After several attendees of this year’s Chaos Communication Congress (CCC) in Germany said organisers have continued to downplay or ignore issues of harassment and sexual assault, Chelsea Komlo, an open-source software developer and Tor contributor, is speaking out publicly about the rape and assault she says she experienced in an attempt to help combat the toxic environment that some say has plagued the annual privacy and security conference for years.
Photo: Getty
The Chaos Computer Club, which organises CCC, faced pressure in 2016 to bolster its response to harassment after multiple women came forward to accuse former Tor developer Jacob Appelbaum of rape and sexual assault. Appelbaum had delivered talks at CCC and been a prominent member of the security community.
Komlo told Gizmodo that CCC’s inaction this year in response to previous allegations of assault prompted her to speak publicly about her experience with Appelbaum for the first time. Komlo says Appelbaum raped her after CCC in 2015, an incident she previously described publicly under the pseudonym “River” in mid-2016.
“We’ve seen at CCC that the same things are continuing, and I felt like doing this was really important to prevent future harm to other people,” Komlo told Gizmodo.
At this year’s CCC, which runs through December 30, attendees have said that the conference organisers allowed a person who allegedly assaulted another attendee last year to attend this year’s conference and rejected talks about harassment. Dirk Engling, a spokesperson for CCC, told Gizmodo that the conference received very few submissions for talks about harassment but added that there are several lightning talks and self-organised sessions about these topics occurring at the conference.
Thomas Covenant, a programmer attending CCC, revealed this week that the conference had chosen not to ban their abuser even after Covenant provided medical records and police reports detailing the assault. Engling said that CCC reviewed the materials provided by Covenant and chose not to issue a ban.
“The process, in this case, had several unfortunate delays that led to the decision taking way too long. This is an issue we are discussing internally and will address in the future,” Engling said.
Covenant’s story of CCC not taking action to remove an accused abuser rang eerily similar to Komlo’s own experience and motivated her to speak about her experience, she said. “It mirrored the environment that allowed abuse to happen to me — people knowing about abuse and still allowing that person to come to the conference and be welcome and be around vulnerable people,” Komlo said. “That environment is what resulted in my rape by Jacob.”
Komlo was attending her first CCC in 2015 when she briefly met Appelbaum. He later propositioned her for group sex within minutes of seeing her at a social event, she said, and she declined.
Komlo had previously seen Appelbaum give a talk about privacy, which inspired her to become more involved with the security community. She looked up to him, and when others laughed off his sexual comments, she followed their lead.
After each CCC, which is held at the end of December, many attendees travel to Berlin to celebrate New Year’s Eve. Komlo went on the trip in 2015 and stayed with Appelbaum for several days in Berlin. During the trip, they had consensual sex, Komlo said. Appelbaum also raped her one night while she was intoxicated and argued with her when she asked him to stop, she said.
“What has always stood out to me is that when I met him, he asked me several times to participate in an orgy with his male friends. And I said no,” she explained. “I said no every single time and was extremely clear. He worked to earn my trust, and when I was alone with him and his male friends, he crossed those boundaries.”
In her 2016 pseudonymous statement, in a recent interview with Gizmodo, and in an on-record statement published today, Komlo said that Appelbaum raped her in front of several male friends while she was intoxicated. One of the other men present also assaulted her, she said.
“I didn’t understand what was happening, but I eventually said no. The next thing I remember was him having sex with me in front of his friends,” she said. “I had never expressed consent and what happened was something I explicitly told Jake I didn’t want to do. I wasn’t able, at the time, to stop what was happening to me. It wasn’t a misunderstanding or me wishing later it hadn’t happened.”
Two individuals confirmed to Gizmodo that Komlo told them about the incident in the months after it occurred. One individual asked not to be named out of concern for their personal safety. The other is Isis Lovecruft, a Tor developer who has called attention to CCC’s handling of abuse and spoken out about their interactions with Appelbaum.
Komlo also participated in the Tor Project’s internal investigation into Appelbaum’s behaviour, which concluded in his resignation from the organisation, Tor Project’s executive director, Shari Steele, said.
“My reasoning for asking him to resign was broader than just Chelsea,” Steele said. “Chelsea was finally the straw that broke the camel’s back, but I had heard numerous accounts. When I asked him to resign, it was over a pattern of behaviour.” Appelbaum resigned from the Tor Project on May 25 of last year. Tor hired an independent investigator to look into the allegations against Appelbaum, including Komlo’s, and found them to be credible, Steele explained.
Appelbaum did not respond to a request for comment from Gizmodo. In a 2016 statement, issued when the allegations against him became public, Appelbaum said that his accusers were participating in “a calculated and targeted attack” designed “to spread vicious and spurious allegations against me.”
Komlo considered publishing a statement about her experience in 2016, using her real name, but she ultimately decided not to because she feared retaliation and because it seemed that organisations with which Appelbaum was affiliated were taking action. The Tor Project, the privacy non-profit where Appelbaum had worked, conducted an internal investigation into his behaviour and replaced its entire board.
The second individual involved in Komlo’s assault went through a community justice process, apologising to her and engaging in a genuine effort to make things right, she said. “I forgave this person, and I firmly believe that individuals (and organisations) who have committed mistakes should be forgiven if they truly understand the harm done and genuinely work to make things right for the future,” Komlo wrote in her statement.
Lovecruft said that the community justice process can sometimes be helpful for groups reckoning with abuse. “An accountability process is a process,” they said in a message to Gizmodo. “Just like any process, as in software, there are edge cases, unexpected inputs. It needs maintenance, and sometimes patches, to keep it working as designed — just like any software. It is also important that both these processes have logic for handling fatal errors when the programme cannot continue, when something goes horribly wrong.”
CCC announced last year that Appelbaum would no longer be welcome at its events, although it did not mention him by name, instead describing him as “a regular visitor and speaker.”
But the renewed allegations of ignored misconduct at CCC led Komlo to believe that CCC isn’t taking abuse seriously.
“The fact that this happened to me and is happening now, the negligence of the people who are around reported abusers — that’s what I would like to call attention to,” Komlo said. “The CCC says, ‘all creatures welcome.’ That’s fine until someone is abusive. You need punishment; you need clear boundaries about what is and isn’t acceptable in your community. When things aren’t drawn out, and there aren’t processes in place, and there’s not a clear structure for acting on abuse, people don’t know what to do, so they’re inactive and bad behaviour just continues.”
According to Engling, CCC does prohibit harassment and assault. In 2005, it denounced “chauvinism and nationalism.” In 2012, the organisation announced that it was developing an anti-harassment policy and endeavouring to respond more quickly to reports of harassment.
And in its current code of conduct, CCC says it has three teams in place for mediating conflicts, preventing violence, and engaging in crisis intervention. Although the code of conduct does not explicitly prohibit sexual harassment or assault, it does say that participants are expected to keep the environment safe and that “lifeforms not ascending to this level of dignity are not welcome.”
“The CCC’s stance on violence, harassment or discrimination is crystal clear and has been stated repeatedly,” Engling said.
Until CCC and other organisations set firm anti-harassment policies and name individuals like Appelbaum who have been banned from attending, Komlo and Steele say that women entering the privacy community for the first time run the risk of being harmed.
“For a long time, there were people in our information security community who were doing harm to people, and it was almost seen as expected,” Steele explained. The Tor Project’s reckoning last year was a painful but necessary process to eliminate abuse, she said. “We are seeing societally that this notion of men behaving badly has gone rampant. It is pretty wonderful to see women feeling strong enough now that they can say something.
The best thing I can say for an organisation is, take a look at your policies and procedures. Make sure victims can feel protected if they come forward and you are true to that, not simply that you are providing lip service or have something on the books. You believe them, you act on it, you protect them.”
Tor’s action on the issue may have led to the organisation being penalised by CCC. In a blog post, Lovecruft said that CCC had purposefully rejected talks that dealt with harassment — a claim CCC denied through its spokesperson.
“You can look at the facts and make your own determinations. For years and years, Tor would do its ‘State of the Onion’ talk at CCC,” Steele said. “The year after Jake was no longer employed at Tor, all of our talks, including ‘State of the Onion,’ were rejected.”
CCC’s denial of allegedly rejecting talks related to harassment or from Tor presenters shows that the organisation is not focused on addressing its harassment issue, Lovecruft said. “They’re doing the same pattern again: to do whatever they can in private to shut down conversations and stop progress, and do whatever they can in public to save face,” they said.
Chasing out participants who speak out about abuse, rather than abusers themselves, puts community members at risk, Komlo said.
“I saw [Appelbaum] as a leader in the community and so I trusted him. That’s why it’s so painful to see abusers tolerated in the community. I know new people are going to walk in having no idea and be taken advantage of,” Komlo said. “You don’t want the only new people to be ones who can survive that kind of thing.”
Additional reporting by Melanie Ehrenkranz