5 ms·

> The company's compliance with law enforcement is limited to what is actually required by law. I'm distressed at how quickly the article brushes this off. Wha

> The company's compliance with law enforcement is limited to what is actually required by law. I'm distressed at how quickly the article brushes this off. What could The Law possibly demand of a music editors users? What am I misunderstanding here?

wyldfire 5y ago
I believe that once your open source software vendor collects telemetry, it becomes a concern to the users what kind of a custodian they will be for the data they collect. "Would they volunteer their users' data if asked by law enforcement?" for example would be a concern. And this answer seems to be "No, but they would comply with lawful court orders to produce their users' data."
- nixpulvis 5y ago
  I meam it's just such a strange statement. Are they really equipped to judge what is and isn't "actually required by law"? Would they be morally obligated to report the rogue officials illegally demanding information?
  - wyldfire 5y ago
    It's not illegal for law enforcement officials to ask companies for records nor is it illegal for the companies to give it unless it's explicitly privileged (like medicine, religious/legal counsel, etc). The law enforcement agents asking for the info are not rogue. It's tantamount to interviewing someone who might have information about a crime. The difference is that it's so terribly easy to go fishing for an enormous amount of information and companies can legally just go ahead and comply. I think it's actually occurred in the past (many times?) which is why it's identified as an item of concern.
    - nixpulvis 5y ago
      If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no?
      - wyldfire 5y ago
        Well, yeah hire lawyers! > I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no? shrug throw it on the pile of sorely needed legislative changes. The laws just haven't kept up with things.
      - autoexec 5y ago
        > If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. In the US you may not even be given any choice in the matter. They just hand you a national security letter and you're forced to give them access to anything they want for as long as they want it while being forbidden from ever telling anyone (your customers, your shareholders, the press, etc) that it's even happening. The laws really need to be changed, but how do you petition government to give up so much power? Hell, the NSA has outright lied to congress about what they're doing so our lawmakers can't even know about the data collection going on until some brave whistleblower comes along who is willing to sacrifice everything to let us know.
        samus 5y ago
        A agent with black sunglasses and a national security letter is a very different case from cops going on a fishing trip. It's a bad idea to ignore the former. But there is probably (IANAL) no requirement to answer to queries of the latter, unless they also have a court order.
        5y ago
  - michaelmrose 5y ago
    They would be liable to be required by law NOT to report that.
- autoexec 5y ago
  Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to be responsible for maintaining, securing, removing, or providing that data when law enforcement (or the state) comes knocking. Nobody using the software is asking for this data collection. Even with their "assurance" that data isn't kept for more than 24 hours, that's more than enough time for it to copied and shared with any number of parties and without independent audits we have no means to be certain the data is being cared for or removed as they claim. Just don't collect any more info that you absolutely need and users don't have to put their faith in you that it won't be abused, you don't have to deal with the headaches and if law enforcement should ever come around asking you can just say "Sorry, we don't collect that information" and you don't have waste time dealing with those requests either.
  - void_mint 5y ago
    > Why collect the data in the first place? To sell, obviously.
    - TedDoesntTalk 5y ago
      No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
      - pmontra 5y ago
        They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
        TedDoesntTalk 5y ago
        They’re not storing IP addresses. Read the post on GitHub.
babypuncher 5y ago
That doesn't really matter, once you have data and the cops show up with a warrant asking for it, you are required by law to hand it over
- gizdan 5y ago
  You cannot hand over what you don't have. A software being offline has that advantage going for it. You don't see law enforcement going to the GIMP's development team saying "we need this persons GIMP data", which is arguably more likely to be abused.
  - babypuncher 5y ago
    Right, but I'm just explaining why there is nothing unusual or alarming about a privacy policy saying that they will comply with law enforcement when legally required. This is all a non-issue since the telemetry is entirely opt-in and can even be stripped out entirely with a single make flag.
michaelmrose 5y ago
You could be leaking enough data about the hash or acoustic fingerprint of files users are editing which could be correlated with enough unique information to identify a user. On the positive side you could identify the user who created ransom_message.mp3 in the exceedingly unlikely case this scenario comes to pass. More realistically you could identify the creator of unpopular_religious_message005.mp3 or how about helping a repressive regime locate any and all creators of any of 385 banned religious or political ideas?
viraptor 5y ago
It's common to include that in privacy policies and it's more of a FYI. This will apply whether they include it in the policy or not.

wyldfire 5y ago

I believe that once your open source software vendor collects telemetry, it becomes a concern to the users what kind of a custodian they will be for the data they collect. "Would they volunteer their users' data if asked by law enforcement?" for example would be a concern. And this answer seems to be "No, but they would comply with lawful court orders to produce their users' data."

nixpulvis 5y ago
I meam it's just such a strange statement. Are they really equipped to judge what is and isn't "actually required by law"? Would they be morally obligated to report the rogue officials illegally demanding information?
- wyldfire 5y ago
  It's not illegal for law enforcement officials to ask companies for records nor is it illegal for the companies to give it unless it's explicitly privileged (like medicine, religious/legal counsel, etc). The law enforcement agents asking for the info are not rogue. It's tantamount to interviewing someone who might have information about a crime. The difference is that it's so terribly easy to go fishing for an enormous amount of information and companies can legally just go ahead and comply. I think it's actually occurred in the past (many times?) which is why it's identified as an item of concern.
  - nixpulvis 5y ago
    If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no?
    - wyldfire 5y ago
      Well, yeah hire lawyers! > I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no? shrug throw it on the pile of sorely needed legislative changes. The laws just haven't kept up with things.
    - autoexec 5y ago
      > If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. In the US you may not even be given any choice in the matter. They just hand you a national security letter and you're forced to give them access to anything they want for as long as they want it while being forbidden from ever telling anyone (your customers, your shareholders, the press, etc) that it's even happening. The laws really need to be changed, but how do you petition government to give up so much power? Hell, the NSA has outright lied to congress about what they're doing so our lawmakers can't even know about the data collection going on until some brave whistleblower comes along who is willing to sacrifice everything to let us know.
      - samus 5y ago
        A agent with black sunglasses and a national security letter is a very different case from cops going on a fishing trip. It's a bad idea to ignore the former. But there is probably (IANAL) no requirement to answer to queries of the latter, unless they also have a court order.
      - 5y ago
- michaelmrose 5y ago
  They would be liable to be required by law NOT to report that.
autoexec 5y ago
Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to be responsible for maintaining, securing, removing, or providing that data when law enforcement (or the state) comes knocking. Nobody using the software is asking for this data collection. Even with their "assurance" that data isn't kept for more than 24 hours, that's more than enough time for it to copied and shared with any number of parties and without independent audits we have no means to be certain the data is being cared for or removed as they claim. Just don't collect any more info that you absolutely need and users don't have to put their faith in you that it won't be abused, you don't have to deal with the headaches and if law enforcement should ever come around asking you can just say "Sorry, we don't collect that information" and you don't have waste time dealing with those requests either.
- void_mint 5y ago
  > Why collect the data in the first place? To sell, obviously.
  - TedDoesntTalk 5y ago
    No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
    - pmontra 5y ago
      They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
      - TedDoesntTalk 5y ago
        They’re not storing IP addresses. Read the post on GitHub.

babypuncher 5y ago

That doesn't really matter, once you have data and the cops show up with a warrant asking for it, you are required by law to hand it over

gizdan 5y ago
You cannot hand over what you don't have. A software being offline has that advantage going for it. You don't see law enforcement going to the GIMP's development team saying "we need this persons GIMP data", which is arguably more likely to be abused.
- babypuncher 5y ago
  Right, but I'm just explaining why there is nothing unusual or alarming about a privacy policy saying that they will comply with law enforcement when legally required. This is all a non-issue since the telemetry is entirely opt-in and can even be stripped out entirely with a single make flag.

michaelmrose 5y ago

You could be leaking enough data about the hash or acoustic fingerprint of files users are editing which could be correlated with enough unique information to identify a user. On the positive side you could identify the user who created ransom_message.mp3 in the exceedingly unlikely case this scenario comes to pass. More realistically you could identify the creator of unpopular_religious_message005.mp3 or how about helping a repressive regime locate any and all creators of any of 385 banned religious or political ideas?

viraptor 5y ago

It's common to include that in privacy policies and it's more of a FYI. This will apply whether they include it in the policy or not.