-731

The Moderator review and reinstatement processes posted 21 October 2019 have been discussed with the moderators and the two posts below reflect the agreed process for removing or reinstating moderators from now on. While these processes may change over time as they're put into practice, for now they are considered finalized and are available for use.

There are two review policies - one (Action Review) is the older policy from 2012 and one (Conduct Review) is the new policy. There is one reinstatement policy for all former moderators who wish to be reinstated.

We expect that some of you may have questions about the processes and want some clarifications. This post is a place for you to ask them. Please do not post questions about the process on those posts - they will be removed.

We very much respect the value of meta discussion but would like to keep the process posts clean and not have to delete all of the discussion to make the actual policy clear. Having the discussion here makes that easier. We have cross-linked the posts so that they're easy to find.

For ease of response and voting, please limit each answer to one specific concern.

  • 116
    Are there specific guidelines re interacting with the press (by either party)? – mjwills Oct 21 at 20:26
  • 15
    @mjwills have you seen meta.stackexchange.com/questions/335708/… ? – sourcejedi Oct 21 at 20:27
  • 131
    Genuine question, when can we expect to get responses to the questions/concerns raised? – Script47 Oct 21 at 21:18
  • 9
    @Script47 Gonna depend on the question. Some of them we're already answering. Some of them will take some time. – Catija Oct 21 at 21:22
  • 134
    It ain't much and I don't have a big reputation but I kindly ask for Monica to be reinstated. – smtrejo says Reinstate Monica Oct 30 at 0:20
  • 11
    Slightly off topic, but how is it decided who gets the unhappy task of posting "questions" like this and exposing their reputation to damage from massive downvoting? – K Man Nov 3 at 23:24
  • 3
    @KMan Kinda depends. For this, I was helping JNat so he posted the policies and I posted the feedback post - but as you can see, JNat's been the one primarily answering questions in the answers below. For the new FAQ, I was the primary person working on reconciling the existing FAQ posts to create the new FAQ and Cesar was helping and had posted the prior FAQ. – Catija Nov 4 at 0:16
  • 17
    @Catija Is there a planned timeline you can share when a followup to this is posted? Can we expect any changes in the process, and/or an announcement of the final process, and is there a timeline for either? – Magisch Nov 4 at 9:33
  • 49
    @Script47 Well it's been a few weeks and only 1 of the top 13 posts has a staff answer. I guess that's your answer. – David says Reinstate Monica Nov 5 at 21:42
  • 40
    @Catija I haven't heard anything on the feedback that was left -- do you have a timeframe on when we can expect to hear something? – George Stocker Nov 7 at 12:51
  • 5
    It's been 4 weeks since this was posted, and 5 days since the last (visible) activity I can find. Does this still need to be [featured]? – The Guy with The Hat Nov 18 at 19:11
  • 12
    @TheGuywithTheHat This needs to be [featured] until SE Inc. responds to the posts and the issue is resolved satisfactorily. – Reinstate Monica iamnotmaynard Nov 19 at 16:08
  • 35
    @TheGuywithTheHat I'm fine with this ugly stain on SE's face until SE takes responsibility. Obviously they will eventually take this down on their own initiative, but I don't see any reason to let them off the hook just because they sat around and did nothing for months. – David says Reinstate Monica Nov 20 at 2:00
  • 8
    @GeorgeStocker - When can we expect to hear something? What about all those new podcasts? – J.R. means 'Just Reinstate' Nov 23 at 10:52
  • 6
    Looks like the Devil number is referring to the devilish nature of SE Inc. – Omega Krypton Nov 26 at 14:51

72 Answers 72

8

Why was "Remove access immediately" chosen as a first resort over a less extreme alternate?
It also seems to me that the current workflow doesn't actually prevent the compromised account from continuing the bad behavior, they can just continue doing it without a diamond next to their name.

A quick brainstorm:

  • A solution that should work for all accounts.

    • Disable login.
    • Send an email to allow reactivation.
  • If an account has multiple authentication methods.

    • Disable the compromised login.
    • Inform the user.
  • A potential solution that only works for SE accounts.

    • Reset the password of the account.
    • Kick all user sessions from the server.
8

Execution Phase

  1. If an Emergency Removal took place, moderator access can't be restored. At CM2's discretion, the network account may be suspended for 30 days to prevent further harm while issue is being handled. CM2 will communicate their findings to the moderator, and annotate their account. The process is concluded here.

Unless I've misread the comments and clarifications on some of the other answers, Emergency Removal could be used for anything from an active security breach to acting out of character.

What happens if CM1 misreads the situation and overreacts when stumbling upon the initial problem, and initiates an Emergency Removal on the mod; the process concludes finding a violation did occur, but it wasn't what CM1 initially thought it was was, and in retrospect the Emergency Removal wasn't warranted?

On a first offense, if the Emergency Removal had not occurred, the mod would get a warning, but since the Emergency Removal did take place, now they can't be restored.

If you are looking for a fair process, the punishment should be determined by the mod's actions, not by CM1's reaction.

7

I have two concerns about the removal and reinstatement policies. The first is that SE maintains complete control over the process and the second is the lack of transparency in the processes.

I think removal should require agreement between a CM (i.e., an SE employee) and a site moderator (i.e., an elected/pro-term appointed moderator from the community that is not an SE employee) that the moderator in question should be removed. For the reinstatement process, I think blocking reinstatement should require agreement between a CM and a site moderator that the moderator in question should not be reinstated. The moderators to be involved in these processes could either be the non-employee moderators at MSE, randomly chosen from moderators across the network with more than N years of moderating experience, solicited from moderators in the TL on a first-come basis or something like that or really anything that gives community members a seat at the table.

In the removal process, this means CM2 and CM3 would be replaced by moderators. SE essentially gets two shots to convince a moderator that the moderator in question needs to be removed. In the reinstatement process, CM2 would be replaced by a moderator. If CM1 and the moderator acting as CM2 both want to prevent reinstatement, the process is concluded and the request is denied. If the CM1 wants to prevent reinstatement, but the moderator acting as CM2 does not, the process goes directly to the execution phase to be decided by the current mods.

In regards to transparency, I believe both processes should be private and only involve the individuals directly relevant. That said, I think it would be helpful, and not much work, to keep moderators aware that the processes are being used and working.

In the reinstatement process immediately after CM 1 is assigned I think a message should be posted in TL stating that a reinstatement request has been received from USERNAME at SITENAME. I then think weekly updates should be posted in TL stating where in the reinstatement process the request is. Finally, when the process is concluded a post in TL should be given stating which action ended the process (i.e., previous reasons, recent behavior, irreconcilable differences, precondition rejected, non-response, reinstatement).

For the removal process, just knowing that it is being used would be helpful. In the Emergency Removal Process (ERP) I think step 3.5 should be to post in TL that a moderator has been temporarily removed under the ERP. In the Regular Investigation Process (RIP) step 2.5 should be to post in TL that a concern has been raised about a moderator and that the RIP has been initiated. In both cases, once the initial notification has been given, weekly updates stating where in the process the investigation is should be made in TL. Finally, when the process is concluded a post in TL should be given stating which action ended the process.

Finally, I think yearly (quarterly if this happens a lot) summaries should be posted about how often the processes were used and what the outcomes were. This should be done publicly on either MSE or on a blog post as well as in the TL.

  • 12
    I like including moderators, but I don't think people should be able to volunteer for specific cases (too much risk of advocacy), and I am concerned that in some cases what's needed is an on-site moderator, not a random one. If a moderator was removed for reasons that are not public beyond the site, involving arbitrary other moderators increases the "splash zone", so to speak, from those actions. Even if a removal is initiated by SE rather than users, the model from the original removal process seems sound to me. If SE thinks a whole site has gone bad, that's a different problem. – Monica Cellio Oct 28 at 23:56
  • @MonicaCellio I would really like to see moderators be involved, but I am not sure how they should be selected. The splash zone is not something I had even considered, but I would like to think that moderators can be trusted to be discrete. – StrongBad Oct 29 at 0:03
  • 2
    I've seen cases that reached CMs but should have been (and were) resolved on-site; no need to embarrass the mod involved more broadly. Moderators should be discrete, but also bear in mind that moderators on one site are often users on another, so you'd probably need to find mods with no involvement on the site in question to avoid that awkwardness. It's going to feel weird to, in the future, need to send a mod message to a mod who sat in judgement over you, right? – Monica Cellio Oct 29 at 0:08
  • @MonicaCellio the moderator would only be involved in the removal if CM1 found grounds for removal and then any vote for removal from a moderator standing in for either CM2 or CM3 results in removal. This also minimizes the splash zone since it only goes forward if CM1 thinks there is a case. – StrongBad Oct 29 at 0:14
  • 3
    Oh, I missed the sequencing there. That does make it better, yes. We still need to avoid conflicts of interest, whether from volunteers with opinions or users of the site, but that's probably manageable. – Monica Cellio Oct 29 at 0:17
  • 1
    @MonicaCellio none of this really matters because what is clear is that SE is not going to give up their total control of the removal process or their ability to block a reinstatement and they are going to keep everything hidden. – StrongBad Oct 29 at 0:22
  • 3
    Unfortunately, yes. Which is why going through it is dubious even if one was removed with due process, let alone the case where that didn't happen. – Monica Cellio Oct 29 at 0:28
6

In Moderator Conduct Review Process, in the Discovery phase, section 4.2.1. Current words:

moderator access can be restored

Please replace "can" with "will".

5

Why two processes for removal of a moderator?

The 'Moderator Conduct Review Process' boils down to "Act first, then go through reinstation process".

If the request comes from a user/Stack Exchange employee or a moderator, the process is not the same. Why?

The starting point is the same, a mail to contact@stackexchange.com, depending on whom wrote the mail the moderator case will be evaluated with other moderators from the site or just by CMs...

That makes no sense, whomever the originating complain comes from the process should be identical.

The specific case of "issue causing immediate harm (security issue like a moderator's account appearing to be compromised, or moderator agreement violation as described above)." should just add a diamond removal immediately before proceeding to the rest of the process.

4

I have identified a potential optimisation to the process:

Execution phase 1.1 gives any existing CM moderator veto rights to reinstatement. If this veto step is carried out at the start of the process (during the CM selection/recusement of Discovery Phase 1) then the entire discovery phase can be skipped.

Execution Phase 1.1

If this consultation results in an unfavorable outcome (at least one mod in the current team strongly objects to reinstatement), the request is denied and the reasons for it will be stated back to PM. The process is concluded here.

Or maybe this veto right should be looked at as it seems to render a lot of the process superfluous.

  • The text you quoted is about objections from current mods on that site, not about CMs... It's the current site mods that have "veto rights", not CMs. – V2Blast Oct 22 at 3:50
  • @V2Blast Thank you, I thought they were the same thing. That clears up some of my confusion. Although the point remains that they could do that step first and save a bunch of the CM's time. – david Oct 22 at 3:56
  • Ah. Yeah, the CMs are the actual company employees, as opposed to the elected diamond moderators specific to each site on the network (e.g. Cooking.SE). – V2Blast Oct 22 at 4:04
4

Just a few quick remarks. I apologize if they overlap with other answers. Given that there are so many of them, it's difficult to keep the overview.

  • This is too much red tape (bureaucratic). Consider simplifying the whole process.
  • One way of simplifying would be to just state contracts and leave the implementation details to either be developed ad-hoc or for internal documents.
  • One contract that seems to be missing would be the right of the accused (in case of a removal) to get a detailed explanation of the accusations, the evidence and the reasoning from the "judgement team" in written form. I would appreciate if that could be added.
  • Instead of doing all that complicated CM1, CM2, CM3 ping-pong behavior, why not just say that always three CMs will meet and a majority of them decides. That's similar to how the close votes review process works. That might simplify some parts of the process.
4

Please include some more specific details about handling moderators who stepped down voluntarily and then wish to take up their positions again.

There was a recent case (which I do not wish to link to) wherein a moderator was semi-inactive for several years on two rather popular science sites. Apparently he would quietly handle a couple of flags or perform some other moderation-related activity which was completely invisible to the community (and did not leave any traces like comments in his recent activity page) every now and then. But there were absolutely no visible contributions from the last three years, and very few for several years before that. He played a huge role in setting up the site's policies when the sites were new, which is evident from the fact that he was the author of almost all canonical FAQ posts in about 2012. But a couple of years later, his participation suddenly shut down, and he did not mention any reason on meta or chat.

There was no evidence or reason to suspect that he was misusing his powers, and there was no reason to believe that he would return in the future and misuse the mod tools. Still, a high-rep contributor on one of the communities who had joined after the moderator had gone inactive said that he/she was somewhat concerned by the fact that someone with whom he/she had never interacted was a moderator. Concerns were raised regarding whether it is logical to have Moderator For Life positions, and some users claimed they would rather see a continuous stream of contributions or messages of some form from each moderator, just so that they can be reassured that no moderator's views had changed drastically from the position which got him/her elected.

A meta post was made asking whether the community would like this inactive-ish moderator to remain in his position. A month later, the moderator chimed in, explained how circumstances had changed in the real world and left him without the time to participate on SE, and resigned on both sites. This action was positively received and community members, moderators, and members of the SE community team thanked the moderator for his contributions.

I feel that in such cases, the community team needs to take a lot of care while re-instating the moderator. Over five years, the site's dynamics, rules, and values can change significantly, and the moderator needs to be made aware of that. While I do not believe that they should have to go through the whole process of re-election, I think that the moderator reinstatement process post should clearly state that the case of stepping down, particularly upon non-aggressive requests, is not considered trivial.

3

Reinstatement process, Discovery phase, step 2.3:

If CM1 (and the team) finds reinstatement is possible and there isn't a need to establish a precondition, they'll just proceed.

Does this mean "Proceed to reinstate" or "Proceed to the next phase"?

  • 5
    Based on the flowchart it seems to be: "Proceed to the next phase" – divibisan Oct 21 at 21:22
  • 2
    To the next phase, correct. – JNat Oct 22 at 10:04
3

Why is there no input from the community in the mod removal process (when there have been complaints, this does not apply to the emergency removal)? As I see it the communitie(s) that a moderator manages will have the clearest view about whether or not a moderator crossed a boundary. And they will be the people that know the moderator in question the best, as they probably deal with them on a more frequent basis. Which will help in deciding if it is a persistent problem or a having-a-bad-monday-morning one off issue. (I'm not saying that in a one off case no action should be taken here.)

There are a lot of different stack exchange sites, and each of them are unique and different. Because of this each site will have their own "unofficial" rules on top of the global CoC. A question that may be rude to ask on siteA may be completely acceptable on siteB, and vice versa. We can not expect CM's to know the ins and outs of every community, and know every moderator by heart. As there are just too many of them.

I know this issue is probably less obvious on big sites like StackOverflow that has a larger amount of mods, but on sites with only a handful (or fewer) mods I think just a CM's view may be insufficient, and a "Community vote" should be cast (may be as a "supplementary" vote instead of a binding one).

I also think this would help counter the defense of "The cm's reviewing me were biased", as it would be a vote cast by the entire community.

As mentioned in the comments, this may not be feasible due to privacy and confidential information, so my guess would be that the community gets to know the type of complaint. E.g "complaints about discriminating" or "Issues unbased suspensions", maybe providing additional information from the taken minutes, if this is needed.

  • 1
    I guess SE would say that in the interest of privacy the community can't be involved but I agree with you. There needs to be much more transparency. – Script47 Oct 22 at 8:44
  • @Script47 The privacy aspect is a good point. I suppose the community would only get to know the generic type of issue raised, and get the information about the minutes that the post itself stated can be released if the mods wish to do so. – remy_rm Oct 22 at 8:47
  • A redacted version so to speak, that'd work. – Script47 Oct 22 at 8:49
3

In watching this for nearly month now, I'm convinced that a few factors will lead to this being a defining element of the future of online communities and moderators/moderation:

  • that this has continued to be a massive corporate screw-up
  • the high profile and respect the StackExchange community had up to this point
  • the unassailable reputation and image of the related mod
  • the conviction of those involved
  • the legal and media dimensions of the situation's evolution

One of the most ideal outcomes would be a fully public-sphere 'IRL' legal case and ruling. This would

  • break the (5th? 6th?) wall between online and real-life,
  • set valuable precedents, and
  • be hard to neatly control with divisive bipartisan political-media

For those reasons, I expect that each involved could find themselves allied with unexpected interest-groups.

1

What ways can moderators, and users, protect their accounts to reduce chances of their accounts being compromised?

As far as I know 2FA isn't possible with Stack Exchange.


Given that there's a chance at "CM 2 agrees with CM 1's conclusion" that a compromised account could be nuked from moderator-ship. I don't want to leave my account vulnerable and find out first hand what would happen to my account if it were compromised and committed CoC violations.

  • While I don't believe 2FA is directly supported, certainly nothing prevents you from using, e.g., a dedicated e-mail address for SE login purposes only (I do that) to reduce the possibility of the login e-mail address being discovered; and have a very long password (mine is random and on the order of 60 characters; I don't even know myself exactly how long it is). More generally, this feels like a good question for Information Security. – a CVn Oct 22 at 9:46
  • @aCVn I already have pretty good password policies, like yourself. Your comment seems to say the onus is on me to not get hacked, not on Stack Exchange for implementing security measures. – Peilonrayz Oct 22 at 10:02
  • @aCVn I'm guessing probably 64 characters; that seems about right for password storage. – user474678 Oct 22 at 10:51
  • I would say it's a shared responsibility. Stack Exchange is in a position to implement support, but it's up to users to use that support appropriately. I would hope that anyone who ends up being a moderator are able to take steps to secure their account against unauthorized access; lack of specific 2FA support on the platform certainly isn't an excuse not to do as well as one reasonably can. – a CVn Oct 22 at 10:51
  • @JL2210 NIST SP800-63B § 5.1.1.2 recommends allowing passwords ("memorized secrets" in NIST-speak) to be at least 64 characters long, so my standard passwords are slightly shorter. At some point there's a point of diminishing returns; a randomly generated alphanumeric password 60 characters long corresponds to log2(62^60) ~ 357 bits. There is no appreciable qualitative difference between 357 bits and, say, the 381 bits of a similar 64-character password; in both cases, it's difficult enough to crack that xkcd.com/792 applies in spades. – a CVn Oct 22 at 11:06
  • 2
    You can use a separate OAuth provider for login, e.g. Google, who supports 2FA. – Paŭlo Ebermann Oct 22 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .