144 thoughts on “Pixel Scroll 9/28/16 I Can Tick, I Can Tick ‘Cause I’m Better Than You”

1. Would it be better to make those decisions armed with relevant information, or with the kind of back-channel rumors and innuendo that are handed about now?

   Irrelevant. Any actual system you design needs to have these hypotheticals answered, ideally in advance and not by the poor person on the spot. And some will be potentially worse answers than “we don’t vet in advance” or the current system of conventions using local information only (Sorry, but the local information is NOT purely innuendo, it’s just of limited use). The hypotheticals are in fact a good way to troubleshoot what WILL exist, not just to nay-say it, as you think.

   You’re getting very defensive. The people pointing out it might not be easy are NOT thinking “It’s harder than that therefore it’s a bad idea”. Which seems to be your assumption.

   It’s like editors. Editors don’t usually laugh or cheer or sneer when rejecting stories. They WANT good stories. They are on your side. But a story has to be above a certain threshold for them to even feel it is worth the time and effort to say “Okay, if you rewrite this and address these points…”, much less “Yes! We’ll take it!”

   We want to get this idea into shape. Defending it against all criticism or dismissing all criticism with one blithe line of “Oh, we’ll just… It’ll be easy!” in this case might be detrimental, not useful.

2. Greg Hullender: Since Aaron’s first and guiding intent was in fact to prevent people coming to a new and different convention and harassing someone (per his Alyssa Wong example) your suggestion of “Just using it to decide what happens after harassment” seems to be missing the actual intent.

3. Aaron – good question (with or without data).

   Look, any system can be nitpicked. Want to steal a library book but they have those sensor things in them? Open a window and throw it outside for later retrieval. (I’ve yet to see the public library that can afford full perimeter protection).

   Most retail businesses accept 15 to 20% “loss” due to breakage and shoplifting as in line with doing business. Do they open or stay closed?

   You put into place those systems that are cost effective and cross your fingers over the rest.

   But to answer some of the questions:

   Each convention would have to make their own judgment call on what to do with the information. Me, I’d sit down with Dave and explain to him that he is more than welcome, provided he understands that he will probably be under intense scrutiny and that anything he does that even hints at violating codes will probably be reported – even if unfounded. I’d let him know that it takes a while to repair reputation and that one of the requisites for doing so is being scrupulous in observing the rules (make everyone think Mac2 made a mistake based on your behavior here). If he wants to attend under those circumstances, please do. Anyone asking “why is DT being allowed to attend” would be told about the forgoing with the explanation that we continue to believe that human beings are capable of changing their behavior and we’re giving him the chance.
   Of course anyone harassed by him might have an attorney casting a wide net going after the con because they “knew beforehand yada yada” – and the con would just have to deal because the same BS could come up over anything.

   Kowal vs Truesdale – not an issue. its a membership organization operating under its own guidelines and not violating superior law when doing so. Mens rights groups are still allowed to hold meetings that bar women and a membership organization is still allowed to mete out its own justice within its purview. (Non-legal explanation: Dave was a Dick, Mary was not.)

   the database needs basic identifying information: name, state and city ought to be enough for the vast majority of cases. (Considering I’ve been to cons where I could have taken anyone’s name tag off the registration table and spent the (free) day as “John Q. Public” there are larger fish to fry.

   However, pictures can be put in the database also and someone coming for at the door registration – unless they are a known non-bad actor (to reg folks), their membership is provisional, pending checks. It gets a sticker on it. Anyone with a sticker who gets reported for any violation is out the door immediately.

   And, to close a loophole, I personally would add to the code of conduct that anyone found to have aided and abetted a banned person in attending, helped them avoid consequences or in any way enabled them at the convention will be summarily ejected as well.

4. I think the credit card information is a red herring, because nobody is suggesting that credit card information should be shared between cons: if I join Wiscon, they aren’t going to ask how I paid for my Boskone membership, they don’t even care how I paid for a five-years-ago Wiscon membership. They might be tracking people whose checks bounced, but not whether I used a credit card, let alone that it was a Mastercard with thus-and-such number and expiration date.

   This suggestion, to work, requires sharing of information between cons: Wiscon doesn’t and still wouldn’t care whether I bought a Boskone membership with cash, Paypal, a check, or had a friend buy it for me, but they would be asking Boskone about people who had been expelled for violating the code of conduct.

5. Irrelevant. Any actual system you design needs to have these hypotheticals answered, ideally in advance and not by the poor person on the spot.

   Actually, it is very relevant. These decisions have to be made “by the poor person on the spot” right now, with little or no reliable information guide them. These decisions are going to be made, whether there is information sharing or not, even if the decision is simply to not do any kind of evaluation at all.

   Defending it against all criticism or dismissing all criticism with one blithe line of “Oh, we’ll just… It’ll be easy!” in this case might be detrimental, not useful.

   I’ve written hundreds of words on this subject in this comment thread alone. Right now, the decisions brought up in the hypotheticals Bill posed are being made already, by each convention. Even if conventions share information, how they would make decisions would still be determined by each individual convention. The only thing that would change is the information they has available upon which to make that decision.

6. I think the credit card information is a red herring, because nobody is suggesting that credit card information should be shared between cons

   The issue was brought up because people were questioning whether conventions would be able to handle sensitive information properly. The point is that conventions are handling sensitive information on a regular basis already, and have been doing so for years. If they can handle that, why would this be substantially different?

7. @Lenora Rose

   Since Aaron’s first and guiding intent was in fact to prevent people coming to a new and different convention and harassing someone (per his Alyssa Wong example) your suggestion of “Just using it to decide what happens after harassment” seems to be missing the actual intent.

   I know. I’m just trying to scale it down to something practical. If that were made to work, then after a few years someone might propose extending it. Small steps.

8. Aaron: And again, what is happening now is irrelevant to your ability to actually respond to the hypotheticals. Nobody needs to tell a convention what it’s already doing, but they might need a clear answer to what your intent with the database is, what they will be able to do, what decisions are at their discretion vs. what are not. The question of whether a con can look up a name on a driver’s license at the door of a con while processing a cash-paid on-the-spot membership is something a con will want to know.

   Steve davidson seems to have been able to offer one sets of answers (though I am a bit concerned that an on the spot purchase has just become a potential second-class citizen in a scenario he offers). Do you support his ideas? have different ideas?

   I’ve written hundreds of words on this subject in this comment thread alone.

   Some of which come across as more defensive than receptive to critique.

   The point is that conventions are handling sensitive information on a regular basis already, and have been doing so for years. If they can handle that, why would this be substantially different?

   BECAUSE it is shared between cons. And credit card information or the like is not.

9. (10) First, I agree with everyone here who said that a data-sharing scheme on harassment cases or violations between cons would run up HARD against EU regulations and national laws in Europe of all sorts, both regarding libel, data sharing, and data handling.

   But to me the law is only secondary to why I think the proposal is a bad idea.

   Aaron: How so? Is there anything that I have said that suggests that such a sharing method would not be fan run? Is there anything that suggests conventions would not have the choice to use the data in a manner that they think is best? I think a lot of people are assuming that there would be some sort of supervisory organization that would handle harassment issues for conventions. All I’ve suggested is that conventions should share information between themselves so they can make informed decisions about attendees who have an established track record.

   I might have been a little unclear in my first post, better would have been to say that your proposal would externalise the job of keeping harassment and bullying out of fandom as a whole to a select group within fandom.

   I am guided here by several pieces. One is that fandom is much more than cons, and harassment can take place at any of them. One of the worst cases of harassment in Swedish fandom largely expressed itself in fanzines. I prefer a solution that can help to prevent harassment in any fannish activity.

   Another is that true prevention doesn’t lie in blocking a harasser from a con: that’s more repression than prevention. True prevention would lie in creating an environment where everyone knows that harassment isn’t OK, and how to act responsibly if it happens—especially for direct witnesses. True prevention lies in a fannish culture which will work against harassment. Banning should be the last and final step, not the first.

   A third is that data sharing is already possible, but it runs on trust and the specific cases. You have to ask a responsible person in an organisation about the specific person. Now, you might not get an answer, but it is possible to ask.

10. Well, I think like everything else – let the person who wants to try this create this. Make contacts with cons. Write the code. See how many that will line up.

    Perhaps no conventions. Perhaps one to start. Or two and three. They are going to have to go through all the detals with the conventions anyhow.

    My guess is that but you already have to make decisions will not hold much water as there will be much more work, much larger impact and much larger responsibility. But it will be interesting to see which people who will volunteer the time and effort to work with this.

    When they have put in a 1000 hours or so and have some kind of proof of concept, then I’ll be happy to see the first version.

11. And again, what is happening now is irrelevant to your ability to actually respond to the hypotheticals.

    The hypotheticals are beside the point. The idea is to share information so that each convention can decide what to do while in possession of a greater array of facts. How each situation is handled is something that needs to be worked out by each convention – every one of these organizations has its own ideas about how to handle issues, and I don’t think that anyone who thinks that layering on some kind of universal solution would work would be dealing in reality.

    Nobody needs to tell a convention what it’s already doing, but they might need a clear answer to what your intent with the database is, what they will be able to do, what decisions are at their discretion vs. what are not.

    Every decision is at their discretion. That’s the nature of running conventions. A somewhat useful analogy might be to a credit score. The organizations that report credit scores don’t tell the companies using them how to use the data. One company might decide a particular score makes someone too risky to lend to, another might come to a different conclusion. The organization providing the report doesn’t care either way, they just report the information.

    The question of whether a con can look up a name on a driver’s license at the door of a con while processing a cash-paid on-the-spot membership is something a con will want to know.

    Well that depends on what form the data takes, which is not set in stone at this point, and whether the convention wants to check licenses and so on. How much work the convention wants to do at the door is up to the convention.

    Steve davidson seems to have been able to offer one sets of answers (though I am a bit concerned that an on the spot purchase has just become a potential second-class citizen in a scenario he offers). Do you support his ideas? have different ideas?

    I neither support davidson’s ideas or oppose them at this point, mostly because they are different from what I have suggested. As far as I can tell, he’s saying to take publicly available information that has been reported essentially through the fan media and construct a list out of that that people can find on his website. That’s different from conventions sharing information about harassment incidents between themselves.

    BECAUSE it is shared between cons. And credit card information or the like is not.

    So, a group of organizations that have been individual capable of handling sensitive information would suddenly be unable to do so because they are all handling sensitive information? I’m not following your logic here.

12. I might have been a little unclear in my first post, better would have been to say that your proposal would externalise the job of keeping harassment and bullying out of fandom as a whole to a select group within fandom.

    Harassment right now is handled primarily by a select group within fandom. I certainly don’t recall there being any plebiscites held in the past to decide any harassment cases. Right now harassment is handled by incident response teams that answer to security chairs and convention chairs. They are handled by those people who show up and do the volunteer work.

    I am guided here by several pieces. One is that fandom is much more than cons, and harassment can take place at any of them. One of the worst cases of harassment in Swedish fandom largely expressed itself in fanzines. I prefer a solution that can help to prevent harassment in any fannish activity.

    This is allowing the perfect to be the enemy of the good. It is essentially saying that because an idea doesn’t solve every problem, it can’t solve any problem.

    Another is that true prevention doesn’t lie in blocking a harasser from a con: that’s more repression than prevention.

    So your solution is to allow people with a track record of harassment to show up over and over again to continue to do it? It isn’t repression to tell people with a propensity for bad behavior they can’t come to the party any more.

    True prevention would lie in creating an environment where everyone knows that harassment isn’t OK, and how to act responsibly if it happens—especially for direct witnesses. True prevention lies in a fannish culture which will work against harassment.

    And part of establishing that harassment isn’t okay is taking steps to remove harassers from the environment, both by taking action against them, after they violate the code of conduct, and by making the decision to possibly bar them from future events if they demonstrate an inability to stop their bad behavior.

    Banning should be the last and final step, not the first.

    I haven’t suggested banning as a first step. I’ve suggested tracking incidents of harassment across conventions so that conventions can possibly make the decision to ban people after they have an established track record of harassment.

    A third is that data sharing is already possible, but it runs on trust and the specific cases.

    Sure, and it has led to a situation in which people can get themselves banned from conventions three times and not have the dots connected in their serial harassment until the third time, and then only because they made the mistake of harassing the same target twice. I don’t think that is good enough.

13. So back at LonCon3, I was talking to someone…Abi Sutherland, I think it was. And she brought up Minecraft.

    Minecraft has a list kept by volunteers called “MCBans.” It’s basically a list of players who are banned from Minecraft servers. There’s a list of Global Ban Reasons considered “valid” (griefing, DDOS, spambots, racist, and a couple technical issues) and those considered “invalid” (which I don’t always agree with, but nevermind that for the moment.) If a global ban is deemed excessive, they can, because of the nature of the game, reduce it to a “local” ban, and if somebody is banning from their server “improperly” the whole server can be penalized or removed from the system.

    Servers can list themselves as subscribing to MCBans, subscribing and reporting to MCBans, or as not subscribing.

    This was the first system I had heard suggested that, essentially, something for everybody. A con that did not feel comfortable reporting people but would like a mechanism to screen existing known quantities could subscribe to such a list but not report to it.

    Now, servers are not cons, and technical solutions that work on a machine won’t necessarily work with humans. Still.

    (Technically speaking, as it happens, a couple buddies of mine are involved with running con registration systems. There would be weeping and gnashing of teeth, but there are already methods of flagging a registration in the system and sending it to human eyeballs, so I suspect that it would be doable to use such a list, in the proper format, to flag registrations so that a human had to hand-approve it.)

    There are going to be cons who want absolutely nothing to do with it, of course–and while I twitch at it, I can see valid arguments made for some of the reasons one might NOT want anything to do with it–legal liability, anonymity, even high-drama communities where the con decides that they simply can’t deal with the con-goers fighting like cats in a sack to put each other on the list. But if you had a well-publicized list, and then a con stating that they reported to it, did not report, but used it, or did not use it, it might be an interesting starting point.

14. @James Moar

    He might have done something distinctively Lynchian, like include a little guy who offers cryptic advice spoken in an unusual manner.

    Or include a dude who breathes noisily before doing scary things (Insert appropriate trigger warnings): https://www.youtube.com/watch?v=xsIMXIMBpBw

15. @TYP

    Person A was in an abusive relationship with Person B. Person A leaves and starts talking about it. Person B starts threatening libel action, with the implicit threat that their defense will be that Person A consented to [style of BDSM that will seriously squick the general population].

    There appeared to be quite a bit of that going on during the Jacob Appelbaum investigation: https://en.wikipedia.org/wiki/Jacob_Appelbaum#Allegations_of_sexual_misconduct

16. @Aaron:

    The “libel problem” is a red herring. To be libel, a published statement must be untrue

    I have been told by at least one lawyer that you are wrong in the US, not just Sweden, France, or any other place mentioned above. If the report is “There was a complaint; here’s what we did” (which is \probably/ bland enough to avoid libel), how are other conventions to judge whether the filer reacted correctly AND whether the behavior was enough to bar the complainee from those other conventions?

    As for maintaining the data: no sane conrunning fan would get involved in this unless there were an actual corporation to shield participants from individual liability — and I wouldn’t touch it under any circumstances (even though I first tried to get a troublemaker tossed from my home convention over 30 years ago) because corporate shielding is not complete.

    I see you say you have conrunning experience. Details?

    The issue was brought up because people were questioning whether conventions would be able to handle sensitive information properly. The point is that conventions are handling sensitive information on a regular basis already, and have been doing so for years. If they can handle that, why would this be substantially different?

    leads me to doubt the significant of your experience AND charge you with the sort of misleading argument I expect from a Puppy. As several people have already said (before Lenora answered this directly), whatever data is stored (which IME tends to exclude numbers) is the property of that con; you are proposing that all cons pool their data.

    What I would envision, but did not lay out specifically because I didn’t want to limit the possible options would be for conventions to work together – possibly creating something akin to a trade association. Conventions can join, possibly after being vetted by other members for some responsibility standards, and those who are in can have access to the shared data, probably on a limited need to know basis.

    I know some pairs of conventions that collaborate on some items (the most extensive case being one where the people who do the work ignore the people trying to stand on principles of enmity); I do not see a general consortium working.

    The hypotheticals are beside the point. No, they aren’t. You’re proposing throwing up a huge system without proper design; think about what would happen if somebody did that with the computer in your car.

17. If the report is “There was a complaint; here’s what we did” (which is \probably/ bland enough to avoid libel), how are other conventions to judge whether the filer reacted correctly AND whether the behavior was enough to bar the complainee from those other conventions?

    Did you have a lawyer make that assessment? Or are you making that determination? I’m a member of the Virginia bar. Where are you licensed?

    How is it possible that Minecraft servers and paintball leagues can maintain a similar system, but it is so horribly fraught with terrible legal difficulties if it is done by conventions?

    As several people have already said (before Lenora answered this directly), whatever data is stored (which IME tends to exclude numbers) is the property of that con; you are proposing that all cons pool their data.

    And? The question was whether conventions could handle the data responsibly. Conventions have shown that they can do so. The concern that somehow the data would be less safe in the same hands just because conventions share it is almost ludicrous.

    No, they aren’t. You’re proposing throwing up a huge system without proper design; think about what would happen if somebody did that with the computer in your car.

    They are entirely beside the point because they don’t have anything to do with what is being proposed that would be new. Conventions would still be responsible for making their own decisions. I’m not proposing any specific structure at this point, just that this sort of cooperation should be done.

    A lot of people are jumping to very specific conclusions about what I have suggested that are essentially fantasies they’ve spun out of what they think I have said. You’re one of them.

18. Start it in the US where truth IS a defense against libel. After it’s worked out, then other countries can join or not, or come up with a system that works with their lawyers.

19. Thanks, again, for the continuing discussion. @Aaron, your response to me definitely helped clarify the concept as you see it. Limiting this to cons big and professional enough to be meaningfully vetted is significant.

    (Just as a point of comparison, my own local scene is full of small-ish events – down to as few as 20-30 people. Even though most of them have a common umbrella organization with good oversight and infrastructure, I wouldn’t want the registration person for each of the events to have access to something like this. It sounds like this system simply wouldn’t apply to events like these, or be available to them — or they’d need to find some further workaround, like a trusted point-of-contact in the umbrella organization who could vet their registration list for them.)

20. So, a question: would you see the incident report in the database as including the name of the person who made the complaint?

21. Aaron: Harassment right now is handled primarily by a select group within fandom. I certainly don’t recall there being any plebiscites held in the past to decide any harassment cases. Right now harassment is handled by incident response teams that answer to security chairs and convention chairs. They are handled by those people who show up and do the volunteer work.

    I think you have a narrow interpretation of dealing with harassment here. Yes, the actual handling (as in investigating and deciding on any reaction) is done by a select group (the chair of the con and whoever they deputise for this). But the first and most important defense is every member of the con. They—we—are needed as reporters, witnesses, and people who intervene in harassment cases as soon as they develop. That we do not hide in the herd and think someone else will deal with it.

    Your proposal doesn’t help with that. At best it’s neutral.

    Limited data sharing is already possible. If an unknown (to me) person is asking for a position of trust, I can already investigate them by asking other cons or organisations where they’ve been involved. If I find a person that is known to me that is a risk factor (due to being a bully, having alcohol issues, being a harasser, or something else) at a con, I can already get in touch with the people running the con, and say that they have a potential problem.

22. Karl-Johan Norén: I think you have a narrow interpretation of dealing with harassment here… Your proposal doesn’t help with that. At best it’s neutral.

    I think you’ve misunderstood the point of Aaron’s proposal. It is to serve as a supplement to everything you’ve described.

    Because once people have done what you describe, and the incident has been dealt with, right now any knowledge or record of it pretty much just goes away. And the next con starts out at zero again, instead of starting out with advance knowledge of who’s been a problem, and just how big of one, and was it big enough or enough occurrences that we should just say, “thanks, but you’ve demonstrated a repeated pattern of behavior, and we don’t want you at our con”.

23. So, a group of organizations that have been individual capable of handling sensitive information would suddenly be unable to do so because they are all handling sensitive information? I’m not following your logic here.

    Yes! Yes, this is exactly the case 🙂

    I can see why you’re finding this a suspicious claim. Let’s see if I can make the case for this.

    Basically: the bigger a system gets, the more people become involved, the harder it is to maintain trust. The size, the sheer number of people, and the necessity of coordinating between them, introduce serious new points of weakness.

    (I’ll be using a tiny smattering of security-ish terminology here, like “attack,” “defection,” “vulnerability.” The idea here is to discuss threats to the system, but that doesn’t imply violence, malice, or even intention — somebody can “attack” or “defect” without even knowing it.)

    —

    Let’s start with this: The bigger, the more important, and the more sensitive a system is, the more attractive it becomes for attack. A target with a thousand credit card listings is less attractive than a target with ten thousand credit card listings. Getting the incident reports from one convention is less attractive than getting the incident reports from a hundred conventions. Getting my drinking buddy’s credit card information is less attractive than getting the write-up for my drinking buddy’s harassment incident.

    What that means is that while previous conrunners certainly haven’t gone and abused the information they had, their ability to keep that information secure is not a good indication of being able to keep this information secure. They’ll be facing greater threats, and frequent, intelligent attacks.

    Secondly, more people involved means more opportunity for defectors. By “defector,” I mean anybody who compromises the system. Again, not necessarily intentional. The entire system is dependent on their not being any leaks. Bring one defector into the system – malicious, careless, embroiled in drama two years after joining in, whatever – and the whole thing goes up in flames.

    If we were still dealing with a couple of individuals in small, local systems, there’d be damage and backlash – but they’d be localized; limited. There would simply be less there to damage. Local defectors give you local disasters; global defectors give you catastrophe.

    Thirdly, trust is not transitive. If Alice and Bob trust each other, and Alice and Carla trust each other, that doesn’t imply that Bob and Carla trust each other. As the network grows, the number of opportunities for friction and discord simply explode. When you say that they have individually been capable of handling sensitive information, that doesn’t actually imply that each of those individuals actually considers the others capable.

    Which means the assumption that the entire network is trustworthy is flawed, or at least needs to be understood with greater nuance. Those flaws could be incident reports that are unreliable; incident reports that are uninformative; sharing sensitive information within the conrunning group; sharing information on social media (“Listen, I understand you’re upset, but the previous incident you’re talking about wasn’t in our database!”); and much, much, much more. If you’ve ever had appreciative-but-necessary criticism towards somebody for poor handling of harassment incidents, those people will probably be in the network.

    So what you actually need to do is be able to define concrete requirements for how this information needs to be handled; requirements for how the system is to be used and protected. I do not think you’ll be able to make the claim that the group of organizations has individually been able to meet your requirements. You need to set standards and get widespread buy-in; this is a significant step above “they’ve all been OK up until now.”

    Lastly, the act of coordination requires additional resources and introduces new vulnerabilities. Does this resource have a website? It can be hacked. Or you can just leave it open on your web browser. Does this resource have a dedicated community build up around it? Discussions and arguments from that community can spill out into rumor and social media. Oh, and all the people who think that responding to harassment is SJW terrorism towards innocents? Now have a central, convenient punching bag for rage and lawsuits. And so on.

    —

    None of this is necessarily insurmountable. I do hear that human civilization has, in fact, managed to maintain some big systems involving many people, and some of these systems are actually successful at getting stuff done 😛

    But the important point here is that scaling from a handful of trustworthy people at each convention, to a wide network of trustworthy people in continuing coordination across the country, means orders of magnitude more of information, but also orders of magnitude more of risk.

    So the risk, in my view, is the central issue here. I’m sure there are significant legal and logistical challenges, but I would hope those can be solved. The thing that I don’t think that can be solved is the risk that this leaks, explodes, or starts being abused.

    I can recommend Bruce Schneier’s Liars and Outliers, which does a clear and excellent job discussing how drastically size and complexity also increase risk. It dawdles rather more than necessary, but it’s very clear, and introduces terminology I consider absolutely fundamental, certainly when discussing coordination issues.

24. And for talking about risk, some questions I’d like to see addressed would be:

    1. In the event the database is leaked, how bad are the repercussions for somebody on the list with one single incident?
    2. How bad are the repercussions for somebody sharing a name with somebody on the list?
    3. How do you vet access to the list?
    4. How do you vet adding new incidents to the list?

25. There are some pretty big problems with the No-Fly list. Some of them could/would show up in this database, unless they were carefully anticipated and dealt with.

    1. People on the no-fly list don’t know they are on it until the find out they can’t fly.
    If I spend hundreds of dollars to get to a big con, and arrive and find out I can’t get admission, then I’ve wasted my travel costs. Do you just accept that, or do you try to prevent it? Can people proactively inquire if they are on the list? How do you know that an inquiry about John B. Fan comes from John B. Fan, and not someone who has heard stories about JBF and is a gossip monger?

    2. People who get put on the NF list wrongly find it almost impossible to get off it. Is there a right of appeal of one’s presence on the SF blacklist? Who decides? Does the decision include statements from the original accuser? What if the original accuser doesn’t want to participate in the appeal — does the appellant win by default?

    3. The standards of getting put on the NF list are pretty loose; at least, they are looser than many think they ought to be. What level of trust/responsibility/integrity do you need from someone who nominates a person to the SF blacklist? If I call the list administrator, and say “we had a problem with xxx and kicked him out”, who vets me?

    It’s difficult to see how an SF blacklist can work better than what we have now — a situation where cases get discussed in SF media, and are googleable to anyone who cares. Are you assuming that cases will be entered into the database that aren’t currently getting blogged and tweeted about?

26. “It’s difficult to see how an SF blacklist can work better than what we have now — a situation where cases get discussed in SF media, and are googleable to anyone who cares. Are you assuming that cases will be entered into the database that aren’t currently getting blogged and tweeted about?”

    Difference is that you don’t have to google 4000 individuals if you instead could have an automatic lookup at registration.

27. Bill: It’s difficult to see how an SF blacklist can work better than what we have now — a situation where cases get discussed in SF media, and are googleable to anyone who cares. Are you assuming that cases will be entered into the database that aren’t currently getting blogged and tweeted about?

    Are you assuming that all the people who need to know will be in on the informal gossip network which discusses the events that don’t get widely publicized on the Internet?

    Because not all of these events get discussed publicly. In fact, the majority of them don’t. How are people supposed to find out about those?

28. @RedWombat

    Had a quick look at what McBans does. It seems to work on the mincraft.net user id which I suspect would not be considered personal data as it may well not identify the user. If (Swedish based) Mojang provided the end user data (real name, address, etc) to McBans without adequate safeguards being in place though they’d get hammered.

29. JJ: I think you’ve misunderstood the point of Aaron’s proposal. It is to serve as a supplement to everything you’ve described.

    Yes, I understand that. However, it will be a huge effort, and thus I believe it will necessarily come to dominate how we as a fandom wants to deal with harassment and possibly other issues.

    JJ: Because once people have done what you describe, and the incident has been dealt with, right now any knowledge or record of it pretty much just goes away. And the next con starts out at zero again, instead of starting out with advance knowledge of who’s been a problem, and just how big of one, and was it big enough or enough occurrences that we should just say, “thanks, but you’ve demonstrated a repeated pattern of behavior, and we don’t want you at our con”.

    No, the knowledge doesn’t go away. It remains with the people who worked with or witnessed the case. It can be disseminated already in a controlled and case-by-case basis, just like I described in my prior message.

    Did it used to work? Hell no. Does it work now? Maybe to a limited degree. Can it be made to work better? Yes, and the key there is a culture where we can and do speak out against harassment and other bad behaviour.

30. Karl-Johan Norén: No, the knowledge doesn’t go away. It remains with the people who worked with or witnessed the case. It can be disseminated already in a controlled and case-by-case basis, just like I described in my prior message.

    Except, as I and other people have pointed out, that’s not happening.

    Karl-Johan Norén: Did it used to work? Hell no. Does it work now? Maybe to a limited degree. Can it be made to work better? Yes, and the key there is a culture where we can and do speak out against harassment and other bad behaviour.

    Another key is setting up an organized way to disseminate that information.

    The assumption that a whole bunch of people will be willing to violate Geek Social Fallacy #1 to effect this change on an individual basis by passing around gossip informally has been demonstrated, over many years, to be an incorrect assumption. Please don’t keep insisting that it will work. We’ve already got a many-year history demonstrating that it won’t.

31. Aaron: Standback has pointed out in great detail that you are fantasizing about the workability of a large-access database. The fact that you can’t even answer the question about your con experience suggests that you’re also fantasizing about its relevance.

32. So, if I understand the situation correctly, what happens now is that when someone harasses others or misbehaves in such a way that they come to the attention of a con, they may or may not face consequences including being tossed and banned. This may or may not become public knowledge, generally informally through social media, often by the victims or friends of the victims. This information is not vetted in any way, except in our varied inclinations to listen to and believe the victims and witnesses.

    This informally disseminated information is not shared between SMOFs and as a result serial harassers, for instance, are free to attend all cons from which they have not been specifically banned for harassment. Also, even if the SMOFs of Con B know about someone banned from Con A, because there has been a shitstorm of publicly available discussion and information, there is no attempt to dissuade the hypothetical bannee from attending Con B.

    Is that about right?

    What are the odds that eventually Con B gets sued by someone victimized by Banned by Con A, because that information was available on social media but was ignored?

    If an attendee does violate a con’s policies and, as increasingly happens, because the times they are a changing, is tossed, why can there not also be an addition of “…and your name will be added to Disciplined by a Con Spreadsheet of Doom.”

    I’m bemused by some of the responses here, so I’m guessing I’m just too simpleminded to understand the objections. Because it looks to me as if the proposal is to systematize something that is already happening, publicly and increasingly frequently, without in any way interfering with the way cons handle security issues now. It also doesn’t require that cons have codes of conduct (although as time passes, it will likely increase organizational risk to not have them, no matter how informal or formal the system for disseminating names).

    When someone is harassed at a con names the person responsible, how much concern is there that the victimizer has been publicly named? How much secrecy is each of us comfortable with, when it comes to victims naming harassers? How about those a con has found worthy of disciplining for harassing one or more people? Does that need to be more secret? Why?

    I’m generally of the mindset that if you accurately define a problem there are any number of workable solutions, none of which will be discovered if you start from “that can’t work because…”

33. @ Bill: I’m assuming that your first issue would be handled when the registration comes in. Perhaps I’m naive in assuming that people don’t spend hundreds of dollars on travel arrangements when they haven’t bought a membership? But when a person on the blacklist attempts to register, they should be told at that point that they are unwelcome at the con.

34. Aaron: Once again, you seem to be reacting to peoples’ comments as if any question or critique is coming from people who *don’t* like the base concept. Try to look at the majority of comments as coming from people who want it to work and **therefore** are poking at it and looking for holes. Especially something like standback’s commentary.

    Well that depends on what form the data takes, which is not set in stone at this point,

    …

    I’m not proposing any specific structure at this point, just that this sort of cooperation should be done.

    You’ve as much as admitted it’s an idea in preliminary stages, and yet the very questions which would solidify the idea into a final form are the ones you seem to think are unnecessary nitpicks.

    You are not being attacked.

    How is it possible that Minecraft servers and paintball leagues can maintain a similar system, but it is so horribly fraught with terrible legal difficulties if it is done by conventions?

    I was under the impression people were offering those examples in the spirit of “here is a place with a similar problem, let’s look at commonalities and differences to see what can be applied to your proposal”. And some of the differences (real names as a necessity, information more specific than penalties and public records) are exactly the ones that make the answer to that question a genuine issue.

    A lot of people are jumping to very specific conclusions about what I have suggested that are essentially fantasies they’ve spun out of what they think I have said.

    More accurately, people are taking your general idea, trying to apply it to their knowledge of event-running, law, database systems etc. and draw up plausible implementations, and, yes, point to the drawbacks of that implementation. But until you provide your beta model of how this looks in practice, they’ll have to keep drawing up hypotheticals.

    At some point, to move forward on the idea, it needs:
    – a firm idea what information the database holds on each person.
    – A firm idea how the database is built, where it’s stored and how it’s supported.
    – a firm idea how reports are vetted to get put on in the first place (“take each con report at its word” is also a vetting process.)
    – a firm idea of an appeals process for being removed (“no process” is not an option)
    – a firm idea how it’s decided which conventions are allowed access to the list (Longevity? Size? What if a Concom member in position to have access is themselves on the list?)
    – am firm idea how to broach the idea to conventions in the first place. What do they need to know beforehand?
    – Can a con view the list without including its own reports?
    – whether the list is downloadable or merely viewable; if downloaded, if/how to make sure cons are using the latest updates.
    – whether access, once approved, is ongoing or needs to be periodically re-approved,
    – How public is the list of conventions whop have access to the list? Does it include information like the minecraft servers do: not accessing, accessing but not reporting, accessing and reporting?
    – how to handle complaints about the list, ranging from its mere existance to specific people/things on the list.
    – a set of suggested guidelines how the information is used (this can be very loose but there should at least be suggestions)
    – How to handle legal issues. (If this requires removing too much incriminating data, at what point does the list cease to be useful for its intended purpose? If this requires keeping it from being used in certain jurisdictions, how to avoid that?)
    – Security issues. What can be done if the list is made public? Does an unintended leakage trigger legal issues?
    etc.

    This is just what needs to be in the draft you use to try and get volunteers and create a write-up to address conventions.

    And for the sake of information, I have run exactly ONE event. I have, however, done a fair bit of volunteering, and been privy to a lot more discussion of conrunning and event running than that. So my opinion is that of an educated layperson.

35. So, how ’bout those Chronicles of St. Mary’s stories? I’ve listened to two from Audible so far, wildly out of order, and I’m enjoying the heck out of them. Historians, relatively sensible time travel, nicely twisted sense of humor.

    Reviews for The Very First Damned Thing and Ships and Stings and Wedding Rings are up now.

    Getting a headache from the other discussion, important as it is.

36. I’m not making any assumptions about how data is currently informally spread, that’s why I was asking. Is there a general consensus that there are a significant number of harassers against whom some action (temporary or permanent suspension, or membership revocation) has been taken, but that aren’t generally googleable?

    If the answer is yes, then there is a void that an SF Blacklist may fill. If the answer is no, then the problem isn’t the lack of a database; it is that cons don’t act on available data. (JJ says the answer is yes. Why is this the case? Will people who are currently sitting on knowledge of incidents open up to a central database? Because if they don’t, it won’t solve the problem.)

    Either way, is this a useful alternative to the status quo: For people with knowledge of previous harassment actions to enter them into the Geek Feminism wiki, which already includes a number of incidents (but is not exhaustive; I don’t see Alyssa Wong’s Midamericon experiences). (JJ — it sounds like you are aware of harassers who aren’t generally known. I don’t mean to sound accusatory, but why aren’t you publicizing them? Your reasons for keeping knowledge close may be generally applicable, and the implementation of a database needs to address those concerns.)

    And to add to Lenora’s list:
    Who pays? and how much? If this is to be done right, with safeguards and controls, it has to be more than a password-protected Google Doc. It ought to be some sort of organization, with liability insurance and some separability from the individuals who work on it to protect them from personal liability. It should have some minimal access to legal counsel. This is an organization which will be saying, “here is a list of people who are so dangerous you should consider keeping them from participating in your event”. People have an established right not to have false adverse information spread about them; this organization has to ensure that what it documents is true. All of thisf is a pretty big responsibility, and it shouldn’t be done on the cheap.

    And once a database is built and comes into use, who owns it? If it is useful, it will be of some monetary value. How can it be set up so that this monetary value doesn’t become the cart driving the horse?

37. Cheryl S. said:

    This informally disseminated information is not shared between SMOFs and as a result serial harassers, for instance, are free to attend all cons from which they have not been specifically banned for harassment. Also, even if the SMOFs of Con B know about someone banned from Con A, because there has been a shitstorm of publicly available discussion and information, there is no attempt to dissuade the hypothetical bannee from attending Con B.

    Is that about right?

    Any incident high-profile enough to make waves on social media is likely to be discussed by conrunners somewhere, but it might not make it beyond one specific forum, or the fandom or language of the con it happened at.

    There have always been cons willing to pre-emptively ban people, as well as cons with various justifications for allowing everyone in through the door. (No, I don’t have statistics, just anecdata.) In this day of explicit codes of conduct, you may notice language starting to appear more and more often about events outside a con still being actionable under its code of conduct.

    What are the odds that eventually Con B gets sued by someone victimized by Banned by Con A, because that information was available on social media but was ignored?

    I think they’d have a tough time being able to prove that the management of Con B saw the particular tweets, forum post, or whatever detailing the incident. ISTM that being signed up to access the proposed database would actually make it easier to sue Con B if it slips up and lets in someone who then causes another incident.

38. You’ve as much as admitted it’s an idea in preliminary stages, and yet the very questions which would solidify the idea into a final form are the ones you seem to think are unnecessary nitpicks.

    Actually, what I’ve seen is a lot of “that can never work because of X”, where X is an allegedly insurmountable problem that somehow is overcome in a lot of other situations. To the extent there have been actual suggestions that clarify or propose solutions, those have been responded to.

    At some point, to move forward on the idea, it needs:

    Okay, here are some initial thoughts. Take these with the caveat that much of this is subject to change, and has to be since any discussion involving a disparate collection of conventions necessarily has to be in order to accommodate their varied predilections.

    – a firm idea what information the database holds on each person.

    That is going to depend on the information that each convention chooses to record as an account of reported incidents. One issue is that working across conventions necessitates dealing with how each convention handles matters now. Could a “standard report form” be incorporated as part of this idea? Sure, but that requires conventions to agree to do it. Could it work without that? Sure, but it means that the information being shared isn’t going to be uniform, which will require more judgment when someone is using it. There are multiple directions this could go. I’d suggest, at a start, the data included should be the name of the perpetrator, the nature of the complaint, what investigation was done by the convention including if possible any response from the accused, the results of that investigation and any sanctions imposed. I’d be leery of including the identity of the victim, unless they volunteer to include that. I’d suggest not including anything regarding reports that are investigated and found to be unfounded, but only those where the complaint was found to be valid and some sort of response from the convention was required.

    – A firm idea how the database is built, where it’s stored and how it’s supported.

    The most straightforward way to do this would be to have some sort of shared organization to which convention sponsoring organizations could be members. Probably something akin to a trade association of the sort that exist in many business communities, possibly chartered as a nonprofit corporation. Set some critera for joining, set dues at a sufficient level to pay the needed expenses, and have some association guidelines for dealing with the data.

    – a firm idea how reports are vetted to get put on in the first place (“take each con report at its word” is also a vetting process.)

    I think it would be difficult to handle this other than “take each convention report at its word”, because doing otherwise would require some sort of non-convention observer be present at every convention, which would likely be a logistical nightmare. You could have those submitting the report affirm that it is true and accurate to the best of their knowledge – putting their reputations on the line that it is factual. Ultimately, all reports rely upon the truthfulness of those submitting them, but then again, so do all actions taken enforcing codes of conduct.

    One possibly impractical notion would be to have someone from another convention attend participating conventions and sign off on their harassment reports as being accurate as a kind of oversight, but that seems both overly intrusive and probably not doable as a practical matter for many conventions.

    – a firm idea of an appeals process for being removed (“no process” is not an option)

    I’m not sure that this should be an adjudicative body. That’s not the purpose here. The decision making I envision would be done at the convention level, not at the data sharing level. That is, I think, one of the misconceptions people have taken away from this proposal – they think that the idea is to create some sort of oversight body that will watch over how conventions deal with conduct issues and provide some sort of “higher court” to keep them in line. It isn’t. The conventions would be coequals, pooling their resources in an organized manner so that each one could decide how to handle their own business.

    I do, however, think that the information should be regularly purged of old data. The idea is to allow conventions to be forewarned of individuals who have displayed a pattern of improper behavior. To that end, keeping information from, let’s say a decade or more ago, wouldn’t be that useful. I could see writing in exceptions for particularly egregious offenses – for example someone whose conduct had risen to the level of criminal activity – but those exceptions would need to be both limited and carefully defined. For the most part, the fact that someone had a complaint against them twelve years ago that resulted in a warning would have small enough value that I would maintain that it should be purged from the system.

    – a firm idea how it’s decided which conventions are allowed access to the list (Longevity? Size? What if a Concom member in position to have access is themselves on the list?)

    I think standards would have to be crafted as to the responsibility of the convention as an organization before it could be allowed to participate. I’m thinking that longevity and size are not great criteria, because those don’t tell you how reliable the people running the convention now are. The real question boils down to how trustworthy the people who are going to handle the data are, more than anything else. In an ideal world, one could do a background check on those that a convention designated to handle the data, but most of my experience with background checks involves government action. Whether this could be done in a private situation like this needs further investigation.

    I’d expect, at the minimum, that the convention would provide written assurances from those who would be handling the data, and accept liability for any misuse of the data. One could also look to how the convention handles data now, how they handle code of conduct complaints, what appeal procedures they have in place, and other similar practices.

    As far as conventions putting forward people who are on the list, I would think that would normally be a disqualifying issue. A convention would need to suggest someone else to be their responsible individual.

    – am firm idea how to broach the idea to conventions in the first place. What do they need to know beforehand?

    I would think the best option would be to start small, with a handful of participating conventions and build from there. Possibly even just two. Present it to them as an information sharing program where they work together for their mutual benefit.

    – Can a con view the list without including its own reports?

    That is an open question. I would say no, but that isn’t a firm conviction.

    – whether the list is downloadable or merely viewable; if downloaded, if/how to make sure cons are using the latest updates.

    I would suggest making the list viewable, but only by a limited number of people on the convention committee, probably as few as two or three. I would make the list modifiable only by specific people based on written reports submitted by participating conventions.

    – whether access, once approved, is ongoing or needs to be periodically re-approved,

    Access would need to be periodically reapproved – at the very least when the staff who would have access to the data changes, but probably on a regular schedule – say every three to five years. For reapprovals, one element that can be added to the responsibility determination is how the convention has handled the shared data.

    – How public is the list of conventions whop have access to the list? Does it include information like the minecraft servers do: not accessing, accessing but not reporting, accessing and reporting?

    To make the data worthwhile, I would think that conventions would need to be able to say they are participating as part of their code of conduct. To the extent that conventions could participate without reporting, or without accessing, that would probably also need to be public information.

    – how to handle complaints about the list, ranging from its mere existence to specific people/things on the list.

    Complaints about the mere existence of the list would need to be handled by the proposed organization. Mostly, I would expect that the response would be something along the lines of “those conventions using the list is public information. those who want to avoid it are advised to either avoid attending those conventions or take up with their leadership whether they wish to continue to participate”.

    I would suggest that complaints about specific things on the list should be referred to the originating convention. The information is only as good as the conventions that provide it – and any revisions to the data would have to be primarily their responsibility. Obviously, if data were somehow transmitted incorrectly, that could be handled directly. Unless one wants to give investigatory authority to the organization that maintains the list, then there would not be much they could do directly.

    – a set of suggested guidelines how the information is used (this can be very loose but there should at least be suggestions)

    I would say that the conventions would have to agree to only use the information for making determinations concerning (a) resolution of code of conduct complaints, and (b) whether or not to admit particular attendees.

    – How to handle legal issues. (If this requires removing too much incriminating data, at what point does the list cease to be useful for its intended purpose? If this requires keeping it from being used in certain jurisdictions, how to avoid that?)

    This is, at least in part, going to be determined by the jurisdiction in which the participating conventions are located. Even if the list only includes the person complained about and the action taken by the convention, that would still be useful.

    – Security issues. What can be done if the list is made public? Does an unintended leakage trigger legal issues?

    One possibility would be to split the list into two elements – a list of complaints and actions taken with the violator identified only by a number, and a separate list of numbers matched with names. You could also tailor the information contained on the list to local legal conditions.

    I would make conventions responsible for leaks that can be tied to their actions – one could have agreement to that be a condition of having access to the list.

    There’s obviously a lot more to be worked out, and many of the final contours will likely be very different from those outlined here, but that’s a preliminary stab at it.

39. I wasn’t assuming an outside observer to the actual process or convention, but simply something that can be signed off on by the con as “true to the best of our ability”, and/or someone looking at any public reports or discussion of the convention itself, noting places known for “drama” or possible extenuating circumstances. (which may themselves be unreliable, but their existence make things interesting.)

40. Just my two cents worth, but back in the day there were a couple of local cons that I could have got thrown out of just by showing up there. And I am sure that that a couple of people would have loved to put me on your “shoot on sight if you see them approaching your con” list if it had existed then. Back then this did not cause me any real trouble because everyone in the area knew what was going on and ignored it at other cons in the area. But with this I could have been banned from a Worldcon easily, especially one that was set outside the USA.

41. Trek Against Trump.

    There are a couple of names missing that I would have expected to see, but I suspect it’s because they’re not American citizens.

42. Bill: JJ — it sounds like you are aware of harassers who aren’t generally known. I don’t mean to sound accusatory, but why aren’t you publicizing them? Your reasons for keeping knowledge close may be generally applicable, and the implementation of a database needs to address those concerns.

    Yes, Bill, I am aware that there are harassers whose names aren’t generally known. My point, if you’d read my comments in the thread a little more carefully, is that despite having seen posts about incidents on social media, I still don’t know who the perpetrators of those incidents are.

    And I’m damned good with Google, and with other less obvious methods of finding things on the Internet (case in point: my being able to identify the two companies who provided the Jovian and the Dragon Awards).

    I didn’t have much problem finding the name involved with one of the Wiscon incidents, which involved a serial harasser who’d been doing things for many years (but I note that this name was finally only generally made available after many years when it wasn’t).

    I had a lot more problem finding the name involved in the Readercon incident when it happened (although it may be easier to find, now that a significant amount of time has passed). And that person was a serial harasser, too, whose name and history was not at all widely available before then. (And I’ll note that I still see that person showing up at cons, and being involved on concoms, so there are apparently a lot of people in fandom who don’t have a problem with the things that they have done.)

    Both of the above were apparently “well-known missing stairs” in fandom — but unless you happened to know one of the people who was in-the-know, and they happened to be willing to warn you about the missing stair, you were out of luck.

    And as I said, there was a con recently who basically put out a Press Release that said “There was an incident at our con, and we dealt with it according to our Code of Conduct” — which tells no one anything. I’m sure that it was intended to give people confidence that that particular con is enforcing its CoC. In fact, it provided little assurance or confidence (at least to me), because a) no one has idea what happened, b) no one knows what was done about it, and c) the perpetrator’s name is not known, leaving them free to go repeat the behavior at other conventions.

    In other words, I agree with Aaron’s premise that it would benefit fandom and conventions if cons were able to devise a more reliable method of sharing that information that does not involve “hearing on the grapevine that something happened” and “happening to know the right person” and them being willing to share that information with you.

    It’s just that there are a lot of logistical issues with such a method, which would need to be worked out in order to make it viable.

43. I wasn’t assuming an outside observer to the actual process or convention, but simply something that can be signed off on by the con as “true to the best of our ability”, and/or someone looking at any public reports or discussion of the convention itself, noting places known for “drama” or possible extenuating circumstances.

    Either you’re going to have to accept that conventions are doing things properly, or you have to send observers. You can’t really do things another way.

44. Pingback: Pixel Scroll 1/6/17 It Scrolls! It Pixels! It Makes Julienne Files! | File 770

Comments are closed.