<> == Original Dispute == Date: 2012-12-28 14:05:10 (anonymized version) {{{ > Dear support, > > please file dispute against R2 and R1. > > My claim is that R2 abused his position as event organizer > at > > 29c3 to justify a raid of personal CAP forms of assurees. R2 > assisted him in doing so. > > When leaving the 29c3 location on the evening of 27th December 2012, I > left a folder with some CAP forms of assurances I made ove assurees > over > > the day hidden under my notebook. Apparently, teh booth was under > supervision, so R2 and R1 noticed that. These > forms > were: > > - NOT signed by me, so I did NOT acknowledge that any of the > proceedings > > were connected to official CAcert work > - NOT entered into the system, so the data on them did NOT affect > active > > assurances or statements made by me towards CAcert > > When I came back the next morning, I noticed that the folder was > missing > > and asked around if someone had seen it. Neither R1 nor > R2, when seeing me, took care of informing me where it had > gone. When I specifically asked for it, R1 said that he > removed it and sotred it in some location unknown to me and that he > could not hand it out to me because of privacy concerns. > > While R2 and R1 are right in saying that leaving CAP forms with > assuree data at the booth is a privacy issue, this is a *personal* > issue > > between the assuree and me for the reasons mentioned above (NO assurer > statement given by me). It is a bug in CAcert assurance procedure that > the assurer does not have to give his statement to the assurer > beforehand. > Up > to the moment I sign the assurer statement on the form and enter the > assurance into the system, I do NOT acknowledge officially that I > acted in the name of CAcert. > > Thus said, no event organizer or other CAcert person has the right to > act in a way R2 and R1 did. I file dispute against them for > abuse of a position given to R1 by the event team leader. > > I accept the CCA and DRP under this arbitration, CARS. }}} == correspondence about statements of C, R1, R2, WIT1, WIT2, WIT3 == === A: Question to C to clarify some points from the original dispute === Date: Mon, 18 Nov 2013 02:48:27 +0100 {{{ Dear C, R1, R2, you all should now be able to read the private part of the arbitration case a20121228.1[1]. Up until now it only contains mails that all of you should be aware off since you were sender or recipients of them. You can especially find the original dispute there. Regarding the original dispute I have some further questions to the claimant. a) Your claim is abuse of positions. This could only be done by persons being in positions that can be abused. While you mentioned the position of R1 it's not clear which position R2 had concerning the event, that he could abuse. b) What happend to the CAPs in question? [1]https://wiki.cacert.org/Arbitrations/priv/a20121228.1 }}} === C: and clarification of the dispute === Date: Mon, 18 Nov 2013 07:54:01 +0100 {{{ Hi, > a) Your claim is abuse of positions. This could only be done by persons > being in positions that can be abused. While you mentioned the position > of R1 it's not clear which position R2 had > concerning the event, that he could abuse. R2 accompanied R1 in his action because "that case could easily result in an arbitration", and he has a position in Arbitration. Although this claim is valid, R2 took decisive action without having been assigned an arbitration case under a duly filed dispute, and without acceptance of his position under DRP by all parties. I am certain that an Arbitrator/Case Manager must not do self-justice while not in a valid arbitration case. > b) What happend to the CAPs in question? They were returned to me after I threatened to make hell break loose. I was not granted access to the forms first because R1 insisted in waiting for R2 to return to the location, because he sealed the folder containing the forms, which was my property. R1 is correct in two points, and wrong in some others. I am going to draw the reason for this case from those arguments: + It is a little bit careless from a privacy point of view to leave a folder with filled-in CAP forms unattended at an event location, although it was well hidden under my laptop. + If the CAP forms had been of any interest to CAcert as a whole, some action should have been taken to solve this issue together with the assurer (i.e. me) - However, the CAP forms in question were only vicariously related to CAcert as a whole. That's mainly an issue with the procedure of assurance, because unless the assurer signs the CAP form (and the assurer statement) in front of the assuree, the assurer stays an independent part of the community who will *later* (probably) make a statement towards CAcert. Up to that point, the assurance is merely a procedure between the two persons in question. This point is probably ruled out by § 7 of the AP, although this paragraph doesn't make any claims about CAcert's roles in the assurance step. In theory, any assurer would have to explain their own privacy policy derived from CAcert's privacy statement to any assuree before they give away their data. Note that the AP does not authorize the Privacy Policy as a subsidiary policy - this is probably a bug. - We do not have a strong hierarchy within CAcert. If R1 (and R2) see an issue with anything I do, I expect them to react to that in a community-spirited manner. Removing the forms from the location and then casting phrases like "I am the event organizer, so I have all rights!" or "I am an Arbitrator, so I have all rights!" does not seem legit to me. Again, I do not think that an Arbitrator may judge in any case not passed to arbitration by a (valid) claimant - with the claimants being all assurees that handed CAP forms to me that day. - R1 and R2 entirely ignored the fact that I was carrying at least two communication devices with me, connected to at least four handles, all of which both R1 knew and could have called. They proved their capability of getting a phone call routed through to me several times before, so I strongly suggest they could have done that in the case at hand as well. That makes the case look even more like an abusive power play. - I am totally ok with R1, as event organizer, noticing a privacy issue. Now, if he *had* tried to call me, and would have failed, I would have regarded it as totally ok if he secured the forms in some place, and then informed me about it later, but returning the forms to me immediately. It is, however, a completely different issue that he refused to return the forms (and the rest of the folder) to me until I forcefully took it from him. - I am aware that the organizer of an event has to give a CARS saying that "all assurances at the event were conducted in conformance with AP". I do not think that leaving CAP forms hidden, but unattended for a short time means breaking AP, and unfortunately, I must also state that R1 did not take his position very serious in that regard. Apart from the case we are currently discussing, I did not see him at the booth very often. In reality, it was WIT1, WIT2 and me who ran the event; R1 was merely listed as organizer in the Wiki. So maybe he should change that attitude before invoking his position in a power play. I expect this arbitration to result in the following: - Updating the Privacy Policy to authorize Privacy Policy as a subsidiary document (I will happily do that) - Updating the Assurer Handbook (or whatever) to point out that an assurer should visibly prove their submission to CCA, AP, etc. *before* having the assuree decide whether they permit usage of their data - Educating assurers to follow that proposal (I will happily update slides and talks for ATEs in my role as Co-Auditor) - Making very clear that an Arbitrator has no rights of self-justice, only when handling a real arbitration case under a duly filed dispute - Making very clear that CAcert is community-driven without a strong hierarchy, so all efforts should involve all related parties within the community Again: I think that R1 and R2 were partially right in their motivation, but their action is harmful for the community and not in conformance with any rules. But I am totally willing to have this case clarify what behaviour to expect in certain positions, and then update all materials to make better procedures become practice. If this case results in R1's and R2's behaviour being entirely correct, I am also willing to make *that* policy/proposed practice, jsut to make that one clear. I am totally willing to carry out the result of this case as a precedent, in terms of educating myself *and* the rest of the community. }}} === A: question to C about a possible (textual) mixup and possible witnesses mentioned in last statement === Date: Tue, 19 Nov 2013 17:32:51 +0100 {{{ Dear C, thank you for the quick answer to my questions and further explanation of your claim in this case. It is much clearer now. I will not go into details until the respondents have had time to make a statement of their own, since at least R1 announced his intention to give one. Albeit I do have two small questions. 1. You mentioned two other persons (WIT1 and WIT2) do you know if they were present when either the confiscation of the documents or the confrontation between you and R1 and/or R2 took place? 2. When writing: > I expect this arbitration to result in the following: > > - Updating the Privacy Policy to authorize Privacy Policy as a > subsidiary document (I will happily do that) I assume you meant 'Updating Assurance Policy to authorize Privacy Policy...' instead of 'Updating Privacy Policy to authorize Privacy Policy...' which does not make much sense. Am I correct? Or do you have another Policy in mind? }}} === DRO: contests 'an arbitrator may not judge in any case not passed to arbitration by a (valid) claimant' === Date: Tue, 19 Nov 2013 19:14:47 +0000 {{{ As DRO/Arb/Assurer I am deemed to have accepted CCA. C said "Again, I do not think that an Arbitrator may judge in any case not passed to arbitration by a (valid) claimant" One role that CAcert arbitrators have is to act or to authorise action in an emergency - there's not always time to do all the administration beforehand - as an example there are some emergency access cases where this has occurred and an arbitrator has authorised actions verbally however these should be (and have been) "written up" after the event. (a20120614.1 and a20120622.1 are examples of these). I therefore contest that the need to be able to take emergency action would make C's idea impractical ! You might also want to look at the pending case a20130904.1 as part of your considerations - [A of that case] has acted before a formal case was created but at least there is some documentation of that action - albeit only in the ticket. As to whether the actions allegedly taken by R2 as an Arbitrator constitute an "emergency action", this would fall to you as (A) to decide! As DRO, I would be concerned that there is no apparent documentation of those actions. DRO CARS }}} === C: confirms textual mixup and likelihood of two persons mentioned in former statement being possible witnesses for one part of the incident. === Date: Tue, 19 Nov 2013 21:21:37 +0100 {{{ Hi, > 1. You mentioned two other persons (WIT1 and WIT2) > do you know if they were present when either the confiscation of the > documents or the confrontation between you and R1 and/or > R2 took place? I am certain none of them were present when the confiscation happened, and I think that most likely both of them were present at the confrontation. > 2. When writing: > > I expect this arbitration to result in the following: > > > > - Updating the Privacy Policy to authorize Privacy Policy as a > > subsidiary document (I will happily do that) > > I assume you meant 'Updating Assurance Policy to authorize Privacy > Policy...' instead of 'Updating Privacy Policy to authorize Privacy > Policy...' which does not make much sense. Am I correct? Or do you have > another Policy in mind? Sorry, that was a mistake. I intended to say exactly what you concluded. }}} === R1: statement === Date: Thu, 21 Nov 2013 09:05:23 +0100 {{{ Dear Eva, dear others, as promised in my previous mail I'd like to add some details to the happenings based on my memories and a braindump from mid-January. To safe me from redundant typing I'll use initials of the names for all actors, i.e.: R1: my humble person WIT3: WIT3 () C: C R2: R2 The events can be divided mostly into two parts. The first part happened between Day 1 and Day 2 at the 29C3 congress at about 03:30 local time (02:30 UTC). The second part happened between noon and teatime (exact time unknown). All events took place at the 29C3 in the Congress Center Hamburg (CCH) at the CAcert booth; except when explicitely noted otherwise. For the first part: - - At about 03:30 R2 and R1 were on their way to the hostel for the night when they decided to take a short detour to the CAcert stand to check the situation there and if everything was okay. - - When still about 5 to 10 meters away from the booth R2 points R1 to a blue clipboard below the laptop of C. In concern of a possible privacy breach R2 asks R1 to check IF the forms were filled in while ensuring no information was read or copied (if present). - - Noticing THAT information was filled in R2 and R1 mutually agreed to ask a third assurer (WIT3) to assist in assessment of the situation. - - After arrival of WIT3 all persons present (R1, WIT3, R2) discussed the further course of action and came to the conclusion to safe-guarding the CAP forms until they can be handed back to C in person ASAP. To prevent accidential exposure of the topmost form it was flipped over to its back-side (blank). - - Before handing over the clipboard to R1 for safe-guarding the clipboard was sealed by R2 while the process was being observed by WIT3. The sealed clipboard with all CAP forms was than instantly brought to the Engel Area (separate area at the congress where only volunteers have access) into the bag of R1 (taking it out of view at the stand). While the Engel Area usually is quite open (no real entry checks) you don't usually get there randomly. - - After this R2 and R1 went to the hostel for the night. For the second part: - - Some time after noon R1 returns to the booth to check up on everything. - - C asks R1 if he has seen the clipboard which R1 instantly acknowledges and furthermore includes that based on the proceedings from part one the return has to be witnessed by R2 to verify the seal. - - C threatens R1 to report the incident to the event administration for theft/stealing/misappropriation. - - R1 instantly calls R2 on the phone to organize the return of the clipboard and verification of the seal. - - After R2 arrived at the stand R1 goes to his bag still being in the Engel Area to fetch the clipboard. When returning to the stand R1 hands the clipboard directly to R2 to check on the seal to be intact. - - R2 checks the seal and addresses C for the return of the clipboard. C instantly snatches the clipboard away from R2 and starts to angrily complain about the proceedings to the bystandars at the CAcert booth. - - R2 and R1 both try to explain the background of the safe-guarding to C pointing out the situation when the CAP forms were found at the CAcert booth unattended. - - R2 and R1 mutually agreed to not unnecessarily follow up on these events, especially to not file dispute as the situation was assessed as minor and has been resolved from their point of view. - - Approximately two hours after the return of the clipboard has been completed C filed dispute carbon-copying the mail to events@c.o. Furthermore I'd like to add the following observations: - - The CARS given by C falsely represents some details of the events that for sure have been reported to C. - - This includes e.g. the presence of WIT3 which was reported to C but doesn't appear in the dispute filing of C at any point making it appear only R1 and R2 were involved. Now there are at least the following questions that would be of interest to me: - - As the CAP forms were left unattended and in plain view (as for the clipboard at least) it would be of great interest WHEN exactly a CAP form starts to fall unter privacy policy and as such requires the assurer to take proper action to ensure protection against unauthorized access by third parties. - - What are necessary precautions (recommended and required ones) to be taken by the assurer for such a CAP form? CARS, }}} === C: challenges some of the points made by R1 in his statement === Date: Fri, 22 Nov 2013 23:44:53 +0100 {{{ Hi all, > - When still about 5 to 10 meters away from the booth R2 points R1 to > a blue clipboard below the laptop of C. In concern of a possible > privacy breach R2 asks R1 to check IF the forms were filled in while > ensuring no information was read or copied (if present). I plainly deem that a lie. I have the very clipboard and notebook and question here and can reaarange them the exact way they were when left at the booth - with the clipboard completely hidden under the notebook and sure as hell not visible from the distance. > - Before handing over the clipboard to R1 for safe-guarding the > clipboard was sealed by R2 while the process was being observed by WIT3. > The sealed clipboard with all CAP forms was than instantly brought to > the Engel Area (separate area at the congress where only volunteers have > access) into the bag of R1 (taking it out of view at the stand). While > the Engel Area usually is quite open (no real entry checks) you don't > usually get there randomly. And there are a lot of engel at the event. I doubt putting duct tape on the edge of a clipboard makes it less exciting for the public, and I doubt the engel area is a safer place to leave it unattended at than any other place at the 29c3 :D. > Furthermore I'd like to add the following observations: > - The CARS given by C falsely represents some details of the events > that for sure have been reported to C. What was reported to me is unimportant - collecting reports is the arbitrator's job. What I posted is what I have observed and what was obvious to me. > - This includes e.g. the presence of WIT3 which was reported to C but > doesn't appear in the dispute filing of C at any point making it appear > only R1 and R2 were involved. Because WIT3 was apparently not important enough for the situation to get him back to the sight when the clipboard was returned. It was also WIT3 who I asked for the clipboard first, and he said he had seen "R2 and R1 doing something with a clipboard he does not know whom it belonged to". I refuse to call WIT3 a liar because he is a close friend, so I instead doubt that he was really put in the position of an assasser. > - What are necessary precautions (recommended and required ones) to be > taken by the assurer for such a CAP form? And: Whz is it ok for another community member to move them to a place as unsafe as the old one? }}} === C: challenges that the arguments given by the DRO can be applied to the given case === Date: Fri, 22 Nov 2013 23:51:39 +0100 {{{ > One role that CAcert arbitrators have is to act or to authorise > action in an emergency - there's not always time to do all the > administration beforehand - as an example there are some emergency > access cases where this has occurred and an arbitrator has > authorised actions verbally however these should be (and have been) > "written up" after the event. (a20120614.1 and a20120622.1 are > examples of these). With the claimant being someone needing emergency access, and the respondent being CAcert. And, above all, with the claimant not being the same person as the arbitrator, and the person to execute the ruling also being someone else than the arbitrator. }}} === R2: statement === Date: Sat, 23 Nov 2013 16:56:37 +0100 {{{ Dear Eva, dear others, The primary language of this mail is German but to make matters more easy I'll provide a (loose) English translation. DE: Basierend auf Ausführungen von R1 möchte ich einige Deteils aus meiner Sicht hinzufügen. EN: Based on the explaination given by R1 I'd like to add a few details from my point of view. On 11/22/2013 11:44 PM, C wrote: > Hi all, > > > - When still about 5 to 10 meters away from the booth R2 points R1 to > > a blue clipboard below the laptop of C. In concern of a possible > > privacy breach R2 asks R1 to check IF the forms were filled in while > > ensuring no information was read or copied (if present). > > I plainly deem that a lie. I have the very clipboard and notebook and > question here and can reaarange them the exact way they were when left > at the booth - with the clipboard completely hidden under the notebook > and sure as hell not visible from the distance. DE: Fakt ist jedoch, dass das Klemmbrett zu diesem Zeitpunkt als ich am Stand vorbeikam sichtbar gewesen ist. EN: Yet fact is, that the moment I passed by the CAcert booth the clipboard WAS visible. > > > - Before handing over the clipboard to R1 for safe-guarding the > > clipboard was sealed by R2 while the process was being observed by WIT3. > > The sealed clipboard with all CAP forms was than instantly brought to > > the Engel Area (separate area at the congress where only volunteers have > > access) into the bag of R1 (taking it out of view at the stand). While > > the Engel Area usually is quite open (no real entry checks) you don't > > usually get there randomly. > > And there are a lot of engel at the event. I doubt putting duct tape on > the edge of a clipboard makes it less exciting for the public, and I > doubt the engel area is a safer place to leave it unattended at than any > other place at the 29c3 :D. DE: Zum Himmel(Engel Area): dort ist immer ein Engel oder der Schichtkoordinator anwesend. Des weiteren war das versiegelte Klemmbrett in einer geschlossenen Tasche untergebracht die dort mit einer Menge anderem Gepäck abgestellt war. EN: Regarding the Engel Area: There is always at least one Engel or the shift coordinator present in the Engel Area. Further more the sealed clipboard was placed inside a closed bag, which was left there together with much other luggage. > > > Furthermore I'd like to add the following observations: > > - The CARS given by C falsely represents some details of the events > > that for sure have been reported to C. > > What was reported to me is unimportant - collecting reports is the > arbitrator's job. What I posted is what I have observed and what was > obvious to me. > > > - This includes e.g. the presence of WIT3 which was reported to C but > > doesn't appear in the dispute filing of C at any point making it appear > > only R1 and R2 were involved. > > Because WIT3 was apparently not important enough for the situation to get > him back to the sight when the clipboard was returned. It was also WIT3 > who I asked for the clipboard first, and he said he had seen "R2 and R1 > doing something with a clipboard he does not know whom it belonged to". > I refuse to call WIT3 a liar because he is a close friend, so I instead > doubt that he was really put in the position of an assasser. DE: Das ist einfach zu erklären: Während die Versiegelung stattfand wurde ein Zeuge benötigt, der den Vorgang der Versigelung bezeugen kann; in diesem Falle WIT3. Bei der Prüfung des Siegels wurde WIT3 nicht zwingend benötigt, weil ein Zeuge in diesem falle Du(C) bei dem Vorgang anwesend war. Daher reicht meiner Ansicht nach, dass R1 nur mich(R2) für die Überprüfung herangeholt hat. EN: That's simply to explain: While doing the seal a witness was required, who could attest the process of sealing took place - in this case done by WIT3. When checking the seal WIT3 wasn't required, because a witness of the process was present - which is you(C). That's why IMO it was sufficient for R1 to only call for me(R2) to verify the seal. > > > - What are necessary precautions (recommended and required ones) to be > > taken by the assurer for such a CAP form? > > And: Whz is it ok for another community member to move them to a place > as unsafe as the old one? }}} === A: more questions to C, R1, R2 === Date: Sat, 23 Nov 2013 17:59:44 +0100 {{{ Dear C, R1, R2, thank you all for your statements. However, as I hinted in my last mail, there are some more questions I have to ask to understand what happened back then. While answering those questions, please keep in mind that all of you are giving CARS when answering. Additionally everybody else giving statements in an arbitration case (or at least this one) is giving CARS. You (and they) are giving those CARS about what you/they remember as best es possible. However the human brain may fail in some points. It's a known fact that people will give different statements over the same situation even while trying to answer correctly. And thats probably even more the case for situation happening about a year ago. That's why people are doing notes. So please think twice before giving a CARS that someone else is lying whith their CARS. My questions to you are: @ the respondents: - Did you know who the owner of the clipboard was when confiscating it? - Did you assume that the owner of the clipboard was well asleep at that time? - Did you try to inform anybody but WIT3 about your confiscation? (Like a note at the booth) - When did you arrive at the congress location at the second day? - Did you visit the CAcert booth right away so you could try to give the CAPs back or inform someone about the issue so that you could be contacted yourself? - Did you try to contact the claimant about the confiscation? If not, why not? - A laptop is a quite valuable thing. At least the claimant left his at the booth. So it could be argued that people thought about that booth to be a safe place. Why do you think that is not the case? And if you don't think it was a safe place, did you leave the laptop at the booth? - Why did you choose the engel area for storing the CAPs instead of f.e. taking it with you to the hostel? - Under what authority do you think you acted while confiscating the CAPs? - Did you mention that authority to the claimant? - Did you mention any other authority of yours to the claimant during the confrontation? @ the claimant: - What was the last time you had hold on the CAPs before the confiscation? - Where you on the location at the time of the confiscation and should the respondents have known about that? - When did you intend to get to them next? - When did you actually arrive at the booth? / When did you discover the CAPs missing? - What authorities / positions did the respeondents mention to you during your confrontation? @ all of you: In what context was the posibility of arbitration mentioned? }}} === C: answers additional questions === Date: Sat, 23 Nov 2013 23:29:54 +0100 {{{ Hi, > - What was the last time you had hold on the CAPs before the confiscation? That was at night, at approx. 23:00 CET. > - Where you on the location at the time of the confiscation and should > the respondents have known about that? I was not at the location. I had left together with WIT2 and WIT1 for late dinner. However, the following was the case and well-known to all parties: 1. I was carrying my mobile, and it was operational 2. At least R2 had my number recorded 3. I had my Asterisk PBX hooked up to the event phone system and had configured it to route site-local calls to my mobile, and there was enough proof throughout the night that this connection worked 4. Both respondents called me at least once during the day, so I think they will have known the number for that as well; besides, the number was recorded in the public event phonebook, in the CAcert event attendees list and on my CAcert Wiki page. I conclude that there were more than enough ways to contact me. > - When did you intend to get to them next? Before noon on the next day. > - When did you actually arrive at the booth? / When did you discover the > CAPs missing? I cannot recall exact times, but we arrived at the event location around noon. I think I went to the booth first, and when I approached it, R2 and R1 left instead of informing me of the raid. Wehn I discovered the CAP forms missing shortly after, I tried for around an hour to get hold of one of them. > - What authorities / positions did the respeondents mention to you > during your confrontation? R1 mentioned his role as event organizer, R2 mentioned his role as arbitrator. > In what context was the posibility of arbitration mentioned? When R1 refused to hand my stuff out to me, I threatened to bring the case to arbitration. I do not recall what R1 and R2, after he arrived, had to say about that, but I have no doubt that what was reported is correct. }}} === A: questions WIT3 === Date: Sat, 23 Nov 2013 23:37:48 +0100 {{{ Dear WIT3, I'm the arbitrator of the case a20121228.1[1], CM is the Case Manager. You were named as possible witness/actor of one incident addressed by this case. To clarify what happend, I have to ask you some questions. I happen to know, that you did accept CCA and doing so DRP. The incident happend during the night between 2012-12-27 and 2012-12-28 at the 29c3. As far as I know, you were called to the CAcert booth by R1 and R2 because of some CAP-forms they found there. Please describe the incident evolving by that call. If possible please include the following points in your statement: - Do you think, R1 and R2 knew whom the clipboard and the CAPs belonged to? - What authorities (of any of you) were mentioned for your actions? - What was your assumption about the authorities R1 and R2 did act on? - What reasons were given for the actions? - Do you have any idea what time it was? - Was anybody informed about the incident? At 2012-12-28 the CAPs were returned to their owner/assurer. - Do you know anything about what happend then? If you have any other input that may help to solve this case, please be so kind and help me there. [1] https://wiki.cacert.org/Arbitrations/a20121228.1 }}} === R2: answers additional questions === Date: Mon, 25 Nov 2013 02:09:07 +0100 {{{ Dear Eva, dear others On 11/23/2013 05:59 PM, Eva wrote: > Dear C, R1, R2, > > thank you all for your statements. > > However, as I hinted in my last mail, there are some more questions I > have to ask to understand what happened back then. > > While answering those questions, please keep in mind that all of you are > giving CARS when answering. Additionally everybody else giving > statements in an arbitration case (or at least this one) is giving CARS. > You (and they) are giving those CARS about what you/they remember as > best es possible. However the human brain may fail in some points. It's > a known fact that people will give different statements over the same > situation even while trying to answer correctly. And thats probably even > more the case for situation happening about a year ago. That's why > people are doing notes. > > So please think twice before giving a CARS that someone else is lying > whith their CARS. > > My questions to you are: > @ the respondents: > - Did you know who the owner of the clipboard was when confiscating it? AFAIR I assumed the owner of the clipboard to be C due to other things near by. > - Did you assume that the owner of the clipboard was well asleep at that > time? It was unknown to me what C has been doing at that time. But it was in the middle of the night and people usually sleep. Also i preferred to have C present. > - Did you try to inform anybody but WIT3 about your confiscation? (Like a > note at the booth) Unfortunately no such note has been left AFAIR. > - When did you arrive at the congress location at the second day? At about noon. > - Did you visit the CAcert booth right away so you could try to give the > CAPs back or inform someone about the issue so that you could be > contacted yourself? No > - Did you try to contact the claimant about the confiscation? If not, > why not? No, I attended 2 talks > - A laptop is a quite valuable thing. At least the claimant left his at > the booth. So it could be argued that people thought about that booth to > be a safe place. Why do you think that is not the case? And if you don't > think it was a safe place, did you leave the laptop at the booth? It's not my department what people do with their stuff. But assuming filled and signed CAP forms is not simply a personal matter but also a matter of trust of the assuree and data protection. > - Why did you choose the engel area for storing the CAPs instead of f.e. > taking it with you to the hostel? At the hostel I shared a room with other persons. As I was the one who sealed these documents I wanted to ensure I have no access to the clipboard. > - Under what authority do you think you acted while confiscating the CAPs? As Assurer. > - Did you mention that authority to the claimant? Yes. > - Did you mention any other authority of yours to the claimant during > the confrontation? I don't remember the exect content of that conversation as the conversation was kinda heated. > > @ the claimant: > - What was the last time you had hold on the CAPs before the confiscation? > - Where you on the location at the time of the confiscation and should > the respondents have known about that? > - When did you intend to get to them next? > - When did you actually arrive at the booth? / When did you discover the > CAPs missing? > - What authorities / positions did the respeondents mention to you > during your confrontation? > > @ all of you: > In what context was the posibility of arbitration mentioned? > when returning the clipboard I mentioned to C I am not amused about this and I didn't intent to file a dispute against C in this case. After this I did't want to follow up on this. }}} === R1: answers additional questions === Date: Mon, 25 Nov 2013 09:17:23 +0100 {{{ Dear Eva, dear others, Am 23.11.2013 17:59, schrieb Eva: > Dear C, R1, R2, > > thank you all for your statements. > > However, as I hinted in my last mail, there are some more questions I > have to ask to understand what happened back then. Go ahead. > While answering those questions, please keep in mind that all of you are > giving CARS when answering. Additionally everybody else giving > statements in an arbitration case (or at least this one) is giving CARS. > You (and they) are giving those CARS about what you/they remember as > best es possible. However the human brain may fail in some points. It's > a known fact that people will give different statements over the same > situation even while trying to answer correctly. And thats probably even > more the case for situation happening about a year ago. That's why > people are doing notes. > > So please think twice before giving a CARS that someone else is lying > whith their CARS. > > My questions to you are: > @ the respondents: > - Did you know who the owner of the clipboard was when confiscating it? Upon seeing the clipboard R2 hinted me at I recognized it as belonging to C due to having it seen previously when I was at the stand earlier that day. > - Did you assume that the owner of the clipboard was well asleep at that > time? I don't remember exactly if this assumption was made, but the decision was more leaned towards not unnecessarily calling people late at night especially as congress is kinda exhausting for all people involed. But it is likely that if "C might be asleep" was a factor in the decision process, it would have supported the decision not to call him. Also at least I favoured to have the matter resolved in person with C when everybody was well awake again. > - Did you try to inform anybody but WIT3 about your confiscation? (Like a > note at the booth) AFAIR no such information was given out. Also (unfortunately) no note was left at the booth. > - When did you arrive at the congress location at the second day? IIRC I arrived at about noon. > - Did you visit the CAcert booth right away so you could try to give the > CAPs back or inform someone about the issue so that you could be > contacted yourself? I passed by the CAcert booth on my way to the Engel Area but didn't notice C at the booth. > - Did you try to contact the claimant about the confiscation? If not, > why not? I first wanted to get on track for the day. Furthermore, due to the way C usually acts towards me I had little interest in getting my day ruined right from the start. > - A laptop is a quite valuable thing. At least the claimant left his at > the booth. So it could be argued that people thought about that booth to > be a safe place. Why do you think that is not the case? And if you don't > think it was a safe place, did you leave the laptop at the booth? I think you should make a distinction here between what safety level you think appropriate for your own things (i.e. it is totally fine for me if you deem your stuff safe enough at a certain place) and the level you should ensure for things entrusted to you (like private details of an assuree you were asked to process on behalf of someone else). For my own stuff the second level is usually much higher than for the first one, due to the additional responsibility you bear in the second situation. Thus leaving your own stuff at an unattended booth is your personal decision; leaving someone else's stuff at an unattended booth might be at least a bold offense to the people who entrusted you to their information. Furthermore: Given that confiscating the clipboard without this act being noticed was possible it is a grave violation of the duties of an asurer to protect the CAP forms from unauthorized access by third parties a laid out in the Assurer Handbook section 1.3.8 paragraph on storage of the CAP forms. > - Why did you choose the engel area for storing the CAPs instead of f.e. > taking it with you to the hostel? There are mainly two reasons for this decision: 1. While the Engel Area is kinda open it still offers a better protection against casual walking into it to take away things as there's always at least a minimum oversight by the Engels preparing their shifts or relaxing from their previous one. Thus when leaving the clipboard there I could be sure that noone could get it unnoticed as easy as at the CAcert booth. 2. When safeguarding the clipboard in my bag R2 and me(R1) made sure R2 didn't know the exact location so R2 couldn't tamper with the seal until the clipboard was to be returned. Besides the seal of the clipboard itself (by R2) there were also some shibboleths involved through me to detect (unauthorized) access by other people. No such unauthorized access has taken place based on the observation that all shibboleths I left were unbreached. Hadwe taken the bag with us to the hostel this had allowed R2 possibly unobserved access to the sealed clipboard which would have invalidated the sealing/made the sealing pointless. Thus to make a long story short: The Engel Area was choosen to ensure R2 could not access the CAP forms at night/til return to C and second because it was deemed a more secure place compared to the open area near the CAcert booth with completely uncontrolled access. > - Under what authority do you think you acted while confiscating the CAPs? Obligations of every assurer according to Assurer Handbook, sections 1.3.8 as well as privacy regulations to avoid unnecessary breach of private information. Furthermore as I had responsibility as event organizer I acted to limit the impact of private information floating around unattended at night at the stand. > - Did you mention that authority to the claimant? Yes. When I tried to explain the reasoning which led to the events earlier that day/at night time. > - Did you mention any other authority of yours to the claimant during > the confrontation? AFAIR I only further mentioned my status as an assurer besides the position as event organizer. I'm not aware of any other positions or authorities of mine which I mentioned. > @ the claimant: > - What was the last time you had hold on the CAPs before the confiscation? > - Where you on the location at the time of the confiscation and should > the respondents have known about that? > - When did you intend to get to them next? > - When did you actually arrive at the booth? / When did you discover the > CAPs missing? > - What authorities / positions did the respeondents mention to you > during your confrontation? > > @ all of you: > In what context was the posibility of arbitration mentioned? > When discussing the proceedings at night the possibiliy of arbitration was mentioned as one aspect that should be avoided in this case as noone had the desire to make a mountain out of a molehill. At the confrontation C used arbitration as a threat to R1 and R2. }}} === A: questions to WIT1 === Date: Mon, 25 Nov 2013 23:10:46 +0100 {{{ Dear WIT1, I'm the arbitrator of the case a20121228.1[1], CM is the Case Manager. You were named as possible witness of one incident addressed by this case. To clarify what happend, I have to ask you some questions. I assume, that you did accept CCA and doing so DRP. The incident happend on 2012-12-28 at the CAcert booth of the 29c3. As far as I know, R1 and R2 had removed CAP-Formulars belonging to C from the CAcert booth in the night before. Please give a CARS about anything you can remember concerning that issue, especially about the confrontation that took place between those three, after C learned that R1 and R2 had stored the documents somewhere else. If possible, please include the following points in your statement: - Can you remember what R1 and R2 said about the authorities they acted on? - Did they give any reasons for their actions? - Was arbitration mentioned? By whom? In what context? If you have any other input that may help to solve this case, please be so kind and help me there. [1] https://wiki.cacert.org/Arbitrations/a20121228. }}} === A: questions to WIT2 === Date: Mon, 25 Nov 2013 21:34:53 +0100 {{{ Dear WIT2, I'm the arbitrator of the case a20121228.1[1], CM is the Case Manager. You were named as possible witness of one incident addressed by this case. To clarify what happend, I have to ask you some questions. I assume, that you did accept CCA and doing so DRP. The incident happend on 2012-12-28 at the CAcert booth of the 29c3. As far as I know, R1 and R2 had removed CAP-Formulars belonging to C from the CAcert booth in the night before. Please give a CARS about anything you can remember concerning that issue, especially about the confrontation that took place between those three, after C learned that R1 and R2 had stored the documents somewhere else. If possible, please include the following points in your statement: - Can you remember what R1 and R2 said about the authorities they acted on? - Did they give any reasons for their actions? - Was arbitration mentioned? By whom? In what context? If you have any other input that may help to solve this case, please be so kind and help me there. [1] https://wiki.cacert.org/Arbitrations/a20121228. }}} === WIT2: statement === Date: Tue, 03 Dec 2013 20:21:12 +0100 {{{ Am 25.11.2013 21:34, schrieb Eva: > Dear WIT2, Dear Eva > I'm the arbitrator of the case a20121228.1[1], CM is the > Case Manager. > > You were named as possible witness of one incident addressed by > this case. To clarify what happend, I have to ask you some questions. I > assume, that you did accept CCA and doing so DRP. > > The incident happend on 2012-12-28 at the CAcert booth of the 29c3. As > far as I know, R1 and R2 had removed CAP-Formulars > belonging to C from the CAcert booth in the night before. > > Please give a CARS about anything you can remember concerning that > issue, especially about the confrontation that took place between those > three, after C learned that R1 and R2 > had stored the documents somewhere else. > > If possible, please include the following points in your statement: > - Can you remember what R1 and R2 said about the > authorities they acted on? > - Did they give any reasons for their actions? > - Was arbitration mentioned? By whom? In what context? It's quite a long time ago, so I don't remember exactly what happened. I know that C stored the CAP-Forms inside a binder with some other private stuff at the CAcert booth. One morning we arrived the CAcert booth, the CAP-Forms belonging to C were gone. Later, after C find out, that R2 and R1 removed the CAPforms, they (R2 and R1) came to the CAcert booth. Then the three a had a discussion about, where to store the CAP-Forms during a Congress. R1 and R2 argued, that C stored the Forms at an unsafe location. And that was the reason for them to take away the CAP-Formulars. And as far as I know R1 and R2 didn't mentioned any authorities they where acting on. But I do not remember whether someone said something about arbitration. Hope i could help in this case. }}} === WIT1: statement === Date: Tue, 10 Dec 2013 14:45:27 +0100 {{{ I'm sorry. The last weeks have been particulary stressful for me. Let me provide a CARS right here in this digitally signed email. If you have further questions, feel free to email me. Please excuse that I am not able to make a CARS in the Wiki as I do not know my credentials for the Wiki. --- Begin CARS --- During the 29th Chaos Communication Congress in Hamburg, Germany members of CaCert organized an assembly [1] for CaCert. This assembly consisted of R2, R1, C, me and other people not relevant to this CARS. C kept CAP forms assured by him in a blue folder that was placed on the assembly's table. It was not known to me what the contents of this folders where until the undermentioned events occured. We left for dinner on 2012-12-28 and collectively left our belongings at the assembly. I do not recall whether the aforementioned folder of C was left at the assembly or not. I do recall that C and other persons joined us for dinner. I do recall that R2 did not join us for dinner. After we returned to the CCH facilites C noticed that his aforementioned blue folder was missing. I do not recall the exact sequence of events that led to the following events which happend a few minutes after the events in this paragraph. R2 explained to C that he removed the folder, well knowing that it contains confidential CAP forms belonging to C as an educative act to demonstrate the risk of these forms getting stolen if left unattended. C objected that R2 was to guard the assembly and that his act of removing the aforementioned folder was theft. C immediately either filed an arbitration or did just announce to file an arbitration against R2 and apparently other parties. [1] http://events.ccc.de/congress/2012/wiki/Assemblies --- End CARS --- }}} === WIT3: statement === Date: Thu, 12 Dec 2013 08:21:37 +0000 {{{ hello, >> You were named as possible witness/actor of one incident addressed by >> this case. To clarify what happend, I have to ask you some questions. I >> happen to know, that you did accept CCA and doing so DRP. >> >> The incident happend during the night between 2012-12-27 and 2012-12-28 >> at the 29c3. As far as I know, you were called to the CAcert booth by >> R1 and R2 because of some CAP-forms they found there. >> >> Please describe the incident evolving by that call. >> >> If possible please include the following points in your statement: >> - Do you think, R1 and R2 knew whom the clipboard and the CAPs >> belonged to? >> - What authorities (of any of you) were mentioned for your actions? >> - What was your assumption about the authorities R1 and R2 did >> act on? >> - What reasons were given for the actions? >> - Do you have any idea what time it was? >> - Was anybody informed about the incident? >> >> At 2012-12-28 the CAPs were returned to their owner/assurer. >> - Do you know anything about what happend then? As far as i remember: During the night (must have been between 3:00 and 4:00 in the morning) R1 and/or R2 came from the CAcert table to the "angel area" (a special Area at 29c3 for volunteers) asking me if i have some minutes at the CAcert table before i leave to the hostel. They told me that there is an issue with CAP-forms at the table. When we arrived at the table, i could see Cs notebook with his (wellknown) CAcert-clipboard under the notebook. R1 and/or R2 told me, that there are used CAP-forms on this clipboard. We had a short talk about how to solve this issue and came to the conclusion, that it makes sense to seal the Clipboard containing the CAP-forms to take care of the applicants privacy. To make sure, that nobody opens the clipboard it was taped and sealed with martins signature on the crossings of the tape. After this the sealed clipboard was deposited in R1 luggage in the angel area (= out of the view of other participants) and we left the congress for the night. As far as i know, nobody tried to contact C via phone (it was in the middle of the night) and nobody sent a mail to CAcert-support (since it was no issue support could solve). ... On the next day (i don't know the time) the clipbboard was returned to C ... as far as i know. I don't know if i was there when R1 and/or R2 gave it back, but i don't think so (it's nearly one year ago!). }}} === A: additional question to WIT3 === Date: Thu, 12 Dec 2013 10:41:35 +0100 {{{ Dear WIT3, thank you for your quick response to my last mail. Your detailed statement is appreciated and quite helpfull. I'm sorry to bother you again, but there remaines one question, not touched by your statement, that is of some relevance. All of you had (and have) multiple authorities in the context of CAcert, each of you probably aware of all of them. >>> - What authorities (of any of you) were mentioned for your actions? Currently I would assume, that none was mentioned. But if you can remember something else, please tell me about it. I know that it's a long time ago and I'm sorry that arbitration took so long to pick up this case, that it's hard to remember all details, now. We are making an effort to speed up arbitration. }}} === A: additional questions to WIT1 === Date: Thu, 12 Dec 2013 14:34:54 +0100 {{{ Dear WIT1, thank you for you quick answer. > The last weeks have been particulary stressful for me. Let me provide a > CARS right here in this digitally signed email. If you have further > questions, feel free to email me. Please excuse that I am not able to > make a CARS in the Wiki as I do not know my credentials for the Wiki. That's quite fine. It's intended to be done by mail. The only ones who should regularly edit the arbitration cases in the wiki are the respective case managers and arbitrators. I know that it's a long time ago and that it's hard to remember everything. But there are some points I would like to ask you again. If you don't know the answers to the questions, that's fine. If you are not sure about them, just say so. Do you have any idea about times? You mentioned "dinner" but that can mean a lot. (Especially when you are thinking about geeks going to CCC events.) Do you remember any involvement of R1? Do you remember anybody mentioning any roles they acted on? }}} === WIT1: answers questions === Date: Thu, 12 Dec 2013 21:36:13 +0100 {{{ Dear Eva, Let me answer your questions in another CARS right here. I'm sorry for not being able to answer all your question in sufficient detail. It might be possible that I remember more details but I do not want to give details that may be false memories or which I cannot put into a specific place in the sequence of events that happened. --- Begin CARS --- > Do you have any idea about times? You mentioned "dinner" but that can > mean a lot. (Especially when you are thinking about geeks going to CCC > events.) I do not recall when we went to dinner. I recall that the sun had already set by the time we left the CCH facilities. We went to the restaurant Schweinske at Hamburg Hauptbahnhof. > Do you remember any involvement of R1? I remember R1 defending the actions of R2. I do not remember any further involvement of R1 in the case of theft of the aforementioned folder. This does mean that such an involvement might not have happened. > Do you remember anybody mentioning any roles they acted on? I do recall R2 taking away the aforementioned folder with CAP-forms to educate C about his duties as an assurer, one of which is secure and confident archival of received CAP forms. I do not recall whether or not R2 did take away the folder while impersonating any of the roles R2 implements as a member of CACert. I do recall C filing an arbitration in his function as an assurer for CACert. --- End CARS --- }}} === WIT3: ansers question about roles === Date: Mon, 16 Dec 2013 17:50:24 +0000 {{{ Hello, > All of you had (and have) multiple authorities in the context of > CAcert, each of you probably aware of all of them. > >>>> - What authorities (of any of you) were mentioned for your >>>> actions? > > Currently I would assume, that none was mentioned. But if you can > remember something else, please tell me about it. > > I know that it's a long time ago and I'm sorry that arbitration > took so long to pick up this case, that it's hard to remember all > details, now. We are making an effort to speed up arbitration. It MAY have been possible, that we have talked about being Arbitrator/Board-Member/Software-Assessor/... ... but ... ... to handle the privacy issue of the applicants this did not matter: As far i remember, nobody argued as Arbitrator/Board-Member/Software-Assessor/... but in the state of a CAcert-Community-Member/Assurer to prevent a privacy breach against CAcert and ensure, that the person keeping the CAP-Forms for the night cannot modify them (to keep them valid for the Assurer). }}} === A: new questions to WIT3, about contact with C === Date: Tue, 17 Dec 2013 10:00:43 +0100 {{{ Dear WIT3, thank you for the clarification to my last question. I can answer one of the big questions of the case, now. But while trying to combine all statements to one big picture, yesterday, I stumbled about something where you were mentioned as well that I was not aware of and did not cover with my questions. C mentioned that after he discovered his CAP-forms missing, at about noon (2012-12-28), he directly asked you about them. Can you remember this? Do you remember your answer? Do you know if you informed R1 or R2 about your contact with C? Since I already was cleaning up the picture, this should really be my last questions to you as witness in this case. }}} === WIT3: answers questions: cannot remember this === Date: Mon, 16 Dec 2013 18:33:46 +0000 {{{ Hello, > C mentioned that after he discovered his CAP-forms missing, > at about noon (2012-12-28), he directly asked you about them. Can > you remember this? Do you remember your answer? Do you know if you > informed R1 or R2 about your contact with C? Really? ;-) I don't know ... If he asked me, i answered him, that he should contact R1 and/or R2 (since R1 had the clipboard with the CAPs and R2 sealed them). Normally i'm quite busy on the Congress when being on the way between Angel-Area and the video-equipment in one of the rooms ... About contacting R1 and/or R2: No, i did not. ... but since it was during the day, C could have used Eventphone to contact R1 and/or R2 (when i left the hostel in the morning, both were still sleeping). }}}