Dear NGSC EC, NPOC EC, NCSG and NPOC members, This is a strange email. One it didn't occur to me I was going to write and yet here we are. In short, effective immediately I'll cease to provide support to NPOC and NCSG beyond my natural attributions as both an organizational and individual member. This is the TLDR version. For those interested, the explanations are below to the best of my abilities. For handovers, see below. *The circumstances.* In my account of the situation I will avoid to name people directly. Although everyone pretty much knows who is who in these stories. *A) NPOC's channels' (and others) credentials (Vaultwarden)* As part of my efforts to provide NPOC with an IT infrastructure at par with current needs, one of the main tasks was to secure all credentials used by NPOC EC and establish an effective way to do handovers between leadership changes. A Vaultwarden instance was created and all credentials secured in it. NPOC had now a credentials vault that is fully self-hosted, with unique and complex passwords for all platforms as well as MFA enabled when available. It also had a proper credentials structure that allowed full handovers in under 10 minutes. Ever since Istanbul I tried several times to hand over these. The procedure needs to be performed ONCE yet in the correct sequence. Just last week I was stood up not once but twice for calls I had organized to do the handover. After the last attempt, I requested advise to how to proceed with this. It's been 4 days and I haven't heard back. This is on top of several attempts during Istanbul and some more after it (one did materialize, which is where an SMTP problem was detected). I have also invited, several times, the other reps involved in using this credentials to book me (I gave a personal booking link) to explain how to use Vaultwarden (plus all the other platforms described below) and how the structures and templates I created work... to no avail. No one has booked me to this date despite having made myself largely available. But time for attacks and defamation wasn't in short supply, as I saw recently. The important thing to me is that this is already going on to close to 2 months and the handover is not yet done. Yes, there were problems with the instance (SMTP was buggy and the solution, after looking into it for hours, was to update the instance version) and yet these could have been solved either in Istanbul or soon after should the people involved in the handover had taken any interest on this. I also understand that everyone has work outside of NPOC, that we are all volunteers, etc... The situation just reached an untenable point in which I am done to be blamed for this not being done already. If everyone is busy, so am I. Moreover, all the efforts done in consolidating and securing the credentials have gone to waste as NPOC EC members have unilaterally decided to reset some of the passwords. I cannot provide any reassurances as to the quality and safety of these new passwords so I won't be accepting any responsibility for anything happening to those accounts. *B) The NPOC seat on the NCSG EC.* A few months back, and to my surprise, I was offered to fill one of the seats for NPOC at the NCSG EC. I didn't feel particularly prepared yet I was assured my only attributions would be to review membership submissions. It turned out that this was not accurate, as I discovered later on. Personally, I took the request as an opportunity to speed up my understanding and increase my participation in ICANN. To be clear, I have nothing against the people who have recently been appointed for the NPOC seats @ NCSG EC. I have however reservations as to how all these processes are managed as I learned about the new positions only because of a semi-formal announcement on a mailing list. At the time of writing this email I have not yet being told by NPOC leadership this change of situation, which has implications in my schedule and the work I was undertaking for NCSG. I was kept in the dark as to why the person before me was removed and I was put in his stead. I have been kept in the dark as to the results of the current "elections"(?). If I was approached personally to help with the "vacancy", I would expect to be approached personally to be told "You are out" (which I am fine with!). All in all, I find this waltz to be unbecoming of proper leadership. This is not what I expect from the NPOC EC at large. *C) Leadership* Since I joined NPOC, all I have observed (and witnessed) are petty attitudes from certain members, certainly fueled by personal interests more than working for the community. I have attempted to follow the established ranks and support the elected reps because that's what we are suppose to do as elected chairs. This has obviously proven to be a sterile attempt. The frictions, veiled accusations, political games, power plays and other distasteful attitudes that I have witnessed are not the result of natural clashes between people with different opinions. They are unnecessary and only make active participation in NPOC a 5 stars challenge. We wonder why we don't have "fresh blood"? *D) IT infrastructure & services for NPOC* I have purchased platforms for NPOC (some with my own money), I had created the beginning of an IT infrastructure that would have allowed the constituency to have a respectable degree of security and functionality moving forward. I had designed a methodology (and started to document it) to help automate tasks and streamline operations (less effort) to produce information for our constituency members (which, in turn, I was hoping would spark new participation). This had been under a mix of personal initiative (that's on me) and requests from the NPOC EC. My efforts have been met with lack of interest (by the same people who green lighted the approach) and sheer veiled accusations of having some hidden agenda by some. There is no reason for me to attempt helping on this area moving forward, especially not having observed the support that was to be expected by members of the NPOC EC. The mentality on IT infrastructure is backwards and I don't have any interest on fighting it. *E) Other frustrations* During one of the NPOC EC meetings, I proposed to structure our reporting, to create templates for our participation in sessions. This was intended to enable a flow of information for proper Comms (SocMed, Publications, Readouts). It was also intended to produce some transparency about what is being done and followed by NPOC. To my disappointment, the idea was received with a mix of disinterest and sheer, blunt opposition. I was taken aback by how adamantly some EC members were unhappy with something that should be a net positive for the whole constituency. My reading is that certain members are not OK with being accountable to the work that is expected/declared to be done. In general, NPOC is lacking direction and spends way too much time and energy handling infighting and otherwise petty attitudes. We have little resources and we waste them on feuds. Much needs to change if NPOC expects to have a role in ICANN. *Handover Tasks* *- Vaultwarden* Info@ remains the Owner. I have removed my personal account as Admin. The NPOC EC is Admin. I will send the Owner credentials to the NPOC EC Chair via separate channels. From that point on, having removed myself from the Admins, I will not perform administration tasks on the instance. The Vaultwarden instance will remain available for as long as the current VPS host keeps it alive. @NPOC EC: A) If NPOC EC wants to make use of it, do proceed. B) If decision is made to not use this instance, I'll appreciate being told and I'll destroy it (saving some organization credits in the process). In the scenario where NPOC EC decides to not use the Vault, two dumps will be performed: - Full dump of credentials >> NPOC EC Chair - Partial dump of credentials for SocMed >> NPOC Outreach Chair The dumps will be communicated via separate channels to ensure basic security. Note that all MFA settings will have to be disabled in all applicable accounts. Whomever handles these accounts later should reactivate MFA as they take over them. 30 natural days should be sufficient to let me know. *- VBout* This SocMed scheduled was donated long ago to NPOC and has been used by me when I was Comms Chair. @NPOC EC: A) Should NPOC EC wish to use the platform, the necessary credentials are in the Vault. Plenty of documentation to learn to use the platform is available. B) Should NPOC EC decide to not use the platform, please let me know and I'll delete the sub-account. 30 natural days should be sufficient to let me know. *- ElkQR* This QR generator platform was acquired for NPOC. The Admin account is under Info@. Should NPOC EC wish to use the platform, the necessary credentials are in the Vault. It's paid for (it's an LTD) and I will not seek refund. *- Cloudflare* This platform was adopted to manage NPOC's DNS needs under approval of NPOC EC. The Admin account is under Info@. Whomever will take care of handling the DNS can be given the corresponding permissions by whomever will be managing IT for NPOC. *- Canva* This platform was configured to have a templated collaterals for SocMed and other comms. I managed to obtain the NGO license by using my US 501(c)(3) so that NPOC could have all the tools available. The platform is accessible through Info@ @NPOC EC: A) Should the NPOC EC decide to use the platform, they will find all the templates I created for the posts. B) Should NPOC EC decide to not use it, let me know and I'll unlink the account. 30 natural days should be sufficient for this. *- Sleekplan* This platform was intended to create a participation environment for NPOC members to vote and express their opinions on priorities for NPOC moving forward. The platform is registered under Info@. I managed to get it for the constituency for free. *- Google Account (NPOC.ICANN@Gmail.com - G Drive, Forms, etc.)* As NPOC needed some basic storage and a generic Gmail account to access/offer services, a Gmail account was created (and fought with Google - long story). The secondary/recovery email is Info@. Credentials are on the Vault. The GDrive has an initial folder structure with all the materials I managed to collect in while being NPOC Comms Chair. *- NCSG CRM* I have proceeded to Delete my account and from this point onward I have no access to the NCSG CRM. [image: image.png] @Andrea Glandon <andrea.glandon@icann.org> I am not sure if there's anything else that needs to be done. Please proceed, if ever. Thx! *- ICANN NPOC Pages* There are a number of NPOC pages @ Community that I should be removed from having Edit permissions. @Andrea Glandon <andrea.glandon@icann.org> could you look into this? Thx. Note to NPOC EC: This is why having a structured credentials access is crucial. But I am giving up on explaining this. *- NPOC Info@ email/list* I still receive the emails sent to this address. @Andrea Glandon <andrea.glandon@icann.org> could you please remove me from it? Thx. *- NPOC Github* This was indented to build a backend for NPOC, in terms of task management and documentation. This account is linked to Info@ You can do with it what you will. *- Other minor platforms* Credentials can be found on the Vault. NPOC EC is free to do as it wishes with them. *- NCSG Operating Procedures* @Rafik Dammak <rafik.dammak@gmail.com> It is my understanding that I have no part to play in this since I am not part of the NCSG EC anymore. The document remains available, nothing changes on that end. Feel free to disregard the comments I left on it. *- IT for NCSG* I owe a gap analysis to the NCSG EC. @Rafik Dammak <rafik.dammak@gmail.com> : Do let me know if you still want this or not. Please note while I'll do the analysis, I won't be helping with implementation at this stage as I do not wish to repeat the same mistakes as with NPOC. I believe this is all. I will not entertain comments or replies to this email except those related to decisions yet to be made (and that are quite explicit in the text). Regards, Jean F. Queralt Founder & CEO - The IO Foundation <https://TheIOFoundation.org> Book a meeting <https://TIOF.Click/BookJFQ> (30 minutes) -- **DISCLAIMER** *The content of this message, which may contain personal or sensitive data, is confidential. If you have received it by mistake, please inform the sender by replying to the email and then permanently delete the message, including any attachments. It is forbidden to copy, forward or in any way reveal the content of this message to anyone. The integrity and security of this email cannot be guaranteed over the Internet and, therefore, the sender will not be held liable for any damage caused by the message.*
