4 ms·

This part is a huge issue: > When I asked Otter to clarify whether it shares user data with non-U.S. government or law enforcement agencies, the answer wasn’t

This part is a huge issue: > When I asked Otter to clarify whether it shares user data with non-U.S. government or law enforcement agencies, the answer wasn’t comforting. “We disclose Personal Information if we are legally required to do so, or if we have a good faith belief that such use is reasonably necessary to comply with a legal obligation, process or request,” Denise Mutch, an Otter service team member, told me via email on Dec. 16. Later in the article, a different Otter representative (Mitchell Woodrow) says the opposite, but that indicates to me that they don't have a consistent internal policy for whether to turn interviews over to totalitarian regimes, which is a huge, HUGE problem.

bigiain 5y ago
Anybody who shares information on any 3rd party company platform in the belief that it's so private that they won't disclose it "to comply with a legal obligation" is kidding themselves. Even Signal/WhisperSystems, who I have a great deal of respect for, would without question cave under government demands which come from the sort of people who've learn't from their failure to force Lavabit/Levison's compliance and silence. I have no doubt that successors to Levison's refusal to exploit their own previously-secure systems at the Government's request have been successfully threatened and manipulated into doing so using much more powerful threats and consequences that Levison's option of "OK then, I'll just shut my whole company down". If a sufficiently powerful TLA decided I needed to be surveilled for a serious enough suspicion of a serious enough crime, I have no doubt that I'm "STILL GONNA BE MOSSAD’ED UPON"* The chance of _any_ non-privacy-obsessed tech startup/company like Otter deciding to lawyer up and fight the US government to protect _my_ individual privacy as a low-paying customer is literally zero. The _best_ I can expect of them is to have a solid process in place to ensure the people demanding my data have the appropriate paperwork and jurisdictional oversight in place, more realistically I'd expect them to have a "law enforcement portal" like Facebook/eBay et al. where bored cops can log in and stalk their ex girlfriends. * https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- upwardbound 5y ago
  Understood; in truth my biggest specific concern is the ambiguity about whether or not they would comply with non-US regimes. In an ideal world they would (imho) comply with the US but not with foreign regimes. Better to have only one info leak rather than many.

bigiain 5y ago

Anybody who shares information on any 3rd party company platform in the belief that it's so private that they won't disclose it "to comply with a legal obligation" is kidding themselves. Even Signal/WhisperSystems, who I have a great deal of respect for, would without question cave under government demands which come from the sort of people who've learn't from their failure to force Lavabit/Levison's compliance and silence. I have no doubt that successors to Levison's refusal to exploit their own previously-secure systems at the Government's request have been successfully threatened and manipulated into doing so using much more powerful threats and consequences that Levison's option of "OK then, I'll just shut my whole company down". If a sufficiently powerful TLA decided I needed to be surveilled for a serious enough suspicion of a serious enough crime, I have no doubt that I'm "STILL GONNA BE MOSSAD’ED UPON"* The chance of _any_ non-privacy-obsessed tech startup/company like Otter deciding to lawyer up and fight the US government to protect _my_ individual privacy as a low-paying customer is literally zero. The _best_ I can expect of them is to have a solid process in place to ensure the people demanding my data have the appropriate paperwork and jurisdictional oversight in place, more realistically I'd expect them to have a "law enforcement portal" like Facebook/eBay et al. where bored cops can log in and stalk their ex girlfriends. * https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf

upwardbound 5y ago
Understood; in truth my biggest specific concern is the ambiguity about whether or not they would comply with non-US regimes. In an ideal world they would (imho) comply with the US but not with foreign regimes. Better to have only one info leak rather than many.