Original Dispute

Date: 2012-12-28 14:05:10 (anonymized version)

> Dear support,
> 
> please file dispute against R2 and R1.
> 
> My claim is that R2 abused his position as event organizer 
> at
> 
> 29c3 to justify a raid of personal CAP forms of assurees. R2 
> assisted him in doing so.
> 
> When leaving the 29c3 location on the evening of 27th December 2012, I 
> left a folder with some CAP forms of assurances I made ove assurees 
> over
> 
> the day hidden under my notebook. Apparently, teh booth was under 
> supervision, so R2 and R1 noticed that. These 
> forms
> were:
> 
> - NOT signed by me, so I did NOT acknowledge that any of the 
> proceedings
> 
> were connected to official CAcert work
> - NOT entered into the system, so the data on them did NOT affect 
> active
> 
> assurances or statements made by me towards CAcert
> 
> When I came back the next morning, I noticed that the folder was 
> missing
> 
> and asked around if someone had seen it. Neither R1 nor 
> R2, when seeing me, took care of informing me where it had 
> gone. When I specifically asked for it, R1 said that he 
> removed it and sotred it in some location unknown to me and that he 
> could not hand it out to me because of privacy concerns.
> 
> While R2 and R1 are right in saying that leaving CAP forms with 
> assuree data at the booth is a privacy issue, this is a *personal* 
> issue
> 
> between the assuree and me for the reasons mentioned above (NO assurer 
> statement given by me). It is a bug in CAcert assurance procedure that 
> the assurer does not have to give his statement to the assurer 
> beforehand.
> Up
> to the moment I sign the assurer statement on the form and enter the 
> assurance into the system, I do NOT acknowledge officially that I 
> acted in the name of CAcert.
> 
> Thus said, no event organizer or other CAcert person has the right to 
> act in a way R2 and R1 did. I file dispute against them for 
> abuse of a position given to R1 by the event team leader.
> 
> I accept the CCA and DRP under this arbitration, CARS.

correspondence about statements of C, R1, R2, WIT1, WIT2, WIT3

A: Question to C to clarify some points from the original dispute

Date: Mon, 18 Nov 2013 02:48:27 +0100

Dear C, R1, R2,

you all should now be able to read the private part of the arbitration
case a20121228.1[1].

Up until now it only contains mails that all of you should be aware off
since you were sender or recipients of them. You can especially find the
original dispute there.

Regarding the original dispute I have some further questions to the
claimant.

a) Your claim is abuse of positions. This could only be done by persons
being in positions that can be abused. While you mentioned the position
of R1 it's not clear which position R2 had
concerning the event, that he could abuse.

b) What happend to the CAPs in question?

[1]https://wiki.cacert.org/Arbitrations/priv/a20121228.1

C: and clarification of the dispute

Date: Mon, 18 Nov 2013 07:54:01 +0100

Hi,

> a) Your claim is abuse of positions. This could only be done by persons
> being in positions that can be abused. While you mentioned the position
> of R1 it's not clear which position R2 had
> concerning the event, that he could abuse.

R2 accompanied R1 in his action because "that case
could easily result in an arbitration", and he has a position in
Arbitration. Although this claim is valid, R2 took decisive
action without having been assigned an arbitration case under a duly
filed dispute, and without acceptance of his position under DRP by all
parties. I am certain that an Arbitrator/Case Manager must not do
self-justice while not in a valid arbitration case.

> b) What happend to the CAPs in question?

They were returned to me after I threatened to make hell break loose. I
was not granted access to the forms first because R1 insisted
in waiting for R2 to return to the location, because he sealed
the folder containing the forms, which was my property.

R1 is correct in two points, and wrong in some others. I am
going to draw the reason for this case from those arguments:

 + It is a little bit careless from a privacy point of view to leave a
   folder with filled-in CAP forms unattended at an event location,
   although it was well hidden under my laptop.
 + If the CAP forms had been of any interest to CAcert as a whole,
   some action should have been taken to solve this issue together
   with the assurer (i.e. me)

 - However, the CAP forms in question were only vicariously related to
   CAcert as a whole. That's mainly an issue with the procedure of
   assurance, because unless the assurer signs the CAP form (and the
   assurer statement) in front of the assuree, the assurer stays an
   independent part of the community who will *later* (probably) make
   a statement towards CAcert. Up to that point, the assurance is
   merely a procedure between the two persons in question. This point
   is probably ruled out by ยง 7 of the AP, although this paragraph
   doesn't make any claims about CAcert's roles in the assurance
   step. In theory, any assurer would have to explain their own
   privacy policy derived from CAcert's privacy statement to any
   assuree before they give away their data. Note that the AP does
   not authorize the Privacy Policy as a subsidiary policy - this is
   probably a bug.

 - We do not have a strong hierarchy within CAcert. If R1
   (and R2) see an issue with anything I do, I expect them
   to react to that in a community-spirited manner. Removing the forms
   from the location and then casting phrases like "I am the event
   organizer, so I have all rights!" or "I am an Arbitrator, so I
   have all rights!" does not seem legit to me. Again, I do not think
   that an Arbitrator may judge in any case not passed to arbitration
   by a (valid) claimant - with the claimants being all assurees that
   handed CAP forms to me that day.

 - R1 and R2 entirely ignored the fact that I was
   carrying at least two communication devices with me, connected to
   at least four handles, all of which both R1 knew and
   could have called. They proved their capability of getting a phone
   call routed through to me several times before, so I strongly
   suggest they could have done that in the case at hand as well. That
   makes the case look even more like an abusive power play.

 - I am totally ok with R1, as event organizer, noticing
   a privacy issue. Now, if he *had* tried to call me, and would have
   failed, I would have regarded it as totally ok if he secured the
   forms in some place, and then informed me about it later, but
   returning the forms to me immediately. It is, however, a completely
   different issue that he refused to return the forms (and the rest of
   the folder) to me until I forcefully took it from him.

 - I am aware that the organizer of an event has to give a CARS saying
   that "all assurances at the event were conducted in conformance with
   AP". I do not think that leaving CAP forms hidden, but unattended for
   a short time means breaking AP, and unfortunately, I must also state
   that R1 did not take his position very serious in that
   regard. Apart from the case we are currently discussing, I did not
   see him at the booth very often. In reality, it was WIT1, 
   WIT2 and me who ran the event; R1 was
   merely listed as organizer in the Wiki. So maybe he should change that
   attitude before invoking his position in a power play.


I expect this arbitration to result in the following:

 - Updating the Privacy Policy to authorize Privacy Policy as a
   subsidiary document (I will happily do that)
 - Updating the Assurer Handbook (or whatever) to point out that an
   assurer should visibly prove their submission to CCA, AP, etc.
   *before* having the assuree decide whether they permit usage of
   their data
 - Educating assurers to follow that proposal (I will happily update
   slides and talks for ATEs in my role as Co-Auditor)
 - Making very clear that an Arbitrator has no rights of self-justice,
   only when handling a real arbitration case under a duly filed dispute
 - Making very clear that CAcert is community-driven without a strong
   hierarchy, so all efforts should involve all related parties within
   the community


Again: I think that R1 and R2 were partially right
in their motivation, but their action is harmful for the community and
not in conformance with any rules. But I am totally willing to have this
case clarify what behaviour to expect in certain positions, and then
update all materials to make better procedures become practice.

If this case results in R1's and R2's behaviour
being entirely correct, I am also willing to make *that* policy/proposed
practice, jsut to make that one clear. I am totally willing to carry out
the result of this case as a precedent, in terms of educating myself
*and* the rest of the community.

A: question to C about a possible (textual) mixup and possible witnesses mentioned in last statement

Date: Tue, 19 Nov 2013 17:32:51 +0100

Dear C,

thank you for the quick answer to my questions and further explanation
of your claim in this case. It is much clearer now.

I will not go into details until the respondents have had time to make a
statement of their own, since at least R1 announced his
intention to give one.

Albeit I do have two small questions.

1. You mentioned two other persons (WIT1 and WIT2)
do you know if they were present when either the confiscation of the
documents or the confrontation between you and R1 and/or
R2 took place?

2. When writing:
> I expect this arbitration to result in the following:
>
>  - Updating the Privacy Policy to authorize Privacy Policy as a
>    subsidiary document (I will happily do that)

I assume you meant 'Updating Assurance Policy to authorize Privacy
Policy...' instead of 'Updating Privacy Policy to authorize Privacy
Policy...' which does not make much sense. Am I correct? Or do you have
another Policy in mind?

DRO: contests 'an arbitrator may not judge in any case not passed to arbitration by a (valid) claimant'

Date: Tue, 19 Nov 2013 19:14:47 +0000

As DRO/Arb/Assurer I am deemed to have accepted CCA.

C said "Again, I do not think that an Arbitrator may judge in any 
case not passed to arbitration by a (valid) claimant"

One role that CAcert arbitrators have is to act or to authorise action 
in an emergency - there's not always time to do all the administration 
beforehand - as an example there are some emergency access cases where 
this has occurred and an arbitrator has authorised actions verbally 
however these should be (and have been) "written up" after the event. 
(a20120614.1 and a20120622.1 are examples of these).

I therefore contest that the need to be able to take emergency action 
would make C's idea impractical !

You might also want to look at the pending case a20130904.1 as part of 
your considerations - [A of that case] has acted before a formal case was created but 
at least there is some documentation of that action - albeit only in the 
ticket.

As to whether the actions allegedly taken by R2 as an Arbitrator 
constitute an "emergency action", this would fall to you as (A) to 
decide!  As DRO, I would be concerned that there is no apparent 
documentation of those actions.

DRO
CARS

C: confirms textual mixup and likelihood of two persons mentioned in former statement being possible witnesses for one part of the incident.

Date: Tue, 19 Nov 2013 21:21:37 +0100

Hi,

> 1. You mentioned two other persons (WIT1 and WIT2)
> do you know if they were present when either the confiscation of the
> documents or the confrontation between you and R1 and/or
> R2 took place?

I am certain none of them were present when the confiscation happened,
and I think that most likely both of them were present at the
confrontation.

> 2. When writing:
> > I expect this arbitration to result in the following:
> >
> >  - Updating the Privacy Policy to authorize Privacy Policy as a
> >    subsidiary document (I will happily do that)
> 
> I assume you meant 'Updating Assurance Policy to authorize Privacy
> Policy...' instead of 'Updating Privacy Policy to authorize Privacy
> Policy...' which does not make much sense. Am I correct? Or do you have
> another Policy in mind?

Sorry, that was a mistake. I intended to say exactly what you concluded.

R1: statement

Date: Thu, 21 Nov 2013 09:05:23 +0100

Dear Eva, dear others,

as promised in my previous mail I'd like to add some details to the
happenings based on my memories and a braindump from mid-January.

To safe me from redundant typing I'll use initials of the names for all
actors, i.e.:
R1: my humble person
WIT3: WIT3 (<email from WIT3>)
C: C
R2: R2

The events can be divided mostly into two parts. The first part happened
between Day 1 and Day 2 at the 29C3 congress at about 03:30 local time
(02:30 UTC). The second part happened between noon and teatime (exact
time unknown). All events took place at the 29C3 in the Congress Center
Hamburg (CCH) at the CAcert booth; except when explicitely noted otherwise.


For the first part:
- - At about 03:30 R2 and R1 were on their way to the hostel for the
night when they decided to take a short detour to the CAcert stand to
check the situation there and if everything was okay.

- - When still about 5 to 10 meters away from the booth R2 points R1 to
a blue clipboard below the laptop of C. In concern of a possible
privacy breach R2 asks R1 to check IF the forms were filled in while
ensuring no information was read or copied (if present).

- - Noticing THAT information was filled in R2 and R1 mutually agreed to
ask a third assurer (WIT3) to assist in assessment of the situation.

- - After arrival of WIT3 all persons present (R1, WIT3, R2) discussed the
further course of action and came to the conclusion to safe-guarding the
CAP forms until they can be handed back to C in person ASAP. To prevent
accidential exposure of the topmost form it was flipped over to its
back-side (blank).

- - Before handing over the clipboard to R1 for safe-guarding the
clipboard was sealed by R2 while the process was being observed by WIT3.
The sealed clipboard with all CAP forms was than instantly brought to
the Engel Area (separate area at the congress where only volunteers have
access) into the bag of R1 (taking it out of view at the stand). While
the Engel Area usually is quite open (no real entry checks) you don't
usually get there randomly.

- - After this R2 and R1 went to the hostel for the night.


For the second part:
- - Some time after noon R1 returns to the booth to check up on everything.

- - C asks R1 if he has seen the clipboard which R1 instantly
acknowledges and furthermore includes that based on the proceedings from
part one the return has to be witnessed by R2 to verify the seal.

- - C threatens R1 to report the incident to the event administration
for theft/stealing/misappropriation.

- - R1 instantly calls R2 on the phone to organize the return of the
clipboard and verification of the seal.

- - After R2 arrived at the stand R1 goes to his bag still being in the
Engel Area to fetch the clipboard. When returning to the stand R1 hands
the clipboard directly to R2 to check on the seal to be intact.

- - R2 checks the seal and addresses C for the return of the clipboard.
C instantly snatches the clipboard away from R2 and starts to angrily
complain about the proceedings to the bystandars at the CAcert booth.

- - R2 and R1 both try to explain the background of the safe-guarding to
C pointing out the situation when the CAP forms were found at the
CAcert booth unattended.

- - R2 and R1 mutually agreed to not unnecessarily follow up on these
events, especially to not file dispute as the situation was assessed as
minor and has been resolved from their point of view.

- - Approximately two hours after the return of the clipboard has been
completed C filed dispute carbon-copying the mail to events@c.o.


Furthermore I'd like to add the following observations:
- - The CARS given by C falsely represents some details of the events
that for sure have been reported to C.

- - This includes e.g. the presence of WIT3 which was reported to C but
doesn't appear in the dispute filing of C at any point making it appear
only R1 and R2 were involved.


Now there are at least the following questions that would be of interest
to me:
- - As the CAP forms were left unattended and in plain view (as for the
clipboard at least) it would be of great interest WHEN exactly a CAP
form starts to fall unter privacy policy and as such requires the
assurer to take proper action to ensure protection against unauthorized
access by third parties.

- - What are necessary precautions (recommended and required ones) to be
taken by the assurer for such a CAP form?


CARS,

C: challenges some of the points made by R1 in his statement

Date: Fri, 22 Nov 2013 23:44:53 +0100

Hi all,

> - When still about 5 to 10 meters away from the booth R2 points R1 to
> a blue clipboard below the laptop of C. In concern of a possible
> privacy breach R2 asks R1 to check IF the forms were filled in while
> ensuring no information was read or copied (if present).

I plainly deem that a lie. I have the very clipboard and notebook and
question here and can reaarange them the exact way they were when left
at the booth - with the clipboard completely hidden under the notebook
and sure as hell not visible from the distance.

> - Before handing over the clipboard to R1 for safe-guarding the
> clipboard was sealed by R2 while the process was being observed by WIT3.
> The sealed clipboard with all CAP forms was than instantly brought to
> the Engel Area (separate area at the congress where only volunteers have
> access) into the bag of R1 (taking it out of view at the stand). While
> the Engel Area usually is quite open (no real entry checks) you don't
> usually get there randomly.

And there are a lot of engel at the event. I doubt putting duct tape on
the edge of a clipboard makes it less exciting for the public, and I
doubt the engel area is a safer place to leave it unattended at than any
other place at the 29c3 :D.

> Furthermore I'd like to add the following observations:
> - The CARS given by C falsely represents some details of the events
> that for sure have been reported to C.

What was reported to me is unimportant - collecting reports is the
arbitrator's job. What I posted is what I have observed and what was
obvious to me.

> - This includes e.g. the presence of WIT3 which was reported to C but
> doesn't appear in the dispute filing of C at any point making it appear
> only R1 and R2 were involved.

Because WIT3 was apparently not important enough for the situation to get
him back to the sight when the clipboard was returned. It was also WIT3
who I asked for the clipboard first, and he said he had seen "R2 and R1
doing something with a clipboard he does not know whom it belonged to".
I refuse to call WIT3 a liar because he is a close friend, so I instead
doubt that he was really put in the position of an assasser.

> - What are necessary precautions (recommended and required ones) to be
> taken by the assurer for such a CAP form?

And: Whz is it ok for another community member to move them to a place
as unsafe as the old one?

C: challenges that the arguments given by the DRO can be applied to the given case

Date: Fri, 22 Nov 2013 23:51:39 +0100

> One role that CAcert arbitrators have is to act or to authorise
> action in an emergency - there's not always time to do all the
> administration beforehand - as an example there are some emergency
> access cases where this has occurred and an arbitrator has
> authorised actions verbally however these should be (and have been)
> "written up" after the event. (a20120614.1 and a20120622.1 are
> examples of these).

With the claimant being someone needing emergency access, and the
respondent being CAcert. And, above all, with the claimant not being the
same person as the arbitrator, and the person to execute the ruling also
being someone else than the arbitrator.

R2: statement

Date: Sat, 23 Nov 2013 16:56:37 +0100

Dear Eva, dear others,

The primary language of this mail is German but to make matters more
easy I'll provide a (loose) English translation.

DE:
Basierend auf Ausfรผhrungen von R1 mรถchte ich einige Deteils aus meiner
Sicht hinzufรผgen.

EN:
Based on the explaination given by R1 I'd like to add a few details from
my point of view.

On 11/22/2013 11:44 PM, C wrote:
> Hi all,
>
> > - When still about 5 to 10 meters away from the booth R2 points R1 to
> > a blue clipboard below the laptop of C. In concern of a possible
> > privacy breach R2 asks R1 to check IF the forms were filled in while
> > ensuring no information was read or copied (if present).
>
> I plainly deem that a lie. I have the very clipboard and notebook and
> question here and can reaarange them the exact way they were when left
> at the booth - with the clipboard completely hidden under the notebook
> and sure as hell not visible from the distance.
DE:
Fakt ist jedoch, dass das Klemmbrett zu diesem Zeitpunkt als ich am
Stand vorbeikam sichtbar gewesen ist.

EN:
Yet fact is, that the moment I passed by the CAcert booth the clipboard
WAS visible.
>
> > - Before handing over the clipboard to R1 for safe-guarding the
> > clipboard was sealed by R2 while the process was being observed by WIT3.
> > The sealed clipboard with all CAP forms was than instantly brought to
> > the Engel Area (separate area at the congress where only volunteers have
> > access) into the bag of R1 (taking it out of view at the stand). While
> > the Engel Area usually is quite open (no real entry checks) you don't
> > usually get there randomly.
>
> And there are a lot of engel at the event. I doubt putting duct tape on
> the edge of a clipboard makes it less exciting for the public, and I
> doubt the engel area is a safer place to leave it unattended at than any
> other place at the 29c3 :D.
DE:
Zum Himmel(Engel Area): dort ist immer ein Engel oder der
Schichtkoordinator anwesend.
Des weiteren war das versiegelte Klemmbrett in einer geschlossenen
Tasche untergebracht die dort mit einer Menge anderem Gepรคck abgestellt war.

EN:
Regarding the Engel Area: There is always at least one Engel or the
shift coordinator present in the Engel Area.
Further more the sealed clipboard was placed inside a closed bag, which
was left there together with much other luggage.
>
> > Furthermore I'd like to add the following observations:
> > - The CARS given by C falsely represents some details of the events
> > that for sure have been reported to C.
>
> What was reported to me is unimportant - collecting reports is the
> arbitrator's job. What I posted is what I have observed and what was
> obvious to me.
>
> > - This includes e.g. the presence of WIT3 which was reported to C but
> > doesn't appear in the dispute filing of C at any point making it appear
> > only R1 and R2 were involved.
>
> Because WIT3 was apparently not important enough for the situation to get
> him back to the sight when the clipboard was returned. It was also WIT3
> who I asked for the clipboard first, and he said he had seen "R2 and R1
> doing something with a clipboard he does not know whom it belonged to".
> I refuse to call WIT3 a liar because he is a close friend, so I instead
> doubt that he was really put in the position of an assasser.
DE:
Das ist einfach zu erklรคren: Wรคhrend die Versiegelung stattfand wurde
ein Zeuge benรถtigt, der den Vorgang der Versigelung bezeugen kann; in
diesem Falle WIT3. Bei der Prรผfung des Siegels wurde WIT3 nicht zwingend
benรถtigt, weil ein Zeuge in diesem falle Du(C) bei dem Vorgang anwesend
war. Daher reicht meiner Ansicht nach, dass R1 nur mich(R2) fรผr die
รœberprรผfung herangeholt hat.

EN:
That's simply to explain: While doing the seal a witness was required,
who could attest the process of sealing took place - in this case done
by WIT3. When checking the seal WIT3 wasn't required, because a witness of
the process was present - which is you(C). That's why IMO it was
sufficient for R1 to only call for me(R2) to verify the seal.
>
> > - What are necessary precautions (recommended and required ones) to be
> > taken by the assurer for such a CAP form?
>
> And: Whz is it ok for another community member to move them to a place
> as unsafe as the old one?

A: more questions to C, R1, R2

Date: Sat, 23 Nov 2013 17:59:44 +0100

Dear C, R1, R2,

thank you all for your statements.

However, as I hinted in my last mail, there are some more questions I
have to ask to understand what happened back then.

While answering those questions, please keep in mind that all of you are
giving CARS when answering. Additionally everybody else giving
statements in an arbitration case (or at least this one) is giving CARS.
You (and they) are giving those CARS about what you/they remember as
best es possible. However the human brain may fail in some points. It's
a known fact that people will give different statements over the same
situation even while trying to answer correctly. And thats probably even
more the case for situation happening about a year ago. That's why
people are doing notes.

So please think twice before giving a CARS that someone else is lying
whith their CARS.

My questions to you are:
@ the respondents:
- Did you know who the owner of the clipboard was when confiscating it?
- Did you assume that the owner of the clipboard was well asleep at that
time?
- Did you try to inform anybody but WIT3 about your confiscation? (Like a
note at the booth)
- When did you arrive at the congress location at the second day?
- Did you visit the CAcert booth right away so you could try to give the
CAPs back or inform someone about the issue so that you could be
contacted yourself?
- Did you try to contact the claimant about the confiscation? If not,
why not?
- A laptop is a quite valuable thing. At least the claimant left his at
the booth. So it could be argued that people thought about that booth to
be a safe place. Why do you think that is not the case? And if you don't
think it was a safe place, did you leave the laptop at the booth?
- Why did you choose the engel area for storing the CAPs instead of f.e.
taking it with you to the hostel?
- Under what authority do you think you acted while confiscating the CAPs?
- Did you mention that authority to the claimant?
- Did you mention any other authority of yours to the claimant during
the confrontation?

@ the claimant:
- What was the last time you had hold on the CAPs before the confiscation?
- Where you on the location at the time of the confiscation and should
the respondents have known about that?
- When did you intend to get to them next?
- When did you actually arrive at the booth? / When did you discover the
CAPs missing?
- What authorities / positions did the respeondents mention to you
during your confrontation?

@ all of you:
In what context was the posibility of arbitration mentioned?

C: answers additional questions

Date: Sat, 23 Nov 2013 23:29:54 +0100

Hi,

> - What was the last time you had hold on the CAPs before the confiscation?

That was at night, at approx. 23:00 CET.

> - Where you on the location at the time of the confiscation and should
> the respondents have known about that?

I was not at the location. I had left together with WIT2 and
WIT1 for late dinner.

However, the following was the case and well-known to all parties:

 1. I was carrying my mobile, and it was operational
 2. At least R2 had my number recorded
 3. I had my Asterisk PBX hooked up to the event phone system and
    had configured it to route site-local calls to my mobile,
    and there was enough proof throughout the night that this
    connection worked
 4. Both respondents called me at least once during the day,
    so I think they will have known the number for that as well;
    besides, the number was recorded in the public event phonebook,
    in the CAcert event attendees list and on my CAcert Wiki page.

I conclude that there were more than enough ways to contact me.

> - When did you intend to get to them next?

Before noon on the next day.

> - When did you actually arrive at the booth? / When did you discover the
> CAPs missing?

I cannot recall exact times, but we arrived at the event location around
noon. I think I went to the booth first, and when I approached it,
R2 and R1 left instead of informing me of the raid. Wehn I
discovered the CAP forms missing shortly after, I tried for around an
hour to get hold of one of them.

> - What authorities / positions did the respeondents mention to you
> during your confrontation?

R1 mentioned his role as event organizer, R2
mentioned his role as arbitrator.

> In what context was the posibility of arbitration mentioned?

When R1 refused to hand my stuff out to me, I threatened to bring the
case to arbitration. I do not recall what R1 and R2, after he
arrived, had to say about that, but I have no doubt that what was
reported is correct.

A: questions WIT3

Date: Sat, 23 Nov 2013 23:37:48 +0100

Dear WIT3,

I'm the arbitrator of the case a20121228.1[1], CM is the
Case Manager.

You were named as possible witness/actor of one incident addressed by
this case. To clarify what happend, I have to ask you some questions. I
happen to know, that you did accept CCA and doing so DRP.

The incident happend during the night between 2012-12-27 and 2012-12-28
at the 29c3. As far as I know, you were called to the CAcert booth by
R1 and R2 because of some CAP-forms they found there.

Please describe the incident evolving by that call.

If possible please include the following points in your statement:
- Do you think, R1 and R2 knew whom the clipboard and the CAPs
belonged to?
- What authorities (of any of you) were mentioned for your actions?
- What was your assumption about the authorities R1 and R2 did
act on?
- What reasons were given for the actions?
- Do you have any idea what time it was?
- Was anybody informed about the incident?

At 2012-12-28 the CAPs were returned to their owner/assurer.
- Do you know anything about what happend then?

If you have any other input that may help to solve this case, please be
so kind and help me there.

[1] https://wiki.cacert.org/Arbitrations/a20121228.1

R2: answers additional questions

Date: Mon, 25 Nov 2013 02:09:07 +0100

Dear Eva, dear others


On 11/23/2013 05:59 PM, Eva wrote:
> Dear C, R1, R2,
>
> thank you all for your statements.
>
> However, as I hinted in my last mail, there are some more questions I
> have to ask to understand what happened back then.
>
> While answering those questions, please keep in mind that all of you are
> giving CARS when answering. Additionally everybody else giving
> statements in an arbitration case (or at least this one) is giving CARS.
> You (and they) are giving those CARS about what you/they remember as
> best es possible. However the human brain may fail in some points. It's
> a known fact that people will give different statements over the same
> situation even while trying to answer correctly. And thats probably even
> more the case for situation happening about a year ago. That's why
> people are doing notes.
>
> So please think twice before giving a CARS that someone else is lying
> whith their CARS.
>
> My questions to you are:
> @ the respondents:
> - Did you know who the owner of the clipboard was when confiscating it?
AFAIR I assumed the owner of the clipboard to be C due to other things
near by.

> - Did you assume that the owner of the clipboard was well asleep at that
> time?

It was unknown to me what C has been doing at that time.
But it was in the middle of the night and people usually sleep.
Also i preferred to have C present.
> - Did you try to inform anybody but WIT3 about your confiscation? (Like a
> note at the booth)
Unfortunately no such note has been left AFAIR.
> - When did you arrive at the congress location at the second day?
At about noon.
> - Did you visit the CAcert booth right away so you could try to give the
> CAPs back or inform someone about the issue so that you could be
> contacted yourself?
No

> - Did you try to contact the claimant about the confiscation? If not,
> why not?
No, I attended 2 talks

> - A laptop is a quite valuable thing. At least the claimant left his at
> the booth. So it could be argued that people thought about that booth to
> be a safe place. Why do you think that is not the case? And if you don't
> think it was a safe place, did you leave the laptop at the booth?
It's not my department what people do with their stuff.

But assuming filled and signed CAP forms is not simply a personal matter
but also a matter of trust of the assuree and data protection.

> - Why did you choose the engel area for storing the CAPs instead of f.e.
> taking it with you to the hostel?
At the hostel I shared a room with other persons. As I was the one who
sealed these documents I wanted to ensure I have no access to the clipboard.

> - Under what authority do you think you acted while confiscating the CAPs?
As Assurer.

> - Did you mention that authority to the claimant?
Yes.

> - Did you mention any other authority of yours to the claimant during
> the confrontation?
I don't remember the exect content of that conversation as the
conversation was kinda heated.

>
> @ the claimant:
> - What was the last time you had hold on the CAPs before the confiscation?
> - Where you on the location at the time of the confiscation and should
> the respondents have known about that?
> - When did you intend to get to them next?
> - When did you actually arrive at the booth? / When did you discover the
> CAPs missing?
> - What authorities / positions did the respeondents mention to you
> during your confrontation?
>
> @ all of you:
> In what context was the posibility of arbitration mentioned?
>
when returning the clipboard I mentioned to C I am not amused about
this and I didn't intent to file a dispute against C in this case.
After this I did't want to follow up on this.

R1: answers additional questions

Date: Mon, 25 Nov 2013 09:17:23 +0100

Dear Eva, dear others,

Am 23.11.2013 17:59, schrieb Eva:
> Dear C, R1, R2,
>
> thank you all for your statements.
>
> However, as I hinted in my last mail, there are some more questions I
> have to ask to understand what happened back then.
Go ahead.
> While answering those questions, please keep in mind that all of you are
> giving CARS when answering. Additionally everybody else giving
> statements in an arbitration case (or at least this one) is giving CARS.
> You (and they) are giving those CARS about what you/they remember as
> best es possible. However the human brain may fail in some points. It's
> a known fact that people will give different statements over the same
> situation even while trying to answer correctly. And thats probably even
> more the case for situation happening about a year ago. That's why
> people are doing notes.
>
> So please think twice before giving a CARS that someone else is lying
> whith their CARS.
>
> My questions to you are:
> @ the respondents:
> - Did you know who the owner of the clipboard was when confiscating it?
Upon seeing the clipboard R2 hinted me at I recognized it as belonging
to C due to having it seen previously when I was at the stand earlier
that day.
> - Did you assume that the owner of the clipboard was well asleep at that
> time?
I don't remember exactly if this assumption was made, but the decision
was more leaned towards not unnecessarily calling people late at night
especially as congress is kinda exhausting for all people involed. But
it is likely that if "C might be asleep" was a factor in the decision
process, it would have supported the decision not to call him. Also at
least I favoured to have the matter resolved in person with C when
everybody was well awake again.
> - Did you try to inform anybody but WIT3 about your confiscation? (Like a
> note at the booth)
AFAIR no such information was given out. Also (unfortunately) no note
was left at the booth.
> - When did you arrive at the congress location at the second day?
IIRC I arrived at about noon.
> - Did you visit the CAcert booth right away so you could try to give the
> CAPs back or inform someone about the issue so that you could be
> contacted yourself?
I passed by the CAcert booth on my way to the Engel Area but didn't
notice C at the booth.
> - Did you try to contact the claimant about the confiscation? If not,
> why not?
I first wanted to get on track for the day. Furthermore, due to the way
C usually acts towards me I had little interest in getting my day
ruined right from the start.
> - A laptop is a quite valuable thing. At least the claimant left his at
> the booth. So it could be argued that people thought about that booth to
> be a safe place. Why do you think that is not the case? And if you don't
> think it was a safe place, did you leave the laptop at the booth?
I think you should make a distinction here between what safety level you
think appropriate for your own things (i.e. it is totally fine for me if
you deem your stuff safe enough at a certain place) and the level you
should ensure for things entrusted to you (like private details of an
assuree you were asked to process on behalf of someone else). For my own
stuff the second level is usually much higher than for the first one,
due to the additional responsibility you bear in the second situation.
Thus leaving your own stuff at an unattended booth is your personal
decision; leaving someone else's stuff at an unattended booth might be
at least a bold offense to the people who entrusted you to their
information.

Furthermore: Given that confiscating the clipboard without this act
being noticed was possible it is a grave violation of the duties of an
asurer to protect the CAP forms from unauthorized access by third
parties a laid out in the Assurer Handbook section 1.3.8 paragraph on
storage of the CAP forms.
> - Why did you choose the engel area for storing the CAPs instead of f.e.
> taking it with you to the hostel?
There are mainly two reasons for this decision:
1. While the Engel Area is kinda open it still offers a better
protection against casual walking into it to take away things as there's
always at least a minimum oversight by the Engels preparing their shifts
or relaxing from their previous one. Thus when leaving the clipboard
there I could be sure that noone could get it unnoticed as easy as at
the CAcert booth.

2. When safeguarding the clipboard in my bag R2 and me(R1) made sure R2
didn't know the exact location so R2 couldn't tamper with the seal until
the clipboard was to be returned. Besides the seal of the clipboard
itself (by R2) there were also some shibboleths involved through me to
detect (unauthorized) access by other people. No such unauthorized
access has taken place based on the observation that all shibboleths I
left were unbreached. Hadwe taken the bag with us to the hostel this had
allowed R2 possibly unobserved access to the sealed clipboard which
would have invalidated the sealing/made the sealing pointless.

Thus to make a long story short: The Engel Area was choosen to ensure R2
could not access the CAP forms at night/til return to C and second
because it was deemed a more secure place compared to the open area near
the CAcert booth with completely uncontrolled access.
> - Under what authority do you think you acted while confiscating the CAPs?
Obligations of every assurer according to Assurer Handbook, sections
1.3.8 as well as privacy regulations to avoid unnecessary breach of
private information.

Furthermore as I had responsibility as event organizer I acted to limit
the impact of private information floating around unattended at night at
the stand.
> - Did you mention that authority to the claimant?
Yes. When I tried to explain the reasoning which led to the events
earlier that day/at night time.
> - Did you mention any other authority of yours to the claimant during
> the confrontation?
AFAIR I only further mentioned my status as an assurer besides the
position as event organizer. I'm not aware of any other positions or
authorities of mine which I mentioned.
> @ the claimant:
> - What was the last time you had hold on the CAPs before the confiscation?
> - Where you on the location at the time of the confiscation and should
> the respondents have known about that?
> - When did you intend to get to them next?
> - When did you actually arrive at the booth? / When did you discover the
> CAPs missing?
> - What authorities / positions did the respeondents mention to you
> during your confrontation?
>
> @ all of you:
> In what context was the posibility of arbitration mentioned?
>
When discussing the proceedings at night the possibiliy of arbitration
was mentioned as one aspect that should be avoided in this case as noone
had the desire to make a mountain out of a molehill.

At the confrontation C used arbitration as a threat to R1 and R2.

A: questions to WIT1

Date: Mon, 25 Nov 2013 23:10:46 +0100

Dear WIT1,

I'm the arbitrator of the case a20121228.1[1], CM is the
Case Manager.

You were named as possible witness of one incident addressed by
this case. To clarify what happend, I have to ask you some questions. I
assume, that you did accept CCA and doing so DRP.

The incident happend on 2012-12-28 at the CAcert booth of the 29c3. As
far as I know, R1 and R2 had removed CAP-Formulars
belonging to C from the CAcert booth in the night before.

Please give a CARS about anything you can remember concerning that
issue, especially about the confrontation that took place between those
three, after C learned that R1 and R2 had stored the
documents somewhere else.

If possible, please include the following points in your statement:
- Can you remember what R1 and R2 said about the authorities they
acted on?
- Did they give any reasons for their actions?
- Was arbitration mentioned? By whom? In what context?

If you have any other input that may help to solve this case, please be
so kind and help me there.

[1] https://wiki.cacert.org/Arbitrations/a20121228.

A: questions to WIT2

Date: Mon, 25 Nov 2013 21:34:53 +0100

Dear WIT2,

I'm the arbitrator of the case a20121228.1[1], CM is the
Case Manager.

You were named as possible witness of one incident addressed by
this case. To clarify what happend, I have to ask you some questions. I
assume, that you did accept CCA and doing so DRP.

The incident happend on 2012-12-28 at the CAcert booth of the 29c3. As
far as I know, R1 and R2 had removed CAP-Formulars
belonging to C from the CAcert booth in the night before.

Please give a CARS about anything you can remember concerning that
issue, especially about the confrontation that took place between those
three, after C learned that R1 and R2
had stored the documents somewhere else.

If possible, please include the following points in your statement:
- Can you remember what R1 and R2 said about the
authorities they acted on?
- Did they give any reasons for their actions?
- Was arbitration mentioned? By whom? In what context?

If you have any other input that may help to solve this case, please be
so kind and help me there.

[1] https://wiki.cacert.org/Arbitrations/a20121228.

WIT2: statement

Date: Tue, 03 Dec 2013 20:21:12 +0100

Am 25.11.2013 21:34, schrieb Eva:
> Dear WIT2,
Dear Eva
> I'm the arbitrator of the case a20121228.1[1], CM is the
> Case Manager.
>
> You were named as possible witness of one incident addressed by
> this case. To clarify what happend, I have to ask you some questions. I
> assume, that you did accept CCA and doing so DRP.
>
> The incident happend on 2012-12-28 at the CAcert booth of the 29c3. As
> far as I know, R1 and R2 had removed CAP-Formulars
> belonging to C from the CAcert booth in the night before.
>
> Please give a CARS about anything you can remember concerning that
> issue, especially about the confrontation that took place between those
> three, after C learned that R1 and R2
> had stored the documents somewhere else.
>
> If possible, please include the following points in your statement:
> - Can you remember what R1 and R2 said about the
> authorities they acted on?
> - Did they give any reasons for their actions?
> - Was arbitration mentioned? By whom? In what context?
It's quite a long time ago, so I don't remember exactly what happened.
I know that C stored the CAP-Forms inside a binder with 
some other private stuff at the CAcert booth.
One morning we arrived the CAcert booth, the CAP-Forms belonging to 
C were gone.
Later, after C find out, that R2 and R1 removed the CAPforms, they (R2 and R1) came 
to the CAcert booth.
Then the three a had a discussion about, where to store the CAP-Forms 
during a Congress.
R1 and R2 argued, that C stored the Forms at an unsafe 
location. And that was the reason for them to take away the CAP-Formulars.
And as far as I know R1 and R2 didn't mentioned any authorities 
they where acting on.
But I do not remember whether someone said something about arbitration.

Hope i could help in this case.

WIT1: statement

Date: Tue, 10 Dec 2013 14:45:27 +0100

I'm sorry.

The last weeks have been particulary stressful for me. Let me provide a
CARS right here in this digitally signed email. If you have further
questions, feel free to email me. Please excuse that I am not able to
make a CARS in the Wiki as I do not know my credentials for the Wiki.

--- Begin CARS ---

During the 29th Chaos Communication Congress in Hamburg, Germany members
of CaCert organized an assembly [1] for CaCert. This assembly consisted
of R2, R1, C, me and other people not
relevant to this CARS.

C kept CAP forms assured by him in a blue folder that was
placed on the assembly's table. It was not known to me what the contents
of this folders where until the undermentioned events occured.

We left for dinner on 2012-12-28 and collectively left our belongings at
the assembly. I do not recall whether the aforementioned folder of
C was left at the assembly or not. I do recall that C and other persons joined us for 

dinner. I do recall that R2 did not join us for dinner.

After we returned to the CCH facilites C noticed that his
aforementioned blue folder was missing. I do not recall the exact
sequence of events that led to the following events which happend a few
minutes after the events in this paragraph.

R2 explained to C that he removed the folder,
well knowing that it contains confidential CAP forms belonging to
C as an educative act to demonstrate the risk of these
forms getting stolen if left unattended.

C objected that R2 was to guard the assembly and
that his act of removing the aforementioned folder was theft. C immediately either filed 

an arbitration or did just announce to
file an arbitration against R2 and apparently other parties.

[1] http://events.ccc.de/congress/2012/wiki/Assemblies

--- End CARS ---

WIT3: statement

Date: Thu, 12 Dec 2013 08:21:37 +0000

hello,

>> You were named as possible witness/actor of one incident addressed by
>> this case. To clarify what happend, I have to ask you some questions. I
>> happen to know, that you did accept CCA and doing so DRP.
>>
>> The incident happend during the night between 2012-12-27 and 2012-12-28
>> at the 29c3. As far as I know, you were called to the CAcert booth by
>> R1 and R2 because of some CAP-forms they found there.
>>
>> Please describe the incident evolving by that call.
>>
>> If possible please include the following points in your statement:
>> - Do you think, R1 and R2 knew whom the clipboard and the CAPs
>> belonged to?
>> - What authorities (of any of you) were mentioned for your actions?
>> - What was your assumption about the authorities R1 and R2 did
>> act on?
>> - What reasons were given for the actions?
>> - Do you have any idea what time it was?
>> - Was anybody informed about the incident?
>>
>> At 2012-12-28 the CAPs were returned to their owner/assurer.
>> - Do you know anything about what happend then?

As far as i remember:

During the night (must have been between 3:00 and 4:00 in the morning)
R1 and/or R2 came from the CAcert table to the "angel area" (a
special Area at 29c3 for volunteers) asking me if i have some minutes at
the CAcert table before i leave to the hostel.

They told me that there is an issue with CAP-forms at the table.

When we arrived at the table, i could see Cs notebook with his
(wellknown) CAcert-clipboard under the notebook. R1 and/or R2 told
me, that there are used CAP-forms on this clipboard.

We had a short talk about how to solve this issue and came to the
conclusion, that it makes sense to seal the Clipboard containing the
CAP-forms to take care of the applicants privacy.

To make sure, that nobody opens the clipboard it was taped and sealed
with martins signature on the crossings of the tape. After this the
sealed clipboard was deposited in R1 luggage in the angel area (=
out of the view of other participants) and we left the congress for the
night.

As far as i know, nobody tried to contact C via phone (it was in
the middle of the night) and nobody sent a mail to CAcert-support (since
it was no issue support could solve).

...

On the next day (i don't know the time) the clipbboard was returned to
C ... as far as i know. I don't know if i was there when R1
and/or R2 gave it back, but i don't think so (it's nearly one year ago!).

A: additional question to WIT3

Date: Thu, 12 Dec 2013 10:41:35 +0100

Dear WIT3,

thank you for your quick response to my last mail. Your detailed
statement is appreciated and quite helpfull.

I'm sorry to bother you again, but there remaines one question, not
touched by your statement, that is of some relevance.

All of you had (and have) multiple authorities in the context of CAcert,
each of you probably aware of all of them.

>>> - What authorities (of any of you) were mentioned for your actions?

Currently I would assume, that none was mentioned. But if you can
remember something else, please tell me about it.

I know that it's a long time ago and I'm sorry that arbitration took so
long to pick up this case, that it's hard to remember all details, now.
We are making an effort to speed up arbitration.

A: additional questions to WIT1

Date: Thu, 12 Dec 2013 14:34:54 +0100

Dear WIT1,

thank you for you quick answer.

> The last weeks have been particulary stressful for me. Let me provide a
> CARS right here in this digitally signed email. If you have further
> questions, feel free to email me. Please excuse that I am not able to
> make a CARS in the Wiki as I do not know my credentials for the Wiki.

That's quite fine. It's intended to be done by mail. The only ones who
should regularly edit the arbitration cases in the wiki are the
respective case managers and arbitrators.

I know that it's a long time ago and that it's hard to remember
everything. But there are some points I would like to ask you again. If
you don't know the answers to the questions, that's fine. If you are not
sure about them, just say so.

Do you have any idea about times? You mentioned "dinner" but that can
mean a lot. (Especially when you are thinking about geeks going to CCC
events.)

Do you remember any involvement of R1?

Do you remember anybody mentioning any roles they acted on?

WIT1: answers questions

Date: Thu, 12 Dec 2013 21:36:13 +0100

Dear Eva,

Let me answer your questions in another CARS right here. I'm sorry for
not being able to answer all your question in sufficient detail. It
might be possible that I remember more details but I do not want to give
details that may be false memories or which I cannot put into a specific
place in the sequence of events that happened.

--- Begin CARS ---

> Do you have any idea about times? You mentioned "dinner" but that can
> mean a lot. (Especially when you are thinking about geeks going to CCC
> events.)

I do not recall when we went to dinner. I recall that the sun had
already set by the time we left the CCH facilities. We went to the
restaurant Schweinske at Hamburg Hauptbahnhof. 

> Do you remember any involvement of R1?

I remember R1 defending the actions of R2. I do not
remember any further involvement of R1 in the case of theft
of the aforementioned folder. This does mean that such an involvement
might not have happened.

> Do you remember anybody mentioning any roles they acted on?

I do recall R2 taking away the aforementioned folder with
CAP-forms to educate C about his duties as an assurer, one
of which is secure and confident archival of received CAP forms.

I do not recall whether or not R2 did take away the folder
while impersonating any of the roles R2 implements as a member
of CACert.

I do recall C filing an arbitration in his function as an
assurer for CACert.

--- End CARS ---

WIT3: ansers question about roles

Date: Mon, 16 Dec 2013 17:50:24 +0000

Hello,

> All of you had (and have) multiple authorities in the context of
> CAcert, each of you probably aware of all of them.
>
>>>> - What authorities (of any of you) were mentioned for your
>>>> actions?
>
> Currently I would assume, that none was mentioned. But if you can
> remember something else, please tell me about it.
>
> I know that it's a long time ago and I'm sorry that arbitration
> took so long to pick up this case, that it's hard to remember all
> details, now. We are making an effort to speed up arbitration.

It MAY have been possible, that we have talked about being
Arbitrator/Board-Member/Software-Assessor/...

... but ...

... to handle the privacy issue of the applicants this did not matter:

As far i remember, nobody argued as
Arbitrator/Board-Member/Software-Assessor/... but in the state of a
CAcert-Community-Member/Assurer to prevent a privacy breach against
CAcert and ensure, that the person keeping the CAP-Forms for the night
cannot modify them (to keep them valid for the Assurer).

A: new questions to WIT3, about contact with C

Date: Tue, 17 Dec 2013 10:00:43 +0100

Dear WIT3,

thank you for the clarification to my last question. I can answer one of
the big questions of the case, now.

But while trying to combine all statements to one big picture,
yesterday, I stumbled about something where you were mentioned as well
that I was not aware of and did not cover with my questions.

C mentioned that after he discovered his CAP-forms missing, at
about noon (2012-12-28), he directly asked you about them.

Can you remember this? Do you remember your answer? Do you know if you
informed R1 or R2 about your contact with C?

Since I already was cleaning up the picture, this should really be my
last questions to you as witness in this case.

WIT3: answers questions: cannot remember this

Date: Mon, 16 Dec 2013 18:33:46 +0000

Hello,

> C mentioned that after he discovered his CAP-forms missing,
> at about noon (2012-12-28), he directly asked you about them. Can
> you remember this? Do you remember your answer? Do you know if you
> informed R1 or R2 about your contact with C?

Really? ;-)

I don't know ...

If he asked me, i answered him, that he should contact R1 and/or
R2 (since R1 had the clipboard with the CAPs and R2 sealed them).

Normally i'm quite busy on the Congress when being on the way between
Angel-Area and the video-equipment in one of the rooms ...

About contacting R1 and/or R2: No, i did not.

... but since it was during the day, C could have used
Eventphone to contact R1 and/or R2 (when i left the hostel in the
morning, both were still sleeping).