We can focus on Otter.ai, but the quote that jumps out to me is: > Until those laws change, journalists and others who rely on transcription apps need to caref

We can focus on Otter.ai, but the quote that jumps out to me is: > Until those laws change, journalists and others who rely on transcription apps need to carefully consider the potential dangers. What this article is revealing to me is that journalists who are dealing with sensitive information aren't well-trained enough to recognize all of the dangers in the services they use. Knowing what I know about AI-driven services, even really large ones like Alexa or Siri, it would never be acceptable to me to use a remote service to transcribe an interview that absolutely had to be private and that hadn't already had all of the sensitive info redacted. It's a lack of knowledge about how AI works and how these networks are built and maintained (real people do run into the information, and there are bugs even in giant products). It's also a lack of knowledge about the security capabilities of the company: how is this information being stored, what encryption is being used, has the company been audited? It's really irresponsible, but I also believe the author when they said they just never thought about it before, I believe that it probably never crossed their mind that a big company might misplace data or that it might be forced to hand that data to a government. What's frustrating is the qualifier "until those laws change". There are a lot of potential risks to using a remote transcription service even if the laws are different. For ordinary people, legislation around privacy is important. But when dealing with information of this type, you need better security fundamentals. So this feels like the author still doesn't realize just how dangerous they're being by using a service like Otter.ai for interviews where someone's life might be at risk. ---- On that subject, I also don't think calling out the journalist in this way is victim blaming; I think the victim here is the person being interviewed, and I think journalists have a moral responsibility to understand data security because the people who talk to them are trusting them to be able to keep that information safe. If you can't do that, then it's irresponsible to handle sensitive information that can harm other people. There are risks associated with handing any remote company an unencrypted interview with sensitive information that they will feed into an AI network, regardless of that company's intentions. That is not something a law can fix, you as a journalist need to be able to protect the people who trust you and you need to know the limitations of a company saying "we won't share this", you need to know what the inherent risks of the technology and process are instead of just trusting them. Not to let Otter.ai off the hook here; if they're aware of the fact that people are sending interviews where information leaks could be dangerous, they need to do a better job of educating their clients about what the risks are. The tech industry in general needs to do a better job of education here, we share some blame. What we are seeing is the effects of Google/Amazon/Apple creating an inaccurate picture of what AI is and of how private it is: we create this narrative where people assume that Siri/Alexa are just isolated boxes that sit in a vacuum where nothing can touch the data. And it turns out that's not accurate at all, metadata (like transcript titles) gets leaked from those services, people review transcripts and use it to keep training the AI, there are bugs that leak data across accounts. And there are real-world consequences to us training the public to disregard the possibility that those leaks can happen; consequences like journalists believing us and using our technology in irresponsible ways. I support privacy legislation, but privacy legislation will not make it OK for journalists to be irresponsible with sensitive information. There needs to be more of an understanding that for journalists who have clients who are in a position of extreme trust with them, some behavior is just inherently risky. It doesn't matter if there's legislation, if you're a journalist it's still not OK to send sensitive information over SMS, or do unencrypted phone calls to conduct sensitive interviews, or to send sensitive interviews to corporations that you don't have an extremely close relationship with. You have to learn data security, I'm sorry. To the extent we in the tech industry can help with that, it should be by making it clear that we mess up a lot and we leak a lot of data and we aren't magical wizards that can just decide to keep data safe -- all of that boasting about our privacy policies are just narratives we use to get more people to be more comfortable talking to their smart homes. ---- > In the three months since that initial exchange (and there was more to come), I’ve gone down the rabbit hole — talking to cybersecurity experts, press freedom advocates and a former government official — to try and understand what vulnerabilities and risks are present in this app that’s become a favorite among journalists for its fast, reliable and cheap automated transcription. This doesn't require a complicated rabbit hole of research, I can tell you right now that if the person you're interviewing is being hunted by a government, if they are "a wanted man", you do not put their interview on any service that is not fully end-to-end encrypted so that even the service can not access the data, period. We have enough technology and good enough encryption tools that you don't need to take that risk anymore. That means transcription, (regardless of whether it's AI-driven or manual) needs to happen on your own hardware. If it's not a sensitive interview, or if a leak would just be embarrassing or cost someone some money -- then sure, maybe you have different standards for that kind of information, use a remote transcription service for those interviews if you need to. But not for someone who's wanted by a government.