 Organizational structures for sustainable free software development. Title says it all in my opinion and I think this is a very important topic. The talk will be held by Mo, who has experience with dozens of free software projects and funding sources. As a funder and recipient of grants, contracts and donations. The stage is yours. Give a big hand and round of applause for Mo, please. Hello everyone. Nice rainy fourth day of Congress. Yes, I'm going to talk about organizational structures. What do I mean by that and why am I talking about this? I was invited to submit a talk about open source funding and they cut me short. They gave me instead of the 60 minutes that I offered, they gave me 30 minutes. So now I'm cutting out all the part that is actually talking about funding. Because I think before you can go and even speak about funding, you need to understand that funding can be dangerous, money can be very destructive for open source projects. And in order to be prepared for the next part of my talk that you're not going to hear today, I want to talk a bit more about organizational structures and another alternative title of this talk could be open source governance. So even more dry than the previous title. Before I go into detail of why am I giving this talk, who am I? Why do I think I have some experience with all these topics? Some caution, some trigger warning. As you might have experienced, I'm using open source and free software exchangeably in this talk. And I know this can cause a lot of uproar, people can die, and I don't want anyone's feeling to get hurt. I can go into detail about why I'm doing this and why I'm using this interchangeably, both for the aspects of the licensing where classically you would use kind of open source licenses, as well as for all the open source principles and guidelines for the development, the collaboration and everything that is happening on organizational level. So bear with me, if you're a free software person, I'm your friend. So a bit about me. In 2010 I was studying computer science at the Technical University Dresden and as one of my site projects, near the end of the studies, I started something called torservers.net. Torservers.net is a network of organizations. So we started with the first organization in Germany, a non-profit members association, and the goal of this network of organizations is to run tor infrastructure. So over the years we've grown this network from this single organization in Germany to 22 organizations in 15 countries. Most of these organizations have been set up specifically for this purpose, to run network infrastructure. And most of them are also charitable non-profits. So I kind of accidentally learned a lot about the differences between the different countries on how they look at charitable law and stuff like that. In 2013 I came across a pretty new foundation, the Renewable Freedom Foundation. It was set up in 2012 by Georg Cheff, the then newspaper owner of the Donaukourier in Ingolstadt. So it's a daily newspaper and he started a foundation with the goal to protect and preserve civil liberties in the digital space. And ever since we've been working with dozens of organizations and dozens of projects across the whole sphere of anything that you can basically see at the Congress. And we are a small foundation so we had to find our purpose in this space and we are focusing mostly on organizational development, and taking away burden from people that set out to realize their goals and in order to realize your goals you sometimes have to do stuff that you don't want to do. And we help with that. And this led to the creation of a new entity in 2016, the Center for the Cultivation of Technology, which is a non-profit limited liability company in Germany, and I will go back to that and mention it later in this talk. So why are we here? What are we talking about? I cut my talk short. I mentioned this. A lot of the stuff that you're going to see are references to outside material. This is a complex topic and I encourage you to look at the references and pick them up. They should be now listed in the FAR plan for this event. So you don't have to take pictures or anything of this or follow the video to hunt the references. They're all linked on the website. And my goal for this talk is that there's a growing number of people in our space that think critically about funding, that also see that more and more funding is coming to the space and that we need to become better at organizing and learning and collectively sharing our experiences with funders, with funding entities, how to write grants and stuff like that. And if at the end of this talk maybe one or two people come up to me and become part of that network, that would be great. That's my hope for this talk. So let's start on April 7th, 2014. I think you all well recognize this logo. This was one of the first times where kind of in a marketing experiment people described a weakness in OpenSSL. This is Heartbleed. And Heartbleed kicked off quite a bit of activities. There was a blog post by the OpenSSL developers basically how they're not getting any funding to do their work properly. And also it kicked off a lot of other research in this area about how can we actually support open source. One of the most prominent figures that is walking around talking about these topics is Nadja Ekbal. This is like three references that I feel are very important to look at. The unstructured labor behind our digital infrastructure was a report published in July 2016. I picked out another short talk of her rebuilding the cathedral at the strange loop conference. And she's maintaining sort of a list of funding opportunities. So she's comparing the different ways to get open source funded. So if you're coming only for that part, take a look at that list, the lemonade stand. Mozilla also did quite a bit of research. They're, as you know, a fairly large organization handling a lot of volunteers and a lot of volunteer contributions. We also know that there is a lot of controversy around how well they manage this. And in order to improve, they commissioned a few studies. One of the studies was done by Stanford in 2009. How do you actually work with volunteers? Basically the topic always is how do you scale and how do you keep volunteers excited around your project and contributors? There's an interesting community survey that I invite you to look at. And there's a more extensive report published in 2016 about the motivations of contributors to open source. And I will come back to this because this is exactly the crucial part when you transition from a project that has been run on volunteer basis or that has some people involved that managed to contribute to the project and how to grow your project and keep that spirit up and be inclusive as a community. Kind of the most famous and the most relevant reference here is Jono Bacon. Not necessarily this book. This is a good book. It's a lengthy book. But he also gave a lot of different talks and he's giving seminars about this. And I highly recommend his stuff. I put a small note at the bottom. This book is not an instruction manual because it is an instruction manual. And I don't like that style. So try to read it and read in between the lines. There's a lot of takeaways that you can have from this book that you won't get if you follow it line by line. I think that many people demand an instruction manual for how to manage communities. And then you end up with that kind of writing. But I still think that this is kind of the most valuable book describing the motivations of open source developers. He talks a lot about creating a sense of belonging in the community that you need a shared belief in the project and that you will need to have opportunity to contribute on an equal basis. So this is the announcement of the core infrastructure initiative by the Linux Foundation that is only roughly like two or three weeks after Heartbleed. So they managed to find some commercial companies to bootstrap a program that would support open source infrastructure and of course the first software that they supported with this and are still supporting is OpenSSL. And I will just briefly mention a bunch of funding opportunities and a bunch of ways how open source projects might be able to get some funding to show that there's been quite a lot of movement in these areas. The P that you can see here is the German Prototype Fund that's the German Ministry of Education and Research that is supporting this project. So there is German federal government money that is used to fund open source development and I encourage every one of you to check out the Prototype Fund website and look at the previous rounds of projects that they've been supporting because I think it's an excellent selection. I listed a bunch of others. I'm not going to go more into detail about the funders. That's for a second talk, a separate talk, but you can find these resources. I picked out two specifically, the Snowdift Wiki, the market research they did that Erin did is really excellent into the different ways of funding and also we maintain a huge list of funding sources. That's I think around 300 foundations listed there. Not all of them fund open source technology, but since we are active in a more broader space of digital everything, you will find a lot of material there. One thing that I want to specifically pick out and highlight because it hasn't been talked about before, not that I know of, is a program that is currently in its phase of accepting applications with the wonderful name of ICT 24, 2018, 2019. It's a European Commission call for participation for the next generation internet. This is relevant and interesting because the way they're framing this call will show you quite clearly that they are interested in the kind of technologies that get built by our communities. Sometimes the language is kind of funny and the terminology is something that you have to get used to, but I like it. It's kind of human-centric, openness, cooperation across borders, decentralization, inclusiveness, protection of privacy. That's the values that also we stand for. In this program, the research and innovation actions that this is going to fund should encourage when relevant, open source software, open hardware design, access to data, standardization activities. So everything that kind of our communities have been doing and want to be doing. So this is really a great opportunity and we will see how this will end up because, and now I'm coming to the crucial point of this call, it is a call for intermediaries. So you're not supposed to apply as a project directly for that kind of money because that's just too huge. The amount of money that they're giving out in total budget just for this call is 21.5 million just in 2018. So as intermediaries you can apply for these fundings and they're split across three different topics. One topic is privacy technologies, the other is peer-to-peer technologies and the third is kind of data mining, big data stuff. And these intermediaries then are responsible to split up that funding and give it away to third parties and this is something that commission calls usually exclude. Usually they require you to develop everything in-house and make it very hard to involve external participants. So this will be interesting to follow. The deadline is in April and sometime maybe during the next year we will see who got this money and how they're going to redistribute this. Now for dealing with money I put this nice little piggy bank as a kind of contrast to how dangerous actually funding can be if you don't think about it. So when you want to deal with money and I'm probably not telling you any news, as a project you have to decide whether you want to start some kind of legal entity to help you with that because at certain points you just don't want to have it go through one individual. So you have the option of creating your own organization or you find an existing organization to partner with. In the hopes that it's kind of less bureaucratic you already have some kind of infrastructure that there's hopefully already some accounting happening and all that stuff. So let's look at the two different options. The one option starting your own is something that a lot of people feel that is the way to go because they believe that they stay in control. It's your own thing. You're not depending on some external weird partner organization but I am warning from this model because you're actually creating an organism. When you create an organization you create some organism and that organism develops its own life and then my experience with many projects is that over time the organization swallows its people and you're contributing to something that you set out to be doing in this organization without necessarily taking a step back and deciding when to let go of an organization or when to restructure it. It will defend itself. So how do you do this? What you see here is a very elaborate bylaws or chapter or the articles of creation of your organization and there's typically two ways to do this. One you go and hire a lawyer and they come up with some draft document for you. This is kind of very often the way that people do it in the US. In Europe mostly what you do is you copy something. You compile it yourself. So in Europe you don't need a lawyer to create organizations. You're not expected to get a lawyer involved. So what happens then is that you look around, you compare different articles from similar organizations and then quite often you copy different parts of these documents together to form your own organization. The problem in both cases is that here what happens is that you are getting some template that has governance structure described that does not necessarily match the governance structure of your project and it does not necessarily match the values and the spirit of a collaborative environment for open source development. This is even more dangerous, the kind of copy pasta because you usually end up with a document that is in itself incoherent because some of the articles at the beginning contradict some articles coming later. When you talk to lawyers that they see this over and over again so this is not something that just happens sometimes but this is the usual case that this is not even coherent in itself. Let alone coherent and compatible with how you actually want to run the project. This leads to kind of a feeling that you have to have these two worlds. You think that there are some legal requirements for your organization that does not exactly fit the spirit but there is opportunity there. There is opportunity there to express the actual governance that you have in your project and even probably unwritten. You have some idea of how you want to work together. I caution people, don't just copy and paste something, don't go to your lawyer and say, I want to create a nonprofit or I want to create a company that is getting the cheap kind of capitalist model of an organization. I call this the Stack Overflow effect. It's copy-pasting stuff from Stack Overflow and importing it and bootstrapping an organization like that. The alternative that you have is using a fiscal sponsor. That's the professional term for looking for a partner organization and partnering with an existing organization. In the free software space, there's a bunch of those that you can pick from and all of these include some guidance along the way, especially if they're made for open source projects and if they're already experienced with other projects. This is a newspaper article in the LWN article. Choose Your Foundation is a website that compares a bunch of the most prominent ones in the US. I want to highlight the Commons Conservancy, the Commons Conservancy is a bit different model. It isn't actually a fiscal sponsor. It is a way to define your own governance. So independently of what kind of legal entities you're going to use, you can use the material that the Commons Conservancy is producing to pick and choose governance models. So they have documents about forking organizations, for example. So you're not only forking the source code, but really forking the organization and what happens to the assets that the organization has, domain names, trademarks and stuff like that. So ultimately, in any case, you will have to talk about this ugly topic and that's why I use this kind of very ugly slide to talk about governance because that's something that kind of the projects, usually that I work with, are loose collectives, are politically motivated, come with anarchist spirit, are kind of against any form of formal governance, which is not exactly what anarchism is about, but that's a separate talk altogether. Let's stick to this. So what we have in open source actually is a lot of tools that have been developed that implement the governance models without it becoming kind of a long-written statement. So when you think about issue trackers, when you think about mailing lists, the way you interact and code with revision control systems, all of that is an implementation of inherently of a governance model in open source. And we are lacking those tools in the other areas that become relevant for governance. And this is basically what I want to highlight in this talk. So... But how do we go from here? How do we take all these unwritten rules and these kind of spiritual or ethical guidelines that we come out? And this will be very different from organization to organization. How do we turn them into something that other people can follow? And this is important, especially during the phase where you start receiving money because then you have to make a decision on how to spend that money, and you can still make that decision collectively, but over time you bring in people maybe from different spaces. And they're coming with a different background, they're coming with a different set of ethical principles. And they might be spoiled already by working in some bullshit company for a long time. And then they come and they take that, these principles that they've learned into your nice collaborative environment. And there's a tendency, and I see that in many places, that as organizations grow up, there's this divide between the principles for the software development side and the principles of how the organization is run. A very good book that talks about this in a non-technical environment about organizations is this book. It's Frederick Lalou, Reinventing Organizations. And for me, this is very inspiring as a blueprint for how you can actually copy the model. You will find a lot of material here where you can see directly how it relates to the open-source way of doing things. I picked out the quote, Impressive Brilliant, this book is a world changer, not because I believe that it is, but because actually it's a bit of a warning because it's written in a very enthusiastic way. So sometimes you have to kind of let the author go but still continue reading. There's a lot of good thinking material in there. And one thing I want to pick out is the sections where they talk about the different governance models in terms of hierarchical structures compared to consensus structures. And the third and the model that is highlighted across this book is what they call the advice process. And when you look at the advice process in that book, it's basically what our communities know as rough consensus. So if you have an idea, you have the full authority to execute that idea, but you are forced to get input, you're forced to get advice from the outside. So the only way to violate kind of rules is that you're not reaching out to relevant people for advice. And relevant people are the people that you work with, are the people that might have some good ideas around that topic, but they cannot block you. The authority stays with you for that decision. There's another really relevant section, especially given what's happening here with Code of Conducts and all this, is the need of clearly documented and explicit decision-making processes in a way that is compatible with that kind of thinking that you are a self-organized group and you want to strengthen the self-organization in that organization. And there's really interesting material in there that could avoid some of the weird Code of Conduct stuff that has happened in our communities. So I really encourage you to at least look at that section of the book. Another interesting thing, he's looking at comparing some different entities that use this model in their own ways. And one of them is a multinational corporation active in 80 countries or something with 20,000 employees. And still, they have this principle that anyone in the organization can spend as much money as they want, as long as they're following that advice principle that I mentioned earlier. So this is just something to inspire you when you think about managing money in an organization. And there's a bunch of projects starting to appear that are trying to apply open-source principles to this. One is co-budget, you're invited to look at that. The other more known is open-collective. Open-collective, you can sign up as an open-source project. People can donate to your project and you can also establish some transparency because a lot of times you lose that transparency of what is actually happening with that money and who has access to that money and who can spend that money. Just briefly something about funding sources. I already mentioned the Lemonade Standlist. There's the free sections of small donor, private foundations, public funding. There's a lot to be said about small donors but when people ask me about crowdfunding and campaigning and stuff like that, I'm very reluctant about that because it usually doesn't work. So the only thing that works in terms of raising money from small donors is that you can show the support of the community and then get some larger donor to top that up and agree, oh wow, that project really has users. It doesn't really work that well in most cases but that's very specific cases. So quickly, just dealing with funders, some of the learnings that I took away from my work in the previous years. One that I'm still struggling with is how can we make this planning and writing grant applications fun? If any one of you has some exciting ideas about gamification of grant applications, I'm all ears. And my advice is, and that's something that also a lot of people are making mistakes there, is that plans change, right? You develop a plan, you give it to the funder, it's maybe for one year or two year grant and they expect that this is going to change because it has changed. There's no way that you can follow that plan line by line but it's mostly the side of the recipient that feels kind of weird when you deviate from your plans. Do that, change your plans, communicate this early and because otherwise you're creating trouble at the end of the project or you're doing stuff that you don't really want to do anymore. In terms of writing grant applications, a lot of things are kind of a mistake that people are doing because they're like in the developer mode of thinking, is they think in terms of deliverables and deliverables in terms of what kind of features can we add to the software. This is actually an art form. Coming up with estimates for software development, I encourage everyone to look into the material about software estimation because it's kind of crazy. I cannot talk more about this because I'm already over time but one thing that I still want to mention and this is the last side is that in a lot of cases I've seen that you can think about deliverables in a completely different way. You can think about deliverables in a way that is actually supporting community growth rather than just feature sets and the metrics of success that you can define there because funders want some metrics of success demonstrated is the number of people that are participating on your mailing list, the number of people you have in your ISC channels, all that kind of stuff and redirecting some of the funding to the more kind of community oriented hacker phones, running events, t-shirts and all that. You know about this but usually in the moment of a grant application that all that gets dropped and then you're struggling keeping that up. So now that I'm over time I'm going to skip like maybe a hundred of slides and I'm going to end with this slide and thank you.