Since this post casts djb in an unfavorable light, I feel it's important to post some of his emails here, so that his words can stand alone, uncolored.
As most of you know, we hired Jake for a 5-year PhD program, starting
with a 50-50 split between Tor and TU/e, and increasing TU/e percentage
assuming that the first year goes well.
The Tor Project put up a blog post yesterday afternoon saying that Jake
had resigned from Tor. The blog post doesn't say "to concentrate on his
PhD studies" or any other explanation. If you look on Twitter you'll
find a shocking statement "Jake finally raped enough people that Tor as
an organisation couldn't ignore it anymore" from Meredith Patterson, and
a rapidly growing pile of comments.
If it's true that Jake raped someone then of course he should go to jail
for this heinous crime. If it's not true then the source of the false
accusation should be appropriately punished for slander. Clearly
_someone_ has broken the law.
But it's not my job to issue punishment, or to figure out who deserves
punishment. I'm going to presume _everyone_ innocent until proven
guilty. Everyone has a right to due process: being told exactly what the
accusations are, having adequate chance to respond, having hearings in
front of a neutral judge, etc.
Often people are falsely accused of crimes. I see it as part of my duty,
as a member of a civilized society, to avoid prejudging and punishing
people who are accused and who have not had their day in court. On the
opposite side, often people are correctly accused of crimes, and I also
see it as part of my duty to avoid prejudging and punishing accusers who
have not had their day in court.
As long as nobody goes to court claiming rape or slander, I would ask
that you join me in presuming that the accusations of rape are false,
_and_ in presuming that the accusations of slander are false. Assuming
that someone _does_ go to court, I would ask that you join me in waiting
for judges and juries to do their jobs---no matter how tempting it is to
instead join a poorly informed mob on one side or the other. I'm not
saying that judges and juries never make mistakes; I'm saying that the
alternatives are much worse.
---Dan"
Furthermore, from the article:
"Isis told Tanja their story of being raped by Jacob, without identifing it as theirs. Tanja’s response was to ask “Why were they in the same bed with Jake?”, and when I asked Tanja whether, if someone she knew personally came to her with this story, she would believe them. Tanja said no, not without hearing Jake’s explanation. At this point myself and Isis left in tears, ending the conversation."
From the emails file:
"
Dear Harry,
A few weeks ago you initiated a strictly confidential, and ongoing,
conversation with me. During this conversation I have been listening
carefully to what you've been saying, frequently summarizing to confirm
my understanding, asking questions regarding various details, and
providing my advice as to the best procedures for you to follow.
I'm deeply concerned about this conversation, for two basic reasons.
First, I've now heard multiple rumors making me believe that you have
been summarizing the contents of this conversation to other people in a
highly inaccurate way. Perhaps you weren't paying close attention to
what I said, or perhaps you weren't careful in how you summarized it.
There are other possible explanations---perhaps the rumors I've heard do
not reflect what you actually said; perhaps I seriously miscommunicated
something---but the bottom line is that I'm not confident in the
reliability of the communication channel.
Second, some of the things you've said sound more severe than simply
wanting advice. It seems to me that you're facing problems that you
don't feel able to resolve on your own: your goal is for other people,
in particular me, to take action. However, a strictly confidential
conversation makes action impossible. My role in such a conversation is
purely as an advisor; complaints and other requests for action require
different procedures.
Given these concerns, I've decided that this message will be the end of
our strictly confidential conversation. I recommend that you send me a
separate message explaining in detail what problems you're facing---
without any reference to the previous conversation; again, it's
procedurally impossible for me to take action that relies even slightly
on any portion of a strictly confidential conversation---and explaining
what actions you would like me to take.
I'm sorry if this sounds excessively formal, but following proper
procedures avoids errors and provides protection for everyone involved.
---Dan"
From a followup email sent by Dan:
"
> In fact, I told both Dan and Tanja in June that I felt I had no option
> but to resign, due to sexual harassment, blackmail, and physical abuse
> by another of their students.
Mr. de Valence fails to mention that what he told me was part of a
strictly confidential conversation. I was not even at liberty to
disclose to you the existence of this conversation.
After careful consideration, given what I now see Mr. de Valence
writing, I have concluded that the following limited disclosure is
proper: with all due respect, Mr. de Valence is wildly exaggerating the
contents of his conversation with me. It is with the utmost care that I
am choosing the words "wildly exaggerating".
[...]
> That student, Jacob Appelbaum, was fired this summer from his other
> job, at The Tor Project,
The article cited by Mr. de Valence says that Mr. Appelbaum resigned
from the Tor Project. "Was fired" is not an accurate summary.
I am Mr. Appelbaum's first supervisor. I am aware that Mr. Appelbaum has
been accused online of rape. I am also aware of the following articles
to the contrary by investigative journalists:
I don't know which side is correct, and I'm certainly not in a position
to judge. Obviously it is important for criminals to be punished, and it
is also important for innocent people to be protected against false
accusations; this is why we have courts.
[...]
Six days before the deadline, Mr. de Valence said on the chat system
that he wouldn't get much done that day or the next day because he felt
"quite burnt out from last week and travel and some life crises", and
that he would check back in the next day. He then fell silent, with the
status of his work far from clear.
Three days later, after the lead student finally managed to track him
down by smartphone, Mr. de Valence sent one message saying
Hi, sorry if I was unclear, I merged the WIP code I had into master
so that other people could work on it, because I am burnt out and
can't do both implementation work and the Tor meeting at the same
time.
He then fell silent again. It turned out that the software was quite far
from a satisfactory state. The rest of the team had to stay up late
nights writing code and text to get the submission done on time.
Two weeks later, to my astonishment, Mr. de Valence gave a public talk
at the University of Waterloo on the results of the paper. He had never
asked the team for permission; he had never even notified anyone else on
the team that he was planning to give a public talk. (I first heard
about the talk from a Waterloo tweet two days before the talk.) The only
part publicly announced before that, a tweet in September, had clear
consensus of the team; the question of what to announce when had been an
explicit discussion topic for much longer. As for content, Mr. de
Valence's previous slides for a private ECRYPT-NET audience needed quite
a few fixes, were missing cryptographic context, and predated tons of
work on the paper by the rest of the team. Even today I don't know what
his Waterloo slides said; he never replied to my email asking for
slides.
"
I have to split up this comment in order to post it due to HN's length limit. See my reply below.
"Dan has written at some length about the importance of “due process”, both internally to the research group and externally to the world. But it’s telling to notice that in every such discussion, Dan carefully avoided any mention of concrete processes: he did not define the “different procedures” suddenly required for him to take action, nor what “proper procedures” should be followed."
This is patently false. Dan sent a series of emails that clearly outlined both the procedure to take to file a formal complaint, as well as Dan's reasoning for insisting on these procedures.
I recommend reading https://www.hdevalence.ca/etc/34de2f3c2a48f7da/EmAiLs.txt in its entirety. It isn't something that can be summarized. I've done my best, but I have cherry-picked quotes here which both support and defend Dan. Why? I feel it's important for someone to point out that insisting that someone file a formal complaint is not the same thing as failing to take action.
Again, the length of https://www.hdevalence.ca/etc/34de2f3c2a48f7da/EmAiLs.txt and the emotions that are invested in this situation will prevent most readers from actually reading the full emails in their entirety before making a judgement. But I strongly recommend taking the time to do this.
Note that in no way am I condoning or defending anything about Jacob's behavior. There is enough anecdotal evidence to be extraordinarily suspicious of him. But I am uncomfortable with the idea that Dan is getting thrown under the bus solely because he insisted that Henry file a formal complaint, and because Dan refused to take action based on off-the-record conversations.
D. Responsible Employees and Reporting22
D-1. Which school employees are obligated to report incidents of possible sexual violence to
school officials?
Answer: Under Title IX, whether an individual is obligated to report incidents of alleged
sexual violence generally depends on whether the individual is a responsible employee of
the school. A responsible employee must report incidents of sexual violence to the Title IX
coordinator or other appropriate school designee, subject to the exemption for school
counseling employees discussed in question E-3. This is because, as discussed in question
A-4, a school is obligated to address sexual violence about which a responsible employee
knew or should have known. As explained in question C-3, the Title IX coordinator must be
informed of all reports and complaints raising Title IX issues, even if the report or
22 This document addresses only Title IX’s reporting requirements. It does not address requirements under the
Clery Act or other federal, state, or local laws, or an individual school’s code of conduct.
Page 15 – Questions and Answers on Title IX and Sexual Violence
complaint was initially filed with another individual or office, subject to the exemption for
school counseling employees discussed in question E-3.
D-2. Who is a “responsible employee”?
Answer: According to OCR’s 2001 Guidance, a responsible employee includes any
employee: who has the authority to take action to redress sexual violence; who has been
given the duty of reporting incidents of sexual violence or any other misconduct by
students to the Title IX coordinator or other appropriate school designee; or whom a
student could reasonably believe has this authority or duty.
23
A school must make clear to all of its employees and students which staff members are
responsible employees so that students can make informed decisions about whether to
disclose information to those employees. A school must also inform all employees of their
own reporting responsibilities and the importance of informing complainants of: the
reporting obligations of responsible employees; complainants’ option to request
confidentiality and available confidential advocacy, counseling, or other support services;
and complainants’ right to file a Title IX complaint with the school and to report a crime to
campus or local law enforcement.
======
I don't know the people involved in this story, and have no stake/stance on the claim itself (I'm not involved in infosec). However, given similar stories when Title IX issues arise in athletics where coaches/athletic directors/etc. try to avoid taking responsibility for reporting sexual harassment/assault allegations that have been vocalized and/or do not inform complainants of their full options, it sounds very likely that the professors did not take proper action if Title IX applies because the onus is on an employee to take action when the employee gets wind of an allegation. Probably the biggest case in the sports world that exemplifies this is the Sandusky rapes and Penn State, where allegations were not reported up the chain.
I'm not sure what the jurisdiction is here, and whether it was something under US jurisdiction (I saw some talk about UIC, short for Univ. of Illinois-Chicago, but also a Dutch university as well). I just thought to add some context around this type of issue that many here may not be aware of - Title IX is considered extremely serious with regards to the US education system.
> It is completely standard for a complaint to go first to the alleged
culprit, then (if that doesn't resolve the problem) to the supervisor,
and so on up the chain. This certainly isn't something I invented, and
I'm puzzled as to why Mr. de Valence seems to be skipping steps.
> Of course there are some circumstances where HR can be, should be, or
must be involved. Mr. de Valence is wrong in suggesting that I said
anything to the contrary. There wasn't any reason for me to mention HR
when I was recommending that he file a written complaint with me.
This doesn't pass the sniff test to me. If a complaint is verbal, sure culprit first and then supervisor... which is what happened. If a complaint is written, I've never heard of it being standard procedure to give a written complaint to the accused first. As for involving HR, someone seriously complaining of sexual harassment (both parties indicate a significant confidential initial talk) is a giant red flag to get HR on-board. 'We've talked, write to me first and then we'll talk about it more' doesn't smell right.
My reading of the situation? Both sides appear to be arses. The complainant keeps talking to new parties without submitting the written complaint that was requested multiple times. The supervisor engages in questionable advice. It doesn't seem any party comes out particularly clean on this one, to me (sitting on the sidelines, getting an imperfect view...).
From the article, Dan and Tanja are superiors in a workplace, not unrelated folks in a volunteer project. It's their responsibility to ensure a safe place to work - telling people to take it to the courts is an unreasonable way to start dealing with an internal HR problem.
They do not reflect a reasonable grasp of how functional workplaces happen, how the legal system works, or what the university policies they he is bound to follow require.
Even something as simple as his insistence that either the crime of rape or the crime of slander has been committed is naive and wrong, and it closely reflects one of the more damning sections from the linked blog post. (The issues are, briefly, that 1) it's not a binary and both or neither could easily be true 2) even if it was a binary result set, the legal system doesn't render innocent verdicts; all it can do is decide if something has been shown beyond reasonable doubt 3) all of that is irrelevant to his role as a supervisor and his responsibility to provide a safe workplace; he has obligations to take actions both before the legal system renders a verdict and regardless of what that verdict actually is.)
From https://www.hdevalence.ca/etc/34de2f3c2a48f7da/EmAiLs.txt
"Hi everybody,
As most of you know, we hired Jake for a 5-year PhD program, starting with a 50-50 split between Tor and TU/e, and increasing TU/e percentage assuming that the first year goes well.
The Tor Project put up a blog post yesterday afternoon saying that Jake had resigned from Tor. The blog post doesn't say "to concentrate on his PhD studies" or any other explanation. If you look on Twitter you'll find a shocking statement "Jake finally raped enough people that Tor as an organisation couldn't ignore it anymore" from Meredith Patterson, and a rapidly growing pile of comments.
If it's true that Jake raped someone then of course he should go to jail for this heinous crime. If it's not true then the source of the false accusation should be appropriately punished for slander. Clearly _someone_ has broken the law.
But it's not my job to issue punishment, or to figure out who deserves punishment. I'm going to presume _everyone_ innocent until proven guilty. Everyone has a right to due process: being told exactly what the accusations are, having adequate chance to respond, having hearings in front of a neutral judge, etc.
Often people are falsely accused of crimes. I see it as part of my duty, as a member of a civilized society, to avoid prejudging and punishing people who are accused and who have not had their day in court. On the opposite side, often people are correctly accused of crimes, and I also see it as part of my duty to avoid prejudging and punishing accusers who have not had their day in court.
As long as nobody goes to court claiming rape or slander, I would ask that you join me in presuming that the accusations of rape are false, _and_ in presuming that the accusations of slander are false. Assuming that someone _does_ go to court, I would ask that you join me in waiting for judges and juries to do their jobs---no matter how tempting it is to instead join a poorly informed mob on one side or the other. I'm not saying that judges and juries never make mistakes; I'm saying that the alternatives are much worse.
---Dan"
Furthermore, from the article:
"Isis told Tanja their story of being raped by Jacob, without identifing it as theirs. Tanja’s response was to ask “Why were they in the same bed with Jake?”, and when I asked Tanja whether, if someone she knew personally came to her with this story, she would believe them. Tanja said no, not without hearing Jake’s explanation. At this point myself and Isis left in tears, ending the conversation."
From the emails file:
" Dear Harry,
A few weeks ago you initiated a strictly confidential, and ongoing, conversation with me. During this conversation I have been listening carefully to what you've been saying, frequently summarizing to confirm my understanding, asking questions regarding various details, and providing my advice as to the best procedures for you to follow.
I'm deeply concerned about this conversation, for two basic reasons.
First, I've now heard multiple rumors making me believe that you have been summarizing the contents of this conversation to other people in a highly inaccurate way. Perhaps you weren't paying close attention to what I said, or perhaps you weren't careful in how you summarized it. There are other possible explanations---perhaps the rumors I've heard do not reflect what you actually said; perhaps I seriously miscommunicated something---but the bottom line is that I'm not confident in the reliability of the communication channel.
Second, some of the things you've said sound more severe than simply wanting advice. It seems to me that you're facing problems that you don't feel able to resolve on your own: your goal is for other people, in particular me, to take action. However, a strictly confidential conversation makes action impossible. My role in such a conversation is purely as an advisor; complaints and other requests for action require different procedures.
Given these concerns, I've decided that this message will be the end of our strictly confidential conversation. I recommend that you send me a separate message explaining in detail what problems you're facing--- without any reference to the previous conversation; again, it's procedurally impossible for me to take action that relies even slightly on any portion of a strictly confidential conversation---and explaining what actions you would like me to take.
I'm sorry if this sounds excessively formal, but following proper procedures avoids errors and provides protection for everyone involved.
---Dan"
From a followup email sent by Dan:
" > In fact, I told both Dan and Tanja in June that I felt I had no option
> but to resign, due to sexual harassment, blackmail, and physical abuse
> by another of their students.
Mr. de Valence fails to mention that what he told me was part of a strictly confidential conversation. I was not even at liberty to disclose to you the existence of this conversation.
After careful consideration, given what I now see Mr. de Valence writing, I have concluded that the following limited disclosure is proper: with all due respect, Mr. de Valence is wildly exaggerating the contents of his conversation with me. It is with the utmost care that I am choosing the words "wildly exaggerating".
[...]
> That student, Jacob Appelbaum, was fired this summer from his other
> job, at The Tor Project,
The article cited by Mr. de Valence says that Mr. Appelbaum resigned from the Tor Project. "Was fired" is not an accurate summary.
> on account of other abusive behaviour, as
> described in The New York Times:
> https://www.nytimes.com/2016/07/28/technology/tor-project-ja...
I am Mr. Appelbaum's first supervisor. I am aware that Mr. Appelbaum has been accused online of rape. I am also aware of the following articles to the contrary by investigative journalists:
http://www.zeit.de/kultur/2016-08/jacob-appelbaum-rape-sexua...
https://taz.de/Der-Fall-Jacob-Appelbaum/!5361578/
I don't know which side is correct, and I'm certainly not in a position to judge. Obviously it is important for criminals to be punished, and it is also important for innocent people to be protected against false accusations; this is why we have courts.
[...]
Six days before the deadline, Mr. de Valence said on the chat system that he wouldn't get much done that day or the next day because he felt "quite burnt out from last week and travel and some life crises", and that he would check back in the next day. He then fell silent, with the status of his work far from clear.
Three days later, after the lead student finally managed to track him down by smartphone, Mr. de Valence sent one message saying
He then fell silent again. It turned out that the software was quite far from a satisfactory state. The rest of the team had to stay up late nights writing code and text to get the submission done on time.Two weeks later, to my astonishment, Mr. de Valence gave a public talk at the University of Waterloo on the results of the paper. He had never asked the team for permission; he had never even notified anyone else on the team that he was planning to give a public talk. (I first heard about the talk from a Waterloo tweet two days before the talk.) The only part publicly announced before that, a tweet in September, had clear consensus of the team; the question of what to announce when had been an explicit discussion topic for much longer. As for content, Mr. de Valence's previous slides for a private ECRYPT-NET audience needed quite a few fixes, were missing cryptographic context, and predated tons of work on the paper by the rest of the team. Even today I don't know what his Waterloo slides said; he never replied to my email asking for slides. "
I have to split up this comment in order to post it due to HN's length limit. See my reply below.