The witch-hunt against Larry Garfield, part 1

This story has been out there for a while, but I haven’t posted until now because I was letting the story develop a bit more. (I have, in the past, posted too soon before parts of the story have developed and wound up looking, or at least feeling, like an idiot. More on this later.) Now that both sides have posted at least one statement, I feel the story has developed enough that I can go ahead and comment.

At present, I am not a Drupal user, but the issues that this situation presents could just as easily happen to anyone in any community-based free software project (WordPress, Joomla, Concrete 5, etc) and it’s entirely possible that I could wind up a Drupal user at some point in the future (I have set up a Drupal site before that I wound up never actually making a live website). In fact, I see parallels between this story and things that have happened to me in a couple of the various communities I have been involved in over the years. So I don’t see this as a Drupal issue, I see it as a community leadership and project governance issue, and a mighty big one at that.

A recent article on TechCrunch reports on the issues surrounding Larry Garfield and his continued participation in the Drupal project after over a decade of contributions. How the issues came to be is a chilling tale, which I will attempt to summarize in a timeline fashion, but I would like to invite readers to also read Larry’s blog post about the situation (titled appropriately enough “TMI About me”).

The timeline:

• 2005 (April or later): Larry Garfield begins his involvement with the Drupal project.
• 2016 October (approximate): Someone finds Larry’s profile on a private website for alternative lifestyles (in this case, it would appear, a BDSM community). This person was “Offended(tm)” (as Larry says it), screenshots a post, and passes it around, which is a direct violation of the site’s terms of service (TOS).
• Some time later: This post makes it to Drupal’s Community Working Group (CWG), which finds no code of conduct violation that they can take action on. Despite this, a “gossip campaign” continues against Larry.
• Some time after the above: The CWG informs Larry of the situation, who responds with an open offer for others to speak privately with him about his personal life if they so desire.
• Late 2016 November (US Thanksgiving weekend) at Drupal Iron Camp in Prague, Czech Republic: Klaus Purer takes up Larry on his offer, though he doesn’t listen to much of what Larry had to say, ending the conversation with a statement that he was going to “distance himself from” Larry. Larry offers a handshake, which I would assume was declined by Mr. Purer.
• Some time later: Mr. Purer signs up on the same private website, to go “spelunking” through Larry’s post history, sharing the “worst” posts with the CWG (again, in a flagrant violation of the TOS of that site).
• 2017 January: Larry has a Google Hangouts conversation with Mr. Purer, during which the latter implies he is speaking not only for himself but for another group of anonymous individuals and attempts to blackmail Larry into resigning from his positions in the Drupal community, including his Drupal advocacy within the PHP community. Larry, in his post, states he “do[es] not suffer bullying and threats lightly” and as a result referred the matter back to the CWG, who mediates by having separate conversations between both Larry and Mr. Purer. They conclude again that no code of conduct violation has occurred.
• Some time after the above: Mr. Purer continues his “spelunking” of the private website and sharing of content from that site with the CWG (still in violation of that website’s TOS).
• 2017 February 24 (a Friday): Larry gets a phone call from Drupal project lead Dries Buytaert (roughly equivalent to a prominent WordPress user/contributor getting a call from Matt Mullenweg himself). Mr. Buytaert would reveal that he and the Drupal Association’s executive director Megan Sanicki had known about this situation for some time, but not once reached out to Larry until this phone call. Mr. Buytaert asks Larry “to step down from Drupal… in the best interest of the project”. Larry says this is impossible as it would directly impact his career (and due to Larry’s advocacy of Drupal in the PHP community, not necessarily in the best interests of the Drupal project either).
• 2017 February 27 (the following Monday): Ms. Sanicki sends Larry an email dismissing him from his position as track chair and speaker at DrupalCon “per [his] conversation with Dries [Buytaert]”. From Larry’s blog post: “I do not know if ‘per my conversation with Dries’ means I’m unwelcome in Drupal because of my sex life, I’m unwelcome in Drupal because Dries was afraid Klaus would go public and embarrass the project otherwise, or something else. I have been given no further information than that and still have not been.”
• After the preceding email: The Board of Directors (of the Drupal project) votes to affirm Ms. Sanicki’s “decision to revoke the session for DrupalCon Baltimore and end the track chair term”. They did this after Larry presented his case in writing when he was unable to present his case in person due to being scheduled to present at a conference.
• 2017 March 22: Larry makes his blog post (linked below).
• 2017 March 23: Ms. Sanicki makes a blog post on behalf of the Drupal Association addressing the situation (linked below).
• 2017 March 26: Techcrunch publishes their article and it is shared to the Cypherpunks email list (and many other places, I’m sure) shortly thereafter.
• 2017 March 27: Larry makes his second blog post (linked below).
• 2017 March 29: Ms. Sanicki updates the DA blog post.
• 2017 March 31: Another DA blog post from Ms. Sanicki (or at least posted from her author account) goes up (linked below).
• 2017 April 5: Larry makes a third blog post, which I will comment on in more detail in the second part of this post (as this one has already grown to be rather long).

Larry goes on to quote from both the Drupal and DrupalCon Codes of Conduct. The first quote from the Drupal Code of Conduct:

We expect members of the Drupal community to be respectful when dealing with other contributors as well as with people outside the Drupal project and with users of Drupal.

It is obvious to me that at least Mr. Purer and the original as-yet-unnamed individual who found Larry’s profile have violated this rule by sharing information about Larry from a private site where such sharing is prohibited by the TOS. I would think that everyone, including Mr. Buytaert and Ms. Sanicki, who has acted on such information shared in violation of the TOS, should be considered as “having eaten from the fruit of the poisoned tree” as it would be said in US criminal law.

Larry hasn’t broken this rule just by having a different lifestyle and adopting quirks from a subculture. He mentions saying “be well” or “I wish you well” to end a conversation. The US pharmacy Walgreens had their cashiers say “be well” for quite a while, so it’s not like it’s all that weird. I certainly hope they didn’t quit because someone made a stink about it.

And Larry’s quote from the DrupalCon Code of Conduct:

Sponsors, volunteers, speakers, attendees, and other participants should strive to treat all people with dignity and respect, regardless of their culture, religion, physical appearance, disability, race, ethnicity, gender, or sexual orientation.

Larry goes on to refer to Gor as a culture and BDSM as a sexual orientation, both of which I would consider reasonable categorizations. And so the story sat for a few days, while both the Drupal Association made its statement about the issue and Larry made a second blog post about the topic.

I’m not going to go into detail on the second blog post (other than that I made a few edits to the part I wrote before it went up, based on that information). However, I am definitely going to call out Ms. Sanicki’s blatant lies and contradictions in her statement made on behalf of the Drupal Association. My commentary to each quoted section of their statement is directed at the Drupal Association and specifically at Ms. Sanicki:

We want to be clear that the decision to remove Larry’s DrupalCon session and track chair role was not because of his private life or personal beliefs. The Drupal Association stands by our values of inclusivity. Our decision was based on confidential information conveyed in private by many sources. Due to the confidential nature of the situation we cannot and will not disclose any information that may harm any members of our community, including Larry.

Okay, so this wasn’t about his private life. Yet you’re not saying exactly what it was. It’s funny how the reason is so confidential yet Larry has no problem putting out there exactly what parts of his private life people are apparently taking issue with. Even if the community doesn’t have a right to know why you, the Drupal Association, have a problem with Larry remaining a part of the project, Larry himself deserves to know. Larry refused to resign after Mr. Buytaert’s phone call to him, so the fact Larry was summarily removed from his track role and DrupalCon session after that call is a bit more puzzling.

What exact rule(s), in either the Drupal or DrupalCon Codes of Conduct, did Larry break? If there are none, why is he being treated like he did break a rule?

This decision followed our established process. As the Executive Director, charged with safekeeping the goodwill of the organization, I made this decision after considering input from various sources including the Community Working Group (CWG) and Drupal Project Lead, Dries Buytaert. Upon Larry’s request for an appeal, the full board reviewed the situation, all the evidence, and statements provided by Larry. After reviewing the entirety of the information available (including information not in the public view) the decision was upheld.

What you (Ms. Sanicki) did not tell us, is that the CWG is three people, all selected by Mr. Buytaert. Thankfully, the comment saying so was allowed, so the rest of us following this debacle know this. I am also reading between the lines here that the CWG could be seen as an extension of Mr. Buytaert’s ego and that he would be unlikely to pick people that would vote on matters like this against his wishes. The CWG should be picked by leaders in the community and not just the project lead. How can we possibly trust the CWG to make unbiased decisions otherwise?

In order to protect everyone involved we cannot comment more, and trust that the community will be understanding.

I read this as “we are above admitting we really screwed this up and so this dollop of bovine excrement is all we’re going to drop on the concerned members of the community.” Sorry, no sale.

We do see that there are many feelings and questions around this DrupalCon decision and we empathize with those community members. We will continue to monitor comments. We are listening.

Good, then I hope this blog post finds its way to you. I want to know at what point the two of you (Ms. Sanicki and Mr. Buytaert) are going to admit that you screwed this whole thing up and reverse it. Also, Klaus Purer and whoever originally sent the complaint about Larry to the CWG both need to face some serious consequences (though I suspect it was, in fact, Mr. Purer who sent in the original tip). Everything that has wound up being leaked from the private website (mentioned by Larry) and put in the hands of any non-member of that site was done so in violation of that site’s Terms of Service or Acceptable Use Policy (TOS/AUP). It’s all “fruit of the poisoned tree” and if everything stems from what was posted on a private website which was accessed on behalf of the CWG and DA in violation of the TOS/AUP, regardless of who did it, then the foundation of any action against Larry is flawed.

It looks like, per the March 31 blog post to the DA blog, that there may yet be action taken against Mr. Purer. However, Larry still needs to be made whole. If there’s a reason for removing him as speaker and track chair at DrupalCon, then we should know why. And not just vague terms like “holds views that are in opposition with the values of the Drupal project” (which in and of itself shouldn’t be an issue), “[people] suffered from varying degrees of shock and concern” (there’s a reason those kinds of websites are private), or “protect the shared values of the Drupal project” (when the action to remove Larry from community involvement is seen by many as a direct contradiction of those values and the first step down a very slippery slope). No, we the community have the right to know what rules Larry broke, chapter and verse.

I’ve seen these kinds of things unfold before–not to mention experiencing a similar situation myself. I would hope those in charge will do the right thing, and try to fix the damage they have caused to Larry’s career. The more likely outcome, unfortunately, is that they don’t give a tinker’s damn and let the (wrong) decision stand. If Drupal wasn’t Larry’s entire career at this point in his life, this would be much less of an outrage. But it is, and this is the most outrageous thing I’ve ever seen a software project’s leadership do to a contributor–many times more outrageous than what happened to Theo de Raadt as a NetBSD contributor back in 1994 (finding the details of which, I leave as an exercise to the reader).

Mr. Buytaert: If you really wish to “protect the shared values of the Drupal project” then you need to reinstate Larry Garfield as a contributor and issue a sincere and meaningful apology to both Larry and the Drupal community, without any further undue delay. You also need to understand the difference between fantasy roleplay and real-life conduct as a member of the community. It really isn’t any of your business if Larry’s into BDSM or Gorean fantasy role-play, and the fact that information was leaked to you from a private website in violation of its privacy-protecting AUP/TOS doesn’t change that. That Larry has had to make this public just to try and protect himself is outrageous and egregiously offensive not just to me, but to a lot of other people out there (judging by the comments I’ve seen on both your blog and the DA’s blog). You should also strongly consider resigning as project lead because instead of “protect[ing] the shared values of the Drupal project”, you have diminished and tarnished them.

Ms. Sanicki: Your role in wrecking Larry’s career by dismissing him as speaker and track chair at DrupalCon is also egregiously offensive. That you pretend it has nothing to do with leaked details of his private life, leaked to you in violation of a private website’s privacy-protecting AUP/TOS, is perhaps the most egregious lie I have ever seen told in my entire adult life. You have made the Drupal Association look just awful, and as I see it, the most certain way you can fix it is by resigning your position without any further undue delay.

Mr. Purer and the as-yet-unnamed person who, in the words of Larry, was “Offended(tm)” by what you found out about him: Your disrespect for privacy in the quest to ruin a man’s career is shameful. I don’t know how you can look yourselves in the mirror in the morning after doing what you have done. If you lack the integrity to remove yourselves from the Drupal community, I hope the leadership does. To violate the AUP/TOS of a private website, put in place to protect the privacy of its members (not just Larry, but all the other members as well), for the purpose of leaking information to destroy a man’s career because you don’t like what you saw, is saying a huge “fuck you” to how we operate in decent society. It may not be a crime in and of itself to do what you did, but it’s definitely unethical and immoral and probably a civil tort as well. Shame on you.

In part two, Larry’s third blog post (which I had skimmed, but not read in detail, before putting the finishing touches on this one).