Bylaws: revise indemnification language

[ebullient]

For some context, I was thinking about our language after reading this:

https://pyfound.blogspot.com/2024/07/notice-of-python-software-foundation.html

We were already reasonably constrained, but it seemed like constraining required/mandatory indemnification to the council/directors and officers at first makes the most sense. We can then allow the CFC to extend that indemnification to cover others (employees or committee members) when appropriate without requiring revisions to bylaws.

The revised text also clarifies that advance payments for indemnifications must be made in writing and include an acknowledgement to repay those funds if necessary

The language brings in more legal jargon, but I've included TIPs to try and keep things readable.

voting group: @commonhaus/cf-egc

Do one of the following:

• Approve the PR or react with 👍 (:+1:) if it looks good to you
• Review with Comments or react with 👀 (:eyes:) if you're "ok" with it (it may not be your favorite)
• If you think it needs discussion or revision
  • Create a review, add your comments and require changes
  • Use the +- button to make a suggestion (instead of just adding a comment).

[haus-rules-bot]

This vote has been closed by ebullient:

• We will raise another PR if Gavin has additional suggestions after consulting with SFC
• After discussion with @jkschneider, we can/should proceed on some items w/o waiting for @timtebeek

---

🗳️12 of 13 members of @commonhaus/cf-egc have voted (reaction or review).

Reaction	Total	Team	Voting members
revise	1	1	gavinking
approve	7	7	aalmiray, cealsair, cowtowncoder, evanchooly, henri-tremblay, kenfinnigan, velo
ok	4	4	dandreadis, ebullient, marc0der, maxandersen

The following votes were not counted (duplicates):
henri-tremblay(👀), maxandersen(👀)

[gavinking]

At least naively, this seems insufficient when it comes to possible patent litigation.

[gavinking]

There's also quite a large asymmetry here: CF requires that everyone abides by all its various policies.

But when it comes to indemnification, only certain special people are presumed indemnified.

[gavinking]

How about: every single person who is subject to the requirement to comply with CF policies is a priori assumed indemnified by the foundation when carrying out foundation-related activities according to those policies?

[ebullient]

"Every person that has to abide by the policies" or even "Every member of the foundation" is too broad of a group. Some other groups have recently realized they were also over-broad, which is what made me think of this: https://pyfound.blogspot.com/2024/07/notice-of-python-software-foundation.html

We're trying to find a balance here. The Foundation must indemnify members of the council (who are the most responsible for ensuring the organization runs properly). This language does allow us to extend that indemnification to people (committee members, staff, etc) who are acting on behalf of the foundation.

We can not be required, by the bylaws, to indemnify everyone.

This section of the bylaws is also mostly about indemnification related to the operation of the organization itself.

For patent issues, I would pursue a different route entirely (and would add that to the IP Policy).

[gavinking]

I would pursue a different route entirely (and would add that to the IP Policy).

Well OK but this has to be dealt with somewhere and currently it's not.

If a community member gets sued by a patent troll for their contribution to a CF project, I don't think it's unreasonable to expect the foundation to step up and help defend them.

[ebullient]

I think that is an unreasonable expectation, actually.

We can not promise to (or be required to) indemnify every contributor to any project from action by patent trolls. That can put the foundation (as a whole) at risk.

[gavinking]

Well I'm struggling to see how that's not a real problem.

If Red Hat donates Quarkus to CF, then suddenly Red Hat employees become potentially unprotected in patent litigation? (Previously they would have been protected due to their role as RH employees.)

Tell me what's wrong with my reasoning here.

[gavinking]

I mean: I suppose they're still protected by RH if their contributions are considered a part of their work at RH. Not sure how any of this works.

[ebullient]

While IANAL, I believe they would still be protected due to their role as RH employees (as you stated).

I'll be a little cynical here, too. Part of the DCO/CLA is keeping the blame on the committer (cribbing from wikipedia here because I'm lazy):

a DCO is an affirmation that a certain person confirms that it is (s)he who holds legal liability for the act of sending of the code, that makes it easier to shift liability to the sender of the code in the case of any legal litigation, which serves as a deterrent of sending any code that can cause legal issues.

If the foundation indemnifies the committer, that deterrent is gone.

As a more positive action, I'm thinking that Commonhaus should join the Open Invention Network, and gain some protection that way.

• https://openinventionnetwork.com/
• https://www.zdnet.com/article/open-invention-network-comes-to-gnomes-aid-in-patent-troll-fight/

[ebullient]

vote::result

• We will raise another PR if Gavin has additional suggestions after consulting with SFC
• After discussion with @jkschneider, we can/should proceed on some items w/o waiting for @timtebeek