4 ms·

What the flying f***.. Is this going to be a standard part of Microsoft 365? Edit: Nope, luckily not. It's part of Microsoft Purview, which is an add-on to M36

What the flying f***.. Is this going to be a standard part of Microsoft 365? Edit: Nope, luckily not. It's part of Microsoft Purview, which is an add-on to M365 by the looks of it: https://www.microsoft.com/en-us/security/business/microsoft-purview https://www.microsoft.com/en-us/security/business/microsoft-... . At least it's not going to bother everyone that uses M365. It probably costs a lot to add on too. Meaning our company will probably not use it. Phew. But whoever's employer does buy this are now constantly going to be scanned for potential malicious activity at work. Sounds like a scene from The Circle, or worse, The Every. Where the characters constantly have to express how happy they are and how aligned with the company because they're insta-fired if they're in the bottom 10%. This was meant to be a work of fiction. 1984 was not a manual, Microsoft. When Microsoft started their data farming with office insights "purely anonymous and intended to help increase your personal performance!!" I always knew it was a way of introducing much worse. But I didn't imagine they'd go this far this quickly, I assumed they'd just use all the data for marketing and misguided employee performance metrics. I say "misguided" since Office insights used the same "healthy" metrics for online meeting hours, concentration hours etc regardless of employees' roles, which obviously differ greatly in the type of work and amount of collaboration. I'm not sure if it still does this by the way, as I turned it off after the first weeks. Which by the way doesn't stop it collecting data, it just stops emailing me about it. It's a totally different thing to accuse employees of wrongdoing based on AI algorithms though. Imagine saying something like "oh god what a day, I hate this place" in a private teams chat after a frustrating meeting. +1 potential leaver point. Or "hey I hope they're going to give us some nice goodies at that event!". +1 suspicious gifts point. A few more points and way to go, you're on the HR shitlist. Sure, Microsoft recommend an "explicitly opted-in investigator" looks at it but who has time to spare these days. It'll just end up a metric on an excel sheet somewhere. I'm sure the data will be "anonymised" but this will probably mean that it will be averaged across a team. Since most of our teams are really small, it's really not that anonymous. And in fact, it makes it even harder to disprove, a low 'leaver' score might be caused by one colleague and put a dark shade over the entire team. I really don't like this at all. I understand that corporate comms tools are not meant to be private. But to me that means someone could look at it in the case of major transgressions. Not to constantly look at it and weigh every word in search of things which aren't even transgressions (as far as I recall, wanting to leave an organisation is still legal). PS: Also... "usernames are pseudonymized by default". What do you mean "by default"???, so it can be switched off to not pseudonymise? I really wonder how legal this is in the EU, especially stricter countries like Germany.

bcrl 4y ago
I am shocked and dismayed that a team of software developers would be willing to implement this kind of feature. The following poem comes to mind: First they came for the Communists And I did not speak out Because I was not a Communist Then they came for the Socialists And I did not speak out Because I was not a Socialist Then they came for the trade unionists And I did not speak out Because I was not a trade unionist Then they came for the Jews And I did not speak out Because I was not a Jew Then they came for me And there was no one left To speak out for me
- BizarroLand 4y ago
  Hey, hey, they got paid a fat 6 figures each to betray the rest of the human race.
capguy255 4y ago
I've used communication compliance for various things and in short - if a communication flags on a policy set up by an admin, it generates an alert that is reviewed by an analyst. By default, the username and associated metadata are masked. The analyst can tag the communication as compliant, non-compliant, or ask a second tier analyst to review. The analyst can also open up an investigation in the eDiscovery module, which prevents the documents from being deleted and allows attorneys or analysts to perform additional searching and tagging. The username, mailbox, and other metadata is not masked in eDiscovery, and so in order to access the investigation someone would need additional permissions. The upshot though is that even if the classifier detects a message, a human analyst would need to decide how to tag the message, and the decision for how to do so would need to be done according to a defensible policy. To your concern about not having to look at every word/message - it's less invasive to only investigate targeted communications than to read every message, or sample a fixed number or percentage of messages. I'm not entirely convinced that a ML approach is that much more useful than having a list of risk keywords because there isn't an easy way to measure and tune to the percentage of true positives detected or how many false positives you need to review to find true positives. Supervised machine learning like this is used pretty regularly during lawsuits to make the exchange of information more efficient but when people use an algorithm to avoid reviewing documents there is typically a process to demonstrate within a certain confidence level and margin of error that the relevant documents have been produced. But if used in a corporate investigation where you would want a higher confidence level and lower margin of error. And to get a higher statistical degree of confidence you need to review more.

bcrl 4y ago

I am shocked and dismayed that a team of software developers would be willing to implement this kind of feature. The following poem comes to mind: First they came for the Communists And I did not speak out Because I was not a Communist Then they came for the Socialists And I did not speak out Because I was not a Socialist Then they came for the trade unionists And I did not speak out Because I was not a trade unionist Then they came for the Jews And I did not speak out Because I was not a Jew Then they came for me And there was no one left To speak out for me

BizarroLand 4y ago
Hey, hey, they got paid a fat 6 figures each to betray the rest of the human race.

capguy255 4y ago

I've used communication compliance for various things and in short - if a communication flags on a policy set up by an admin, it generates an alert that is reviewed by an analyst. By default, the username and associated metadata are masked. The analyst can tag the communication as compliant, non-compliant, or ask a second tier analyst to review. The analyst can also open up an investigation in the eDiscovery module, which prevents the documents from being deleted and allows attorneys or analysts to perform additional searching and tagging. The username, mailbox, and other metadata is not masked in eDiscovery, and so in order to access the investigation someone would need additional permissions. The upshot though is that even if the classifier detects a message, a human analyst would need to decide how to tag the message, and the decision for how to do so would need to be done according to a defensible policy. To your concern about not having to look at every word/message - it's less invasive to only investigate targeted communications than to read every message, or sample a fixed number or percentage of messages. I'm not entirely convinced that a ML approach is that much more useful than having a list of risk keywords because there isn't an easy way to measure and tune to the percentage of true positives detected or how many false positives you need to review to find true positives. Supervised machine learning like this is used pretty regularly during lawsuits to make the exchange of information more efficient but when people use an algorithm to avoid reviewing documents there is typically a process to demonstrate within a certain confidence level and margin of error that the relevant documents have been produced. But if used in a corporate investigation where you would want a higher confidence level and lower margin of error. And to get a higher statistical degree of confidence you need to review more.