Splitting from T341272 to cover the general issue; temporarily assigning to @KFrancis per last comment, as I wondered again how to best proceed in T348520:
In T341272#8997885, @Dzahn wrote:There is a process described at https://wikitech.wikimedia.org/wiki/Volunteer_NDA that says what is needed is signing "the NDA" (which links to the old "L2" document on Phabricator -> https://phabricator.wikimedia.org/L2) and then approval from a C-Level and then we could grant that access.
Then of course we also have _the other NDA_ process which we usually have been following lately, which includes adding you and then the users singing the document you provide to them etc, as is described at:
https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#NDA_Group
This is usually done when user are added to the "LDAP group nda" (https://wikitech.wikimedia.org/wiki/SRE/LDAP/Groups#NDA_group), but in this case we don't need the additional access that this would grant.
When we hand out the equivalent access to WMF staff, we add them to the "LDAP group wmf" and then _a rule was added that we always ALSO add them to the "WMF-NDA" group on phabricator. (cc: @Aklapper who once requested that to simplify the process).
It is still unclear whether the same rule should apply to volunteers. To determine that is an unresolved ticket at https://phabricator.wikimedia.org/T299839.
Since this repeatedly has caused discussions how to handle the access requests the right way, here are some questions for you:
- Does signing https://phabricator.wikimedia.org/L2 nowadays have any meaning from the point of view of legal? Is a user singing that relevant for anything still?
- Would it be ok or wrong to grant access to private data only based on L2 and manager/c-level approval but without the volunteer ever signing anything directly with legal?
- When we share private tickets with volunteers, should they go through you and sign with you in general? If we do that, can we skip the C-level approvals?
- Does it matter to you if the sharing of information is limited to sharing private tickets vs handing our other logins via the LDAP group called "nda"?
Based on your responses I think we should maybe update https://wikitech.wikimedia.org/wiki/Volunteer_NDA and/or https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#NDA_Group to make clear what applies where and is the currently valid one.
In T341272#8998112, @Aklapper wrote:Agreeing with what Dzahn wrote in the previous comment. For historical context: It seems WMF Legal gave its OK in 2015 to using Legalpad in T655. However given fluctuation I'm not sure if everybody is still fully aware of it and the implications. I admit I am also confused when an NDA on file with WMF-Legal dept is required, and when signing L2 in Phabricator Legalpad is sufficient, and it also seems that either there is no consistent policy or public documentation is potentially outdated. Question: Should this get revised, preferably in a separate task?
(See also T111271 for a random example of using Legalpad in the past for [in my understanding] WMF-driven stuff - in this case, OTRS=Znuny.)
In T341272#8998430, @KFrancis wrote:Hi all, Let me do some research and get back to you! Thanks!!!