Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Eben Moglen & SFLC — abusive employer & LGBTQIA+ unfriendly

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2023/10/11/moglen-sflc.html

[ The below is a personal statement that I make on my own behalf. While
my statement’s release coincides with a release of an unrelated statement
on similar topics made
by my
employer, Software Freedom Conservancy
, and
the Free
Software Foundation Europe
, please keep in mind that this statement is
my own, personal opinion — written exclusively by me — and not
necessarily the opinion of either of those organizations. I did not consult
nor coordinate with either organization on this statement. ]

With great trepidation, I have decided to make this public statement
regarding the psychological abuse, including menacing, that I suffered,
perpetrated by Eben Moglen, both while I was employed at his Software
Freedom Law Center (SFLC) from 2005-2010, and in the years after he fired
me. No one revels in having psychological injuries and mistreatment
they’ve suffered paraded to the public. I’ll be frank that if it were not
for Moglen’s use of the USA Trademark Trial and Appeal Board (TTAB) as a
method to perpetrate further abusive behavior, I wouldn’t have written this
post. Furthermore, sadly, Moglen has threatened in recent TTAB filings his
intention to use the proceeding to release personal details about my life
to the public (using the litigation itself as a lever). I have decided to
preemptively make public the facts herein first myself — so that I
can at least control the timing and framing of the information.

This post is long; the issues discussed in it are complicated, nuanced,
and cannot be summed up easily. Nevertheless, I’m realistic that most
people will stop reading soon, so I’ll summarize now as best I can in a few
sentences: I worked initially with, and then for, Eben Moglen for
nearly a decade — during which time he was psychologically abusive and
gaslighted me (under the guise of training and mentoring me). I thought
for many years that he was one of my best friends (— in retrospect, I
believe that he tricked me into believing that he was). As such, I shared
extremely personal details about myself to him — which he has used
both contemporaneously and in years hence to attempt to discredit me with
my colleagues and peers. Recently, Moglen declared his plans to use
current TTAB proceedings to force me to answer questions about my mental
health in
deposition0. Long
ago, I disclosed key personal information to Moglen, I therefore have a
pretty good idea of what his next move will be during that deposition
questioning. Specifically, I believe Moglen was hoping to out me as
omni/bisexual1 as part of my deposition
in this proceeding. As such, I’m outing myself here first (primarily) to
disarm his ability to use what he knows about my sexual orientation against
me. Since that last sentence makes me already out, Moglen will be unable
to use the biggest “secret” that Moglen “has on me”
in his future psychological and legal attacks.

I suspect some folks will stop reading here, but I really urge that you
keep reading this post, and also to read the unrelated statement made by
Conservancy
and FSFE.
The details are important and matter. I am admittedly embarrassed to talk
publicly about how Moglen exacerbated, expanded, and caused new symptoms of
my Post-Traumatic Stress Disorder (PTSD) — which I already suffered
from when I met him. But, I feel it is important to talk about these
issues publicly for many reasons — including that Moglen seeks to
expose these personal facts about me as an attempt to stigmatize what is
actually a positive thing: I seek ongoing treatment for my PTSD (which
Moglen himself, in part, caused) and to simultaneously process and reduce
my (painful and stubborn) internalized shame about my LGBTQIA+
status. (Like many proud LGBTQIA+ folks, I struggle with this because
living in a society unfriendly to LGBTQIA+ folks can lead to difficult
shame issues — this is a well-documented phenomena that LGBTQIA+
folks like myself suffer from
.)

The primary recent catalyst for this situation is as follows: Moglen has
insisted that, as part of the
ongoing trademark
cancellation petition that SFLC filed against my employer, Software Freedom
Conservancy
in
the TTAB,
that Moglen both personally be allowed to be present at, and to
actually take the depositions3 of me and
my colleague, Karen Sandler.

This kind of behavior is typical of how abusers use litigation to
perpetuate their abuse. The USA legal system is designed to give everyone
“their day in Court”. Frankly, many of the rules established
for Court proceedings did not contemplate that the process could be
manipulated by abusers, and it remains an open problem on how to repair the
rules that both preserve the egalitarian nature of our legal system, but
also does not make it easy for abusers to misuse those same rules.
Depositions, in particular, are a key tool in abusers’ arsenals.
Depositions allow Plaintiffs (in the TTAB, BTW, the Plaintiff is called
“the Petitioner”) to gather evidence. Generally speaking, most
Courts have no good default rules to prevent abusers from using these
depositions to get themselves in the room with their victims and harass
those victims further with off-topic haranguing. The only method (which is
quite clunky as a legal tool) to curtail the harassment somewhat is called
a protective order. However, Moglen has been smart enough to use
the very process of the protective order application to further perpetuate
abusive behavior.

To understand all this in context, I ask that you first
read Conservancy’s
public response to the initial filing of the trademark cancellation
proceeding (six years ago)
. In short, SFLC is seeking to
“cancel” the trademark on the name “Software Freedom
Conservancy”. Ostensibly, that’s all this case is (or, rather should
be) about.

The problem is that, upon reading
the docket in
detail
, it’s easily seen that at nearly every step, Moglen has
attempted to use the proceeding as a method to harass and attack me and my
colleague, Karen Sandler — regarding issues wholly unrelated to the
trademarks. The recent arguments have been about our depositions4
mine and Karen’s2.

After some complex legal back-and-forth,
Judge Elgin
ordered that I was legally required to sit for a deposition with and by
Moglen
. This is the point where a catch-22 began for me.

  • Option 0: Sit in a room for 8+ hours with a person who had spent
    years verbally abusing me and let him ask me any question he
    wants
    5
    under penalty of perjury and contempt of Court if I refuse.
  • Option
    1: Give Conservancy’s lawyers permission to talk openly, in public
    documents, about the details of the abuse I suffered from Moglen and the
    psychological harm that it caused me (which is the necessary backup
    document for a protective order motion).

IOW, the only way to
get a protective order that would prevent me from being legally required to
suffer further psychological abuse from Moglen was to publicly talk about
the past abuse 😩. I reluctantly chose Option 1. I encourage you to read
in
full
my first sworn testimony on the issue. That document explains many of the
psychological abusive examples I suffered from Moglen — both as an
employee at SFLC and since
.

Fortunately, that aforementioned sworn testimony was sufficient to
convince Judge Elgin to at least entertain reconsidering her decision that
I have to sit8 for a deposition with Moglen. However, submitting the
official motion then required that I give even more
information about why the deposition with Moglen will be psychologically
harmful. In particular, I had little choice but to add a letter from my
(highly qualified) mental health provider speaking to the psychological
dangers that I would face if deposed by Moglen personally and/or in his
presence. I reluctantly asked my therapist
to provide
such a letter
. It was really tough for me to publicly identify who my
therapist is, but it was, again, my best option out of that catch-22. I
admittedly didn’t anticipate that Moglen might use this knowledge as a
method to further his abuse against me publicly in his response filing.

As can be seen in Moglen’s response
filing, Moglen
directly attacks my therapist’s credentials — claiming she is not
credible nor qualified
. Moglen’s argument is that because my therapist
is a licensed, AASECT-certified sex therapist, she is not qualified to
diagnose PTSD. Of course, Moglen’s argument is without merit: my
therapist’s sex therapy credentials are in addition to her many other
credentials and certifications — all of which is explained on her
website that Moglen admits in his filing he has reviewed.

As I mentioned, at one time, I foolishly and erroneously considered Moglen
a good friend. As such, I told Moglen a lot about my personal life,
including that I was omni/bisexual, and that I was (at the time) closeted. So,
Moglen already knows full well the reason that I would select a therapist
who held among her credentials a certification to give therapy relating to
sexuality. Moglen’s filing is, in my view, a veiled threat to me that he’s
going to disclose publicly what he knows about my sexuality as part of this
proceeding. So, I’ve decided — after much thought — that I
should simply disarm him on this and say it first: I have identified as
bisexual/omnisexual6 since 1993, but I have
never been “out” in my professional community — until
now. Moglen knows full well (because I told him on more than one occasion)
that I struggled with whether or not to come out for decades. Thus, I
chose a therapist who was both qualified to give treatment for PTSD as
well
as for sexual orientation challenges because I’ve lived much of
my life with internalized shame about my sexual orientation. (I was (and
still am, a bit) afraid that it would hurt my career opportunities in the
FOSS community and technology generally if I came out; more on that below.)
I was still working through these issues with my therapist when all these
recent events occurred.

Despite the serious psychological abuse I’ve suffered from Moglen, until
this recent filing, I wouldn’t have imagined that Moglen would attempt to
use the secrecy about my LGBTQIA+ status as a way to further terrorize me.
All I can think to say to Moglen in response is to quote
what Joe Welch
said to Senator Joe McCarthy on 1954-06-09
: “Have you no sense of
decency, sir — at long last? Have you left no sense of
decency?”.

It’s hard to express coherently the difficult realization of the stark
political reality of our world. There are people you might meet (and/or
work for) who, if they have a policy disagreement8 with you later, will use
every single fact about you to their advantage to prevail in that
disagreement. There is truly no reason that Moglen needed to draw
attention to the fact that I see a therapist who specializes (in part) in
issues with sexuality. The fact that he
goes
on to further claim that the mere fact that she has such certification
makes her unqualified
to treat my other mental health illness —
some of which Moglen himself (in part) personally caused — is
unconscionable. I expect that even most of my worst political rivals who
work for proprietary software companies and violate copyleft licenses on a
daily basis would not stoop as low to what Moglen has in this
situation.

At this point, I really have no choice but to come out as
omnisexual7 — even though I
wasn’t really ready to do so. Moglen has insisted now that my therapy has
been brought up in the proceeding,
that he
has a legal right to force me to be evaluated by a therapist of his
choosing
(as if I were a criminal
defendant). Moglen
has also indicated that, during my deposition, he will interrogate me about
my therapy
and my reasons for choosing this particular therapist (see, for
example, footnote 2 on page 11 (PDF-Page 27) of Moglen’s declaration in support of the
motion
). Now, even if the judge grants Conservancy’s motion
to exclude Moglen from my deposition, Moglen will instruct his attorneys to
ask me those questions about my therapy and my sexual orientation —
with the obvious goal of seeking to embarrass me by forcing me to reveal
such things publicly. Like those folks who sat before McCarthy in those
HUAC
hearings, I know
that none of my
secrets will survive
Moglen’s deposition. By outing myself here first,
I am, at least, disarming Moglen from attempting to use my shame about my
sexual orientation against me.

Regarding LGBTQIA+ Acceptance and FOSS

I would like to leave Moglen and his abusive behavior there, and spend the
rest of this post talking about related issues of much greater importance.
First, I want to explain why it was so difficult for me to come out in my
professional community. Being somewhat older than most folks in FOSS
today, I really need to paint the picture of the USA when my career in
technology and FOSS got started. I was in my sophomore year of my Computer
Science undergraduate program when Clinton implemented
the Don’t
ask, Don’t tell (DADT)
policy for military in the USA. Now, as a
pacifist, I had no desire to join the military, but the DADT approach was
widely accepted in all areas of life.
The whole sarcastic “Not that there’s anything wrong with that
…” attitude (made famous contemporaneously to DADT on an
episode of the TV
show, Seinfeld
) made it clear in culture that the world,
including those who ostensibly supported LGBTQIA+ rights, wanted queer
folks to remain, at best, “quiet and proud”, not “loud
and proud”. As a clincher, note that three years after DADT
was put in effect, overwhelming bipartisan support came forward for the
so-called
Defense
of Marriage Act (DOMA)
”. An overwhelming majority of
everyone in Congress and the Presidency (regardless of party affiliation)
was in 1996 anti-LGBTQIA+
. Folks who supported and voted yes for DOMA
include: Earl Blumenauer (still a senator from my current
state), Joe Biden (now POTUS (!)), Barbara Mikulski (a
senator until 2017 from my home state), and Chuck Schumer (still Senate
majority leader today). DADT didn’t end until 2011, and
while SCOTUS
ruled parts of DOMA unconstitutional in 2015
,
Congress didn’t
actually repeal
DOMA until last year
! Hopefully, that gives a
clear sense of what the climate for LGBTQIA+ folks was like in the 1990s,
and why I felt was terrified to be outed — even as the 1990s became
the 2000s.

I also admit that my own shame about my sexual orientation grew as I got
older and began my professional career. I “pass” as straight
— particularly in our heteronormative culture that auto-casts
everyone as cishet until proven otherwise. It was just easier to not bring
it up. Why bother, I thought? It was off-topic (so I felt), and there
were plenty of people around the tech world in the 1990s and early 2000s
who were not particularly LGBTQIA+-friendly, or who feigned that they were
but were still “weird” about it.

I do think tech in general and FOSS in particular are much more
LGBTQIA+-friendly than they once were. However, there has been a huge
anti-LGBTQIA+ backlash in certain areas of the USA in recent years, so even
as I became more comfortable with the idea of being “out”, I
also felt (and do feel) that the world has recently gotten a lot more
dangerous for LGBTQIA+ folks. Folks like Moglen who wage “total
war” against their political opponents know this, and it is precisely
why they try to cast phrases like bisexual, gay, queer, and “sex
therapist” as salacious.

Also, PTSD has this way of making you believe you’re vulnerable in every
situation. When you’re suffering from the worst of PTSD’s symptoms, you
believe that you can never be safe anywhere — ever again. But,
logically I know that I’m safe being a queer person (at least in the small
FOSS world) — for two big reasons. First, the FOSS community of
today is (in most cases) very welcoming to LGBTQIA+ folks and most of the
cishet folks in FOSS identify as LGBTQIA+ allies. Second, I sheepishly
admit that as I’ve reached my 0x32’nd year of life this year, I have a 20+
year credentialed career that has left me in a position of authority and
privilege as a FOSS leader. I gain inherent safety from my position of
power in the community to just be who I am.

While this is absolutely not the manner and time in which I wanted to come
out, I’ll try to make some proverbial lemonade out of the lemons. By now
being out as LGBTQIA+ and already being a FOSS leader, I’d like to
offer to anyone who is new to FOSS and faces fear and worry about LGBTQIA+
issues in FOSS to contact me if they think I can help. I can’t promise to
write back to everyone, but I will do my very best to try to either help or
route you to someone else in FOSS who might be able to.

Also, I want to state something in direct contrast to Moglen’s claims that
the mere fact that a therapist who is qualified for treating people with
issues related to sexual orientation is ipso facto unqualified to treat any
other mental condition. I want to share publicly how valuable it has been
for me in finding a therapist who “gets it” with regard to
living queer in the world while also suffering from other conditions (such as PTSD).
So many LGBTQIA+ youth are bullied due to their orientation, and sustained
bullying commonly causes PTSD. I think we should all be so lucky to have a
mental health provider, as I do,
that
is extensively qualified to treat the whole person
and not just a
single condition or issue. We should stand against people like Moglen who,
upon seeing that someone’s therapist specializes in helping people with
their sexual orientation, would use that fact as a way to shame both the
individual and the therapist. Doing that is wrong, and people who do that
are failing to create safe spaces for the LGBTQIA+ community.

I am aghast that Moglen is trying to shame me for seeking help from a
mental health provider who could help me overcome my internalized shame
regarding my sexual orientation. I also want people to know that I did not
feel safe as a queer person when I worked for Eben Moglen at SFLC. But I
also know Moglen doesn’t represent what our FOSS community and software
freedom is about. I felt I needed to make this post not only to disarm the
power Moglen held to “out me” before I was ready, but also to
warn others that, in my opinion, Software Freedom Law Center (SFLC) as an
organization that is not a safe space for LGBTQIA+ folks.
Finally, I do know that Moglen is also a tenured professor at Columbia Law
School. I have so often worried about his students — who may, as I
did, erroneously believe they can trust Moglen with private information as
important as their LGBTQIA+ status. I simply felt I couldn’t stay silent
about my experiences in good conscience any longer.


0, 4

A deposition is a form of testimony done during litigation before trial
begins. Each party in a legal dispute can subpoena witnesses. Rules vary
from venue to venue, but typically, a deposition is taken for eight hours,
and opposing attorneys can ask as many questions as they want —
including leading questions.

5In most
depositions, there is a time limit, but the scope of what questions
can be asked are not bounded. Somewhat strangely, one’s own lawyer
is not usually permitted to object on grounds of relevancy to the
case, so the questions can be as off-topic as the opposing counsel
wants.

3, 8 The
opposing attorney who asks the question is said to be “taking
the deposition”. The witness is said to be “sitting for
a deposition”. (IIUC, these are terms of art in
litigation).

1,
6,
7
From 1993-2018, I identified as “bisexual”. That term,
unfortunately, is, in my opinion, not friendly to non-binary people,
since the “bi” part (at least to me, I know others
disagree) assumes binary gender. The more common term used today is
“pansexual”, but, personally I prefer the term
“omnisexual” to “pansexual” for reasons that
are beyond the scope of this particular post. I am, however, not
offended if you use any of the three terms to refer to my sexual
orientation.

2Note, BTW: when
you read the docket, Judge Elgin (about 75% of the time) calls Karen
by the name “Ms. Bradley” (using my first name as if it
were Karen’s surname). It’s a bit confusing, so watch for it while
you’re reading so you don’t get confused.

8
Footnote added 2023-10-12, 19:00 US/Eastern: Since I
posted this about 30 hours ago, I’ve gotten so many statements of
support emailed to me that I can’t possibly respond to them all, but
I’ll try. Meanwhile, a few people have hinted at and/or outright
asked what policy disagreements Moglen actually has with me. I was
reluctant to answer because the point I’m making in this post is
that even if Moglen thought every last thing I’ve ever done
in my career was harmful policy-wise, it still would not
justify
these abusive behaviors. Nevertheless, I admit that
if this post were made by someone else, I’d be curious about what the
policy disagreements were, so I decided to answer the question. I
think that my overarching policy disagreement with Eben Moglen is
with regard to how and when to engage in enforcement of the GPL and
other copyleft licenses through litigation. I think Moglen explains
this policy disagreement best
in his
talk that the Linux Foundation contemporaneously promoted (and
continues to regularly reference)
entitled “Whither (Not Wither) Copyleft”
. In this
talk, Moglen states that I (among others) are “on a jihad for
free software” (his words, direct quote) because we continued
to pursue GPL enforcement through litigation. While I agree that
litigation
should still remain the last resort
, I do think it remains a
necessary step often. Moglen argues that even though litigation was
needed in the past, it should never be used again for copyleft and
GPL enforcement. As Moglen outlines in his talk, he supports the
concept of “spontaneous compliance” — a system
whereby there is no regulatory regime and firms simply chose to
follow the rules of copyleft because it’s so obviously in their own
best interest. I’ve not seen this approach work in practice, which is
why I think we must still sometimes file GPL (and LGPL) lawsuits
even today.
Moglen and I have plenty of other smaller policy disagreements: from
appropriate copyright assignment structures for FOSS, to finer points
of how GPLv3 should have been drafted, to tactics and strategy with
regard to copyleft advocacy, to how non-profits and charities should
be structured for the betterment of FOSS. However, I suspect all
these smaller policy disagreements stem from our fundamental policy
disagreement about GPL enforcement. However, I conclude by (a)
saying again no policy disagreement with anyone justifies
abusive behavior toward that person — not ever
, and
(b) please do note the irony that, in that 2016-11-02 speech,
Moglen took the position that lawsuits should no longer be used to
settle disputes in FOSS, and yet — less than 10 months later
Moglen
sued Conservancy (his former client) in the TTAB
.

Cisco Can’t Stop Using Hard-Coded Passwords

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2023/10/cisco-cant-stop-using-hard-coded-passwords.html

There’s a new Cisco vulnerability in its Emergency Responder product:

This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.

This is not the first time Cisco products have had hard-coded passwords made public. You’d think it would learn.

Коментар по становището на Венецианската комисия за измененията в Конституцията

Post Syndicated from Bozho original https://blog.bozho.net/blog/4145

Прочетох становището на Венецианската комисия за проекта за изменение на Конституцията. И смятам, че е като цяло положително. На практика комисията потвърждава собствените си препоръки от миналото по основните въпроси за съдебната реформа и изразява одобрение за това, че тези препоръки са залегнали в проекта. Има елементи, по които дава предложения за подобрения и настоява някои части да се преосмислят. Излага и критика за недостатъчните мотивии и обществени консултации.

Горният абзац звучи скучно и нюансирано. Не става за заглавие. За сметка на това се появиха заглавия като „шамар за измененията в Конституцията“, „Венецианската комисия установи липса на мотиви“, „Венецианската комисия не подкрепя измененията“, „унищожителна критика“, „не пести критики“ и подобни.

В становището на комисията обаче пише, че „Най-важната част от промените са измененията в глава IV (съдебна власт), като проектът на изменения прави няколко стъпки в правилната посока“, „съставът на ВСС е в съответствие с препоръките на Венецианската комисия“ и др.

Венецианската комисия не гласува проекта на първо четене. Тя не трябва да реши с „да“ или „не“, а трябва да напише мотивирано становище по всяко едно от предложенията, и то по различните негови елементи (напр. одобрява посоката за повече отчетност на прокуратурата, но смята, че само 3-ма действащи прокурори в състава на прокурорския съвет е недостатъчно). И тя именно това прави – експертно и нюансирано.

Има две критики, които някои използват, за да дискредитират целия проект. Едната е за кратките мотиви към законопроекта, а другата е за недостатъчното обществено обсъждане. По мотивите – формално са прави, че писмените мотиви са кратки. В парламентарната процедура, обаче, има т.нар. „становище на вносител“, в която Христо Иванов говори 20 минути, излагайки мотивите за предложените изменения в дълбочина. В този смисъл, писмените мотиви са недостатъчни, но се допълват от становището на вносителя. По хронологични причини, Венецианската комисия не ги е виждала, поради което има тази точка в становището ѝ.

По критиката за общественото обсъждане – в правилника на НС общественото обсъждане се провежда по вече внесени текстове, при първото гласуване във водещата комисия. Преди внасяне на проекта няма такава формална процедура, но темите са били обсъждани многократно в различни формати (политически, експертни и медийни) и не може да се каже, че е нямало достатъчно обществен дебат. Той обаче не е бил структуриран около конкретните предложения.

Именно за да има такъв дебат, Конституцията предвижда един месец между внасяне и разглеждане на първо гласуване. И на база на множеството постъпили становища смятам, че обществено обсъждане е имало – всяка заинтересована страна е дала своето становище и писмено, и устно (и то влезе в доклада на конституционната комисия). И тези становища, заедно с това на Венецианската комисия, ще бъдат отчетени при предложенията между 1-во и 2-ро четене, защото те са именно по детайлите.

Можеше ли да има кръгли маси преди първо гласуване – можеше. Не са формално по процедура, но щеше да е добра добавка към процеса. Можем да подобрим правилника на НС, за да включим предварителна стъпка на обществено обсъждане. Смятам, че това има потенциал да подобри законодателния процес (не само по изменения в Конституцията).

Сега, преди второто първо гласуване през декември, имаме време да обясним още по-добре промените. Не детайлите, защото те са строго специфични, и аз, макар да участвам в процеса, нямам самочувствието да разбирам балансите в съдебната власт.

Но ще комуникираме духа и целите на промените, а именно – независимост на съда, отчетност на прокуратурата и премахване на свръховластеността на главния прокурор. Цели, които Венецианската комисия не само подкрепя, а е препоръчвала дълги години и сега отчита позитивно тяхното включване в проекта за изменения на Конституцията.

Материалът Коментар по становището на Венецианската комисия за измененията в Конституцията е публикуван за пръв път на БЛОГодаря.

Scaling marketing for merchants with targeted and intelligent promos

Post Syndicated from Grab Tech original https://engineering.grab.com/scaling-marketing-for-merchants

Introduction

A promotional campaign is a marketing effort that aims to increase sales, customer engagement, or brand awareness for a product, service, or company. The target is to have more orders and sales by assigning promos to consumers within a given budget during the campaign period.

Figure 1 – Merchant feedback on marketing

From our research, we found that merchants have specific goals for the promos they are willing to offer. They want a simple and cost-effective way to achieve their specific business goals by providing well-designed offers to target the correct customers. From Grab’s perspective, we want to help merchants set up and run campaigns efficiently, and help them achieve their specific business goals.

Problem statement

One of Grab’s platform offerings for merchants is the ability to create promotional campaigns. With the emergence of AI technologies, we found that there are opportunities for us to further optimise the platform. The following are the gaps and opportunities we identified:

  • Globally assigned promos without smart targeting: The earlier method targeted every customer, so everyone could redeem until the promo reached the redemption limits. However, this method did not accurately meet business goals or optimise promo spending. The promotional campaign should intelligently target the best promo for each customer to increase sales and better utilise promo spending.
  • No customised promos for every merchant: To better optimise sales for each merchant, merchants should offer customised promos based on their historical consumer trends, not just a general offer set. For example, for a specific merchant, a 27% discount may be the appropriate offer to uplift revenue and sales based on user bookings. However, merchants do not always have the expertise to decide which offer to select to increase profit.
  • No AI-driven optimisation: Without AI models, it was harder for merchants to assign the right promos at scale to each consumer and optimise their business goals.

As shown in the following figure, AI-driven promotional campaigns are expected to bring higher sales with more promo spend than heuristic ones. Hence, at Grab we looked to introduce an automated, AI-driven tool that helps merchants intelligently target consumers with appropriate promos, while optimising sales and promo spending. That’s where Bullseye comes in.

Figure 2 – Graph showing the sales expectations for AI-driven pomotional campaigns

Solution

Bullseye is an automated, AI-driven promo assignment system that leverages the following capabilities:

  • Automated user segmentation: Enables merchants to target new, churned, and active users or all users.
  • Automatic promo design: Enables a merchant-level promo design framework to customise promos for each merchant or merchant group according to their business goals.
  • Assign each user the optimal promo: Users will receive promos selected from an array of available promos based on the merchant’s business objective.
  • Achieve different Grab and merchant objectives: Examples of objectives are to increase merchant sales and decrease Grab promo spend.
  • Flexibility to optimise for an individual merchant brand or group of merchant brands: For promotional campaigns, targeting and optimisation can be performed for a single or group of merchants (e.g. enabling GrabFood to run cuisine-oriented promo campaigns).

Architecture

Figure 3 – Bullseye architecture

The Bullseye architecture consists of a user interface (UI) and a backend service to handle requests. To use Bullseye, our operations team inputs merchant information into the Bullseye UI. The backend service will then interact with APIs to process the information using the AI model. As we work with a large customer population, data is stored in S3 and the API service triggering Chimera Spark job is used to run the prediction model and generate promo assignments. During the assignment, the Spark job parses the input parameters, pre-validates the input, makes some predictions, and then returns the promo assignment results to the backend service.

Implementation

The key components in Bullseye are shown in the following figure:

Figure 4 – Key components of Bullseye
  • Eater Segments Identifier: Identifies each user as active, churned, or new based on their historical orders from target merchants.
  • Promo Designer: We constructed a promo variation design framework to adaptively design promo variations for each campaign request as shown in the diagram below.
    • Offer Content Candidate Generation: Generates variant settings of promos based on the promo usage history.
    • Campaign Impact Simulator: Predicts business metrics such as revenue, sales, and cost based on the user and merchant profiles and offer features.
    • Optimal Promo Selection: Selects the optimal offer based on the predicted impact and the given campaign objective. The optimal would be based on how you define optimal. For example, if the goal is to maximise merchant sales, the model selects the top candidate which can bring the highest revenue. Finally, with the promo selection, the service returns the promo set to be used in the target campaign.

      Figure 5 – Optimal Promo Selection
  • Customer Response Model: Predicts customer responses such as order value, redemption, and take-up rate if assigning a specific promo. Bullseye captures various user attributes and compares it with an offer’s attributes. Examples of attributes are cuisine type, food spiciness, and discount amount. When there is a high similarity in the attributes, there is a higher probability that the user will take up the offer.

    Figure 6 – Customer Response Model

  • Hyper-parameter Selection: Optimises toward multiple business goals. Tuning of hyper-parameters allows the AI assignment model to learn how to meet success criteria such as cost per merchant sales (cpSales) uplift and sales uplift. The success criteria is the achieving of business goals. For example, the merchant wants the sales uplift after assigning promo, but cpSales uplift cannot be higher than 10%. With tuning, the optimiser can find optimal points to meet business goals and use AI models to search for better settings with high efficiency compared to manual specification. We need to constantly tune and iterate models and hyper-parameters to adapt to ever-evolving business goals and the local landscape.

    As shown in the image below, AI assignments without hyper-parameter tuning (HPT) leads to a high cpSales uplift but low sales uplift (red dot). So the hyper-parameters would help to fine-tune the assignment result to be in the optimal space such as the blue dot, which may have lower sales than the red dot but meet the success criteria.

    Figure 7 – Graph showing the impact of using AI assignments with HPT

Impact

We started using Bullseye in 2021. From its use we found that:

  • Hyper-parameters tuning and auto promo design can increase sales and reduce promo spend for food campaigns.
  • Promo Designer optimises budget utilisation and increases the number of promo redemptions for food campaigns.
  • The Customer Response Model reduced promo spending for Mart promotional campaigns.

Conclusion

We have seen positive results with the implementation of Bullseye such as reduced promo spending and maximised budget spending returns. In our efforts to serve our merchants better and help them achieve their business goals, we will continue to improve Bullseye. In the next phase, we plan to implement a more intelligent service, enabling reinforcement learning, and online assignment. We also aim to scale AI adoption by onboarding regional promotional campaigns as much as possible.

Special thanks to William Wu, Rui Tan, Rahadyan Pramudita, Krishna Murthy, and Jiesin Chia for making this project a success.

Join us

Grab is the leading superapp platform in Southeast Asia, providing everyday services that matter to consumers. More than just a ride-hailing and food delivery app, Grab offers a wide range of on-demand services in the region, including mobility, food, package and grocery delivery services, mobile payments, and financial services across 428 cities in eight countries.

Powered by technology and driven by heart, our mission is to drive Southeast Asia forward by creating economic empowerment for everyone. If this mission speaks to you, join our team today!

Patch Tuesday – October 2023

Post Syndicated from Adam Barnett original https://blog.rapid7.com/2023/10/10/patch-tuesday-october-2023/

Patch Tuesday - October 2023

Microsoft is addressing 105 vulnerabilities this October Patch Tuesday, including three zero-day vulnerabilities, as well as 12 critical remote code execution (RCE) vulnerabilities, and one republished third-party vulnerability.

WordPad: zero-day NTLM hash disclosure

Another Patch Tuesday, another zero-day vulnerability offering NTLM hash disclosure, this time in WordPad. The advisory for CVE-2023-36563 describes two possible attack vectors: 1) enticing the user to open a specially crafted malicious file delivered via email, IM, or some other means, or 2) by causing a custom application to run. The advisory doesn’t give much more detail, but the attacker would either need existing access to the system, or some means of exfiltrating the NTLM hash. It may or may not be a coincidence that Microsoft announced last month that WordPad is no longer being updated, and will be removed in a future version of Windows, although no specific timeline has yet been given. Unsurprisingly, Microsoft recommends Word as a replacement for WordPad.

Skype for Business server: zero-day info disclosure

Defenders responsible for a Skype for Business server should take note of an exploited-in-the-wild information disclosure vulnerability for which public exploit code exists. Successful exploitation of CVE-2023-41763 via a specially crafted network call could result in the disclosure of IP addresses and/or port numbers. Although Microsoft does not specify what the scope of the disclosure might be, it will presumably be limited to whatever the Skype for Business server can see; as always, appropriate network segmentation will pay defense-in-depth dividends.

ASP.NET Kestrel web server: zero-day denial of service

Rounding out this month’s trio of exploited-in-the-wild vulnerabilities, and perhaps of less concern: the cross-platform Kestrel web server for ASP.NET Core receives a fix for CVE-2023-44487, a denial of service vulnerability. In the advisory, Microsoft provides essentially no information about attack vector beyond the fact that the vulnerability is specific to HTTP/2 , but does suggest two potential workarounds:

  1. Disabling the HTTP/2 protocol via a Windows Registry modification; and/or
  2. Restricting protocols offered each Kestrel endpoint to exclude HTTP/2.

Microsoft advises timely patching regardless of whether or not one or more workarounds are applied.

N.B. In the advisory, a hyperlink attached to the word “workarounds” does not resolve to anything specific, and Kestrel is misspelled as “Kestral” more than once, although these issues will likely be resolved soon.

Layer 2 Tunneling Protocol: lots of critical RCEs

Twelve critical RCE vulnerabilities seems like a lot, and it is. Fully three-quarters of these are in the same Windows component — the Layer 2 Tunneling Protocol — which has already received fixes for a significant number of critical RCEs in recent months. Exploitation of each of the Layer 2 Tunneling Protocol critical RCEs this month — CVE-2023-41765 CVE-2023-41767 CVE-2023-41768 CVE-2023-41769 CVE-2023-41770 CVE-2023-41771 CVE-2023-41773 CVE-2023-41774 and CVE-2023-38166 — is via a specially crafted protocol message to a Routing and Remote Access Service (RRAS) server.

If there is a silver lining here, it’s that the acknowledgements for almost all of these vulnerabilities cite Microsoft’s Network Security and Containers (NSC) team; a reasonable inference is that Microsoft is directing significant resources towards security research and patching in this area. Since CVEs are typically assigned sequentially, and there are gaps in the sequence, another reasonable inference here is that other similar as-yet-unpublished vulnerabilities have probably been identified and reported to MSRC.

Windows MSMQ: critical RCEs

CVE-2023-35349 describes an RCE vulnerability in the Message Queueing Service. Microsoft does not describe the attack vector, but other similar vulnerabilities require that the attacker send specially crafted malicious MSMQ packet to a MSMQ server. One mitigating factor: the Microsoft Message Queueing Service must be enabled and listening on port 1801 for an asset to be vulnerable, and the Message Queueing Service is not installed by default. As Rapid7 has noted previously, however, a number of applications – including Microsoft Exchange – may quietly introduce MSMQ as part of their own installation routine.

Another MSMQ RCE vulnerability also receives a patch this month: CVE-2023-36697 has a lower CVSS score than its sibling, both because valid domain credentials are required, and because exploitation requires that a user on the target machine connects to a malicious server. Alternatively, Microsoft suggests that an attacker could compromise a legitimate MSMQ server host and make it run as a malicious server to exploit this vulnerability, although it’s not immediately clear how the attacker could do that without already having significant control over the MSMQ host.

Microsoft vTPM: container escape

The final constituent of this month’s dozen patched critical RCE vulnerabilities is rather more exotic: CVE-2023-36718 describes a vulnerability in the Microsoft Virtual Trusted Platform Module (vTPM), which is a TPM 2.0-compliant virtualized version of a hardware TPM offered as a feature of Azure confidential VMs. Successful exploitation could lead to a container escape. The attacker would first need to access the vulnerable VM, and the advisory notes that exploitation is possible when authenticated as a guest mode user. On the bright side, Microsoft evaluates attack complexity as High, since ​​successful exploitation of this vulnerability would rely upon complex memory shaping techniques to attempt an attack.

Exchange (as is tradition): RCE

Exchange administrators should note the existence of CVE-2023-36778, a same-network RCE vulnerability in all current versions of Exchange Server. Successful exploitation requires that the attacker be on the same network as the Exchange Server host, and use valid credentials for an Exchange user in a PowerShell remoting session. By default, PowerShell Remoting only allows connections from members of the Administrators group, and the relevant Windows Firewall rule for connections via public networks rejects connections from outside the same subnet. Defenders may wish to review these rules to ensure that they have not been loosened beyond the default.

Office: LPE

Microsoft Office receives a patch for CVE-2023-36569, a local privilege escalation (LPE) vulnerability. Successful exploitation could lead to SYSTEM privileges, but Microsoft states that the Preview Pane is not a vector. The advisory doesn’t provide much more information; patches are available for Office 2019, 2021, and Apps for Enterprise. Office 2016 is not listed, which might signify that it isn’t vulnerable, or could mean that patches will be provided later.

End of the line: 2012 edition

Today is the final Patch Tuesday for Windows Server 2012, and Windows Server 2012 R2. The only way to receive security updates for these versions of Windows from now on is to subscribe to Microsoft’s last-resort Extended Security Update (ESU) program. Windows 11 21H2 Home, Pro, Pro Education, Pro for Workstations, and SE also move past the end of support. No ESU program is available for Windows 11 client OS, so Windows 11 21H2 assets are insecure-by-default from now on. In all cases, both Microsoft and Rapid7 recommend upgrading to a newer version of Windows as soon as possible.

Summary Charts

Patch Tuesday - October 2023
That’s a long line of Message Queueing vulns.
Patch Tuesday - October 2023
Denial of Service up one place to third. RCE holds the top spot as usual.
Patch Tuesday - October 2023
As usual, no Low or Moderate criticality vulns. It’s not that they don’t exist or get reported, but like all vendors remediating security issues, Microsoft necessarily focuses on those with the highest severity.
Patch Tuesday - October 2023
A relatively long list of components this month, and lots of RCE.

Summary Table

Azure vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36415 Azure Identity SDK Remote Code Execution Vulnerability No No 8.8
CVE-2023-36414 Azure Identity SDK Remote Code Execution Vulnerability No No 8.8
CVE-2023-36419 Azure HDInsight Apache Oozie Workflow Scheduler Elevation of Privilege Vulnerability No No 8.8
CVE-2023-36418 Azure RTOS GUIX Studio Remote Code Execution Vulnerability No No 7.8
CVE-2023-36737 Azure Network Watcher VM Agent Elevation of Privilege Vulnerability No No 7.8

Azure Developer Tools vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36561 Azure DevOps Server Elevation of Privilege Vulnerability No No 7.3

Browser vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-5346 Chromium: CVE-2023-5346 Type Confusion in V8 No No N/A

ESU vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36790 Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability No No 7.8

Exchange Server vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36778 Microsoft Exchange Server Remote Code Execution Vulnerability No No 8

Microsoft Dynamics vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36433 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability No No 6.5
CVE-2023-36429 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability No No 6.5
CVE-2023-36566 Microsoft Common Data Model SDK Denial of Service Vulnerability No No 6.5
CVE-2023-36416 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability No No 6.1

Microsoft Office vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36569 Microsoft Office Elevation of Privilege Vulnerability No No 8.4
CVE-2023-36789 Skype for Business Remote Code Execution Vulnerability No No 7.2
CVE-2023-36786 Skype for Business Remote Code Execution Vulnerability No No 7.2
CVE-2023-36780 Skype for Business Remote Code Execution Vulnerability No No 7.2
CVE-2023-36565 Microsoft Office Graphics Elevation of Privilege Vulnerability No No 7
CVE-2023-36568 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability No No 7
CVE-2023-41763 Skype for Business Elevation of Privilege Vulnerability Yes Yes 5.3

SQL Server vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36417 Microsoft SQL ODBC Driver Remote Code Execution Vulnerability No No 7.8
CVE-2023-36730 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability No No 7.8
CVE-2023-36785 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability No No 7.8
CVE-2023-36420 Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability No No 7.3
CVE-2023-36728 Microsoft SQL Server Denial of Service Vulnerability No No 5.5

Windows vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36704 Windows Setup Files Cleanup Remote Code Execution Vulnerability No No 7.8
CVE-2023-36711 Windows Runtime C++ Template Library Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36725 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36723 Windows Container Manager Service Elevation of Privilege Vulnerability No No 7.8
CVE-2023-41772 Win32k Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36557 PrintHTML API Remote Code Execution Vulnerability No No 7.8
CVE-2023-36729 Named Pipe File System Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36718 Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability No No 7.8
CVE-2023-36701 Microsoft Resilient File System (ReFS) Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36603 Windows TCP/IP Denial of Service Vulnerability No No 7.5
CVE-2023-36720 Windows Mixed Reality Developer Tools Denial of Service Vulnerability No No 7.5
CVE-2023-36709 Microsoft AllJoyn API Denial of Service Vulnerability No No 7.5
CVE-2023-36605 Windows Named Pipe Filesystem Elevation of Privilege Vulnerability No No 7.4
CVE-2023-36902 Windows Runtime Remote Code Execution Vulnerability No No 7
CVE-2023-38159 Windows Graphics Component Elevation of Privilege Vulnerability No No 7
CVE-2023-36721 Windows Error Reporting Service Elevation of Privilege Vulnerability No No 7
CVE-2023-36717 Windows Virtual Trusted Platform Module Denial of Service Vulnerability No No 6.5
CVE-2023-36707 Windows Deployment Services Denial of Service Vulnerability No No 6.5
CVE-2023-36596 Remote Procedure Call Information Disclosure Vulnerability No No 6.5
CVE-2023-36576 Windows Kernel Information Disclosure Vulnerability No No 5.5
CVE-2023-36698 Windows Kernel Security Feature Bypass Vulnerability No No 3.6

Windows Developer Tools vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-38171 Microsoft QUIC Denial of Service Vulnerability No No 7.5
CVE-2023-36435 Microsoft QUIC Denial of Service Vulnerability No No 7.5
CVE-2023-44487 MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack Yes No N/A

Windows ESU vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score
CVE-2023-36434 Windows IIS Server Elevation of Privilege Vulnerability No No 9.8
CVE-2023-35349 Microsoft Message Queuing Remote Code Execution Vulnerability No No 9.8
CVE-2023-36577 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability No No 8.8
CVE-2023-41765 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-41767 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-41768 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-41769 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-41770 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-41771 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-41773 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-41774 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-38166 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability No No 8.1
CVE-2023-36710 Windows Media Foundation Core Remote Code Execution Vulnerability No No 7.8
CVE-2023-36436 Windows MSHTML Platform Remote Code Execution Vulnerability No No 7.8
CVE-2023-36712 Windows Kernel Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36726 Windows Internet Key Exchange (IKE) Extension Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36594 Windows Graphics Component Elevation of Privilege Vulnerability No No 7.8
CVE-2023-41766 Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36732 Win32k Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36731 Win32k Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36743 Win32k Elevation of Privilege Vulnerability No No 7.8
CVE-2023-36598 Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability No No 7.8
CVE-2023-36593 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.8
CVE-2023-36702 Microsoft DirectMusic Remote Code Execution Vulnerability No No 7.8
CVE-2023-36438 Windows TCP/IP Information Disclosure Vulnerability No No 7.5
CVE-2023-36602 Windows TCP/IP Denial of Service Vulnerability No No 7.5
CVE-2023-36567 Windows Deployment Services Information Disclosure Vulnerability No No 7.5
CVE-2023-36606 Microsoft Message Queuing Denial of Service Vulnerability No No 7.5
CVE-2023-36581 Microsoft Message Queuing Denial of Service Vulnerability No No 7.5
CVE-2023-36579 Microsoft Message Queuing Denial of Service Vulnerability No No 7.5
CVE-2023-36431 Microsoft Message Queuing Denial of Service Vulnerability No No 7.5
CVE-2023-36703 DHCP Server Service Denial of Service Vulnerability No No 7.5
CVE-2023-36585 Active Template Library Denial of Service Vulnerability No No 7.5
CVE-2023-36592 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36591 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36590 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36589 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36583 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36582 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36578 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36575 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36574 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36573 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36572 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36571 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36570 Microsoft Message Queuing Remote Code Execution Vulnerability No No 7.3
CVE-2023-36776 Win32k Elevation of Privilege Vulnerability No No 7
CVE-2023-36697 Microsoft Message Queuing Remote Code Execution Vulnerability No No 6.8
CVE-2023-36564 Windows Search Security Feature Bypass Vulnerability No No 6.5
CVE-2023-29348 Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability No No 6.5
CVE-2023-36706 Windows Deployment Services Information Disclosure Vulnerability No No 6.5
CVE-2023-36563 Microsoft WordPad Information Disclosure Vulnerability Yes Yes 6.5
CVE-2023-36724 Windows Power Management Service Information Disclosure Vulnerability No No 5.5
CVE-2023-36713 Windows Common Log File System Driver Information Disclosure Vulnerability No No 5.5
CVE-2023-36584 Windows Mark of the Web Security Feature Bypass Vulnerability No No 5.4
CVE-2023-36722 Active Directory Domain Services Information Disclosure Vulnerability No No 4.4

Using Generative AI, Amazon Bedrock and Amazon CodeGuru to Improve Code Quality and Security

Post Syndicated from Marcilio Mendonca original https://aws.amazon.com/blogs/devops/using-generative-ai-amazon-bedrock-and-amazon-codeguru-to-improve-code-quality-and-security/

Automated code analysis plays a key role in improving code quality and compliance. Amazon CodeGuru Reviewer provides automated recommendations that can assist developers in identifying defects and deviation from coding best practices. For instance, CodeGuru Security automatically flags potential security vulnerabilities such as SQL injection, hardcoded AWS credentials and cross-site request forgery, to name a few. After becoming aware of these findings, developers can take decisive action to remediate their code.

On the other hand, determining what the best course of action is to address a particular automated recommendation might not always be obvious. For instance, an apprentice developer may not fully grasp what a SQL injection attack means or what makes the code at hand particularly vulnerable. In another situation, the developer reviewing a CodeGuru recommendation might not be the same developer who wrote the initial code. In these cases, the developer will first need to get familiarized with the code and the recommendation in order to take proper corrective action.

By using Generative AI, developers can leverage pre-trained foundation models to gain insights on their code’s structure, the CodeGuru Reviewer recommendation and the potential corrective actions. For example, Generative AI models can generate text content, e.g., to explain a technical concept such as SQL injection attacks or the correct use of a given library. Once the recommendation is well understood, the Generative AI model can be used to refactor the original code so that it complies with the recommendation. The possibilities opened up by Generative AI are numerous when it comes to improving code quality and security.

In this post, we will show how you can use CodeGuru Reviewer and Bedrock to improve the quality and security of your code. While CodeGuru Reviewer can provide automated code analysis and recommendations, Bedrock offers a low-friction environment that enables you to gain insights on the CodeGuru recommendations and to find creative ways to remediate your code.

Solution Overview

The diagram below depicts our approach and the AWS services involved. It works as follows:

1. The developer pushes code to an AWS CodeCommit repository.
2. The repository is associated with CodeGuru Reviewer, so an automated code review is initiated.
3. Upon completion, the CodeGuru Reviewer console displays a list of recommendations for the code base, if applicable.
4. Once aware of the recommendation and the affected code, the developer navigates to the Bedrock console, chooses a foundation model and builds a prompt (we will give examples of prompts in the next session).
5. Bedrock generates content as a response to the prompt, including code generation.
6. The developer might optionally refine the prompt, for example, to gain further insights on the CodeGuru Reviewer recommendation or to request for alternatives to remediate the code.
7. The model can respond with generated code that addresses the issue which can then be pushed back into the repository.

CodeCommit, CodeGuru and Bedrock used together

CodeCommit, CodeGuru and Bedrock used together

Note that we use CodeCommit in our walkthrough but readers can use any Git sources supported by CodeGuru Reviewer.

Using Generative AI to Improve Code Quality and Security

Next, we’re going to walk you through a scenario where a developer needs to improve the quality of her code after CodeGuru Reviewer has provided recommendations. But before getting there, let’s choose a code repository and set the Bedrock inference parameters.

A good reference of source repository for exploring CodeGuru Reviewer recommendations is the Amazon CodeGuru Reviewer Python Detector repository. The repository contains a comprehensive list of compliant and non-compliant code which fits well in the context of our discussion.

In terms of Bedrock model, we use Anthropic Claude V1 (v1.3) in our analysis which is specialized in content generation including text and code. We set the required model parameters as follows: temperature=0.5, top_p=0.9, top_k=500, max_tokens=2048. We set temperature and top_p parameters so as to give the model a bit more flexibility to generate responses for the same question. Please check the inference parameter definitions on Bedrock’s user guide for further details on these parameters. Given the randomness level specified by our inference parameters, readers experimenting with the prompts provided in this post might observe slightly different answers than the ones presented.

Requirements

  • An AWS account with access to CodeCommit, CodeGuru and Bedrock
  • Bedrock access enabled in the account. On-demand access should be fine (check pricing here).
  • Download and install the AWS CLI and Git (to push code to CodeCommit)

Walkthrough

Follow the steps below to run CodeGuru Reviewer analysis on a repository and to build and run Bedrock prompts.

  • Clone the from GitHub to your local workstation
git clone https://github.com/aws-samples/amazon-codeguru-reviewer-python-detectors.git
  • Create a CodeCommit repository and add a new Git remote
aws codecommit create-repository --repository-name amazon-codeguru-reviewer-python-detectors

cd amazon-codeguru-reviewer-python-detectors/

git remote add codecommit https://git-codecommit.us-east-1.amazonaws.com/v1/repos/amazon-codeguru-reviewer-python-detectors
  • Associate CodeGuru Reviewer with the repository to enable repository analysis
aws codeguru-reviewer associate-repository --repository 'CodeCommit={Name=amazon-codeguru-reviewer-python-detectors}'

Save the association ARN value returned after the command is executed (e.g., arn:aws:codeguru-reviewer:xx-xxxx-x:111111111111:association:e85aa20c-41d76-03b-f788-cefd0d2a3590).

  • Push code to the CodeCommit repository using the codecommit git remote
git push codecommit main:main
  • Trigger CodeGuru Reviewer to run a repository analysis on the repository’s main branch. Use the repository association ARN you noted in a previous step here.
aws codeguru-reviewer create-code-review \
 --name codereview001 \
 --type '{"RepositoryAnalysis": {"RepositoryHead": {"BranchName": "main"}}}' \
 --repository-association-arn arn:aws:codeguru-reviewer:xx-xxxx-x:111111111111:association:e85aa20c-41d76-03b-f788-cefd0d2a3590

Navigate to the CodeGuru Reviewer Console to see the various recommendations provided (you might have to wait a few minutes for the code analysis to run).

Amazon CodeGuru reviewer

Amazon CodeGuru Reviewer

  • On the CodeGuru Reviewer console (see screenshot above), we select the first recommendation on file hashlib_contructor.py, line 12, and take note of the recommendation content: The constructors for the hashlib module are faster than new(). We recommend using hashlib.sha256() instead.
  • Now let’s extract the affected code. Click on the file name link (hashlib_contructor.py in the figure above) to open the corresponding code in the CodeCommit console.
AWS CodeCommit Repository

AWS CodeCommit Repository

  • The blue arrow in the CodeCommit console above indicates the non-compliant code highlighting the specific line (line 12). We select the wrapping python function from lines 5 through 15 to build our prompt. You may want to experiment reducing the scope to a single line or a given block of lines and check if it yields better responses.
Amazon Bedrock Playground Console

Amazon Bedrock Playground Console

  • We then navigate to the Bedrock console (see screenshot above).
    • Search for keyword Bedrock in the AWS console
    • Select the Bedrock service to navigate to the service console
    • Choose Playgrounds, then choose Text
    • Choose model Anthropic Claude V1 (1.3). If you don’t see this model available, please make sure to enable model access.
  • Set the Inference configuration as shown in the screenshot below including temperature, Top P and the other parameters. Please check the inference parameter definitions on Bedrock’s user guide for further details on these parameters.
  • Build a Bedrock prompt using three elements, as illustrated in the screenshot below:
    • The source code copied from CodeCommit
    • The CodeGuru Reviewer recommendation
    • A request to refactor the code to address the code analysis finding
A Prompt in the Amazon Bedrock Playground Console

A Prompt in the Amazon Bedrock Playground Console

  • Press the Run button. Notice that Bedrock will automatically add the words Human (at the top) and Assistant (at the bottom) to the prompt.  Wait a few seconds and a response is generated (in green). The response includes the refactored code and an explanation on how the code was fixed (see screenshot below).
A Prompt Response (or completion) in the Amazon Bedrock Playground Console

A Prompt Response (or completion) in the Amazon Bedrock Playground Console

Note that the original code was refactored to use ashlib.sha256() instead of  using new in the constructor: hashlib.new(‘sha256’, …). Note that the prompt also asks for an explanation on how the refactored code fixes the issue, so the response includes such details. If we were interested in the refactored code only, we could change the prompt and ask that it returns only the refactored code.

Gaining Insights and Improving Code Quality

So far, our walkthrough showed how to navigate through the CodeCommit, CodeGuru Reviewer and Bedrock consoles to gather relevant content that can be used to build and run a Bedrock prompt. We are now going to explore further prompts to gain insights on the code and the recommendations in order to build more specific prompt to refactor the code. We omit screenshots for brevity. Readers can follow the same process outlined in the previous session.

Learning about the code

Let’s now examine another CodeGuru Reviewer recommendation. Specifically, we want to find the SQL Injection vulnerability raised for file, line 12, as shown below.

Sample non-compliant code

Sample non-compliant code

CodeGuru Reviewer provided the following recommendation:

CodeGuru Reviewer recommendation

For the sake of the walkthrough, let’s assume the developer reviewing the code above was not the original developer who built the code. We start by asking Bedrock to explain the code, line by line. Note that we have not included the CodeGuru Reviewer recommendation in the prompt this time as our initial goal is to understand the code.

Prompt:

Source Code:
def execute_query_noncompliant(request):
    import sqlite3
    name = request.GET.get("name")
    query = "SELECT * FROM Users WHERE name = " + name + ";" 
    with sqlite3.connect("example.db") as connection:
        cursor = connection.cursor()
        # Noncompliant: user input is used without sanitization.
        cursor.execute(query)
        connection.commit()
        connection.close()
Request:
Explain the code logic above line by line.

Response:

Sure, here is a line by line explanation of the code:
def execute_query_noncompliant(request):
This defines a function called execute_query_noncompliant that takes a request as an argument.
import sqlite3
This imports the sqlite3 library to connect to a SQLite database.
name = request.GET.get("name")
This gets a "name" query parameter from the request GET parameters.
query = "SELECT * FROM Users WHERE name = " + name + ";"
This constructs an SQL query string by concatenating the name variable into the query. 
So if name was "John", the query would be:
SELECT * FROM Users WHERE name = John;
with sqlite3.connect("example.db") as connection:
This opens a connection to the "example.db" SQLite database.
   cursor = connection.cursor()
This gets a cursor to execute queries on the connection.
    # Noncompliant: user input is used without sanitization.
    cursor.execute(query)
This executes the query on the database. The comment notes that this is noncompliant 
because it uses unsanitized user input in the query.
    connection.commit()
    connection.close()

Bedrock provides a line-by-line explanation of the code including the library being used (sqllite3) and a comment about the code using an unsanitized [MOU1] user input. The explanation is detailed helping the developer to understand the code logic and structure.

The developer now has a good understanding of the code. Let’s now gain insights on why and how the code is vulnerable to SQL Injection.

Prompt:

Source Code:
def execute_query_noncompliant(request):
    import sqlite3
    name = request.GET.get("name")
    query = "SELECT * FROM Users WHERE name = " + name + ";" 
    with sqlite3.connect("example.db") as connection:
        cursor = connection.cursor()
        # Noncompliant: user input is used without sanitization.
        cursor.execute(query)
        connection.commit()
        connection.close()
Request:
Why is the code above vulnerable to SQL injection?

Response:

The code is vulnerable to SQL injection because it directly concatenates 
user input (the name parameter) into an SQL query string. This allows a 
malicious user to inject SQL code into the query.
For example, if the name parameter is passed as:

'; DROP TABLE Users; -- 
Then the resulting SQL query would be:

SELECT * FROM Users WHERE name = ''; DROP TABLE Users; -- ;
This would drop the Users table, causing damage to the database.
To fix this, the user input should be sanitized before being added to the 
SQL query string. This can be done by:

Escaping single quotes in the input:
name = request.GET.get("name").replace("'", "''")
query = f"SELECT * FROM Users WHERE name = '{name}';"

Using parameterized queries:
query = "SELECT * FROM Users WHERE name = ?"
cursor.execute(query, (name,))

Again, the response is detailed. It explains that the user input is being concatenated directly into a query string. It gives an example of a SQL injection attack that could cause the Users table to be dropped. It also provides two options to fix the code including escaping single quotes and using parameterized queries.

We continue to dive deep into SQL injection. Let’s build a prompt to gather further examples of possible SQL injection attacks.

Prompt:

Source Code:
def execute_query_noncompliant(request):
    import sqlite3
    name = request.GET.get("name")
    query = "SELECT * FROM Users WHERE name = " + name + ";" 
    with sqlite3.connect("example.db") as connection:
        cursor = connection.cursor()
        # Noncompliant: user input is used without sanitization.
        cursor.execute(query)
        connection.commit()
        connection.close()
Request:
Provide examples of SQL injection for the code above

Response:

Here are some examples of SQL injection for that code:

If the name parameter is passed as:
'; DROP TABLE Users; -- 

Then the executed query would be:
SELECT * FROM Users WHERE name = ''; DROP TABLE Users; -- ;
This would drop the Users table.

If the name parameter is passed as:
OR 1=1; -- 

Then the executed query would be:
SELECT * FROM Users WHERE name = OR 1=1; -- ;
This would select all rows from the Users table.

If the name parameter is passed as:
'; UPDATE Users SET password = 'hacked' WHERE 1=1; -- 

Then the executed query would be:
SELECT * FROM Users WHERE name = ''; UPDATE Users SET password = 'hacked' WHERE 1=1; -- ;

This would update all passwords in the Users table to 'hacked'.
So in summary, without sanitizing the input, this code is vulnerable to SQL injection attacks 
that can delete data, access unauthorized data, modify data, etc. The input should be sanitized 
by escaping special characters before using in the SQL query.

Bedrock responds by including two new forms of SQL injection attacks, one that lists all records from the Users table and another one that updates all passwords in the table.

At this point, the developer has learned a lot about the code, SQL injection attacks and the CodeGuru Reviewer recommendation. It’s now time to build a prompt to fix the code. We leverage what we learned in previous prompts including the term “parameterized queries”, as suggested by CodeGuru Reviewer, to build a specific request in the prompt. Note that we have also included the CodeGuru Reviewer recommendation in the prompt this time.

Prompt:

Source Code:
def execute_query_noncompliant(request):
    import sqlite3
    name = request.GET.get("name")
    query = "SELECT * FROM Users WHERE name = " + name + ";" 
    with sqlite3.connect("example.db") as connection:
        cursor = connection.cursor()
        # Noncompliant: user input is used without sanitization.
        cursor.execute(query)
        connection.commit()
        connection.close()

Code Analysis Finding: 
It seems that you are constructing an SQL query using formatted strings. This could 
make your code vulnerable to SQL injection attacks, which can lead to loss of critical 
data. We recommend that you use parameterized queries for constructing SQL queries.  
[Learn more](https://cwe.mitre.org/data/definitions/89.html)
Request:
Fix the code above using parameterized query.

Response:

Here is the fixed code using parameterized query:

def execute_query_compliant(request):
   import sqlite3
   name = request.GET.get("name")
   query = "SELECT * FROM Users WHERE name = ?" 
   with sqlite3.connect("example.db") as connection:
      cursor = connection.cursor()
      # Compliant: Parameterized query prevents SQL injection
      cursor.execute(query, (name,)) 
      connection.commit()
      connection.close()

Instead of concatenating the user input directly into the SQL string, we use a ? 
placeholder and pass the user input as a tuple argument to cursor.execute(). This 
prevents SQL injection since the input is treated as a literal value rather than 
part of the SQL syntax.

The response includes a refactored code that uses a parameterized query to prevent SQL injection attacks (cursor.execute(query, (name,)).


We’re excited with the improvements in the code and now decide to go beyond fixing the SQL injection vulnerability. The next prompt asks Bedrock to make two specific improvements to the refactored.

  • Add python type hints
  • Add exception handling

Prompt:

Source Code:
def execute_query_compliant(request):
   import sqlite3
   name = request.GET.get("name")
   query = "SELECT * FROM Users WHERE name = ?" 
   with sqlite3.connect("example.db") as connection:
      cursor = connection.cursor()
      # Compliant: Parameterized query prevents SQL injection
      cursor.execute(query, (name,)) 
      connection.commit()
      connection.close()

Request: 
Add exception handling and type hints to the code above.

Response:

Here is the code with exception handling and type hints:

def execute_query_compliant(request: Request) -> None: 
   """Executes a compliant SQL query"""
   import sqlite3
   name = request.GET.get("name")
   query = "SELECT * FROM Users WHERE name = ?" 
   try:
      with sqlite3.connect("example.db") as connection: 
          cursor: sqlite3.Cursor = connection.cursor()
          # Compliant: Parameterized query prevents SQL injection
          cursor.execute(query, (name,)) 
          connection.commit()
   except sqlite3.Error as e: 
      print(f"SQLite error: {e}")
   finally: 
      connection.close()

I added:

Type hints:
request: Request indicating the request parameter is of type Request

cursor: sqlite3.Cursor indicating cursor is of type sqlite3.Cursor
Exception handling:
A try/except block catching sqlite3.Error exceptions. 
A finally block ensuring the connection is always closed. 
Let me know if you would like me to explain anything in the updated code!

Note that the generated code now includes a try/except/finally block to handle exceptions and type hints for the function parameter and return value.

However, some variables such as name and query are missing type hints. Here, we’d like to call out the importance of human supervision on automatically generated responses. The developer tweaks the previous prompt to ask that “all variables” have type hint added to them.

Prompt:

Source Code:
def execute_query_compliant(request):
   import sqlite3
   name = request.GET.get("name")
   query = "SELECT * FROM Users WHERE name = ?" 
   with sqlite3.connect("example.db") as connection:
      cursor = connection.cursor()
      # Compliant: Parameterized query prevents SQL injection
      cursor.execute(query, (name,)) 
      connection.commit()
      connection.close()

Request: 
Add exception handling and type hints to all variables in the code above.

Response:

Here is the code with exception handling and type hints:

def execute_query_compliant(request: Request) -> None: 
   """Executes a compliant SQL query"""
   import sqlite3
   name: str = request.GET.get("name")
   query: str = "SELECT * FROM Users WHERE name = ?" 
   try:
      with sqlite3.connect("example.db") as connection: 
         cursor: sqlite3.Cursor = connection.cursor()
         # Compliant: Parameterized query prevents SQL injection
         cursor.execute(query, (name,)) 
         connection.commit()
   except sqlite3.Error as e: 
        print(f"SQLite error: {e}")
   finally: 
        connection.close()

The new response refactors the code making sure all variables now have type hint. This shows how little changes to a prompt can produce much better results. In our example, by adding “all variables” to the prompt caused the response to indeed add type hints to all variables in the code provided.

Here is a summary of the activities performed via Bedrock prompting:

  • Gain insights on the code and the CodeGuru recommendation
    • Explain the code logic above line by line.
    • Why is the code above vulnerable to SQL injection?
    • Provide examples of SQL injection for the code above
  • Refactor and Improve the Code
    • Fix the code above using parameterized query
    • Add exception handling and type hints to the code above
    • Add exception handling and type hints to all variables in the code above.

The main takeaway is that by using a static analysis and security testing tool such as CodeGuru Reviewer in combination with a Generative AI service such as Bedrock, developers can significantly improve their code towards best practices and enhanced security. In addition, prompts which are more specific normally yield better results and that’s when CodeGuru Reviewer can be really helpful as it gives developers hints and keywords that can be used to build powerful prompts.

Cleaning Up

Don’t forget to delete the CodeCommit repository created if you no longer need it.

aws codecommit delete-repository -–repository-name amazon-codeguru-reviewer-python-detectors

Conclusion and Call to Action

In this blog, we discussed how CodeGuru Reviewer and Bedrock can be used in combination to improve code quality and security. While CodeGuru Reviewer provides a rich set of recommendations through automated code reviews, Bedrock gives developers the ability to gain deeper insights on the code and the recommendations as well as to refactor the original code to meet compliance and best practices.

We encourage readers to explore new Bedrock prompts beyond the ones introduced in this post and share their feedback with us.

Here are some ideas:

For a sample Python repository we recommend using the Amazon CodeGuru Reviewer Python Detector repository on GitHub which is publicly accessible to readers.

For Java developers, there’s a CodeGuru Reviewer Python Detector for Java repository alternative available.

Note: at the time of the writing of this post, Bedrock’s Anthropic Claude 2.0 model was not yet available so we invite readers to also experiment with the prompts provided using that model.

Special thanks to my colleagues Raghvender Arni and Mahesh Yadav for support and review of this post.
Author: Marcilio Mendonca

Marcilio Mendonca

Marcilio Mendonca is a Sr. Solutions Developer in the Prototyping And Customer Engineering (PACE) team at Amazon Web Services. He is passionate about helping customers rethink and reinvent their business through the art of prototyping, primarily in the realm of modern application development, Serverless and AI/ML. Prior to joining AWS, Marcilio was a Software Development Engineer with Amazon. He also holds a PhD in Computer Science. You can find Marcilio on LinkedIn at https://www.linkedin.com/in/marcilio/. Let’s connect!

Blue/Green deployments using AWS CDK Pipelines and AWS CodeDeploy

Post Syndicated from Luiz Decaro original https://aws.amazon.com/blogs/devops/blue-green-deployments-using-aws-cdk-pipelines-and-aws-codedeploy/

Customers often ask for help with implementing Blue/Green deployments to Amazon Elastic Container Service (Amazon ECS) using AWS CodeDeploy. Their use cases usually involve cross-Region and cross-account deployment scenarios. These requirements are challenging enough on their own, but in addition to those, there are specific design decisions that need to be considered when using CodeDeploy. These include how to configure CodeDeploy, when and how to create CodeDeploy resources (such as Application and Deployment Group), and how to write code that can be used to deploy to any combination of account and Region.

Today, I will discuss those design decisions in detail and how to use CDK Pipelines to implement a self-mutating pipeline that deploys services to Amazon ECS in cross-account and cross-Region scenarios. At the end of this blog post, I also introduce a demo application, available in Java, that follows best practices for developing and deploying cloud infrastructure using AWS Cloud Development Kit (AWS CDK).

The Pipeline

CDK Pipelines is an opinionated construct library used for building pipelines with different deployment engines. It abstracts implementation details that developers or infrastructure engineers need to solve when implementing a cross-Region or cross-account pipeline. For example, in cross-Region scenarios, AWS CloudFormation needs artifacts to be replicated to the target Region. For that reason, AWS Key Management Service (AWS KMS) keys, an Amazon Simple Storage Service (Amazon S3) bucket, and policies need to be created for the secondary Region. This enables artifacts to be moved from one Region to another. In cross-account scenarios, CodeDeploy requires a cross-account role with access to the KMS key used to encrypt configuration files. This is the sort of detail that our customers want to avoid dealing with manually.

AWS CodeDeploy is a deployment service that automates application deployment across different scenarios. It deploys to Amazon EC2 instances, On-Premises instances, serverless Lambda functions, or Amazon ECS services. It integrates with AWS Identity and Access Management (AWS IAM), to implement access control to deploy or re-deploy old versions of an application. In the Blue/Green deployment type, it is possible to automate the rollback of a deployment using Amazon CloudWatch Alarms.

CDK Pipelines was designed to automate AWS CloudFormation deployments. Using AWS CDK, these CloudFormation deployments may include deploying application software to instances or containers. However, some customers prefer using CodeDeploy to deploy application software. In this blog post, CDK Pipelines will deploy using CodeDeploy instead of CloudFormation.

A pipeline build with CDK Pipelines that deploys to Amazon ECS using AWS CodeDeploy. It contains at least 5 stages: Source, Build, UpdatePipeline, Assets and at least one Deployment stage.

Design Considerations

In this post, I’m considering the use of CDK Pipelines to implement different use cases for deploying a service to any combination of accounts (single-account & cross-account) and regions (single-Region & cross-Region) using CodeDeploy. More specifically, there are four problems that need to be solved:

CodeDeploy Configuration

The most popular options for implementing a Blue/Green deployment type using CodeDeploy are using CloudFormation Hooks or using a CodeDeploy construct. I decided to operate CodeDeploy using its configuration files. This is a flexible design that doesn’t rely on using custom resources, which is another technique customers have used to solve this problem. On each run, a pipeline pushes a container to a repository on Amazon Elastic Container Registry (ECR) and creates a tag. CodeDeploy needs that information to deploy the container.

I recommend creating a pipeline action to scan the AWS CDK cloud assembly and retrieve the repository and tag information. The same action can create the CodeDeploy configuration files. Three configuration files are required to configure CodeDeploy: appspec.yaml, taskdef.json and imageDetail.json. This pipeline action should be executed before the CodeDeploy deployment action. I recommend creating template files for appspec.yaml and taskdef.json. The following script can be used to implement the pipeline action:

##
#!/bin/sh
#
# Action Configure AWS CodeDeploy
# It customizes the files template-appspec.yaml and template-taskdef.json to the environment
#
# Account = The target Account Id
# AppName = Name of the application
# StageName = Name of the stage
# Region = Name of the region (us-east-1, us-east-2)
# PipelineId = Id of the pipeline
# ServiceName = Name of the service. It will be used to define the role and the task definition name
#
# Primary output directory is codedeploy/. All the 3 files created (appspec.json, imageDetail.json and 
# taskDef.json) will be located inside the codedeploy/ directory
#
##
Account=$1
Region=$2
AppName=$3
StageName=$4
PipelineId=$5
ServiceName=$6
repo_name=$(cat assembly*$PipelineId-$StageName/*.assets.json | jq -r '.dockerImages[] | .destinations[] | .repositoryName' | head -1) 
tag_name=$(cat assembly*$PipelineId-$StageName/*.assets.json | jq -r '.dockerImages | to_entries[0].key')  
echo ${repo_name} 
echo ${tag_name} 
printf '{"ImageURI":"%s"}' "$Account.dkr.ecr.$Region.amazonaws.com/${repo_name}:${tag_name}" > codedeploy/imageDetail.json                     
sed 's#APPLICATION#'$AppName'#g' codedeploy/template-appspec.yaml > codedeploy/appspec.yaml 
sed 's#APPLICATION#'$AppName'#g' codedeploy/template-taskdef.json | sed 's#TASK_EXEC_ROLE#arn:aws:iam::'$Account':role/'$ServiceName'#g' | sed 's#fargate-task-definition#'$ServiceName'#g' > codedeploy/taskdef.json 
cat codedeploy/appspec.yaml
cat codedeploy/taskdef.json
cat codedeploy/imageDetail.json

Using a Toolchain

A good strategy is to encapsulate the pipeline inside a Toolchain to abstract how to deploy to different accounts and regions. This helps decoupling clients from the details such as how the pipeline is created, how CodeDeploy is configured, and how cross-account and cross-Region deployments are implemented. To create the pipeline, deploy a Toolchain stack. Out-of-the-box, it allows different environments to be added as needed. Depending on the requirements, the pipeline may be customized to reflect the different stages or waves that different components might require. For more information, please refer to our best practices on how to automate safe, hands-off deployments and its reference implementation.

In detail, the Toolchain stack follows the builder pattern used throughout the CDK for Java. This is a convenience that allows complex objects to be created using a single statement:

 Toolchain.Builder.create(app, Constants.APP_NAME+"Toolchain")
        .stackProperties(StackProps.builder()
                .env(Environment.builder()
                        .account(Demo.TOOLCHAIN_ACCOUNT)
                        .region(Demo.TOOLCHAIN_REGION)
                        .build())
                .build())
        .setGitRepo(Demo.CODECOMMIT_REPO)
        .setGitBranch(Demo.CODECOMMIT_BRANCH)
        .addStage(
                "UAT",
                EcsDeploymentConfig.CANARY_10_PERCENT_5_MINUTES,
                Environment.builder()
                        .account(Demo.SERVICE_ACCOUNT)
                        .region(Demo.SERVICE_REGION)
                        .build())                                                                                                             
        .build();

In the statement above, the continuous deployment pipeline is created in the TOOLCHAIN_ACCOUNT and TOOLCHAIN_REGION. It implements a stage that builds the source code and creates the Java archive (JAR) using Apache Maven.  The pipeline then creates a Docker image containing the JAR file.

The UAT stage will deploy the service to the SERVICE_ACCOUNT and SERVICE_REGION using the deployment configuration CANARY_10_PERCENT_5_MINUTES. This means 10 percent of the traffic is shifted in the first increment and the remaining 90 percent is deployed 5 minutes later.

To create additional deployment stages, you need a stage name, a CodeDeploy deployment configuration and an environment where it should deploy the service. As mentioned, the pipeline is, by default, a self-mutating pipeline. For example, to add a Prod stage, update the code that creates the Toolchain object and submit this change to the code repository. The pipeline will run and update itself adding a Prod stage after the UAT stage. Next, I show in detail the statement used to add a new Prod stage. The new stage deploys to the same account and Region as in the UAT environment:

... 
        .addStage(
                "Prod",
                EcsDeploymentConfig.CANARY_10_PERCENT_5_MINUTES,
                Environment.builder()
                        .account(Demo.SERVICE_ACCOUNT)
                        .region(Demo.SERVICE_REGION)
                        .build())                                                                                                                                      
        .build();

In the statement above, the Prod stage will deploy new versions of the service using a CodeDeploy deployment configuration CANARY_10_PERCENT_5_MINUTES. It means that 10 percent of traffic is shifted in the first increment of 5 minutes. Then, it shifts the rest of the traffic to the new version of the application. Please refer to Organizing Your AWS Environment Using Multiple Accounts whitepaper for best-practices on how to isolate and manage your business applications.

Some customers might find this approach interesting and decide to provide this as an abstraction to their application development teams. In this case, I advise creating a construct that builds such a pipeline. Using a construct would allow for further customization. Examples are stages that promote quality assurance or deploy the service in a disaster recovery scenario.

The implementation creates a stack for the toolchain and another stack for each deployment stage. As an example, consider a toolchain created with a single deployment stage named UAT. After running successfully, the DemoToolchain and DemoService-UAT stacks should be created as in the next image:

Two stacks are needed to create a Pipeline that deploys to a single environment. One stack deploys the Toolchain with the Pipeline and another stack deploys the Service compute infrastructure and CodeDeploy Application and DeploymentGroup. In this example, for an application named Demo that deploys to an environment named UAT, the stacks deployed are: DemoToolchain and DemoService-UAT

CodeDeploy Application and Deployment Group

CodeDeploy configuration requires an application and a deployment group. Depending on the use case, you need to create these in the same or in a different account from the toolchain (pipeline). The pipeline includes the CodeDeploy deployment action that performs the blue/green deployment. My recommendation is to create the CodeDeploy application and deployment group as part of the Service stack. This approach allows to align the lifecycle of CodeDeploy application and deployment group with the related Service stack instance.

CodePipeline allows to create a CodeDeploy deployment action that references a non-existing CodeDeploy application and deployment group. This allows us to implement the following approach:

  • Toolchain stack deploys the pipeline with CodeDeploy deployment action referencing a non-existing CodeDeploy application and deployment group
  • When the pipeline executes, it first deploys the Service stack that creates the related CodeDeploy application and deployment group
  • The next pipeline action executes the CodeDeploy deployment action. When the pipeline executes the CodeDeploy deployment action, the related CodeDeploy application and deployment will already exist.

Below is the pipeline code that references the (initially non-existing) CodeDeploy application and deployment group.

private IEcsDeploymentGroup referenceCodeDeployDeploymentGroup(
        final Environment env, 
        final String serviceName, 
        final IEcsDeploymentConfig ecsDeploymentConfig, 
        final String stageName) {

    IEcsApplication codeDeployApp = EcsApplication.fromEcsApplicationArn(
            this,
            Constants.APP_NAME + "EcsCodeDeployApp-"+stageName,
            Arn.format(ArnComponents.builder()
                    .arnFormat(ArnFormat.COLON_RESOURCE_NAME)
                    .partition("aws")
                    .region(env.getRegion())
                    .service("codedeploy")
                    .account(env.getAccount())
                    .resource("application")
                    .resourceName(serviceName)
                    .build()));

    IEcsDeploymentGroup deploymentGroup = EcsDeploymentGroup.fromEcsDeploymentGroupAttributes(
            this,
            Constants.APP_NAME + "-EcsCodeDeployDG-"+stageName,
            EcsDeploymentGroupAttributes.builder()
                    .deploymentGroupName(serviceName)
                    .application(codeDeployApp)
                    .deploymentConfig(ecsDeploymentConfig)
                    .build());

    return deploymentGroup;
}

To make this work, you should use the same application name and deployment group name values when creating the CodeDeploy deployment action in the pipeline and when creating the CodeDeploy application and deployment group in the Service stack (where the Amazon ECS infrastructure is deployed). This approach is necessary to avoid a circular dependency error when trying to create the CodeDeploy application and deployment group inside the Service stack and reference these objects to configure the CodeDeploy deployment action inside the pipeline. Below is the code that uses Service stack construct ID to name the CodeDeploy application and deployment group. I set the Service stack construct ID to the same name I used when creating the CodeDeploy deployment action in the pipeline.

   // configure AWS CodeDeploy Application and DeploymentGroup
   EcsApplication app = EcsApplication.Builder.create(this, "BlueGreenApplication")
           .applicationName(id)
           .build();

   EcsDeploymentGroup.Builder.create(this, "BlueGreenDeploymentGroup")
           .deploymentGroupName(id)
           .application(app)
           .service(albService.getService())
           .role(createCodeDeployExecutionRole(id))
           .blueGreenDeploymentConfig(EcsBlueGreenDeploymentConfig.builder()
                   .blueTargetGroup(albService.getTargetGroup())
                   .greenTargetGroup(tgGreen)
                   .listener(albService.getListener())
                   .testListener(listenerGreen)
                   .terminationWaitTime(Duration.minutes(15))
                   .build())
           .deploymentConfig(deploymentConfig)
           .build();

CDK Pipelines roles and permissions

CDK Pipelines creates roles and permissions the pipeline uses to execute deployments in different scenarios of regions and accounts. When using CodeDeploy in cross-account scenarios, CDK Pipelines deploys a cross-account support stack that creates a pipeline action role for the CodeDeploy action. This cross-account support stack is defined in a JSON file that needs to be published to the AWS CDK assets bucket in the target account. If the pipeline has the self-mutation feature on (default), the UpdatePipeline stage will do a cdk deploy to deploy changes to the pipeline. In cross-account scenarios, this deployment also involves deploying/updating the cross-account support stack. For this, the SelfMutate action in UpdatePipeline stage needs to assume CDK file-publishing and a deploy roles in the remote account.

The IAM role associated with the AWS CodeBuild project that runs the UpdatePipeline stage does not have these permissions by default. CDK Pipelines cannot grant these permissions automatically, because the information about the permissions that the cross-account stack needs is only available after the AWS CDK app finishes synthesizing. At that point, the permissions that the pipeline has are already locked-in­­. Hence, for cross-account scenarios, the toolchain should extend the permissions of the pipeline’s UpdatePipeline stage to include the file-publishing and deploy roles.

In cross-account environments it is possible to manually add these permissions to the UpdatePipeline stage. To accomplish that, the Toolchain stack may be used to hide this sort of implementation detail. In the end, a method like the one below can be used to add these missing permissions. For each different mapping of stage and environment in the pipeline it validates if the target account is different than the account where the pipeline is deployed. When the criteria is met, it should grant permission to the UpdatePipeline stage to assume CDK bootstrap roles (tagged using key aws-cdk:bootstrap-role) in the target account (with the tag value as file-publishing or deploy). The example below shows how to add permissions to the UpdatePipeline stage:

private void grantUpdatePipelineCrossAccoutPermissions(Map<String, Environment> stageNameEnvironment) {

    if (!stageNameEnvironment.isEmpty()) {

        this.pipeline.buildPipeline();
        for (String stage : stageNameEnvironment.keySet()) {

            HashMap<String, String[]> condition = new HashMap<>();
            condition.put(
                    "iam:ResourceTag/aws-cdk:bootstrap-role",
                    new String[] {"file-publishing", "deploy"});
            pipeline.getSelfMutationProject()
                    .getRole()
                    .addToPrincipalPolicy(PolicyStatement.Builder.create()
                            .actions(Arrays.asList("sts:AssumeRole"))
                            .effect(Effect.ALLOW)
                            .resources(Arrays.asList("arn:*:iam::"
                                    + stageNameEnvironment.get(stage).getAccount() + ":role/*"))
                            .conditions(new HashMap<String, Object>() {{
                                    put("ForAnyValue:StringEquals", condition);
                            }})
                            .build());
        }
    }
}

The Deployment Stage

Let’s consider a pipeline that has a single deployment stage, UAT. The UAT stage deploys a DemoService. For that, it requires four actions: DemoService-UAT (Prepare and Deploy), ConfigureBlueGreenDeploy and Deploy.

When using CodeDeploy the deployment stage is expected to have four actions: two actions to create CloudFormation change set and deploy the ECS or compute infrastructure, an action to configure CodeDeploy and the last action that deploys the application using CodeDeploy. In the diagram, these are (in the diagram in the respective order): DemoService-UAT.Prepare and DemoService-UAT.Deploy, ConfigureBlueGreenDeploy and Deploy.

The
DemoService-UAT.Deploy action will create the ECS resources and the CodeDeploy application and deployment group. The
ConfigureBlueGreenDeploy action will read the AWS CDK
cloud assembly. It uses the configuration files to identify the Amazon Elastic Container Registry (Amazon ECR) repository and the container image tag pushed. The pipeline will send this information to the
Deploy action.  The
Deploy action starts the deployment using CodeDeploy.

Solution Overview

As a convenience, I created an application, written in Java, that solves all these challenges and can be used as an example. The application deployment follows the same 5 steps for all deployment scenarios of account and Region, and this includes the scenarios represented in the following design:

A pipeline created by a Toolchain should be able to deploy to any combination of accounts and regions. This includes four scenarios: single-account and single-Region, single-account and cross-Region, cross-account and single-Region and cross-account and cross-Region

Conclusion

In this post, I identified, explained and solved challenges associated with the creation of a pipeline that deploys a service to Amazon ECS using CodeDeploy in different combinations of accounts and regions. I also introduced a demo application that implements these recommendations. The sample code can be extended to implement more elaborate scenarios. These scenarios might include automated testing, automated deployment rollbacks, or disaster recovery. I wish you success in your transformative journey.

Luiz Decaro

Luiz is a Principal Solutions architect at Amazon Web Services (AWS). He focuses on helping customers from the Financial Services Industry succeed in the cloud. Luiz holds a master’s in software engineering and he triggered his first continuous deployment pipeline in 2005.

The collective thoughts of the interwebz