How We Updated Drupal's Code of Conduct

GEORGE DEMET:
Recording now. So we're good. Thanks, Kevin. Alright. Hello and welcome to How We Updated Drupal's Code of Conduct. My name is George DeMet. I am the founder and CEO of Palantir.net. We are a digital consultancy that specializes in working with open-source technologies based just north of here up in Evanston but with team members all over the country. I've been active in the community since 2007. My first Drupal event was the open source CMS summit in Sunnyvale, California, on the Yahoo Campus back when Yahoo had a campus. And so since then, I've volunteered in several different capacities in the Drupal community. Kind of relevant to our conversation today. I was one of the founding members of the DPL community working group. that was from 2013 to January 1st, 2021. And then then I kind of graduated to the community health team. I'll explain a little bit about the distinction there a little bit. Back about 10 years ago, I co-authored the original version of Drupal's Code of Conduct for events.

So again, I'll kind of explain the different kinds of codes of conduct we have in the Drupal community and how they relate to each other. My pronouns are he, him. I have my Twitter up there, but that's because I haven't updated it yet. I'm actually mostly posting on Mastodon and LinkedIn these days. And you can find me at [email protected]. So, let's start with a little bit of a history and context into Drupal community governance. So, the Drupal project has been around since 2001 when it was founded by Dries Buytaert in his dorm room. And for much of the first few years of the Drupal project like many open-source projects, there really wasn't any established code of conduct. There were kind of unspoken community norms. There were people in the community who would kind of informally step in when they saw something getting out of line. But as the community grew and became larger and more international, and people came into the community who didn't have existing social ties with the people who were already there, it became clear that some kind of code of conduct was needed.

There were also around this time around 2010, there were a few incidents where you know people in the community, well-known high-profile contributors experienced harassment and abuse from other people in the community, had left the community because of this. And so it was actually Moshe Weitzman who is one of the original Drupal co-developers and still active in the community today proposed that Drupal adopt a code of conduct. And specifically, it was Ubuntu's code of conduct that was the current version at the time. And so that was kind of fair. But when the Drupal community implemented it, there was no, they kind of left the enforcement part blank and said, well, for now, we'll add this later, but for now, we're just gonna kind of trust that everyone knows what to do. Well gonna guess how well that went. So in 2012, Drupal held a governance sprint that resulted in the creation of several working groups focused around sort of technical governance, community governance. So, the community working group was the governance body that was formed at that, where it was chartered at that time.

The actual membership wasn't decided for another few months. At the time, that group was reported directly to Dries. And the reason for that was not that Dries wanted it that way, but because there was really no other obvious person or entity to whom the group should report. Around the same time, the Drupal Association which is responsible for DrupalCon and other events in the community adopted a code of conduct very specifically for the events. And so it had language that was very specifically relevant to this is what we need to know. These are the rules for an in-person event. So, I was actually, as I said before, I was involved in that event's code of conduct, which is distinct from that community code of conduct. I had, along with Tiffany Ferris, been Co-Chair of DrupalCon Chicago in 2011. We had a few incidents occur at that event that made it really clear we needed some sort of event code of conduct. And so I worked with some other folks and pushed very strongly for the Duple Association to adopt that code of conduct.

It was a bit of a fraught process. The original version we proposed got a lot of pushback. So, we made some revisions. Interestingly enough, a couple years later, a lot of that language just kind of went back in with no objection 'cause I think people had kind of become more aware and understanding of the value of a code of conduct. So, 2013, 2014, the community working group is chartered. The first things we do, I was one of the founding members, Angie Byron was also in the group at that time, Donna Benjamin, (UNKNOWN) who's from Belgium. So the first thing we did, we kind of spent the first sort of year or so developing an incident report, processes for what happens if there is a conflict in the community where someone's experiencing harassment or abuse. What does that look like? How does it get handled? We added the anti-harassment language to the code of conduct, but it was very general. We didn't get instantaneous specific, just said, we don't tolerate harassment in our community.

So we continued that way for a few years until 2017 when there was what I'll call a community crisis in the Drupal community involving some, I'm not gonna get into details, but it involved a controversy about a high-profile person in the community and who was asked to leave. And so as a result of that, there were a series of community discussions that occurred at DrupalCon in the spring of 2017. There were a couple of different surveys that went out to the community in the summer and fall of 2017. And those resulted in a number of different proposals to improve community governance. Some of those proposals really revolved around the governance of the community working group in particular that it did not make sense to have this group that was responsible for code of conduct enforcement and conflict resolution report to a single individual and for that single individual to be the person who gets escalated to, when someone disagrees with a decision made by BCWG. And Dries agreed with that.

And so, over again, the kind of the next year we worked on redeveloping our charter. And so, on the next slide, I'll go into more detail about that. But the essence is that the Conflict Resolution Team who's responsible for receiving incident reports of harassment or abuse of violations of the code of conduct instead of reporting directly to Dries instead reports to a panel that consists of the community-elected members of the Drupal Association Board of Directors, along with an external representative who's not part of the Drupal community, but who has experience with community management. And that person is selected by the Drupal Association board. So then in 2020, the CWG created the community health team which does not field incident reports but is really there to focus on proactive community health tasks. And so, one really great example of that is that in the issue queues on drupal.org, if there is a conversation that looks like it's headed in the wrong direction for one reason or another, there's what we call these nudges.

And they're carefully written kind of little messages that someone can post in the issue queue that basically says, Hey, looks like this conversation's getting a little bit off track. Please keep these things in mind. And they're focused around sort of different kinds of common ways that a conversation will go off track, right? And so that's one example. The other thing that we were gonna get started doing in 2020 was overhauling the community code of conduct 'cause really it hadn't changed since 2013. And it really hadn't changed very much since 2010. And then that interim, all kinds of open source projects have adopted codes of conduct, and there's new language, new understanding. And through these surveys and everything that we've been doing, we've been receiving a lot of feedback that our community code of conduct was inadequate, but it wasn't clear enough. It wasn't specific enough, it wasn't actionable enough. And because the language was so vague, and we were experiencing this as members of Conflict Resolution Team, people were basically interpreting it whichever way they wanted to serve their interests.

Then the pandemic hit. So we kind of did not get around to really making progress on it until 2022. And so that's kind of what I'm gonna cover in the rest of the conversation. So, really this kind of 2022 to 2023 period. So, we talked a lot about the kind of governance structure. So, right here you have the Drupal Association Board of Directors. Those consist of self-appointed... Groups appointed by the board itself. It also consists of two community-elected board members. So, those two community-elected board members, along with the independent representative who's appointed by the board as a whole consist of the community working groups Review Panel. That independent representative is currently Jono Bacon who's very well-known, very well-respected community governance expert. Has worked with a lot of different open-source projects. He's an author, really great guy. So they have oversight over the community working group's Conflict Resolution Team. And so what that means is that when the committee working group wants to add a new member, that person has to be approved by the Review Panel.

When somebody disagrees with a decision made by the community working group, they can appeal it to this panel. So that is the oversight that the community working group has. So that Conflict Resolution Team also has a community health team, which is a group I talked about before. These are the folks who are responsible for community health, providing support for events ambassadors. People who might represent or be involved in different local communities around the world, different groups within the Duple community. we have subject matter experts who might get pulled into an issue if needed. So if for example, we're dealing with a conflict that might involve some sort of cultural difference or misunderstanding, and if that under expertise and context doesn't exist within the Conflict Resolution Team, they might pull in a subject matter expert to help. All of these folks are bound by a code of ethics, the Community Working Groups Code of Ethics, the Drupal Association Board of Directors has its own code of ethics that binds it.

And so that's kind of the overall governance structure. By the way, if anyone here has any questions as I'm going through this, just raise your hand. This all makes sense in my head, but I'm not sure it makes sense for everyone else (LAUGHS). So please don't hesitate to raise your hand or chime in. Alright, so let's set the stage. It is May of 2022. We're finally getting back to the work of reviewing, updating, overhauling, Drupal's community code of conduct. So need a plan, we need a team. So the team was assembled by the Conflict Resolution Team from the group of community health team members. And so I had just rolled off the Conflict Resolution Team, so I was a member of the (UNKNOWN) health team. I had a lot of context into all of this. So I was the chair of the group. Group also includes Nikki Flores, who actually had a step-down kind of halfway through because she was elected to the Drupal Association board. Became a member of the CWG Review Panel, and so had a little bit of conflict of interest there.

And so stepped aside. Julian Taylor, Jordana Fung, Mark Casias, Donna Bungard, and Mike Anello. So, the first thing we did as a group was a chartering exercise. Because we really needed to decide what we were gonna do, how we were gonna measure success, what our opportunities and constraints were. And so to do that, this is a little bit of a screenshot from a corner of a mural board we created. We used kind of a common chartering template. And we generated stickies that focused on things like, Hey, what are our goals? How do we measure success? Who will participate? What are the resources we need? What are our constraints? So once we were all agreed on that the next step was then to create a timeline with key milestones divided into two-week sprints. And that was really important because we really needed to set that out and have a timeline and an end goal in sight if we were gonna hold ourselves accountable. And so what we agreed was that we were gonna start in June of 2022, and we were gonna get to the point where we had a final draft by mid-December of 2022.

The other thing we agreed as part of assembling and organizing as a team, was that we needed to make sure that the community was aware of what was going on. So, we agreed to post public updates to the Drupal community blog drupal.org. So we had our team. The next step was to identify who our stakeholders were, right? So, we're creating this new code of conduct for the entire Drupal community, which is an enormous global community of tens of thousands of developers around the world, plus countless other users of the software. And we knew that there were certain community groups that we wanted to involve during the process, right? We wanted to talk with people from the security team. We wanted to involve people from the event organizers team, Drupal diversity, and inclusion. We wanted to make sure that that group was represented as folks who have been the targets of harassment and abuse in the past. We knew that they had some important perspectives to add. We reached out to a few topple contributors and maintainers who again, often have to deal with conflict in the issue queues.

Drupal Association, staff community accessibility experts, and then various geographic base groups. And so one of the things that was really, really important was to make sure that this group of stakeholders was not just people who were in the United States and Western Europe. So, we made sure to reach out to folks who were in Africa, who were in Asia, who were in Latin America, and make sure that they were involved in this conversation. Our total group of stakeholders, we wanted to keep it small, was around 20 people. And really the idea was that we wanted to make sure to get all these perspectives and feedback in place before we shared out with the broader community. And that was an experience I had learned from my experience back in 2012 when we were developing the event code of conduct, and we had a very small group of people that created the draft, and we put it out to the community and realized there was a whole bunch of stuff we had not thought of or taken into consideration. So, our next step, and again... So, now going back to our core group of seven was to review other codes of conduct widely used codes of conduct from open source and open source adjacent communities.

So the contributor covenant is, I think by far the most widely used open-source code of conduct. So, we wanted to make sure that that was one that we looked at to kind of understand what language it had, what things had covered. Ubuntu. So, our current code of conduct was based on the version, I think 1.1 of Ubuntu's code of conduct. They're in version two, so we made sure to include that to see would've been updated. Fedora, AllyTalks, Learn WordPress, Decoupled Days, and The Enspiral Handbook, this one was a little kind of different. Enspiral is kind of collective of folks who worked on self-organizing and self-management, but they have some really, really great tools for conflict resolution and restorative justice and cool stuff like that. So, we wanted to get that perspective in as well. And then we basically just kind of split up. All of these different codes of conduct. Someone in our group took one of them, and we broke it down. We broke down each code of conduct, said, OK, what are the different elements that this code of conduct has, right?

And it's like examples of positive and negative behaviors, enforcement expectations, shared values, right? All of these things. So again, we went back to Miro, and then we put all these things on a board, and then we voted as a group. And this is a screenshot from the exercise we did on which things we thought were the things we must have in our revised code of conduct, which were things we thought we should have, and which were things we thought were nice to have. And so at that point, we've got kind of a list of like, okay, here's kind of a prioritized list of all the different elements we were looking for in an updated or revised code of conduct. And then that's when we reached out to our stakeholder group. And the way we solicited feedback, was we essentially created a Google doc. We took for each of the elements that we had identified as must have, should have, nice to have, we pulled sample language from the corresponding codes of conduct that it applied to. And so we had like a category of must-haves, and it would be language from this code of conduct, language from that code of conduct.

And so we had all of this in the Google Doc, and then we shared that with our group of community stakeholders for review and feedback, which they could provide us comments in the Google Doc, or even just reach out to us and have a conversation directly or in Slack. And so we got some really great feedback from that. Again keep in mind, this is not the final document. This is just kind of a rough idea of what we want to include here. What are we missing, essentially? And one of the really big points that came back, and one of the reasons I'm really glad we included people from our broader international community was that a lot of the language in these existing open-source codes of conduct is really difficult to read. And I actually ran some of these codes of conduct through like a, when I was reading score assessments software, and the contributor covenant, again, which is one of the most widely used open-source codes of conduct, assumes that you have, that you're reading it like a college level.

And that's really simply one, not true for many people in open-source, but two, for people for whom English is not their first language, it's really, really difficult to read. Again, there was, in some of the examples we provided, there was discussion of specific examples of acceptable and unacceptable behavior which we also had. There was also some discussion about and feedback on that certain examples maybe made more sense than others. And again, one of the reasons I'm really glad we had we reached out to the stakeholder group was that there were certain words and phrases in some of these code of conduct that had different meanings to people in communities of color or other marginalized communities. And again, coming from a white male American perspective, these are not things I would necessarily have noticed. But they are definitely things that other folks would have noticed. So this was really, really important and helpful. Alright, so then, so we've got that feedback. So, our next step was revisions, revisions, revisions.

And so this process actually took a couple of months for us to do. And the first step was to try and take all of the different, we had this kind of messy Word document that had all this language from all these different codes of conduct. We had all this stakeholder feedback. And so the first step was to turn it into an initial draft that was coherent. And I really want to thank Donna Bungard for doing the first step on that because that was really hard work. And then, essentially, we just kept revising and revising, and so we would have our meetings every two weeks. We would review the current version of the draft and make additional edits based on internal feedback, right? And so it's like, does this language sound right? Is it consistent? Is it clear? This was something I did really taking to heart that feedback that we needed to make the language as easy to read and understand as possible. So used the Hemingway Editor. used Readable, used other tools to say, are we wording this in as clear and straightforward way as possible?

And that's hard because the code of conduct has to deal with a lot of really nuanced situations. And so making that text easy to understand, but not making it so that it would lost its meaning was a really big challenge. When we finally got it, after a couple of months to a place where we thought, we had something we could share we reached out to their stakeholder group and then the full community health team as well for additional review and suggestions. And then we went back to more revising is what we did after that. After a couple more rounds of revision, when we finally thought that the draft was really ready to share with everyone in the Drupal community, we created an issue on drupal.org where we put up the proposed language, we set the context. This is a draft. We're looking for community feedback. They could provide feedback either in the issue queue or privately. They could reach out to us directly or via Google form. Again, this comes from past experience. There are folks who may not feel comfortable providing feedback publicly, so we gave 'em the opportunity to do it privately as well.

We wrote a blog post, big blog post that kind of outlined why we were doing this, the changes we were making, recapping the process to date, and what our next steps would be. Spread the word via social media, slack newsletters with some Drupal newsletters. I think goes out to about 20,000 people to make sure that as many people as possible knew. And this is, again, really important. So obviously once we posted this on drupal.org, people started getting in there. They had some opinions and I didn't agree with all the opinions, but I didn't get involved in the discussion because that was not what we were here for. We weren't here to debate every single little nuance and word and clause and everything. If people had questions, clarifying questions, they wanted to understand something we would answer those, but otherwise, we were not going to provide feedback on the feedback. Another huge thing, and again, this is something learned from past experience, time boxing the feedback period. So, this was in November.

We posted it in early November, and I think we gave folks until the end of the month. So, it was about three weeks feedback period. It did overlap with the Thanksgiving holiday in the United States, but we also made sure that there was plenty of time outside of that for people to solicit feedback. And actually, it really died off before then. So, I think we got what we needed to get. So, then, right, more revisions. So, went into a couple more rounds of revision. And we met our timeline. We got to a finalized draft. But before Christmas last year, and before around mid-December, shared it with the Conflict Resolution Team for review and approval. We received some feedback from the Conflict Resolution Team right away. That feedback was incorporated. One of the things as well was how is this going to look on drupal.org. Because the presentation, the layout of the new code of conduct is very different because, in the new code of conduct, we have these examples of types of behaviors that are welcome and types of behaviors that are not welcome.

And if we had all those displayed out all the time, the code of conduct would be super, super long, and difficult to read. So we needed to do some kind of... Fortunately, there's a little way we can, we can make lists collapsible on drupal.org. So when you look at it, you'll see the core language of the code, but you can also open to see specific examples for each item if that's something that you want to do. So, that was kind of this past winter, early this year. So, the place where we're at right now is that the Conflict Resolution Team has reviewed, the Conflict Resolution Team has asked their Review Panel. Again, those are those community elected members of the DA board plus Jono Bacon, the independent representative to provide final feedback by the end of this month at which point, hopefully pending any last final revisions will be approved. And then the new code of conduct will then be published, announced to the community. Everyone involved will receive contribution credit, whether you were part of the kind of core team, whether you were one of the member of the stakeholder group, or whether you were one of the community members who provided feedback during the open community feedback session.

Even if we didn't incorporate your feedback, we will receive contribution credit because we appreciate it. And yeah, so that's where we're at. So, this is literally my light at the end of the tunnel slide. For me, this is personally something I have been looking forward to for a really long time. When we received all the feedback from the community in 2017 and the situation we were dealing with, one of the things that was really important to me was that we change things so that nothing like that crisis ever happens again in the community. So, since that time I've been really, this is something I've been trying to get done for a long time. So I'm very happy that we are almost there. Yeah. So, actually, I should go back a little bit and say, so during the feedback period, it was interesting, a lot of the feedback we received was not about the new language we were proposing. It was actually feedback on the original language of the code of conduct that we've had since 2010, which we had retained.

And so that was really interesting to me. I think it did validate why we were doing this. There was a lot of discussion about the language, about how we collaborate with others. There was a lot of discussion about how and when people stepped down considerably from the community for whatever reason. And so that community review really did help make this a much better document. So what have we learned? What have we learned during this process, class? Setting a goal, setting milestones early, being okay with making changes if needed. And that really kind of came in I think during that revisions process. We kind of moved things around a little bit because we knew we were going to need to take more time to get the language right. As I've said before, inviting a diverse group of people to review the draft can help catch many issues. And I'm really, really grateful we did that because if we had thrown the draft we had in, like July out to the community, there's a lot of things that folks would've very rightly jumped on as being problematic.

As I've said before, a lot of popular codes of conduct are written using really complex language that not only requires like... Assumes a certain level of proficiency with the English language. And so I think that's something that folks really need to keep in mind when dealing with international projects, international communities. One of the things I'm really hoping happens with the new code of conduct is that it can be translated into different languages which again, will make it even easier for more folks in our community. As mentioned before, allowing people to contribute feedback privately, anonymously is really important to kind of fostering that safety, right? Because a lot of the open and public spaces in our community, the drupal.org issue queues, wherever are still not really, don't really feel safe to everyone all the time. And so being able to share anonymously and privately is really important. And this was the biggest thing for me, is being patient. (LAUGHS) I thought we would get it done in less than six months.

We did not, and that was the right amount of time. So, I'm glad we went with that as our timeline. Again, being patient through this current review period we're in. And I am excited and looking forward to the new code of conduct, but we also want to get it right and that takes time. So that is what I have. Oh, see, and there's my Mastodon link. Any questions? I know we've got a small group here today, but there must be some questions.

SPEAKER:
How many pages?

GEORGE DEMET:
How many pages? It's a great question. If you don't count the... So the current code of conduct is basically like, I don't know, it's what, six or seven paragraphs and it's a little more than that. It's like sections, right? And so we really kind of kept that overall structure. And so that part of it is about the same link. We've added some language at the beginning that kind of provides a more robust introduction. It provides a more robust sort of like statement of scope. That was another weakness with our existing code of conduct. Is it's not really clear, like where this does and doesn't apply for everyone. So, I'm getting around to answering your question. And then we also added the examples of positive and negative behavior. So, it is probably, if I include all of that text, it's probably two to three times longer, but when you see it on drupal.org, it should look pretty... It'll be a little bit longer than the current code, but not too much longer because again, those examples will appear collapsed.

And so again, we wanted to make sure it was as scannable as possible. It's hard to say...

SPEAKER:
How many pages.

GEORGE DEMET:
Yeah. On a screen. Yeah, I mean, I've got a Google Doc somewhere, but yeah, I can't remember how many pages long the Google Doc is. It's like a couple of pages. Yeah. Any other questions? No?

SPEAKER:
Well, I was there, so.

GEORGE DEMET:
Yeah, I know, I mean, you were involved. I mean, actually, do you have anything to add that I missed or?

SPEAKER:
No, some of this was great for the overview. Even though I'm on the Conflict Resolution Team, I had no idea we had an oversight committee. (LAUGHS).

GEORGE DEMET:
They had to approve you, right? To get to be on their team. Yeah. But you're right. Fortunately, they get used really often. I think since we've had the Conflict Resolution Team, well, I don't know since 21. But I know from in kind of the first like year, year and a half when I was still on Conflict Resolution Team and we had the Oversight Panel. I think we brought them in on one issue. And that one was like we weren't in full agreement as a group on how to approach that issue. And we really needed some more perspective on it, 'cause it was tricky. So, yeah. But yeah, otherwise they only were like, hey, we wanna add so and so to the team. Is that cool? And they say yes. I'm assuming most of the time 'cause we do a pretty good job of picking numbers, I think so. Well, thank you. So yeah, so thank you for coming and I think...

SPEAKER:
Just press the button.

GEORGE DEMET:
I'll press the button again when I am done. All righty. Thank you all.