Nepotism, Conflict of interest: Debian GSoC/Outreachy/OSI board

[Mollamby]

Can we trust our upstream?

Are these hidden relationships putting Ubuntu devs at a severe
disadvantage?

Is it safe for Ubuntu to encourage people to get their packages
into Debian, should we give them options to work around Debian?

People have been arriving to DebConf trying to pick apart the
recent concerns.  The version of events commented officially and
the Regrets email published by Sam Hartman is very disparaging
to some people while other people seem to evade any responsibility.

Here are some facts that have emerged through debian-private and
discussions at DebConf that some of us feel very uncomfortable
about.  We are posting anonymously because Sam Hartman's report is
too biased and we don't want to be subject to the next
Anti Harassment humiliations for questioning the DPL.

There is a growing perception that Debian and other associated
groups have become too incestuous.  For everybody else, it means
we don't know who we can trust.

Fact 1: Mollamby
----------------

A clandestine relationship that existed between the Debian Project
Leader (DPL), Chris Lamb and his subordinate, Molly de Blanc,
the head of the Outreach team who is also a member of the controversial
Anti-Harassment team.  Mollamby.

Clandestine relationships are not automatically wrong.  It is
the surrounding facts that make this both scandalous and worthy
of the same scrutiny and media coverage forcefully imposed on
other Debian Developers.  Mollamby.

Fact 2: a GSoC conflict of interest
-----------------------------------

A student applying to GSCoC informed about his relationship
with another member of the community.  The other community
member is named in a delegation by former DPL Chris Lamb.  Neither
the student nor the other community member are under
suspicion:  Both declared the relationship up front.

There were over 100 student applications to GSoC 2018 and only 20%
were selected.  It has not been stated whether the student
in this case was one of those selected.

Fact 3: mentors acted responsibily
----------------------------------

A member of the Outreach team, not a party to the conflict of
interest, reminded other team members about the conflict of
interest in the April 2018 selection meeting.

Fact 4: no policy
-----------------

Debian has no conflict of interest policy.

There was nothing for the GSoC admins or mentors to refer to.

Fact 5: vested interests
------------------------

Debian's list of delegations, equivalent to managers or office-holders
in other organizations, doesn't reveal employment details or any other
clues about vested interests and conflicts of interest.

Fact 6: Molly de Blanc signed off on it
---------------------------------------

In reply to Fact 3, Molly de Blanc acknowledged and signed off on
the conflict of interest.  Her commented has been shared widely
on a blog:

<mollydb> nice responsibile decision making
<mollydb> thanks for being so consciencious

Fact 7: Google complained
-------------------------

July 2018, Google's head of GSoC, Stephanie Taylor, made a
written complaint about conflicts of interest in Debian.

Fact 8: Mollamby investigated themselves
----------------------------------------

Mollamby investigated the complaint.  This was clearly
inappropriate.  How could Molly de Blanc investigate a complaint
against something she signed off on?  How could Chris Lamb, as Debian
Project Leader, investigate a complaint against a team where
his love interest was a prime suspect?

It would have been possible for them to recuse themselves
without declaring the fact there was a relationship.  They could simply
state that because Google was disputing conflicts of interest, they
need help from somebody neutral and not involved in day-to-day
Debian, like a past DPL.

Even in the absence of a relationship, Molly de Blanc never should
have been part of the investigation anyway.

Mollamby investigating themselves.  Mollamby.

Fact 9: opportunistic scapegoating
----------------------------------

Mollamby used another team member as a scapegoat.  The same team
member who reminded everybody about the conflict of interest
during the selections.

Fact 10: inters/students suffer
-------------------------------

Before conducting any investigation, Google sent aggressive and highly
demotivating communications to some students.  It appears Mollamby rushed
Google into this shoot-first-ask-questions-later response.

Fact 11: Google rushed into decision then backflip
--------------------------------------------------

After making enquiries with the entire admin team Google had to
backflip and completely retract their action against students.  Mollamby
had rushed Google into an awkward situation that had to be rolled back.
Mollamby.

Fact 12: interns complained about Molly de Blanc
------------------------------------------------

August 2018, an astute intern made a complaint about Molly de Blanc
not doing any real work, it has already been shared in various places,
including debian-project.

Other community members had made similar observations but none had
ever dared to say it.

Fact 13: previous mentor summit procedure
-----------------------------------------

In previous GSoC rounds before 2018, the two places to attend the
mentor summit were always awarded randomly to any two mentors, with
a preference for mentors who never visited the summit before.

Fact 14: privileges for the admins
----------------------------------

For 2018, Molly de Blanc suggested that one of those two places
should be reserved for an admin.

Fact 15: Molly de Blanc got the free trip
-----------------------------------------

Molly de Blanc, as admin, attended the GSoC mentor summit in
October 2018 and only one other mentor received a place.

Fact 16: Molly de Blanc as AH insider
-------------------------------------

Molly de Blanc formally joins the Anti-Harassment team.  The name
of the team is misleading.  Its real purpose appears to involve
preventing people asking inconvenient questions to the project
leaders: in other words, de Blanc participating in a vigilante group
to prevent people holding her boyfriend, the Debian Project Leader,
to account.  de Blanc was privvy to any complaints against her boyfriend
and also privvy to potential complaints or discussions about
his political rivals.

Fact 17: DAMs rushed into decisions, just like Google
-----------------------------------------------------

The Debian Account Managers are rushed into removing two Debian
Developers from the Debian keyring.  It is the same pattern as the
way Google was rushed into punishing students.  Mollamby.

Fact 18: another intern complains
---------------------------------

A mentor received a complaint from an intern about somebody
in the Anti-harassment team.  The mentor was unable to do anything
due to fear and mistrust of the leadership.

The complaint hasn't been leaked yet, hold on to your seats.

Fact 19: DPL's girlfriend pronounced Developer
----------------------------------------------

Molly de Blanc, girlfriend of the Debian Project Leader, is
controversiallly promoted to become a Debian Developer.
She has not created any packages and she had been subject
to various complaints during 2018.

Fact 20: scapegoat abused
-------------------------

At almost the same time, the Developer who highlighted the conflict
of interest is removed from the Debian keyring, threatened and
insulted in various ways, starting from September 2018, long
before anything overflowed into the public domain.

Fact 21: Google pay offs
------------------------

Debian receives large payments of cash from Google on dates overlapping
with punishments.

Fact 22: Payments from Google obfuscated
----------------------------------------

Details about the largest payment are hidden or obfuscated in
official communications.

Fact 23: censorship
-------------------

It is alleged that an email to the debian-project mailing list asking
about the Google payments and pressure has been censored.

Fact 24: DPL gives delegation to girlfriend
-------------------------------------------

In his last act as Debian Project Leader, Chris Lamb writes a
delegation formally appointing his girlfriend (or ex-girlfriend
at this point), now a Debian Developer, to the Outreach team.

Fact 25: Open Source Initiative (OSI) board kept in the dark
------------------------------------------------------------

Mollamby serve together on the OSI board.  They never informed other
board members or the organizations they are affiliated with (FSF and
Debian respectively) about their conflict of interest.  Molly de Blanc has
become OSI board president in 2019.

Fact 26: DPL budget control
---------------------------

Chris Lamb, as Debian Project Leader, had discretion to approve
his own travel expenses using Debian funds.

Fact 27: subsidised long-distance relationship costs
----------------------------------------------------

Molly de Blanc resides in the US while Chris Lamb resides in the UK.
This was a long distance relationship.  They would meet each other at
events where their travel was paid by free software organizations.

Fact 28: spreading defamation
-----------------------------

Mollamby have both circulated defamatory and politically motivated
allegations against other members of the community.

Molly de Blanc's FOSDEM 2019 talk explicitly boasts about a whisphering
network, this appears to be a call-to-gossip.

Fact 29: misleading denial by DPL
---------------------------------

When Chris Lamb was publicly asked about the defamatory allegations
he circulated, it appears that he has lied by denying it in an
email to debian-project the week before Christmas.

Evidence that Lamb really did send the offensive email was subsequently
posted on a blog.

This very public and dishonest denial makes a serious dent in Lamb's
integrity.  As he was the DPL, dishonesty like this dents Debian's
reputation too.

Fact 30: Molly de Blanc breaks up with FSF and Lamby
----------------------------------------------------

Molly de Blanc's FSF employment terminates at about the same time that
Mollamby break up.

She writes a blog about the breakup.

Fact 31: revolving doors
------------------------

Despite the circumstances, Molly de Blanc immediately begins working
for another former Debian Project Leader, now at GNOME.

Fact 32: fake sorries
---------------------

An email sent to debian-project on 8 July 2019, "Regrets Handling
Conduct Concerns Earlier this Year", from the new DPL, Sam Hartman,
appears to try and put blame back on the developers who spoke up.

It feels like a pretend sorry or conditional sorry email.

This persistent blaming and conditional sorries from leaders
reeks of high arrogance, it is harmful to the victims and it is
perpetuating the problems.

Most ordinary people can recognize the difference between a pretend
sorry and a sincere sorry even if they don't know the people or
the facts.

It is obviously, deceptively and repetitively trying to deflect
responsibility to other parties and distract from the elephant in
the room, Mollamby, so it is hardly an apology at all, it feels more
like a political statement.

Fact 33: new DPL acknowledged conflicts of interest existed, hides names
------------------------------------------------------------------------

The same email referred to in Fact 32 confirms there were
conflicts of interest in the second abusive keyring change too.
Both abusive keyring changes were therefore compromised by
Mollamby and other hidden relationships.

But the names of the culprits are hidden.  They have immunity.

Fact 34: malicious intent and DPL's vendetta
--------------------------------------------

At the same time that a developer was removed from the keyring,
Chris Lamb immediately sent messages out to other organizations
to harm the developer's reputation.  Many independent people
see this as an aggravated and politically motivated breach of
a private decison by Debian Account Managers.  Lamb's indulgence
in doing this appears to be a major reason the issues exploded into
public discussion and drag other Developers into the mess.


This is all a textbook example of nepotism.

Mollamby



Sent with ProtonMail Secure Email.