15 ms·

Otter.ai has saved reporters hours transcribing interviews. Caveat emptor

234 points by danso 5y ago

telesilla 5y ago
You can help. Offer your services and support to institutes such as Centre for Investigative Journalism. Training journalists to use tech is critical for keeping sources safe. https://tcij.org/ https://tcij.org/
sbierwagen 5y ago
Just like how The Intercept keeps burning its sources https://en.wikipedia.org/wiki/The_Intercept#Reality_Winner_controversy https://en.wikipedia.org/wiki/The_Intercept#Reality_Winner_c... you pretty much have to assume any time you talk to a reporter you're like one step removed from talking to a cop. You cannot assume any security competence at all. Putting the source's full first and last name on the recording and then sending it to a third party, sheesh.
- eesmith 5y ago
  What other sources have they burned? That Wikipedia page only lists Winner.
  - profunctor 5y ago
    It also lists two other whistle blowers who blame that journalist.
    - eesmith 5y ago
      This part? > NSA whistleblower John Kiriakou and Guantanamo Bay detention camp whistleblower Joseph Hickman have both accused the same reporter accused of revealing Winner's identity, Matthew Cole, of playing a role in their exposure, which, in Kiriakou's case, led to his imprisonment. I don't see where Kiriakou and Hickman were sources to The Intercept. The [35] links to https://www.peterbcollins.com/2017/06/30/in-depth-interview-whistleblowers-joe-hickman-and-john-kiriakou-on-abu-zubaydeh-torture-and-a-dangerous-reporter/ https://www.peterbcollins.com/2017/06/30/in-depth-interview-... which says: > In the final 5 minutes of the interview, both men share their stories of being burned by "journalist" Matthew Cole, whose work at ABC compromised Hickman and sent Kiriakou to prison. Cole was involved in the recent episode at The Intercept, where NSA leaker Reality Winner was apprehended after Cole shared her leaked document in an effort to verify it. The [36] links to https://www.cbc.ca/radio/asithappens/as-it-happens-tuesday-edition-1.4148070/ex-cia-whistleblower-blasts-reporters-for-not-protecting-alleged-nsa-leaker-reality-winner-1.4148075 https://www.cbc.ca/radio/asithappens/as-it-happens-tuesday-e... with (emphasis mine): > He later spent two years in prison for disclosing the identity of a fellow CIA officer to then-freelance journalist Matthew Cole, one of four authors of Monday's Intercept report. While Cole did not publish the name, his email exchange with Kiriakou was used as evidence against him. So while I see Cole burning several sources, I only see The Intercept burning one.
      - octodog 5y ago
        Distinction without a difference. "The Intercept employs a journalist who has burnt 3 sources".
        eesmith 5y ago
        sbierwagen wrote "Just like how The Intercept keeps burning its sources". I wanted to know more about the other sources they burned, because I hadn't heard of additional cases and wondered why they didn't learn from their experience.
- barkingcat 5y ago
  isn't this always the case? not every reporter works for the nyt and even then it's super leaky. if you talk to a reporter, 100% assumption your full name/full transcript/full video recording is going to be out there. "off the record" never meant anything.
  - skybrian 5y ago
    That's assuming there is a recording. If you meet in person somewhere and agree that they're only allowed to take notes, maybe there wouldn't be one? Or alternately, answer questions in writing and be careful what you say.
    - barkingcat 5y ago
      Many reporters use personal recording and pinhole cameras, etc. regardless of what they agree to. tools of the trade.
      - deleted 5y ago
        [deleted]
- deleted 5y ago
  [deleted]
- pessimizer 5y ago
  A reporter is just some person, and may be a government informant, a corporate spy, or in the case of John Connolly a literal spy for the Church of Scientology.
n8cpdx 5y ago
Does anyone know of something like Otter but offline with tolerable performance? Otter is the only thing approaching affordable for individuals, but I don’t really trust it given they’re playing fast and loose with user data.
- deleted 5y ago
  [deleted]
- CasperDern 5y ago
  Silero[0] seems to have decent performance (although you will have to some minimal coding). I believe there are better ones if you're willing to tinker a bit more. [0]: https://github.com/snakers4/silero-models https://github.com/snakers4/silero-models
- discreditable 5y ago
  The Recorder app on Pixel phones offers on-device transcription. I'm not sure if it's available on other phones though.
- ghaff 5y ago
  You can use Amazon Transcribe. The output is just a block of text but that's fine for a lot of interviews you're just going to grab a few sentences from. There are some various other services along similar lines to Otter.ai but don't remember names off the top of my head.
  - yorwba 5y ago
    I don't think Amazon Transcribe works offline.
    - ghaff 5y ago
      No but the parent's second line seemed to be a complaint about Otter specifically. I would probably trust Amazon to have good privacy practices generally though there's still some sensitivity line beyond which I wouldn't use an online service period even if they seem trustworthy in general.
carbocation 5y ago
Maybe I'm reading this poorly, but it feels very poorly written. The opening stanzas describe a conversation over Signal, followed by a message from Otter.ai. But there is no initial disclosure that the journalist sent the conversation to Otter. The way the story is written, it sounds like Signal was hacked or his phone was exploited. Later, he states: > "Otter said that the fact that Aksu was the focus of the survey was only because I’d entered his name as the recording’s title." So OK, you submitted a recording to Otter? Why not disclose that you used Otter intentionally: > Apparently I wasn’t the only Otter user worried about this kind of scrutiny. “This survey has been discontinued over concerns that some customers (such as yourself) may include personal or sensitive information within the title of the conversation, and including this information within a survey may cause some concern,” Lai said.
- danso 5y ago
  The author does state that they were using Otter — it’s at the beginning of the anecdote > The next day, I received an odd note from Otter.ai, the automated transcription app that I had used to record the interview.
  - carbocation 5y ago
    Confirmed that I am reading poorly—thanks for pointing out this line, I had missed it. Archive.today link demonstrating that this isn't a stealth edit by Politico: https://archive.is/etLpm https://archive.is/etLpm
- magicjosh 5y ago
  Ya the core of the article is missing a key point. Did you enter "Mustafa Aksu" as the title of the Otter recording? If so, they just took the text you entered and emailed it to you. Why did you write this sensationalist article? If they transcribed it and send it to you, maybe there's something here. But expecting Otter to be secure is an entirely different issue. But the article conflates this whole thing about the title with insecurity and it's unclear. There is certainly an article to be written about the dangers of using Otter. But this stuff about the email and the title is a distraction. It attempts to "storify" something that doesn't need it. Automated recording means sending recordings to the cloud where you don't control them. That's a terrible idea for sensitive content. Full stop. That's the article. Disclosure: have used Otter, like it, but wary of security issues. Self hosted option sounds good.
jamestimmins 5y ago
Obviously, a lot of companies prefer to host enterprise software on-prem rather than allow them to run in the cloud. Is anyone aware if there's been a similar movement to create on-prem versions of popular ML-based products? Otter, Grammarly, etc.
- nshm 5y ago
  For offline transcription try Vosk https://github.com/alphacep/vosk-api https://github.com/alphacep/vosk-api
  - deleted 5y ago
    [deleted]
  - invalidator 5y ago
    +1 for Vosk. If you want an easy way to get started with it, try mp4grep [1] which is a ready-made program you can unzip and run. To transcribe a whole file, simply: mp4grep --model ~/apps/mp4grep-0.1.1/model/ --transcribe filename.mp3 The output is more intended for captioning so it's lots of short phrases with timestamps and no punctuation, but it'll give you a quick taste of what Vosk can do. [1] https://github.com/o-oconnell/mp4grep https://github.com/o-oconnell/mp4grep
- Spooky23 5y ago
  Dragon can do transcription and works pretty well. It’s like $500.
- hs86 5y ago
  If you are looking for a self-hosted Grammarly alternative, LanguageTool [0] might be for you. I use LTeX [1] for VSCode, which sets up a local LanguageTool server, and its resource usage is quite significant. (I use it together with their n-gram data sets [2]) [0] https://dev.languagetool.org/ https://dev.languagetool.org/ [1] https://github.com/valentjn/vscode-ltex https://github.com/valentjn/vscode-ltex [2] https://dev.languagetool.org/finding-errors-using-n-gram-data https://dev.languagetool.org/finding-errors-using-n-gram-dat...
speedgoose 5y ago
What's the point of using end to end encrypted messaging apps if you are going to send the recordings in clear text to third party companies ?
- Spooky23 5y ago
  It’s one thing if you are covering the zoning board. But seems incredibly dumb when you are interviewing someone routinely surveilled by a foreign intelligence service.
  - Tepix 5y ago
    Yeah, it seems like a big no-no to pretend towards your source that you are using E2E crypto and then to upload it to a 3rd party tagged with his name. You may have put their lives and the lives of their friends and family at risk. Next time Phelim Kine asks you for an interview, will you agree?
    - sho_hn 5y ago
      I get lambasting the author, but I think a more useful way to think here: They use Signal because they care (or think they should care) and because it's available. If there's no safe alternative available in the space Otter is in (and if you need a transcription tool now to be competitive as a journalist, perhaps) it means there's a market for building one. "Safe transcription app for journalists". Go do it.
      - danShumway 5y ago
        > If there's no safe alternative available in the space Otter is in (and if you need a transcription tool now to be competitive as a journalist, perhaps) it means there's a market for building one. Right, but in the meantime, if a government is hunting me and a journalist asks me to interview them, I want to know I'm secure. I don't want that to be reliant on whether or not a market I know nothing about exists. Definitely, it looks like there's a need for a safe transcription app for journalists. But that's not a license for them to be dangerous while they're waiting for that product to exist. Journalists have a moral responsibility to keep their sources safe in the world that exists today. Otherwise, the takeaway seems to be that nobody with really sensitive information or in a vulnerable position should talk to journalists until after the tech industry builds an entirely new product, which probably isn't the outcome that anybody wants. We need to hammer out some degree of data security best practices that journalists won't break even in the instances where it makes their lives more inconvenient. Ideally, we should try to hammer out best practices that make it possible for a journalist to evaluate whether or not a service is appropriate to use. Otherwise we'll just play this endless game of cat and mouse where someone builds a transcription service that's private, and then another company builds this data-leaking collaboration or markup platform and that hole gets opened... at some point we have to teach journalists that there are certain types of services that they should stay away from unless they meet certain criteria, and it sounds like a lot of journalists don't have a good grasp on how to do that kind of security evaluation. Certainly, there's at least lack of education here about why we're using E2EE and what specific attacks it guards against if it's not ringing alarm bells with journalists when a service asks them to upload the raw interview to a remote server.
sam0x17 5y ago
The article was very sensationalist -- the survey was merely taking the title of the recording and trying to collect data on how users were using the platform. Normally I side against companies in these situation but there is literally no appearance of foul play or spookiness on otter's part -- most unsurprising thing ever really just a reporter that sees a survey asking about a title that he wrote himself and getting spooked because apparently even in 2022 tech is hard to grok for normies.
- mannykannot 5y ago
  "An initial confirmation that the survey was legitimate was followed by a denial from the same Otter representative, laced with a warning that I “not respond to that survey and delete it.” My communications with Otter were all restricted to email and were sporadic, often confusing and contradictory." That's where the story rises above the mundane.
  - sam0x17 5y ago
    Could be something more, but Occam's Razor says it's just support being like wtf is this and dropping the ball in handling the request. If support at your company got an email saying "omg! sensitive information in our recording is being referenced in this random survey we got from you!" I guarantee 2/3 companies would flub the initial response because the support person doesn't understand the technical side of the issue which is that titles are used in one of the survey templates
    - fjorde 5y ago
      Journalists who deal in sensitive material should not trust any of that to any third parties to the greatest extent possible. If I were Chinese intel or the FBI, otter would be one of the richest targets imaginable for some of the most prized information on earth, i.e. high-value intel targets spilling secrets in "full-confidence" and divulging information they might never reveal even in court. otter also transcribes medical/psych convos and legal discussions as well, bringing the sum total of what they could "know" about any human, willing or not, to scary levels. Journalists who are casual or reckless with this kind of data shouldn't be in the business, and companies that don't make these kinds of risks apparent to their user base, or go to lengths to disguise a clear conflict of interest as bad support should not be in that business either.
jdlshore 5y ago
The article raises a good point, but in a hamfisted and clickbaity way. The underlying story is that there is no story: the author recorded a sensitive conversation and sent it to Otter. Otter sent him a survey in response and referenced the title of the recording. The author grew concerned that his recordings had been shared with China. Otter scrambled to respond, and eventually reassured the author that his recordings had never been shared with any foreign governments or law enforcement agencies. The underlying point, that using transcription services puts journalists' sources at risk, is well taken. But the story unfairly tries to make it sound like Otter has a problem, when the author is really just using Otter as a vehicle for their story.
- 0898 5y ago
  “Scrambled to respond” is rather generous, I’d say. It took Otter.ai three months to confirm the email was genuine - having initially said that it wasn’t.
  - toyg 5y ago
    No, having said it was and then shortly after that it wasn't, and then eventually after 3 months that indeed it was. It feels like, after the first candid response, somebody higher up went "oops, this looks bad, deny everything!", and eventually retracted it because the guy wouldn't give up. Looks like the sort of misunderstanding that Pied Piper might find themselves into, to be charitable.
- deleted 5y ago
  [deleted]
- bigcat123 5y ago
- sho_hn 5y ago
  I think the article is extremely interesting: As I kept reading, it eventually dawned on me that what had disturbed the author and gotten their attention at all was really just that a customer survey used the same title they had used when saving the interview recording file. The title was the name of their informant, and I think they were shocked Otter played an informant's name back at them. It seems like they never before considered the implications of using the service and sending interview contents off-device at all. If this is representative of the trade, I think as tech we have a lot of education left to do for everyone's safety. And if it is, good on the author for making it transparent. I feel like they learned a lot researching the article and basically put their own inadequacies on display for public scrutiny, which many others may not do. Consider this next time you update your company's Privacy Policy and wonder if it's understandable, to who, can be discovered at all, etc. Do your users understand what of their data you have and how you use it?
aaron695 5y ago
cracker_jacks 5y ago
Can a viable business be made around targets/victims sending their phishing attacks to a reverse engineering lab? The more valuable the target, the more likely an unknown and valuable exploit might be surfaced. As a consequence, this increases the expected cost of attacking these targets/victims.
- password4321 5y ago
  Like https://www.paypal.com/us/security/report-suspicious-messages https://www.paypal.com/us/security/report-suspicious-message... ? > Forward suspicious email to spoof@paypal.com
dogman144 5y ago
Otter.ai, collector of potentially incredibly sensitive user recordings, despite perhaps having a good privacy policy, has... 81 employees and no cybersecurity team from what I can tell. linkedin[.]com/company/otter-ai/people/?keywords=security Security and privacy isn't a tool, it's a set of tools in a logical stack and used according to correct processes. This is why focused newsroom security teams are so critical, but NYT fired their rep a few years ago and WSJ had or has generic security hires double-timing in that role. It sucks that Khashoggi wasn't more of a watershed moment for this. I wouldn't worry about privacy, I'd worry about threat actors popping otter and it's 0 security team to expose sources.
- radicaldreamer 5y ago
  They're likely already compromised and definitely will be after this story... they should hire a security lead and harden their systems right away.
  - dogman144 5y ago
    Personal opinion is it's irresponsible to exist since 2016 and have not hired someone for it yet, especially after these last years re: Solarwinds. The careers page is hiring a software eng - security which means someone who can build tooling, but won't have any policy/process power beyond what a VP Eng allows them. So good luck deploying necessary changes that that impact dev/product flows. This is the sort of stuff that gets security/privacy people upset at ex-Googler SV tech. Lot of hubris.
axg11 5y ago
I tried and failed to launch a startup in this space. The privacy concerns are huge. Most of the companies in this space (Fireflies, Otter, Vowel, ~Chorus, ~Gong) use external APIs for speech-to-text. That means unencrypted audio and plain text is traversing a 3rd party server. Most people don't care, but when there is eventually a security breach (only a matter of time) there will be a lot of surprised users and customers. With that said, the core idea is great. These companies are starting with transcription but it's not difficult to envisage a future where (a) supplemental information is presented depending on conversation topics, and (b) actions are taken on your behalf. Example: no more need to manually send a calendar invite, just mention it in the conversation and the "AI assistant" will schedule for you.
- mikepurvis 5y ago
  I had a family member who briefly dabbled in online transcription and made maybe a few hundred bucks doing it. Obviously they were required to sign an NDA and so on, but nonetheless, I was shocked at the recordings that they were sent— for example, high level executive meetings where financial details and M&A strategy were being discussed.
  - jfengel 5y ago
    I'm shocked that you got to hear those recordings that were supposedly under NDA. Well, not that shocked. I'm sure your uncle was generally being diligent. But really, you shouldn't have been able to find out what he was working on.
    - mikepurvis 5y ago
      I wasn't hearing them directly, but I heard about them because I was asked about some acronyms that were unfamiliar to the person doing the work. Definitely a grey area, but the point was more that literally anyone off the street can sign up to gig for one of these services and receive access to a bunch of potentially pretty sensitive audio.
      - 5y ago
tedunangst 5y ago
The conclusion of the article is that we need to change the law. Will that prevent China from hacking otter to obtain transcripts?
- none_to_remain 5y ago
  Also USG is another adversary
radicaldreamer 5y ago
The way to do this properly as a reporter would be to record using a standalone voice recorder and transcribe using offline software (Dragon Naturally Speaking or something similar) on an air-gapped machine. If you're a reporter working on human rights pieces which involve nation states, you need to step up your game here or you're putting sources at risk.
77pt77 5y ago
What are my options for something like this that runs entirely in my machine?
- robmsmt 5y ago
  Offline: Sphinx, VOSK, Nvidia NeMo, SpeechBrain, Coqui, Kaldi... some off the top of my head. Some of these require more setup & effort and are more research grade than others. There are also proprietary ASRs which can run offline. I wrote a small python application to evaluate some of them. Link in my profile!
xwowsersx 5y ago
I use Otter pretty religiously to record all work meetings that I participate in. That is probably overkill, but it is great to be able to go back and find details about something I didn't take notes on or wanted to review. I work with a geographically distributed team and it doesn't do an amazing job with English in various accents — I've noticed Google Recorder on Android is better in this regard — but it's good enough. Nice product.
- octodog 5y ago
  Do your colleagues know that they are being recorded?
  - ectopod 5y ago
    Does management know that all meetings are being shared with another company?
- deleted 5y ago
  [deleted]
- tasha0663 5y ago
  As someone with ADHD-PI, this sort of thing is so damn tempting. Like to the point where I could probably actually focus if I knew I could get a transcript.
fudged71 5y ago
I feel dumb for thinking "Caveat emptor" in the title meant "end of story". I don't quite understand why latin terms are used so often when plain english gets the point across to more people.
- willhinsa 5y ago
  Personally I find Latin phrases to be more accurate and succinct than their English replacements. Plus, there's a lot of phrases that you're probably super familiar with that you just don't think about their origin being Latin. When I come across a new Latin phrase, I just treat it like a special kind of phrase that I can learn, in an ad hoc fashion. ;)
- messe 5y ago
  As latin phrases go "Caveat Emptor" is a pretty common one; it didn't seem out of place to me.
- sho_hn 5y ago
  Just a general linguistic phenomenon that source languages are sometimes invoked to elevate speech.
- toyg 5y ago
  Latin is a technical instrument of rhetoric and law. It conveys a set of concepts in a succinct manner by way of shared convention. If you talked to your plumber and said you have a "web server" in your basement, he'd think you give funny names to spiders. The concept of "web server" is a technical shorthand for "computer attached to a telecommunication system, typically the global internet network, that is dedicated to responding to request from other computers for hypertextual media to be delivered over such network". But webserver is shorter and everybody in your sector understands what it is, so you use that. Sure, you could say "I have a computer connected to the network that does stuff", something that "would get the point across to more people", but it would be a very rough and incomplete image. In the same way, people in literature, rhetoric, law, and medicine, use a lot of Latin words to convey specific meanings succinctly. Anybody worth their salt, in the sector, will appreciate them more than "plain English".
danShumway 5y ago
We can focus on Otter.ai, but the quote that jumps out to me is: > Until those laws change, journalists and others who rely on transcription apps need to carefully consider the potential dangers. What this article is revealing to me is that journalists who are dealing with sensitive information aren't well-trained enough to recognize all of the dangers in the services they use. Knowing what I know about AI-driven services, even really large ones like Alexa or Siri, it would never be acceptable to me to use a remote service to transcribe an interview that absolutely had to be private and that hadn't already had all of the sensitive info redacted. It's a lack of knowledge about how AI works and how these networks are built and maintained (real people do run into the information, and there are bugs even in giant products). It's also a lack of knowledge about the security capabilities of the company: how is this information being stored, what encryption is being used, has the company been audited? It's really irresponsible, but I also believe the author when they said they just never thought about it before, I believe that it probably never crossed their mind that a big company might misplace data or that it might be forced to hand that data to a government. What's frustrating is the qualifier "until those laws change". There are a lot of potential risks to using a remote transcription service even if the laws are different. For ordinary people, legislation around privacy is important. But when dealing with information of this type, you need better security fundamentals. So this feels like the author still doesn't realize just how dangerous they're being by using a service like Otter.ai for interviews where someone's life might be at risk. ---- On that subject, I also don't think calling out the journalist in this way is victim blaming; I think the victim here is the person being interviewed, and I think journalists have a moral responsibility to understand data security because the people who talk to them are trusting them to be able to keep that information safe. If you can't do that, then it's irresponsible to handle sensitive information that can harm other people. There are risks associated with handing any remote company an unencrypted interview with sensitive information that they will feed into an AI network, regardless of that company's intentions. That is not something a law can fix, you as a journalist need to be able to protect the people who trust you and you need to know the limitations of a company saying "we won't share this", you need to know what the inherent risks of the technology and process are instead of just trusting them. Not to let Otter.ai off the hook here; if they're aware of the fact that people are sending interviews where information leaks could be dangerous, they need to do a better job of educating their clients about what the risks are. The tech industry in general needs to do a better job of education here, we share some blame. What we are seeing is the effects of Google/Amazon/Apple creating an inaccurate picture of what AI is and of how private it is: we create this narrative where people assume that Siri/Alexa are just isolated boxes that sit in a vacuum where nothing can touch the data. And it turns out that's not accurate at all, metadata (like transcript titles) gets leaked from those services, people review transcripts and use it to keep training the AI, there are bugs that leak data across accounts. And there are real-world consequences to us training the public to disregard the possibility that those leaks can happen; consequences like journalists believing us and using our technology in irresponsible ways. I support privacy legislation, but privacy legislation will not make it OK for journalists to be irresponsible with sensitive information. There needs to be more of an understanding that for journalists who have clients who are in a position of extreme trust with them, some behavior is just inherently risky. It doesn't matter if there's legislation, if you're a journalist it's still not OK to send sensitive information over SMS, or do unencrypted phone calls to conduct sensitive interviews, or to send sensitive interviews to corporations that you don't have an extremely close relationship with. You have to learn data security, I'm sorry. To the extent we in the tech industry can help with that, it should be by making it clear that we mess up a lot and we leak a lot of data and we aren't magical wizards that can just decide to keep data safe -- all of that boasting about our privacy policies are just narratives we use to get more people to be more comfortable talking to their smart homes. ---- > In the three months since that initial exchange (and there was more to come), I’ve gone down the rabbit hole — talking to cybersecurity experts, press freedom advocates and a former government official — to try and understand what vulnerabilities and risks are present in this app that’s become a favorite among journalists for its fast, reliable and cheap automated transcription. This doesn't require a complicated rabbit hole of research, I can tell you right now that if the person you're interviewing is being hunted by a government, if they are "a wanted man", you do not put their interview on any service that is not fully end-to-end encrypted so that even the service can not access the data, period. We have enough technology and good enough encryption tools that you don't need to take that risk anymore. That means transcription, (regardless of whether it's AI-driven or manual) needs to happen on your own hardware. If it's not a sensitive interview, or if a leak would just be embarrassing or cost someone some money -- then sure, maybe you have different standards for that kind of information, use a remote transcription service for those interviews if you need to. But not for someone who's wanted by a government.
1-6 5y ago
If you’re looking for a good transcriber and know a little bit of Python, you can use Nvidia’s Riva.
ramphastidae 5y ago
So Phelim Kine leaked a source’s name and the details of their conversation to a third party because it was cheaper and more convenient than doing their own transcription, and is now trying to blame the third party?
- weq 5y ago
  Yeh lol like WTF its so stupid to think about but unfortunately its how stupid and desensitiesed to giving away information on the internet people are. I saw in a lawtech startup, when i arrived they were transfering data unencrypted over the internet. this data was everything todo with a matter, including documents. Suffice to say they were lucky i had experience building software on Secret networks and patches those holes quick smart (ie. re-wrote there entire stack which was built by 3rd-world-outsourced-devs who have zero care for your busisness continuity. No wonder scamming is outpacing the drug buisness these days. People are dumb and the internet exposes dumbness to desperateness who are more then willing to take up the slack.
upwardbound 5y ago
This part is a huge issue: > When I asked Otter to clarify whether it shares user data with non-U.S. government or law enforcement agencies, the answer wasn’t comforting. “We disclose Personal Information if we are legally required to do so, or if we have a good faith belief that such use is reasonably necessary to comply with a legal obligation, process or request,” Denise Mutch, an Otter service team member, told me via email on Dec. 16. Later in the article, a different Otter representative (Mitchell Woodrow) says the opposite, but that indicates to me that they don't have a consistent internal policy for whether to turn interviews over to totalitarian regimes, which is a huge, HUGE problem.
- bigiain 5y ago
  Anybody who shares information on any 3rd party company platform in the belief that it's so private that they won't disclose it "to comply with a legal obligation" is kidding themselves. Even Signal/WhisperSystems, who I have a great deal of respect for, would without question cave under government demands which come from the sort of people who've learn't from their failure to force Lavabit/Levison's compliance and silence. I have no doubt that successors to Levison's refusal to exploit their own previously-secure systems at the Government's request have been successfully threatened and manipulated into doing so using much more powerful threats and consequences that Levison's option of "OK then, I'll just shut my whole company down". If a sufficiently powerful TLA decided I needed to be surveilled for a serious enough suspicion of a serious enough crime, I have no doubt that I'm "STILL GONNA BE MOSSAD’ED UPON"* The chance of _any_ non-privacy-obsessed tech startup/company like Otter deciding to lawyer up and fight the US government to protect _my_ individual privacy as a low-paying customer is literally zero. The _best_ I can expect of them is to have a solid process in place to ensure the people demanding my data have the appropriate paperwork and jurisdictional oversight in place, more realistically I'd expect them to have a "law enforcement portal" like Facebook/eBay et al. where bored cops can log in and stalk their ex girlfriends. * https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
  - upwardbound 5y ago
    Understood; in truth my biggest specific concern is the ambiguity about whether or not they would comply with non-US regimes. In an ideal world they would (imho) comply with the US but not with foreign regimes. Better to have only one info leak rather than many.
tasha0663 5y ago
I recall the analogy attributed to Gene Spafford: > Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench. Why the F would you even bother with Signal if you're just going to record the call to some other third party service? This is an enormous and stupid mistake.
gjsman-1000 5y ago
I work for an education company… and an instructor said “I think that.” The teacher had her audio garble a bit when saying “think” but to a human it was pretty clear. Otter completely messed up and transcribed it as “I Fuck That” (not kidding) within Zoom. And that’s pretty bad when it’s a bunch of Middle Schoolers…
endisneigh 5y ago
An interesting technical problem would be figuring a way to obsfucate audio such that it could be transcribed, but the transcribed text isn’t actually really what was said. Then you could take the text and put it through the same process that distorted the audio and get the original text.
flower-giraffe 5y ago
From the article: “ So when I talked to Aksu in November, I made sure to use Signal, an encrypted phone app, to protect our discussion” The author apparently then recorded that call and uploaded it to a cloud transcription service. Surely any journalist reporting on human rights abuse by state actors should know that recording the interview on an internet connected device is a risk let alone uploading it to the cloud.
Jaruzel 5y ago
Not offline, but more secure (maybe?) than a random WebApp, is the Transcription option in the online version of Microsoft Word. If you have Microsoft 365 via your employer, you can transcribe up to 300 minutes a month. I use it a lot for recorded work calls, as my memory is awful. I just wish they'd roll it out to the Desktop version of Word, as the online version struggles with transcripts longer than 50 pages.
marginalien 5y ago
This apps seems to offer on-device transcription. Any opinions? https://apps.apple.com/de/app/ada-dictation-speech-to-text/id1474180179 https://apps.apple.com/de/app/ada-dictation-speech-to-text/i...

234 points by danso 5y ago

You can help. Offer your services and support to institutes such as Centre for Investigative Journalism. Training journalists to use tech is critical for keeping sources safe. https://tcij.org/ https://tcij.org/

sbierwagen 5y ago

Just like how The Intercept keeps burning its sources https://en.wikipedia.org/wiki/The_Intercept#Reality_Winner_controversy https://en.wikipedia.org/wiki/The_Intercept#Reality_Winner_c... you pretty much have to assume any time you talk to a reporter you're like one step removed from talking to a cop. You cannot assume any security competence at all. Putting the source's full first and last name on the recording and then sending it to a third party, sheesh.

eesmith 5y ago
What other sources have they burned? That Wikipedia page only lists Winner.
- profunctor 5y ago
  It also lists two other whistle blowers who blame that journalist.
  - eesmith 5y ago
    This part? > NSA whistleblower John Kiriakou and Guantanamo Bay detention camp whistleblower Joseph Hickman have both accused the same reporter accused of revealing Winner's identity, Matthew Cole, of playing a role in their exposure, which, in Kiriakou's case, led to his imprisonment. I don't see where Kiriakou and Hickman were sources to The Intercept. The [35] links to https://www.peterbcollins.com/2017/06/30/in-depth-interview-whistleblowers-joe-hickman-and-john-kiriakou-on-abu-zubaydeh-torture-and-a-dangerous-reporter/ https://www.peterbcollins.com/2017/06/30/in-depth-interview-... which says: > In the final 5 minutes of the interview, both men share their stories of being burned by "journalist" Matthew Cole, whose work at ABC compromised Hickman and sent Kiriakou to prison. Cole was involved in the recent episode at The Intercept, where NSA leaker Reality Winner was apprehended after Cole shared her leaked document in an effort to verify it. The [36] links to https://www.cbc.ca/radio/asithappens/as-it-happens-tuesday-edition-1.4148070/ex-cia-whistleblower-blasts-reporters-for-not-protecting-alleged-nsa-leaker-reality-winner-1.4148075 https://www.cbc.ca/radio/asithappens/as-it-happens-tuesday-e... with (emphasis mine): > He later spent two years in prison for disclosing the identity of a fellow CIA officer to then-freelance journalist Matthew Cole, one of four authors of Monday's Intercept report. While Cole did not publish the name, his email exchange with Kiriakou was used as evidence against him. So while I see Cole burning several sources, I only see The Intercept burning one.
    - octodog 5y ago
      Distinction without a difference. "The Intercept employs a journalist who has burnt 3 sources".
      - eesmith 5y ago
        sbierwagen wrote "Just like how The Intercept keeps burning its sources". I wanted to know more about the other sources they burned, because I hadn't heard of additional cases and wondered why they didn't learn from their experience.
barkingcat 5y ago
isn't this always the case? not every reporter works for the nyt and even then it's super leaky. if you talk to a reporter, 100% assumption your full name/full transcript/full video recording is going to be out there. "off the record" never meant anything.
- skybrian 5y ago
  That's assuming there is a recording. If you meet in person somewhere and agree that they're only allowed to take notes, maybe there wouldn't be one? Or alternately, answer questions in writing and be careful what you say.
  - barkingcat 5y ago
    Many reporters use personal recording and pinhole cameras, etc. regardless of what they agree to. tools of the trade.
    - deleted 5y ago
      [deleted]
deleted 5y ago
[deleted]
pessimizer 5y ago
A reporter is just some person, and may be a government informant, a corporate spy, or in the case of John Connolly a literal spy for the Church of Scientology.

n8cpdx 5y ago

Does anyone know of something like Otter but offline with tolerable performance? Otter is the only thing approaching affordable for individuals, but I don’t really trust it given they’re playing fast and loose with user data.

deleted 5y ago
[deleted]
CasperDern 5y ago
Silero[0] seems to have decent performance (although you will have to some minimal coding). I believe there are better ones if you're willing to tinker a bit more. [0]: https://github.com/snakers4/silero-models https://github.com/snakers4/silero-models
discreditable 5y ago
The Recorder app on Pixel phones offers on-device transcription. I'm not sure if it's available on other phones though.
ghaff 5y ago
You can use Amazon Transcribe. The output is just a block of text but that's fine for a lot of interviews you're just going to grab a few sentences from. There are some various other services along similar lines to Otter.ai but don't remember names off the top of my head.
- yorwba 5y ago
  I don't think Amazon Transcribe works offline.
  - ghaff 5y ago
    No but the parent's second line seemed to be a complaint about Otter specifically. I would probably trust Amazon to have good privacy practices generally though there's still some sensitivity line beyond which I wouldn't use an online service period even if they seem trustworthy in general.

carbocation 5y ago

Maybe I'm reading this poorly, but it feels very poorly written. The opening stanzas describe a conversation over Signal, followed by a message from Otter.ai. But there is no initial disclosure that the journalist sent the conversation to Otter. The way the story is written, it sounds like Signal was hacked or his phone was exploited. Later, he states: > "Otter said that the fact that Aksu was the focus of the survey was only because I’d entered his name as the recording’s title." So OK, you submitted a recording to Otter? Why not disclose that you used Otter intentionally: > Apparently I wasn’t the only Otter user worried about this kind of scrutiny. “This survey has been discontinued over concerns that some customers (such as yourself) may include personal or sensitive information within the title of the conversation, and including this information within a survey may cause some concern,” Lai said.

danso 5y ago
The author does state that they were using Otter — it’s at the beginning of the anecdote > The next day, I received an odd note from Otter.ai, the automated transcription app that I had used to record the interview.
- carbocation 5y ago
  Confirmed that I am reading poorly—thanks for pointing out this line, I had missed it. Archive.today link demonstrating that this isn't a stealth edit by Politico: https://archive.is/etLpm https://archive.is/etLpm
magicjosh 5y ago
Ya the core of the article is missing a key point. Did you enter "Mustafa Aksu" as the title of the Otter recording? If so, they just took the text you entered and emailed it to you. Why did you write this sensationalist article? If they transcribed it and send it to you, maybe there's something here. But expecting Otter to be secure is an entirely different issue. But the article conflates this whole thing about the title with insecurity and it's unclear. There is certainly an article to be written about the dangers of using Otter. But this stuff about the email and the title is a distraction. It attempts to "storify" something that doesn't need it. Automated recording means sending recordings to the cloud where you don't control them. That's a terrible idea for sensitive content. Full stop. That's the article. Disclosure: have used Otter, like it, but wary of security issues. Self hosted option sounds good.

jamestimmins 5y ago

Obviously, a lot of companies prefer to host enterprise software on-prem rather than allow them to run in the cloud. Is anyone aware if there's been a similar movement to create on-prem versions of popular ML-based products? Otter, Grammarly, etc.

nshm 5y ago
For offline transcription try Vosk https://github.com/alphacep/vosk-api https://github.com/alphacep/vosk-api
- deleted 5y ago
  [deleted]
- invalidator 5y ago
  +1 for Vosk. If you want an easy way to get started with it, try mp4grep [1] which is a ready-made program you can unzip and run. To transcribe a whole file, simply: mp4grep --model ~/apps/mp4grep-0.1.1/model/ --transcribe filename.mp3 The output is more intended for captioning so it's lots of short phrases with timestamps and no punctuation, but it'll give you a quick taste of what Vosk can do. [1] https://github.com/o-oconnell/mp4grep https://github.com/o-oconnell/mp4grep
Spooky23 5y ago
Dragon can do transcription and works pretty well. It’s like $500.
hs86 5y ago
If you are looking for a self-hosted Grammarly alternative, LanguageTool [0] might be for you. I use LTeX [1] for VSCode, which sets up a local LanguageTool server, and its resource usage is quite significant. (I use it together with their n-gram data sets [2]) [0] https://dev.languagetool.org/ https://dev.languagetool.org/ [1] https://github.com/valentjn/vscode-ltex https://github.com/valentjn/vscode-ltex [2] https://dev.languagetool.org/finding-errors-using-n-gram-data https://dev.languagetool.org/finding-errors-using-n-gram-dat...

speedgoose 5y ago

What's the point of using end to end encrypted messaging apps if you are going to send the recordings in clear text to third party companies ?

Spooky23 5y ago
It’s one thing if you are covering the zoning board. But seems incredibly dumb when you are interviewing someone routinely surveilled by a foreign intelligence service.
- Tepix 5y ago
  Yeah, it seems like a big no-no to pretend towards your source that you are using E2E crypto and then to upload it to a 3rd party tagged with his name. You may have put their lives and the lives of their friends and family at risk. Next time Phelim Kine asks you for an interview, will you agree?
  - sho_hn 5y ago
    I get lambasting the author, but I think a more useful way to think here: They use Signal because they care (or think they should care) and because it's available. If there's no safe alternative available in the space Otter is in (and if you need a transcription tool now to be competitive as a journalist, perhaps) it means there's a market for building one. "Safe transcription app for journalists". Go do it.
    - danShumway 5y ago
      > If there's no safe alternative available in the space Otter is in (and if you need a transcription tool now to be competitive as a journalist, perhaps) it means there's a market for building one. Right, but in the meantime, if a government is hunting me and a journalist asks me to interview them, I want to know I'm secure. I don't want that to be reliant on whether or not a market I know nothing about exists. Definitely, it looks like there's a need for a safe transcription app for journalists. But that's not a license for them to be dangerous while they're waiting for that product to exist. Journalists have a moral responsibility to keep their sources safe in the world that exists today. Otherwise, the takeaway seems to be that nobody with really sensitive information or in a vulnerable position should talk to journalists until after the tech industry builds an entirely new product, which probably isn't the outcome that anybody wants. We need to hammer out some degree of data security best practices that journalists won't break even in the instances where it makes their lives more inconvenient. Ideally, we should try to hammer out best practices that make it possible for a journalist to evaluate whether or not a service is appropriate to use. Otherwise we'll just play this endless game of cat and mouse where someone builds a transcription service that's private, and then another company builds this data-leaking collaboration or markup platform and that hole gets opened... at some point we have to teach journalists that there are certain types of services that they should stay away from unless they meet certain criteria, and it sounds like a lot of journalists don't have a good grasp on how to do that kind of security evaluation. Certainly, there's at least lack of education here about why we're using E2EE and what specific attacks it guards against if it's not ringing alarm bells with journalists when a service asks them to upload the raw interview to a remote server.

sam0x17 5y ago

The article was very sensationalist -- the survey was merely taking the title of the recording and trying to collect data on how users were using the platform. Normally I side against companies in these situation but there is literally no appearance of foul play or spookiness on otter's part -- most unsurprising thing ever really just a reporter that sees a survey asking about a title that he wrote himself and getting spooked because apparently even in 2022 tech is hard to grok for normies.

mannykannot 5y ago
"An initial confirmation that the survey was legitimate was followed by a denial from the same Otter representative, laced with a warning that I “not respond to that survey and delete it.” My communications with Otter were all restricted to email and were sporadic, often confusing and contradictory." That's where the story rises above the mundane.
- sam0x17 5y ago
  Could be something more, but Occam's Razor says it's just support being like wtf is this and dropping the ball in handling the request. If support at your company got an email saying "omg! sensitive information in our recording is being referenced in this random survey we got from you!" I guarantee 2/3 companies would flub the initial response because the support person doesn't understand the technical side of the issue which is that titles are used in one of the survey templates
  - fjorde 5y ago
    Journalists who deal in sensitive material should not trust any of that to any third parties to the greatest extent possible. If I were Chinese intel or the FBI, otter would be one of the richest targets imaginable for some of the most prized information on earth, i.e. high-value intel targets spilling secrets in "full-confidence" and divulging information they might never reveal even in court. otter also transcribes medical/psych convos and legal discussions as well, bringing the sum total of what they could "know" about any human, willing or not, to scary levels. Journalists who are casual or reckless with this kind of data shouldn't be in the business, and companies that don't make these kinds of risks apparent to their user base, or go to lengths to disguise a clear conflict of interest as bad support should not be in that business either.

jdlshore 5y ago

The article raises a good point, but in a hamfisted and clickbaity way. The underlying story is that there is no story: the author recorded a sensitive conversation and sent it to Otter. Otter sent him a survey in response and referenced the title of the recording. The author grew concerned that his recordings had been shared with China. Otter scrambled to respond, and eventually reassured the author that his recordings had never been shared with any foreign governments or law enforcement agencies. The underlying point, that using transcription services puts journalists' sources at risk, is well taken. But the story unfairly tries to make it sound like Otter has a problem, when the author is really just using Otter as a vehicle for their story.

0898 5y ago
“Scrambled to respond” is rather generous, I’d say. It took Otter.ai three months to confirm the email was genuine - having initially said that it wasn’t.
- toyg 5y ago
  No, having said it was and then shortly after that it wasn't, and then eventually after 3 months that indeed it was. It feels like, after the first candid response, somebody higher up went "oops, this looks bad, deny everything!", and eventually retracted it because the guy wouldn't give up. Looks like the sort of misunderstanding that Pied Piper might find themselves into, to be charitable.
deleted 5y ago
[deleted]
bigcat123 5y ago
sho_hn 5y ago
I think the article is extremely interesting: As I kept reading, it eventually dawned on me that what had disturbed the author and gotten their attention at all was really just that a customer survey used the same title they had used when saving the interview recording file. The title was the name of their informant, and I think they were shocked Otter played an informant's name back at them. It seems like they never before considered the implications of using the service and sending interview contents off-device at all. If this is representative of the trade, I think as tech we have a lot of education left to do for everyone's safety. And if it is, good on the author for making it transparent. I feel like they learned a lot researching the article and basically put their own inadequacies on display for public scrutiny, which many others may not do. Consider this next time you update your company's Privacy Policy and wonder if it's understandable, to who, can be discovered at all, etc. Do your users understand what of their data you have and how you use it?

aaron695 5y ago

cracker_jacks 5y ago

Can a viable business be made around targets/victims sending their phishing attacks to a reverse engineering lab? The more valuable the target, the more likely an unknown and valuable exploit might be surfaced. As a consequence, this increases the expected cost of attacking these targets/victims.

password4321 5y ago
Like https://www.paypal.com/us/security/report-suspicious-messages https://www.paypal.com/us/security/report-suspicious-message... ? > Forward suspicious email to spoof@paypal.com

dogman144 5y ago

Otter.ai, collector of potentially incredibly sensitive user recordings, despite perhaps having a good privacy policy, has... 81 employees and no cybersecurity team from what I can tell. linkedin[.]com/company/otter-ai/people/?keywords=security Security and privacy isn't a tool, it's a set of tools in a logical stack and used according to correct processes. This is why focused newsroom security teams are so critical, but NYT fired their rep a few years ago and WSJ had or has generic security hires double-timing in that role. It sucks that Khashoggi wasn't more of a watershed moment for this. I wouldn't worry about privacy, I'd worry about threat actors popping otter and it's 0 security team to expose sources.

radicaldreamer 5y ago
They're likely already compromised and definitely will be after this story... they should hire a security lead and harden their systems right away.
- dogman144 5y ago
  Personal opinion is it's irresponsible to exist since 2016 and have not hired someone for it yet, especially after these last years re: Solarwinds. The careers page is hiring a software eng - security which means someone who can build tooling, but won't have any policy/process power beyond what a VP Eng allows them. So good luck deploying necessary changes that that impact dev/product flows. This is the sort of stuff that gets security/privacy people upset at ex-Googler SV tech. Lot of hubris.

axg11 5y ago

I tried and failed to launch a startup in this space. The privacy concerns are huge. Most of the companies in this space (Fireflies, Otter, Vowel, ~Chorus, ~Gong) use external APIs for speech-to-text. That means unencrypted audio and plain text is traversing a 3rd party server. Most people don't care, but when there is eventually a security breach (only a matter of time) there will be a lot of surprised users and customers. With that said, the core idea is great. These companies are starting with transcription but it's not difficult to envisage a future where (a) supplemental information is presented depending on conversation topics, and (b) actions are taken on your behalf. Example: no more need to manually send a calendar invite, just mention it in the conversation and the "AI assistant" will schedule for you.

mikepurvis 5y ago
I had a family member who briefly dabbled in online transcription and made maybe a few hundred bucks doing it. Obviously they were required to sign an NDA and so on, but nonetheless, I was shocked at the recordings that they were sent— for example, high level executive meetings where financial details and M&A strategy were being discussed.
- jfengel 5y ago
  I'm shocked that you got to hear those recordings that were supposedly under NDA. Well, not that shocked. I'm sure your uncle was generally being diligent. But really, you shouldn't have been able to find out what he was working on.
  - mikepurvis 5y ago
    I wasn't hearing them directly, but I heard about them because I was asked about some acronyms that were unfamiliar to the person doing the work. Definitely a grey area, but the point was more that literally anyone off the street can sign up to gig for one of these services and receive access to a bunch of potentially pretty sensitive audio.
    - 5y ago

tedunangst 5y ago

The conclusion of the article is that we need to change the law. Will that prevent China from hacking otter to obtain transcripts?

none_to_remain 5y ago
Also USG is another adversary

radicaldreamer 5y ago

The way to do this properly as a reporter would be to record using a standalone voice recorder and transcribe using offline software (Dragon Naturally Speaking or something similar) on an air-gapped machine. If you're a reporter working on human rights pieces which involve nation states, you need to step up your game here or you're putting sources at risk.

77pt77 5y ago

What are my options for something like this that runs entirely in my machine?

robmsmt 5y ago
Offline: Sphinx, VOSK, Nvidia NeMo, SpeechBrain, Coqui, Kaldi... some off the top of my head. Some of these require more setup & effort and are more research grade than others. There are also proprietary ASRs which can run offline. I wrote a small python application to evaluate some of them. Link in my profile!

xwowsersx 5y ago

I use Otter pretty religiously to record all work meetings that I participate in. That is probably overkill, but it is great to be able to go back and find details about something I didn't take notes on or wanted to review. I work with a geographically distributed team and it doesn't do an amazing job with English in various accents — I've noticed Google Recorder on Android is better in this regard — but it's good enough. Nice product.

octodog 5y ago
Do your colleagues know that they are being recorded?
- ectopod 5y ago
  Does management know that all meetings are being shared with another company?
deleted 5y ago
[deleted]
tasha0663 5y ago
As someone with ADHD-PI, this sort of thing is so damn tempting. Like to the point where I could probably actually focus if I knew I could get a transcript.

fudged71 5y ago

I feel dumb for thinking "Caveat emptor" in the title meant "end of story". I don't quite understand why latin terms are used so often when plain english gets the point across to more people.

willhinsa 5y ago
Personally I find Latin phrases to be more accurate and succinct than their English replacements. Plus, there's a lot of phrases that you're probably super familiar with that you just don't think about their origin being Latin. When I come across a new Latin phrase, I just treat it like a special kind of phrase that I can learn, in an ad hoc fashion. ;)
messe 5y ago
As latin phrases go "Caveat Emptor" is a pretty common one; it didn't seem out of place to me.
sho_hn 5y ago
Just a general linguistic phenomenon that source languages are sometimes invoked to elevate speech.
toyg 5y ago
Latin is a technical instrument of rhetoric and law. It conveys a set of concepts in a succinct manner by way of shared convention. If you talked to your plumber and said you have a "web server" in your basement, he'd think you give funny names to spiders. The concept of "web server" is a technical shorthand for "computer attached to a telecommunication system, typically the global internet network, that is dedicated to responding to request from other computers for hypertextual media to be delivered over such network". But webserver is shorter and everybody in your sector understands what it is, so you use that. Sure, you could say "I have a computer connected to the network that does stuff", something that "would get the point across to more people", but it would be a very rough and incomplete image. In the same way, people in literature, rhetoric, law, and medicine, use a lot of Latin words to convey specific meanings succinctly. Anybody worth their salt, in the sector, will appreciate them more than "plain English".

danShumway 5y ago

We can focus on Otter.ai, but the quote that jumps out to me is: > Until those laws change, journalists and others who rely on transcription apps need to carefully consider the potential dangers. What this article is revealing to me is that journalists who are dealing with sensitive information aren't well-trained enough to recognize all of the dangers in the services they use. Knowing what I know about AI-driven services, even really large ones like Alexa or Siri, it would never be acceptable to me to use a remote service to transcribe an interview that absolutely had to be private and that hadn't already had all of the sensitive info redacted. It's a lack of knowledge about how AI works and how these networks are built and maintained (real people do run into the information, and there are bugs even in giant products). It's also a lack of knowledge about the security capabilities of the company: how is this information being stored, what encryption is being used, has the company been audited? It's really irresponsible, but I also believe the author when they said they just never thought about it before, I believe that it probably never crossed their mind that a big company might misplace data or that it might be forced to hand that data to a government. What's frustrating is the qualifier "until those laws change". There are a lot of potential risks to using a remote transcription service even if the laws are different. For ordinary people, legislation around privacy is important. But when dealing with information of this type, you need better security fundamentals. So this feels like the author still doesn't realize just how dangerous they're being by using a service like Otter.ai for interviews where someone's life might be at risk. ---- On that subject, I also don't think calling out the journalist in this way is victim blaming; I think the victim here is the person being interviewed, and I think journalists have a moral responsibility to understand data security because the people who talk to them are trusting them to be able to keep that information safe. If you can't do that, then it's irresponsible to handle sensitive information that can harm other people. There are risks associated with handing any remote company an unencrypted interview with sensitive information that they will feed into an AI network, regardless of that company's intentions. That is not something a law can fix, you as a journalist need to be able to protect the people who trust you and you need to know the limitations of a company saying "we won't share this", you need to know what the inherent risks of the technology and process are instead of just trusting them. Not to let Otter.ai off the hook here; if they're aware of the fact that people are sending interviews where information leaks could be dangerous, they need to do a better job of educating their clients about what the risks are. The tech industry in general needs to do a better job of education here, we share some blame. What we are seeing is the effects of Google/Amazon/Apple creating an inaccurate picture of what AI is and of how private it is: we create this narrative where people assume that Siri/Alexa are just isolated boxes that sit in a vacuum where nothing can touch the data. And it turns out that's not accurate at all, metadata (like transcript titles) gets leaked from those services, people review transcripts and use it to keep training the AI, there are bugs that leak data across accounts. And there are real-world consequences to us training the public to disregard the possibility that those leaks can happen; consequences like journalists believing us and using our technology in irresponsible ways. I support privacy legislation, but privacy legislation will not make it OK for journalists to be irresponsible with sensitive information. There needs to be more of an understanding that for journalists who have clients who are in a position of extreme trust with them, some behavior is just inherently risky. It doesn't matter if there's legislation, if you're a journalist it's still not OK to send sensitive information over SMS, or do unencrypted phone calls to conduct sensitive interviews, or to send sensitive interviews to corporations that you don't have an extremely close relationship with. You have to learn data security, I'm sorry. To the extent we in the tech industry can help with that, it should be by making it clear that we mess up a lot and we leak a lot of data and we aren't magical wizards that can just decide to keep data safe -- all of that boasting about our privacy policies are just narratives we use to get more people to be more comfortable talking to their smart homes. ---- > In the three months since that initial exchange (and there was more to come), I’ve gone down the rabbit hole — talking to cybersecurity experts, press freedom advocates and a former government official — to try and understand what vulnerabilities and risks are present in this app that’s become a favorite among journalists for its fast, reliable and cheap automated transcription. This doesn't require a complicated rabbit hole of research, I can tell you right now that if the person you're interviewing is being hunted by a government, if they are "a wanted man", you do not put their interview on any service that is not fully end-to-end encrypted so that even the service can not access the data, period. We have enough technology and good enough encryption tools that you don't need to take that risk anymore. That means transcription, (regardless of whether it's AI-driven or manual) needs to happen on your own hardware. If it's not a sensitive interview, or if a leak would just be embarrassing or cost someone some money -- then sure, maybe you have different standards for that kind of information, use a remote transcription service for those interviews if you need to. But not for someone who's wanted by a government.

1-6 5y ago

If you’re looking for a good transcriber and know a little bit of Python, you can use Nvidia’s Riva.

ramphastidae 5y ago

So Phelim Kine leaked a source’s name and the details of their conversation to a third party because it was cheaper and more convenient than doing their own transcription, and is now trying to blame the third party?

weq 5y ago
Yeh lol like WTF its so stupid to think about but unfortunately its how stupid and desensitiesed to giving away information on the internet people are. I saw in a lawtech startup, when i arrived they were transfering data unencrypted over the internet. this data was everything todo with a matter, including documents. Suffice to say they were lucky i had experience building software on Secret networks and patches those holes quick smart (ie. re-wrote there entire stack which was built by 3rd-world-outsourced-devs who have zero care for your busisness continuity. No wonder scamming is outpacing the drug buisness these days. People are dumb and the internet exposes dumbness to desperateness who are more then willing to take up the slack.

upwardbound 5y ago

This part is a huge issue: > When I asked Otter to clarify whether it shares user data with non-U.S. government or law enforcement agencies, the answer wasn’t comforting. “We disclose Personal Information if we are legally required to do so, or if we have a good faith belief that such use is reasonably necessary to comply with a legal obligation, process or request,” Denise Mutch, an Otter service team member, told me via email on Dec. 16. Later in the article, a different Otter representative (Mitchell Woodrow) says the opposite, but that indicates to me that they don't have a consistent internal policy for whether to turn interviews over to totalitarian regimes, which is a huge, HUGE problem.

bigiain 5y ago
Anybody who shares information on any 3rd party company platform in the belief that it's so private that they won't disclose it "to comply with a legal obligation" is kidding themselves. Even Signal/WhisperSystems, who I have a great deal of respect for, would without question cave under government demands which come from the sort of people who've learn't from their failure to force Lavabit/Levison's compliance and silence. I have no doubt that successors to Levison's refusal to exploit their own previously-secure systems at the Government's request have been successfully threatened and manipulated into doing so using much more powerful threats and consequences that Levison's option of "OK then, I'll just shut my whole company down". If a sufficiently powerful TLA decided I needed to be surveilled for a serious enough suspicion of a serious enough crime, I have no doubt that I'm "STILL GONNA BE MOSSAD’ED UPON"* The chance of _any_ non-privacy-obsessed tech startup/company like Otter deciding to lawyer up and fight the US government to protect _my_ individual privacy as a low-paying customer is literally zero. The _best_ I can expect of them is to have a solid process in place to ensure the people demanding my data have the appropriate paperwork and jurisdictional oversight in place, more realistically I'd expect them to have a "law enforcement portal" like Facebook/eBay et al. where bored cops can log in and stalk their ex girlfriends. * https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- upwardbound 5y ago
  Understood; in truth my biggest specific concern is the ambiguity about whether or not they would comply with non-US regimes. In an ideal world they would (imho) comply with the US but not with foreign regimes. Better to have only one info leak rather than many.

tasha0663 5y ago

I recall the analogy attributed to Gene Spafford: > Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench. Why the F would you even bother with Signal if you're just going to record the call to some other third party service? This is an enormous and stupid mistake.

gjsman-1000 5y ago

I work for an education company… and an instructor said “I think that.” The teacher had her audio garble a bit when saying “think” but to a human it was pretty clear. Otter completely messed up and transcribed it as “I Fuck That” (not kidding) within Zoom. And that’s pretty bad when it’s a bunch of Middle Schoolers…

endisneigh 5y ago

An interesting technical problem would be figuring a way to obsfucate audio such that it could be transcribed, but the transcribed text isn’t actually really what was said. Then you could take the text and put it through the same process that distorted the audio and get the original text.

flower-giraffe 5y ago

From the article: “ So when I talked to Aksu in November, I made sure to use Signal, an encrypted phone app, to protect our discussion” The author apparently then recorded that call and uploaded it to a cloud transcription service. Surely any journalist reporting on human rights abuse by state actors should know that recording the interview on an internet connected device is a risk let alone uploading it to the cloud.

Jaruzel 5y ago

Not offline, but more secure (maybe?) than a random WebApp, is the Transcription option in the online version of Microsoft Word. If you have Microsoft 365 via your employer, you can transcribe up to 300 minutes a month. I use it a lot for recorded work calls, as my memory is awful. I just wish they'd roll it out to the Desktop version of Word, as the online version struggles with transcripts longer than 50 pages.

marginalien 5y ago

This apps seems to offer on-device transcription. Any opinions? https://apps.apple.com/de/app/ada-dictation-speech-to-text/id1474180179 https://apps.apple.com/de/app/ada-dictation-speech-to-text/i...