DerbyCon Clarifications, Inclusiveness, and Gender

Since our announcement in mid-January that DerbyCon will be shutting its doors, we have received tremendous feedback from the community. We truly appreciate all of the kind thoughts and encouragement from our peers.

This was not an easy decision for us to make, but the bottom line is that DerbyCon is an enormous undertaking for our team, and a tremendous burden on our personal and professional lives every year. Over the years, the members of the DerbyCon team have grown professionally and in our family lives, and quite frankly, the increased demands of the conference have simply become overwhelming.

However, we do feel it is important to clarify our previous statement on this matter, as it has been misinterpreted by a number of people. The intention behind the earlier statement was to express our sincere frustration and fatigue with the online personal attacks we have seen propagated through social media and private online groups, and in this case targeted conference staff, attendees, and others. This statement was not intended to denounce specific individuals or gender, it was a denouncement of the overall behavior and online toxicity that we have become increasingly concerned with in recent years. We want to be clear that our statement was not directed at those who report harassment, concerns about safety and security, or any other legitimate issues or opinions regarding the conference. Our post should have provided more clarity than it did in order to avoid confusion, and for that we apologize. In leaving the reference vague, we had hoped to avoid perpetuating the same types of personal attacks that we have found so concerning.

We would also like to take this opportunity to address concerns that have come up recently about the under-representation of women in our industry and at Information Security conferences in general, and to solicit ideas on how to make our final DerbyCon a more positive and inclusive experience for everyone.

We have always believed that women play an important role in our industry. We hope this goes without saying, but women are a valued part of our community and should always feel welcome and encouraged to participate in conferences, events, and any other opportunities that take place. While the security industry as a whole has a large percentage of men, we have worked each year to take steps to balance this ratio.

In 2017, we published our Code of Conduct, which specified how harassment would be dealt with, and we stand by these guidelines and at our conference. Harassment has no place at DerbyCon, and individuals will be removed if there are instances of harassment reported to or witnessed by staff. This includes harassing anyone who is reporting incidents at the conference or violating the code of conduct rules. Social media has posed new challenges for conferences and organizers, and it can be difficult for us to police social media, closed groups, or private conversations that do not take place at the conference. In instances that happen off conference grounds or outside of the conference time frame, it can be challenging for us to take decisive action. We rely heavily on ensuring conference safety during the conference and in the physical conference space. Using the reporting mechanisms available are important in order for us to respond swiftly and effectively to an incident.

Below is our 2017 post on our values and our code of conduct:

https://www.derbycon.com/blog/derbycon-values-safety-and-code-of-conduct/

In regard to diversity, DerbyCon staff is comprised of both men and women (including a 50/50 review board for talk submissions). Additionally, DerbyCon has both men and women taking on equally important roles in the conference and working toward its success. We firmly believe in fairness, inclusion, and respect for all members of the Information Security community. These values have long been a key part of the purpose, inclusiveness, and culture of the conference. These values are what we built DerbyCon on, and if there are individuals seeking to create a barrier for diversity for one gender, DerbyCon is not a place for them.

On the topic of safety, DerbyCon continues to be a safe conference with a low incident rate. We rely heavily on both volunteer staff and off-duty police officers who are present at the conference (and will be there throughout the entire conference this year). If there are issues where an attendee or volunteer member of staff are not adhering to DerbyCon’s code of conduct, they will be removed and in the latter case permanently excluded from being on staff. Additionally, we established an incident reporting system last year with 24-hour monitoring to make it easier for attendees to touch base with our staff about any problems or concerns during the conference. The code of conduct also outlines the reporting mechanisms for DerbyCon if personnel cannot be found immediately during an incident, as well as the direct line for the Marriott hotel security.

As far as handling incidents, DerbyCon has trained staff to handle any incidents that may arise, including when and where to escalate through a very formal chain of command, as well as law enforcement present at the conference. As a conference, we choose (as do other conferences) to not publicly discuss the details of incidents or decisions that occur at the conference as a matter of confidentiality and sensitivity to the parties involved.

DerbyCon stands by our code of conduct, ethics, and values, and we certainly do our best to handle any incident the best way we can in order to ensure the safety of our attendees. However, we are the first to admit that we could always do better and at times have handled communication poorly. We can and will continue to get better for our last DerbyCon.

Our goal behind the conference is to make it a fun, supportive, collaborative, and positive environment for the entire Information Security community, and we firmly believe in the fair treatment and inclusion of everyone. We are so proud of the past eight years of DerbyCon, the conference, and the difference we have made in the security industry. It has been an incredible experience for all of us and we appreciate all of the support and passion around the conference.

In this final year, the team is super excited to make the last DerbyCon the best yet and to celebrate nine amazing years as a conference for all.

Stay tuned for more updates on DerbyCon as we draw closer to the kickoff date.

-DerbyCon Team