Draft of Social.coop bylaws (our constitution)

Since the Policies/Moderation WG seems to be broken, here are a few points I'd like to address when we get to discuss the bylaws

• Where are our servers located and under which country's law do we operate?
• How is social.coop to act in the (unlikely) case a police force were to request personal data of one or more of our members/users?
• Should we ever receive sensitive data/information, how are we supposed to deal with them?
• What will be our policy around sources?

Feel free to comment and share your ideas!

@michelekipiel what do you mean it's broken? :)

Broken like in "I can't seem to have people reply to my questions" :)

Got you - looks with haven't got a critical pass of peeps to engage in all the important discussions that need having.

On where the servers are - I have seen multiple times that they are in Amsterdam.

On the other points you raised - they would seem to be open questions. Do you have any ideas to propose?

Nope, no proposals so far, as I'm by far not an expert in internet law. I'd love to debate those nonetheless, as I believe protecting the personal data and messages of our members is paramount.

I just updated the Thread Context with a shareable link so people can access it.

How is social.coop to act in the (unlikely) case a police force were to request personal data of one or more of our members/users?

I'm not a data protection expert but have some experience working with EU-based global corporations, both German and Dutch. Where I had to deploy systems that were compliant to internal data protection policy and EU law.

My understanding is that our service provider would be subject to EU (and Dutch) law and the actor responsible for social.coop is the legal person or entity who is registered with our hosting provider. If the registered entity is social.coop — being unincorporated I'm really not sure where we'd stand in this equation.

Communication/hosting service providers are expected to comply with specific regulations — including warrants for individual's data. They generally have no choice in this particular matter and must comply or take decision to litigate — current Coinbase case with IRS is a good example http://www.coindesk.com/irs-enforce-coinbase-user-data-bitcoin/.

AFAIK the only way for there to be a "choice" to not relinquish user data, is through encryption. My assumption is Mastodon doesn't support the encryption of user data, nor does it have a peer-peer architecture so its technically difficult to achieve this, not without undermining any attempts at securing user data. The remaining option is to encrypt our disks to mitigate against our hosting provider handing over raw data. That would put our system administrators under fire as they'd be the likely holders of the private keys. In this case I'm really not sure what the territory looks like but it could be a strategy employed to slow down the acquiring of user data, whilst we figure how to take action.

Encrypting disks is a feasible solution, but would have to be rigorously tested before we deployed to ensure against any incompatibilities in our stack. That being said, disk encryption is not unconditionally sound but is the best option we have given the Mastodon architecture.

Should we ever receive sensitive data/information, how are we supposed to deal with them?

Can you expand on this? Generally, I would recommend only persisting data that requires us to operate as a service. At the moment that is email address and a name.

What will be our policy around sources?

Again, can you expand on this?

What will be our policy around sources?

Again, can you expand on this?

Sure! Consider what happened to Reality Winner after The Intercept's gross incompetence in disclosing the original print-out of a leaked document. My question would be: how are we supposed to handle leaked/secret/unsafe information should we ever get hold of any?

I had some further thought on this ...

Our present situation — is we're capturing min. PII (Personal Identifiable Information) i.e. name and email address, this may change once we're incorporated... Once incorporated, information such as investment shares and so on will be stored of individuals. I would encourage such information to be kept within the control of users, where legally possible. I suggest to table this problem until the time comes...

At present the only private data I can think of are direct messages to each other. All other information is public. In this case we have two options, I can think of:

— Extend Mastodon with a transparent encryption feature, similar to Signal to keep direct messages within the control and retention of communicants. That would be fun to implement : )

— We are explicit to users that direct messages can be relinquished to authorities upon a legal warrant. Therefore, we encourage users to use alternative services such as Telegram or Wire for private messaging or for groups who wish to keep communication private — you never know when social.coop members may want to plan an act of civil disobedience of some kind ;) ... I can imagine that some users will take for granted that we're not like the FB's of this world and therefore their data is "safe" but we're compelled to comply with the law like any service.

Spot on. These are precisely my concerns (though you definitely elaborated them way better than I did :) ). I believe addressing some of the aforementioned points during the next calls (the Euro-friendly one and the final one) will prove beneficial for all.

I think @victormatekole hit most of the key issues on the head :)

The most obvious route in the near-term - is to keep all data on EU-based servers and operate under EU data protection and privacy regulations.

As Victor mentions - there will always be a legal route to turning over user information (via a warrant etc.) but so long as the servers are based in the EU the threshold for this is 'relatively' robust.

Therefore - if we want to afford this data a higher level of protection, that leaves encryption.

But given that we are not incorporated or anything (and we don't have a timeline for this yet - perhaps it isn't actually a short-term priority) this is tricky, for the reasons @victormatekole outlines.

I like the short-term solution of just making it clear in terms of use (i) the general data protection / privacy situation re: user data and (ii) the recommendation to use end-to-end encrypted messengers for conversation that require it.

---

Whether we pursue the route of encrypting all user data (including names/emails etc.) will need to be decided at a later moment - and evaluated as to whether the positives are worth the negatives.

@michelekipiel

Sure! Consider what happened to Reality Winner after The Intercept's gross incompetence in disclosing the original print-out of a leaked document. My question would be: how are we supposed to handle leaked/secret/unsafe information should we ever get hold of any?

I haven't got into this particular case, so don't know details... But given that social.coop is not a publisher, it doesn't warrant concern, unless I am missing something? I can't imagine social.coop ever being viewed as a preferred entity to publish government secrets. And if that was ever the case — I'd quickly direct them to a group that is widely regarded as competent — in publishing such material e.g. Wikileaks.

To conclude on this — there seems to be forming consensus around full disclosure to users regarding the release of private data e.g. private messages and our strong recommendation to use other services for private communication.

Long-term, I'd like to see Mastodon address the privacy around direct messages. It would be of huge benefit for the ecosystem to have the Mastodon architecture adopt end-end encryption for private communication. It would place us in a unique position — of being a social network, as well as a place to hold private communication. At present I'm tied up with bootstrapping multiple projects, as part of Seedbloom, plus I hope to be supporting @mayel in technical operations of social.coop... But as social.coop matures and my time is more available, I'd like to explore this possibility, if it hasn't been already.

Finally, encryption of disks I think we should do in the medium-term, for the sake of good security practices. I have to admit I have failed to carry the practice out for recent platforms I have deployed and administered, but do so for my personal devices. seedbloom.it, will follow this practice, especially as it is expected to hold sensitive and financial data.

Makes perfect sense to me, thank you both! I say let's formalize this chat in a series of articles to make sure everyone in the coop is on the same page when it comes to data handling, disclosures etc...

Yes, thank you all for moving this conversation forward. It's vitally important.

Unfortunately my plans have changed du to family matters and I can not attend the call on Friday. Hope my feedback here helps. Sorry for the long text.

First of all, thank you for putting up this constitution. I like that it is short and precise and shows your experience in building these kinds of organization. I like the contribution system a lot.

I have some general feedback to share.
In my understanding, a self/community-governed organization (a heterarchy https://en.wikipedia.org/wiki/Heterarchy), I also call it empty-centered organization, requires the following minimal definitions in their constitution to work

I. Purpose and Principles

We have a mission but I miss a purpose.

Purpose is stronger than a mission, it stays relevant when mission/objectives are fulfilled.
Which purpose of our organization would give our (each individual) life a meaning?

Maybe something like:
The social.coop brings forward free and secure access to social media and thus a human centered internet.

… however for me personally it is more about transforming hierarchical profit governed multinational corporations into user owned earth centered and community governed organisations/cooperatives.

Am I at the right place with this purpose in this organization or is it social media focussed?
That's fine to, just good to know.

Anyway, in a community governed organization, the purpose is designed from the members, idally within a creative collective process. I strongly believe loomio etc. is not the right tool for this.
I have experienced more appropriate tools for this, though they require a more personal meeting. Maybe possible via zoom/hangout, too. This may be done at a later stage.

Also, some central and defined Principles opposed to rules help the keep the organization dynamic by moving into the intended direction in the same time.

Here comes an example for principles we apply in our change agent collective Vanilla Way https://www.slideshare.net/CoCreativeBusinessEvolution/vanilla-way-values
some might serve us here too, though it is also up to us existing members what is of value to us here and it requires a more collective ideally in-person process, too.

II. Protocols of Communication

What are the forms of meeting and communication we use?
Which are the channels members and becoming members can check to be able to follow up what is going on an taking part in decision making.

List all relevant Media/Groups here and where to learn about how to access.

III. Members and Rights / Responsibilities

Here we can define i.e. the honorary members and the contributing members….

I find the current differentiation not really clear yet.
Where does the differentiation come from?
Is there more about being a member than being able to re-imburse costs?
I don’t understand why there needs to me a limit on honorary members.

VI. Key Performance Indicators

What specific criteria shows that we are on track with our Purpose?

V. Governance & Finance

We have this covered already.
The financial part is titled Contributors - I don’t understand this, since it describes the process and not the role.

Thank you very much for all this work and all the best for the call on Friday and further steps.

Manuela

Thank you for your feedback. It's unfortunate you can't attend the call, as you seem very well informed on the topic and I believe your input would be great. Looking forward to talking to you in the next call :)

To all the others: are you still up for the call on Friday?

Thanks for your suggestions. I agree on purpose — it helps us shape and define our common values, where as the mission is largely about tactical steps that should be aligned with our shared purpose.

In my view, the purpose of social.coop was to have a social network for those that see themselves as architects, developers, promoters, scholars, fortune tellers, etc and naysayers (it is healthy to have opposing views :) ) of the cooperative movement. A petri dish for platform cooperative experiments and forum for debate. A model for those that want to take cooperative principles and bake them into their own projects and ventures.

Finally, the Vanilla Way has some interesting principles – one i'd single out is the one on Trust & Courage as I see a core mission of this network is to bring about collective ownership into the wider world, which can be achieved through courageous and determined efforts outside of the network.

~victor

Dear Michele, yes, shame I missed it. How was it? Are you in the buytwitter Slack for direct contact? You can find me there or contact manuela@vanillaway.net - feel free to reach out.

No worries, we'll catch up another time
:)
The call was very productinve, mainly due to @emlc being a true expert in coop organization, and we managed to address most of the points that will be brought up in the call with @matthewcropp

No I'm not in the buytwitter group but you can always find me here or on social.coop (as @Antanicus)

Hey all,

I won't be able to attend the meeting but I thought I'd add my 2cents here so it could be debated.

Overall, I like the concise presentation — my experience so far of reading cooperative bylaws is that they tend to bring on sedation... This is great in that I can carry the constitution in my head, very important characteristic.

(i) Honorary members and value creation

In my short experience of cooperatives — I see a lot of value being created but never accounted for.... The honorary membership only acknowledges fees paid but doesn't recognise unpaid contributors and the value they create that could be used to support honorary membership. There are various solutions knocking around that are attempting to solve this problem, none that I could recommend as I think they are flawed... Nonetheless, in the short-term we could just track time given by contributors for agreed tasks. This value could be traded in support for honorary members, instead of payment.

(ii) Contention / Blocking

In reference to the proposed ruling of 'No blocks, unless 90% agreement is reached' in regards to reaching consensus on proposals.

Presumably, this is a counter measure to the 'tyranny of the majority' problem? Coming from Bitcoin space i've often thought about this problem.... Bitcoin, has become a great example of where the opposition of a few has thwarted what many believe to be a majority consensus around how to scale Bitcoin. As a result the network has suffered, development has stagnated, relationships strained. It's only pain that is seemingly bringing the two down the slow path to consensus. Bitcoin is a somewhat disjoint example, given that it encompasses actors that have misaligned incentives — this is tempered in a cooperative.

Nonetheless, it has got me thinking about how to deal with minority opposition in a way that brings consensus in an accelerated and sustainable fashion.... In the opensource space, contentious proposals have been resolved by opposing groups 'forking' into new projects. Often preserving the purpose of the original but with a few changes. I am not opposed to that... But I do encourage that community find consensus as opposed to splitting — in some cases it results in irreparable damage to the common mission.

I'd like to hear from those that are more experienced than I — in community and organisation — how to deal with contention that leads to "accelerated sustainable consensus". This could be formalised in a set of smart contracts as part of a wider problem of globally scaled cooperatives and perhaps open source projects. Specific to our constitution — I am wondering if the resolving of contention, in this case blocking — should be formalised and made explicit in the constitution?

~victor

Hello everyone, this is the link to the "eurocall": https://hangouts.google.com/call/skxhjlpbf5cqxjbqqrwxfiipaey

Looking forward to hearing from you!

And here's the minute: https://docs.google.com/document/d/1Vrc1BTeOHyJorjBjG-N6zvxUx7Dg_xbb6ONukFUIouY/edit?usp=sharing

Wish I had managed to join as well (I crashed and slept for about 12 hours when I arrived at home!)

Glad to see you had a good discussion, and will check those resources as well before the next call.

Thanks for posting all this! I wish I could have joined. In Europe, but on Italian trains all day.

@ntnsndr @mayel no worries, we'll have more eurocalls in the future :)