/me cries but supports the request

Thanks Luca!
@Nuria can we get a manager to approve this as well? @faidon or @mark maybe?
Further, can you sign https://phabricator.wikimedia.org/L2

Thanks!

The offboarding script has an option for "stay volunteer".

NDA signed now but I do not have access to https://phabricator.wikimedia.org/L2?

@Nuria Try again now, I just added you to the project called "WMF-NDA-Requests" (https://phabricator.wikimedia.org/project/profile/974/) which seems like it's needed to allow you to sign (https://wikitech.wikimedia.org/wiki/Volunteer_NDA)

done!

Mentioned in SAL (#wikimedia-operations) [2020-10-23T22:56:29Z] <mutante> added Nuria to "nda" LDAP group - leaving her in "wmf" until the actual last day - shell account remains so no puppet change needed in ldap_only_admins (T266086)

In T266086#6575705, @Stashbot wrote:

Mentioned in SAL (#wikimedia-operations) [2020-10-23T22:56:29Z] <mutante> added Nuria to "nda" LDAP group - leaving her in "wmf" until the actual last day - shell account remains so no puppet change needed in ldap_only_admins (T266086)

cc: @KFrancis You have it on file in the right system as well?

@Dzahn because they are an employee of the WMF, the NDA is kept in file by T&C.

I can confirm https://phabricator.wikimedia.org/L2 has been signed by @Nuria
We'd still need a C-Level approval for this. I will seek Grant's approval for this

In T266086#6575066, @Dzahn wrote:

The offboarding script has an option for "stay volunteer".

This is very useful! Thanks

In T266086#6575708, @Dzahn wrote:

In T266086#6575705, @Stashbot wrote:

Mentioned in SAL (#wikimedia-operations) [2020-10-23T22:56:29Z] <mutante> added Nuria to "nda" LDAP group - leaving her in "wmf" until the actual last day - shell account remains so no puppet change needed in ldap_only_admins (T266086)

cc: @KFrancis You have it on file in the right system as well?

Yeah, confirmed the NDA is all complete (and shows up at https://docs.google.com/spreadsheets/d/1xQNx5s2yErvayCMzvk9VkIA2ZihFXSBEhT5Z5ziCsi4)

Having never dealt with this before here, can someone clarify for me what exactly keeping access entails and how it compares to our policies? In other words, what am I being asked to sign off on? @Marostegui

@gsingers We have three major types of NDA/MOU under which people get access to PII-sensitive data on our servers:

• Everyone who's WMF staff has signed an NDA as part of their work contract
• Researchers get access to some data after signing a MOU (with a person on the WMF side being a point of contact and time-limited until the research is completed)
• Some people from the community have signed an NDA (called the Volunteer NDA in contrast to the NDA which applies to staff) which allows them to e.g. debug problems in production, deploy code changes, review Logstash/Turnilo etc.

The volunteer NDA applies only to production servers and some web services which hold PII-sensitive data, it does not extend to anything operated by OIT/ITS (like no wikimedia.org address, no access to Google Docs, Betterworks, etc.).

If a staff member leaves, they have the option to sign the volunteer NDA (essentially replacing the NDA which they had previously upheld throught their work contract) if they want to resume some of their former technical work in a volunteer capacity (it's not the norm (maybe one out of four?), but we have quite a few cases of former staff members which stick around and help out). And each of those volunteer NDAs needs to be signed off by the person's manager.

@MoritzMuehlenhoff Thanks! Approved.

Mentioned in SAL (#wikimedia-operations) [2020-10-31T00:12:39Z] <mutante> removed Nuria from wmf group, she is already in nda group (T266086)

email address changed: https://gerrit.wikimedia.org/r/c/operations/puppet/+/636936