• Arbitrations
• a20140316.1

• Case Number: a20140316.1
• Status: running
• Claimant: CAcert (Support - originally filed by Marcus M)
• Respondent: CAcert

• initial Case Manager: EvaStöwe

• Case Manager: PietStarreveld

• Arbitrator: EvaStöwe

• Date of arbitration start: 2016-08-14
• Date of ruling: 201Y-MM-DD
• Case closed: 201Y-MM-DD
• Complaint: database cleanup regarding deleted accounts
• Relief: TBD

Before: Arbitrator: EvaStöwe (A), Respondent: CAcert (R), Claimant: CAcert (Support - originally filed by Marcus M) (C), Case: a20140316.1

History Log

• 2014-03-16 (issue.c.o): case [s20140316.67]
• 2014-05-24 (iCM): added to wiki, request for CM / A
• 2014-05-24 (iCM): send notification about case to C
• 2014-07-26 (iCM): repeats request for CM / A
• 2016-08-14 (CM): pick up case with A
• 2016-08-14 (A): send init mail to C
• 2016-08-14 (A): send preliminary ruling to software and critical team

Link to Arbitration case a20140316.1 (Private Part), Access for (CM) + (A) only

EOT Private Part

Original Dispute

• Dear arbitrators,
  
  taken the information from the bug 1223 [1] and taken to the split bug
  1259 [1]
  In the support case {a support case number} a member asked for a deleted account.
  He could not access it, and searching in the SE console I could not find
  it either. However if he used the 'Lost password' link on the login
  website, entered the email address and correct birthdate, he got to step
  2 of password recovery. That means, here his account showed up.
  
  This looked strange to me, since normally as SE I can search even for
  deleted email addresses and I find all accounts this email address
  belongs to or previously belonged. But in this case I didn't find it.
  
  So I asked {a critical admin} and he told me: "This email address can be found in the
  table `email`, but with the field `deleted`. It can also be found in the
  table
  `users`, again with `deleted`."
  
  It thus showed up that the handling of the `deleted` field in the
  software is rather inconsistent. I suggest that this handling should be
  straightened in the way that an SE always can see all email addresses,
  domains and accounts that ever existed. If there is more than one
  account, in the list of the accounts to select, a flag should be added
  to show if it is an active account, email address or domain or if it is
  deleted.
  
  Please find an advice for the software team how to handle the cleanup.
  
  
  [1] https://bugs.cacert.org/view.php?id=1223
  [2] https://bugs.cacert.org/view.php?id=1259

Parts in {} anonymised.

Preliminary Ruling

I hereby give the following preliminary ruling:

A patch for bug 1259 may not be set productive until the arbitration
case a20140316.1 is decided or there is a ruling in that case that
allows to set such a patch productive.

Eva Stöwe - 2016-08-14

Discovery

• 2016-10-01: Board issues motion m20161001.1 - "Withdraw a20140316.1 (database cleanup regarding deleted accounts)"

Resolved, that the board considers the bugs filed referred to in the case a20140316.1 are sufficient to the underlying needs, that the case is misfiled, and that the board does not want to encourage the use of Arbitration to bypass or force other channels.

By this act, board has to be considered to take over the representation of the claimant, so the claimant is adjusted to be "CAcert (represented by board)". As head of the executive area, board is able to such a task from the teams, if board sees such a need, at least in cases where some authorisation is requested.

It has to be noted down that the motion was given at the board meeting after the Arbitrator had a) stated that she had gathered everything needed to come to a ruling based on earlier discussiond on board mailing list and in that board meeting and b) given a possible overview about the considered ruling. Which included the possibility of a fine against CAcert because of the request to provide support team members access to user data which the members would consider to be removed on a regular basis, without being able to name any relevant argument and even further to make it easy for support to look up accounts (by accident or intention) which have no relation to a support case at all.

Ruling

Execution

Similiar Cases

See a20110221.1 for a detailed list of Similar cases and related Bug Reports.

• CategoryArbitration

• CategoryArbCaseOthers