for circulating it more widely, giving people time to familiarise themselves, appointing the Anti-Abuse team, and then making the document public.

June 2014: The Anti-Abuse Team was appointed after an internal feedback process. Annalee announced our Code of Conduct publicly. I made our policy made available for reuse and promoted adoption by other communities.

Post mortem

Things we did right

Skud established best practices (particularly the comment policy) at the time our community was founded.

When it became clear that harassment in our community was a periodic problem, we acknowledged publicly that we had not put best practices into place (a anti-harassment policy) and began discussing one suitable to our community.

We returned to the issue periodically without further external prompting or known (to me) incidents of harassment and eventually got a policy in place. In the process, we hope we have developed a new best-practice policy for communities to use so that others do not have to go through this process.

Our new policy has a pretty sophisticated description of various types of harassment, based on a wide variety of personal experiences and reports of harassment received by those of us who do anti-harassment action or advising in other communities. It is better adapted for a long-lived community than the event policy is, by, eg, considering incidents of harassment in the past and in other communities. It has a more explicitly feminist stance in, eg, stating that it centres the concerns of marginalised people, and that tone-policing will not be regarded as harassment.

Things we did wrong

Various individual members of the community were slow to recognise harassment in our community based on first-hand reports from victims.

We were very slow at responding to the known need for a policy, especially for a group which was among the leaders in advocating that in-person events adopt policies. Even on the most generous reading of this timeline, there was explicit discussion of an internal anti-harassment policy in August 2012, at the time Skud discussed Nice Girl’s harassment, meaning that nearly two years passed between us explicitly committing to it existing and it being put in place. We seem to have been caught in a common problem here: we had no active need for the policy (that I know of personally), and so we did not push ahead with it.

Less central members of our community report that they wondered why we didn’t have a code of conduct, but did not feel empowered to ask about it.

Where to from here?

It is far better to have clear documentation concerning safety in particular, and common problems in general, before they are needed. We hope our reusable policy gets adopted by other communities or assists them in drafting their own, to avoid some of the slowness involved in starting from scratch.

Skud reviewed our community structure and documentation in the lead-up to her Open Source Bridge talk and found various inadequacies. She and Annalee have each raised the issue of reviewing our community’s processes,. We would need to look at questions such as:

  • are we following best practices in anti-harassment, anti-abuse and establishing safer spaces?
  • is our group unusually reliant on certain individuals and if so (it usually is so in any community), how can we share knowledge and resources so that there are less single points of failure?
  • is our documentation sufficient for a newcomer to the community?

Does anyone have pointers to similar review processes in other groups? That would be really handy.

Skud suggests that in addition, with important projects like a code of conduct, a relatively structureless group like ours explicitly appoint people to the project, so that they feel empowered to act on it. We particularly need to be alert to Warnock’s dilemma (does silence signify consent, ignorance, lack of understanding, lack of interest or contempt?) in discussing changes to our community. We also need to be alert to hidden hierarchies, to, eg, the sense that nothing can go ahead without approval from, say, Skud as founder or myself as the most frequent poster.

Annalee suggests that we need to improve our institutional memory with documentation like that above, together with internal private documentation where it is impossible to make things public. This helps identify when things were done for a very good reason, versus having emerged essentially by accident, versus never having been done at all by anyone. We also need to clarify (probably continuously) about whether we are a JFDI community, or whether projects must have people appointed to them, or other.

Acknowledgements

Thanks to Annalee, Maco, Skud, Valerie and one of the linkspammers for their review of this post. Except where explicitly attributed, all opinions herein should be taken to be mine, informed by discussion with others in Geek Feminism but not necessarily co-signed by them.

Posted on

Is harassment in your community unwelcome? Adopt a Community Anti-Harassment Policy!

This article originally appeared on Geek Feminism.

Last week, the Geek Feminism community announced that we’ve adopted a code of conduct in our community. Our code begins:

The Geek Feminism (GF) community is dedicated to providing a harassment-free experience for everyone, regardless of gender, gender identity and expression, sexual orientation, disability, physical appearance, body size, race, or religion. We do not tolerate harassment of participants in any form.

This code of conduct applies to all Geek Feminism sponsored spaces, including our blog, mailing lists, and wiki, as well as any other spaces that Geek Feminism hosts, both online and off. Anyone who violates this code of conduct may be sanctioned or expelled from these spaces at the discretion of the Geek Feminism Anti-Abuse Team.

We took quite a long time to do this, after two harassment incidents associated with the Geek Feminism community (albeit, one probably not by people who are actually active in our spaces and who therefore can’t be excluded from them). We’d love it if others learned from our example and adopted a policy within their own communities. To that end, as of today, our Community Anti-Harassment Policy is available for re-use under Creative Commons Zero/public domain and we are beginning to develop associated resources, just as we have done over the past few years for the Conference anti-harassment policy

Here’s what you need:

  1. a policy (remember, ours is available for re-use, either as is, or in a modified form)
  2. a contact point where harassment reports can be received
  3. a group of responders who receive reports and have the power to act on them up to and including excluding harassers from your community

If your community does not have an obvious way to create a group of responders, start discussing how you can create one. In many communities, there is likely to be an existing volunteerocracy at the very least. Can these people reach consensus that your community should be safer from harassment, and that they are unwilling to work with harassers? Simply announcing to people that they must cease a behaviour, or they must leave the community, is in fact very effective as long as there is basic consensus around community norms. For online groups technical structures can help, but social structures are in fact the root of anti-harassment. You don’t need ops or admin power or the crown of the ancient rulers to enforce anti-harassment policies in your community, you need consistent anti-harassment responses by people with social power.

If you don’t know that your community has concensus on being anti-harassment. as a start you can declare your own personal anti-harassment stance, and publicly call for your community to adopt a anti-harassment policy, and a structure that enables the response team to exclude people from the community.

As Geek Feminism shows, activist groups or groups that have advocated for anti-harassment are not safe from internal harassment and still need a policy. And groups with no known harassment incidents are also not safe; it’s quite likely that people in your community have experienced harassment they felt unable to identify or report. Take steps to ensure harassing behaviour becomes known, and that it is known to be unacceptable.

One specific model we encourage you to avoid is the Our community is amazing! So wonderful! We rock! PS no harassment model in which you spend a lot of time affirming your community’s goodness and make a general statement about anti-harassment in passing. We discourage putting this in your anti-harassment policy for these reasons:

  1. you probably do not know the extent of harassment in your community without a policy and a reporting mechanism, and may not rock as much as you think
  2. stating that you are “anti-harassment” without saying what harassment means to you doesn’t give your existing community and potential new members the information they need to find out if their safety needs are a close enough match for your community’s norms

Stating your community’s great work or exemplary behaviour can be really useful for establishing social norms and letting people understand what joining your community means. They form a good basis for specific policies. But don’t make such statements in your anti-harassment policy, make them in a separate document listing your community’s values and goals. And it may be best to say that you aspire or intend to create an amazing space, rather than that you have definitely attained that goal. Statements that you are definitely no questions amazing may be used to silence people with critical feedback and in the end reduce your amazingness.

We also discourage private anti-harassment policies (shared only within a community or within its leadership), for reasons outlined by the Ada Initiative [disclaimer: I co-founded the Ada Initiative].

Do you already have a community anti-harassment policy, or have we convinced you to adopt one? List your community on the Community anti-harassment adoption page! And thank you.

Posted on

Harassment report at your conference: what do you do???

This article was written by me and originally published on the Ada Initiative’s website. It is republished here according to the terms of its Creative Commons licence.

The Ada Initiative’s anti-harassment work and other anti-harassment initiatives have resulted in many conferences adopting anti-harassment policies.

The Ada Initiative are not enforcers of individual conferences’ policies: this is the responsibility of conference staff, and conferences do not usually inform us of reports, nor do we expect them to. Harassment within a community is that community’s responsibility. However, in some cases when Ada Initiative staff have attended a conference, we have been asked to advise conference staff on responses. We’ve learned several useful techniques for making sure that the conference follows through quickly on its commitment to anti-harassment. We’ve drawn our experiences together into a wiki page: Responding to harassment reports.

Our first tip is, of course, to have a policy. Harassment incidents at geek conferences — including open technology and culture conferences — are widespread. If harassment is reported at your conference and you do not have a policy, it is difficult to reach consensus among conference staff that harassment is not welcome, let alone that you should respond to it, or about how you should respond. The result is that people who are worried about harassment, or who have experienced it at your event or other events, will not feel or be safe at your event. Your policy should be in place before your conference. The Ada Initiative and Geek Feminism volunteers have prepared substantial resources on how to put a policy in place.

You should also pre-prepare some emergency contacts, for incidents that you can’t handle. Conference volunteers and staff are rarely able to solely respond to and properly help with physical safety threats, illness or people in crisis. We suggest preparing a handout with contacts for emergency services, venue security, local medical and mental health facilities and crisis hotlines for mental illness, sexual assault, and physical violence. Make this info available in your conference materials so that attendees do not have to come to you, but have copies to hand in case they do.

Having a staff member whose key responsibility is to assist attendees in difficulty (rather than routine conference chores) can assist in a fast response, see the Duty officer wiki page.

Unfortunately, having a policy does not mean harassment won’t occur at your event. Once an incident is reported, you need to respond rapidly to reports. As the wiki page discusses in more detail you should:

  1. get a written report where possible, or have the staff member who received it write down what they were told
  2. have a staff member collate these reports in case of multiple incidents of harassment by one person, so that you can respond to the pattern rather than one instance
  3. have a staff member discuss the incident with the alleged harasser
  4. convene a meeting as soon as reasonably practical to decide on a response
  5. decide on a response and communicate it to the complainant and the harasser as soon as possible
  6. provide the harasser with an avenue of appeal if one is available but insist that they abide by any sanctions in the meantime
  7. communicate the incident and response briefly to the community, either attending the conference or reading your blog etc, to allow them to see that the policy is enforced
  8. remind the attendees and community where the policy is found and invite them to review it

We welcome additional improvements to our detailed guide on how to respond to harassment reports. If you would like to discuss the suggestions, please do so on the wiki’s talk page.

Creative Commons License
Harassment report at your conference: what do you do???
 by the Ada Initiative is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
Based on a work at https://adainitiative.org/2012/10/04/harassment-report-at-your-conference-what-do-you-do/.

Posted on

On feeling less safe

This article originally appeared on Geek Feminism.

Over at Hoyden About Town, Wildly Parenthetical considers Tackling Misogyny: Procedures or Social Sanctions?:

But more interesting has been the discussion about formal and informal mechanisms for dealing with sexual harassment. There are lots of reasons that formal mechanisms don’t work for lots of people… So we have the suggestion of informal “shunning’. Some have, with more and less hyperbole, suggested that without the formality of systems of justice and the “certainty’ they’re meant to bring, individuals could wind up excluded on heresay; this is the “OMG WITCHHUNT!’ objection. And others have pointed out that social sanctions are applied to all kinds of behaviours that are disapproved of in our society, and why should this particular behaviour be any different? I am pretty much with the latter group, although I understand those who think that we should be putting our energies towards fixing the formal systems rather than developing shun-lists…

I left a comment that I want to re-post here, since it captures neatly a lot of my more negative feelings about discussions around anti-harassment policies and such, which a lot of people in the geek community consider informal since geeks themselves will enforce them.

My response (very slightly edited here) was as follows:

I am a fan of social sanctions in an ideal world. There tend to be two problems with introducing it in practice:

  1. Some people at either the level of instinct or the level of rational analysis find it almost impossible to distinguish from bullying (see the Geek Social Fallacies, especially ) and refuse to participate or actively attempt to defend the person sanctioned or decide to sanction the sanctioners, causing a lot of internal community conflict.
  2. It often turns out (at least in communities that I’m a part of) that not as many people are opposed to sexual harassment as one might hope. So a substantial fraction of participants oppose social sanctions or vow to not enforce them because it turns out they like sexual harassment just fine.

Option 2 is always a really distressing conversation to have in a community you felt safe in; you seldom feel safe after it turns out that a loud minority feel that sexual harassment is the effective/normal/desirable (at least, but not exclusively) heterosexual mating strategy.

How is everyone else feeling about the geek community after whatever their latest local round of feminist discussion was? I’m far from entirely negative, but there are definitely whole new places I don’t feel safe from harassment and indeed assault now.