5 ms·

I believe that once your open source software vendor collects telemetry, it becomes a concern to the users what kind of a custodian they will be for the data th

I believe that once your open source software vendor collects telemetry, it becomes a concern to the users what kind of a custodian they will be for the data they collect. "Would they volunteer their users' data if asked by law enforcement?" for example would be a concern. And this answer seems to be "No, but they would comply with lawful court orders to produce their users' data."

nixpulvis 5y ago
I meam it's just such a strange statement. Are they really equipped to judge what is and isn't "actually required by law"? Would they be morally obligated to report the rogue officials illegally demanding information?
- wyldfire 5y ago
  It's not illegal for law enforcement officials to ask companies for records nor is it illegal for the companies to give it unless it's explicitly privileged (like medicine, religious/legal counsel, etc). The law enforcement agents asking for the info are not rogue. It's tantamount to interviewing someone who might have information about a crime. The difference is that it's so terribly easy to go fishing for an enormous amount of information and companies can legally just go ahead and comply. I think it's actually occurred in the past (many times?) which is why it's identified as an item of concern.
  - nixpulvis 5y ago
    If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no?
    - wyldfire 5y ago
      Well, yeah hire lawyers! > I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no? shrug throw it on the pile of sorely needed legislative changes. The laws just haven't kept up with things.
    - autoexec 5y ago
      > If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. In the US you may not even be given any choice in the matter. They just hand you a national security letter and you're forced to give them access to anything they want for as long as they want it while being forbidden from ever telling anyone (your customers, your shareholders, the press, etc) that it's even happening. The laws really need to be changed, but how do you petition government to give up so much power? Hell, the NSA has outright lied to congress about what they're doing so our lawmakers can't even know about the data collection going on until some brave whistleblower comes along who is willing to sacrifice everything to let us know.
      - samus 5y ago
        A agent with black sunglasses and a national security letter is a very different case from cops going on a fishing trip. It's a bad idea to ignore the former. But there is probably (IANAL) no requirement to answer to queries of the latter, unless they also have a court order.
      - rhizome 5y ago
        It's not and doesn't have to be an NSL, law enforcemnt can easily get a warrant via the third party doctrine. https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
- michaelmrose 5y ago
  They would be liable to be required by law NOT to report that.
autoexec 5y ago
Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to be responsible for maintaining, securing, removing, or providing that data when law enforcement (or the state) comes knocking. Nobody using the software is asking for this data collection. Even with their "assurance" that data isn't kept for more than 24 hours, that's more than enough time for it to copied and shared with any number of parties and without independent audits we have no means to be certain the data is being cared for or removed as they claim. Just don't collect any more info that you absolutely need and users don't have to put their faith in you that it won't be abused, you don't have to deal with the headaches and if law enforcement should ever come around asking you can just say "Sorry, we don't collect that information" and you don't have waste time dealing with those requests either.
- void_mint 5y ago
  > Why collect the data in the first place? To sell, obviously.
  - TedDoesntTalk 5y ago
    No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
    - pmontra 5y ago
      They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
      - TedDoesntTalk 5y ago
        They’re not storing IP addresses. Read the post on GitHub.

nixpulvis 5y ago

I meam it's just such a strange statement. Are they really equipped to judge what is and isn't "actually required by law"? Would they be morally obligated to report the rogue officials illegally demanding information?

wyldfire 5y ago
It's not illegal for law enforcement officials to ask companies for records nor is it illegal for the companies to give it unless it's explicitly privileged (like medicine, religious/legal counsel, etc). The law enforcement agents asking for the info are not rogue. It's tantamount to interviewing someone who might have information about a crime. The difference is that it's so terribly easy to go fishing for an enormous amount of information and companies can legally just go ahead and comply. I think it's actually occurred in the past (many times?) which is why it's identified as an item of concern.
- nixpulvis 5y ago
  If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no?
  - wyldfire 5y ago
    Well, yeah hire lawyers! > I understand the practicality of smaller scale inquiries, but at a certain size the rules really aught to change, no? shrug throw it on the pile of sorely needed legislative changes. The laws just haven't kept up with things.
  - autoexec 5y ago
    > If someone asked me to hand over access to a database with thousands if not millions of peoples PII, I would expect it to be "on the books", not just some fishing expedition. I would feel forced to hire lawyers just to validate the request. Fishing around would cause real harm to innocent bystanders. In the US you may not even be given any choice in the matter. They just hand you a national security letter and you're forced to give them access to anything they want for as long as they want it while being forbidden from ever telling anyone (your customers, your shareholders, the press, etc) that it's even happening. The laws really need to be changed, but how do you petition government to give up so much power? Hell, the NSA has outright lied to congress about what they're doing so our lawmakers can't even know about the data collection going on until some brave whistleblower comes along who is willing to sacrifice everything to let us know.
    - samus 5y ago
      A agent with black sunglasses and a national security letter is a very different case from cops going on a fishing trip. It's a bad idea to ignore the former. But there is probably (IANAL) no requirement to answer to queries of the latter, unless they also have a court order.
    - rhizome 5y ago
      It's not and doesn't have to be an NSL, law enforcemnt can easily get a warrant via the third party doctrine. https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
michaelmrose 5y ago
They would be liable to be required by law NOT to report that.

autoexec 5y ago

Why collect the data in the first place? When you aren't collecting IP addresses or CPU and OS details you don't need to worry about things like who is going to be responsible for maintaining, securing, removing, or providing that data when law enforcement (or the state) comes knocking. Nobody using the software is asking for this data collection. Even with their "assurance" that data isn't kept for more than 24 hours, that's more than enough time for it to copied and shared with any number of parties and without independent audits we have no means to be certain the data is being cared for or removed as they claim. Just don't collect any more info that you absolutely need and users don't have to put their faith in you that it won't be abused, you don't have to deal with the headaches and if law enforcement should ever come around asking you can just say "Sorry, we don't collect that information" and you don't have waste time dealing with those requests either.

void_mint 5y ago
> Why collect the data in the first place? To sell, obviously.
- TedDoesntTalk 5y ago
  No, not really. It’s clarified here: https://github.com/audacity/audacity/discussions/1353 https://github.com/audacity/audacity/discussions/1353 They want to know when it’s safe to drop support for a particular operating system version.
  - pmontra 5y ago
    They don't need the IP address for that. Of course their routers will see the address but they don't have to store it. If they store it it's because they need it for some reason.
    - TedDoesntTalk 5y ago
      They’re not storing IP addresses. Read the post on GitHub.