 warning about the content that I'm going to cover today. Because we're talking about code of conduct enforcement, we're talking about the kinds of things that cause you to need to enforce your code of conduct, which includes things like harassment. I've tried to stay away from gory details and just focus on generalities and your response. But this can be a really emotional and uncomfortable topic, so I just want to let you know that that's what's coming. And I don't mind one bit if you need to take a break, walk out, leave the room, do what you need to. It's totally fine. So I want to start by saying that the reason that I work on this and the reason that I work on community event organizing is because it's really amazingly important and meaningful to me that I'm able to help create welcoming spaces to people, inclusive spaces, spaces where people participate. And a code of conduct is one of the very effective tools that I've found for doing that. A lot of what I'm going to talk about today applies to online communities, open source projects, as well as in-person events like this one. I'm going to focus my examples and a lot of the details on what happens in in-person circumstances, but everything that I'm going to talk about is actually applicable in a variety of kinds of community contexts. So as an event organizer, let's imagine, put on all our event organizer hats, we're going to imagine that we have a code of conduct for our event because somebody came to us and they asked, will you add a code of conduct? I think that that would really help encourage more people to come to our event and participate. And you said, okay, yeah, that's great. And then you've kind of been holding your breath because you haven't had to enforce it yet and you're a little nervous. What's going to happen when somebody actually makes a report? So we're going to address that. Your code of conduct might look something like this and you don't need to read this. There's a lot of text. Just know this is a thing that is a code of conduct. And we're going to break down in detail what makes this effective, what makes it more than just a document that you put on your website. So an effective code of conduct starts with your values. And when you think about your event, you might say that you value things like education, friendliness, participation, a diversity of perspectives, people being able to share their experiences. A code of conduct, when you see one written, will often start with a statement like this. Open source and feelings is dedicated to providing a safe, inclusive, welcoming, harassment-free conference experience for everyone. And that's a statement about your values, right? That's a statement that you value people being able to participate without harassment. It's also a commitment to the people who participate in your community. The next thing your code of conduct may cover is what behaviors are inappropriate. And these are often itemized in a lot of details. Again, examples are provided. You can go look this up later. But the important thing to note is that it's detailed. And it's detailed because you want to assure people that you understand the range of experiences that they have and the range of things that they may be scared of or concerned about experiencing. Next, we talk about what actions we choose to take. And this is very deliberately open-ended. Community organizers, event organizers, always have discretion to decide what the most appropriate actions are. But by stating some specifics here, you're also saying this is serious. It is actually very serious that you understand the code of conduct that you participate according to the code of conduct. And we're going to do something if you don't actually follow that. We might also say behaviors that are appropriate, like participate in an authentic and active way. And be mindful of your surroundings and fellow participants. This provides the other side of the picture, right? There are things that you don't do. And then there are things that you do that support the community. We talk about the scope of the policy. That may include official community venues. That may include other business outside the formal space of the community. It includes in-person and online communication. We talk about who to contact. Both often by name and also providing email addresses and phone numbers. This is important because you don't want somebody to be stuck looking for the person with the right badge all the time. You always want another route so that somebody who is brand new to your space, to your event, your community has a way to know that they can make a report and have that be heard. You might also state some reporting guidelines. These things include collecting the contact info for the reporter so you can follow up with them. The name or names of everybody who was involved in the incident. You can talk about when and where it happened and what happened, gathering as much detail as possible. Any additional context? This is things like this person has done this before or we've had similar experiences or they also posted on Reddit about this. Additional context that helps fill it in. And then whether it's ongoing or whether it was an isolated or time limited incident. So the good news is that you don't have to write a brand new code of conduct in order to do this. You can use an existing code of conduct. I've listed a couple here that I've worked with personally that I know are thorough and ready to go. And it's actually important that you don't write a brand new code of conduct if you haven't had experience with this because there's a lot of details to get right. And there's a lot of implications in what can seem like fairly small statements that have community implications and both legal implications as well. So now that you've got it on the website, you need to tell people why you have it. If you just throw this as a link that nobody can find, it is going to have no effects. It may have negative effects. People can't really work with you on this unless they know what's there, why it's there, what you expect from them. So if you organize a user group, you might take some time and talk with people, spend five minutes, right? We have a code of conduct. Why do we have a code of conduct? Well, we really appreciate the welcoming atmosphere of our user group and we want that to continue. Or at the start of the conference, just spend a couple of minutes talking about it so that people understand that this is important to you, they understand what's expected of them and they also have then identified somebody that they can talk to you about it. The next thing that you need is a response team for a small event or a small community that might just be two people, but it needs to be at least two people. Again, this is emotional work. This is sometimes very sticky, complicated, multifaceted work. You need backup, you need support. You need somebody who can help provide coverage when you're not available for whatever reason. And you need somebody to help keep you accountable, right? To make sure that you're making the best decisions for your community. It's also good to think about how your response team represents the people that you're trying to include in your space and how you have or can build credibility through who your response team is. I'm not saying go find people to automatically add diversity and just check that box. Don't go say, oh, you're female and you know things about this, right? That doesn't end well. But think about, you represent your group and you represent the best of your group, right? Think about how what you do and how you do and who you are is part of building that credibility so that you can respond effectively to incidents when they come up. At a big event, coverage can be a little bit more complicated. You might need a duty roster. You should think about both on-site and off-site events like if they're sponsored parties. You need regular check-ins to trade notes to make sure that your reports are getting passed to the appropriate people and that something doesn't happen in one part of your event and then another part of your event and then another part of your event and you don't know that that's happened because you haven't checked it. So make sure that you do. Make sure that you have a way to store your records. One of the groups I work with uses Dropbox for this but make sure that you have something planned in advance. It can be a file folder, that you're putting written reports in. Something so that you aren't in the heat of the moment trying to decide like what do I do with this piece of paper or this email log that I have and have that get lost in the shuffle. And then you should also think about assigning somebody to cover social media because there are lots of ways that harassment can start or be amplified on social media. The other thing is also to think about the on-site security. A lot of spaces have their own building security and those are people that you should get to know and coordinate with. So these are some of the kinds of incidents that you might experience. This is not comprehensive. It would be really hard. We don't need to. But I wanna give you a sense of the scope of what might happen. So the next thing that I'm going to do is outline a response structure. There's a lot of items here. We're going to step through them one by one. I'll put the slides online later. You don't have to take notes, it's okay. You can take notes. But we're going to break this down step by step. Okay? So let's start with an example report from something that could happen at a user group meeting. You know, so without thinking about like, wow, you know, like, how do I impose this big complicated process on it? Let's just talk about what happens here, right? Somebody comes up to you after the meeting and they say, hey, I overheard this really offensive joke and I'm not comfortable with that. I don't think you should be comfortable with that. I think that the person should be told, you know, that that's not appropriate in our community and you go, yeah, I think that's not appropriate in our community. So you collect this information, right? This is your report structure. When you respond to the report, you're going to go through a series of steps and this could happen over email in this kind of circumstance. You could follow up with the person and say, hey, we received a report about a code of conduct violation. This is the nature of that violation. This is when and where it happened. This is not appropriate. This is why that's not appropriate. There are consequences. Those consequences in this case might be, we expect you to not do that again and we will ask you to leave the group if you do. When you tell somebody that they violated the code of conduct, they can have a variety of responses and you can't control how they respond. They may choose to apologize. They may be really mortified that they did something. We hope that people understand why these sorts of behaviors are inappropriate but you can't control that and you can't effectively force them to apologize. That doesn't have any real benefit to your community. So they may say, wow, I'm sorry. Or they might say, I didn't see anything. What are you talking about? The important thing to remember is that you control who participates in your space. So you can't control their reaction. You control participation and the way that your response is designed should be about that. It should be about controlling the space for participation in a way that's supportive for your community. When somebody reports an incident to you, it's important to focus on the details and the statements that they're making, not on your judgments about what occurred or what may have occurred or what you think of the people who are named in this. You should write it down, not trust that you'll remember this accurately. And you should assume that all reports that you receive are credible when you hear them. This is not the time to try to assess like, well, when Joe says something, do I trust Joe? That's not what this is about. The privacy of the person making the report and all people named in the report is very important. Make sure that if you're in person, you step into a more private space, someplace you won't be overheard. If you're online, go off of the public mailing list into private email, Twitter, move it to DMs, move it to email. But in general, make sure that you're not letting people overhear this or leaking information about what's going on while you're still collecting information and responding to it. When somebody makes a report, there may be some immediate needs that you should address. This can be a really stressful kind of thing to do, to have to say that something happened that somebody was harassed or that they experienced something that made them feel unwelcome. You should think about safety first. Like, are there immediate things that you can offer? Can you ask, do they need a quiet room? Do they need a place to rest, water, a friend, a safe walk out of the building? Make sure that you address those kinds of things before you move forward with the report. And let the person that you're talking to dictate their own needs. Ask, offer, don't force, don't impose. And the reason that we need to do this is because the things that constitute code of conduct violations can sometimes be very traumatic. The person that you're talking to dictate their own needs. Ask normal, healthy responses to trauma that can make it very difficult to go back into the conference, go back to the meeting and participate comfortably. People can also be reminded of past trauma in a way that brings up those same kinds of reactions. And when we see somebody is triggered, that's what we mean. That they are re-experiencing trauma. So these things can include being completely exhausted, being disoriented, forgetting what's going on, needing to lie down, needing a glass of water, needing someplace that's quiet and dark and safe and whatever re-establishes that you're okay right now, things are safe right now, there's nothing you need to do. And because that is both like a physiological and a mental experience, it's not something that you wanna try to outreason. Just look for how do we create the most safety, the most feeling of safety right now. So once you have this information, you've addressed the immediate needs that need to be handled with the people that have reported this to you, you assess the impact of the incident. And that's basically the scope, right? How many people are affected? Did this happen publicly, privately? Are there spillover effects? Was this like something that happened in front of the whole conference? Or was this something that happened off in the corner? And then we look at risk. We look at how dangerous it is for this thing to have happened and how dangerous it is that it could happen again. So that can include medical and legal requirements. That can include repeat offenses. That can include, you know, we cannot have this happen again. Like that would be the end of our event and the end of our community. And we put those together. We put this together to look at what kind of an incident we're addressing. And that can range from something like an inappropriate joke made in private to something that involves persistent coordinated harassment. And once we have that, we determine an effective response. And that uses both the scope and the dangerousness of the incident to decide what kind of response that you need. Next, we gather our resources. We may need other people from our organizing team. We may need past incident logs to compare notes on something that may be a repeat incident. We may need organizers from other events that have dealt with similar circumstances to give us feedback on our situation and how we might handle it. We might need people with specialized expertise such as in mental health or domestic violence. Crisis lines, there are local crisis lines that can help in an emergency for a lot of these things. We may need 911, you know, when in doubt, call 911. And we may need online safety resources like Crash Over Eye to help us with things that happen on Twitter or Facebook or Tumblr or other social media sites. And then we do our best to resolve the situation. We try to find a fair and proportionate response. We refer back to our values, you know, refer back to the community that we're trying to build and support. And we think about how we can be responsible to the people who are directly impacted as well as the entire community. And under pressure, it can feel like you need to make big, scary decisions. But I want to assure you that you never have to make a permanent decision right then and there. You can always say, this is for the time being. This person is removed from our event and future events for the time being and we will review it and if we change our mind or if we decide otherwise, we will notify people. You don't have to come with a permanent solution right now. And in a lot of cases, you probably shouldn't because there's going to be more reflection, there's going to be more information gathering. You're going to look at what the impact was at that point and decide what your community needs. Then you follow up with the people who are affected. You tell them if you found a code of conduct violation, you tell them how you responded. If there are other things that you need to discuss or follow up on, you cover that then. Again, you do this probably over private email or an in-person conversation and close that loop. You may need a public response if it's something that happens in public at your event that a lot of people observed. I really like this response from Allied Media. It's, again, it's a lot of text to read, but I just want to point out that they acknowledged that it happened, that these instance happened in public. They talked about the impact on the community and they talked about their response and the tone is really directed at demonstrating support for the people in the community. So when we do this, we need to be cautious about making public statements that can contribute to retaliation. Naming people can be a factor in this, also giving very specific details about instance can be a factor. It can be tempting to be in shame especially, but the actual impacts can be very negative for the person who was harassed or the people that were affected. And this will tend to target the people in your community that are most vulnerable. The people who are seen as having the least support. So back to our user group incident. We're going to follow up with the person who made the report. We're just going to email them before the next user group meeting and say that we found a code of conduct violation and we told the person that what they did was not appropriate. We told them that they will be asked to leave if they do this again. And we assure them that we're here if you need to report anything else. If you need more support, more resources, just let us know because we appreciate your participation in our community. And then you regroup. You look at a little retrospective about how this went. What did we learn? Do we need anything? Did we get in over our heads? Did we feel like we didn't have enough support or enough ability to respond? You know, what do we want to take care of next? And is there anything that we forgot to follow up on? This is also when you can thank each other, you know. Being committed to this report together, that's to this work together, that's really important, right? And you're investing this time and this emotional labor in your community. You know, thank the people that you work with on this and make sure that they know how much that's appreciated. And then you can congratulate yourself because you did. You responded to a code of conduct violation. You didn't die, I hope. And you know, you did something that was really important. You know, so be kind to yourselves because that's hard work. So now that you have this information, you can use this as a template to build your own incident response program. You can also do training. I like to talk with people about specific scenarios that they're most concerned about and make a checklist, you know. We are worried that somebody may bring a weapon to our event and we're not comfortable with that. Okay, so we're going to do this, and this and this if that occurs. We're worried that this person that we have kicked out at a previous event may come back. Okay, so here's what we're going to do. You know, and you can write those things down. You can document them for your response team and you can refer back to them so that you're not putting yourself under pressure to be doing decision-making at the same time that you're in the midst of a very stressful and possibly argumentative situation. So that's what I have to say, thank you. I am working on an online resource center and a training program around this. I would love to have any or all of your help. I'd love to talk to you more one-on-one about this topic too and how you can use this in your communities. So thank you.