3 ms·

Before things like this become widespread, can we get some etiquette (and legal awareness)? On one recent videoconf with a startup founder, it turned out that

by neilv 2y ago

Before things like this become widespread, can we get some etiquette (and legal awareness)? On one recent videoconf with a startup founder, it turned out that they were using some random AI product with access to video and audio on the call, without my knowledge or consent. (Thanks a lot; now some AI gold rush company has video and audio recording of me, as well as ingested the non-public information on the call.) Their response to me asking about that made me sure I wanted nothing to do with that startup. But some AI company probably still has that private data, and if so, presumably will go on to leak it various ways. And it seems the only way to get an AI goldrush company to actually remove all trace of data it's obtained sketchily/illegally, might be to go legal scorched-earth on the company and its executives, as well as to any affiliates to whom they've leaked. We shouldn't need random people undertaking filing lawsuits and criminal complaints, just because some random other person was oblivious/indifferent about "consenting" on their behalf. Which "consent" I don't think is legal consent (especially not in "two-party" states), but AI goldrush companies don't care, yet.

goldfeld 2y ago
If really it is to become widespread it means we as society really got completely lost in the fold. It would be an act of defeat of the human element. But the magnates gonna love it.
grendelt 2y ago
A number of states have laws where you must disclose if the call is being recorded. I pointed this out to a former supervisor that was using otter.ai to record and transcribe calls he would make with potential leads and conference contacts. He said that law didn't apply in the state of our home-office. I told him it applies on calls made to subjects in other states. He disagreed. Not a lawyer, but I don't think that's how it works. And something like this... yikes. Sure, boss, you're not doing eyeball tracking, but all they would have to do is install this on a work computer and just ask AI for a percentage of time not directly spent hammering out code and pay you piecemeal per keystroke or something truly awful. (and the webcam module is coming later, I'm sure.) The future is dystopian.
- SparkyMcUnicorn 2y ago
  IANAL. I asked a lawyer about this and they said that recording a phone call from a one-party consent state to someone in any other state is typically legal without consent, as long as the the person recording is on the call. Personally, I think it's courteous to at least inform that it's being recorded, legality aside. > typically the law applies to the state where the recording is made. https://recordinglaw.com/united-states-recording-laws/one-party-consent-states/ https://recordinglaw.com/united-states-recording-laws/one-pa...
- eightysixfour 2y ago
  These are called one-party vs two(/all)-party consent states, states that are one-party only require a single party in the conversation to consent to being recorded. When the call is across state lines, the ECPA is the federal law, which only requires the consent of one-party, although in theory you could take them to court in the state which had an all-party rule. In general it is considered "nice" to ask, but the court case across state lines probably isn't going to go in favor of the person with the complaint. There are far more one-party states, 37, then two-party.
simonw 2y ago
"But some AI company probably still has that private data, and if so, presumably will go on to leak it various ways." Both OpenAI and Anthropic don't train on data sent to them via their API. If they leak that private data it was from a security breach, not because they piped it into their training run. (Cue a dozen comments saying "if you believe them about that you're naive", to which I have no useful response.)
- roywiggins 2y ago
  I moderately trust them not to egregiously lie, but what about every AI startup that's just a thin layer around an OpenAI API- what are their privacy policies, has it changed in the last 12 hours, and what happens when they go bust and sell their assets off?
  - simonw 2y ago
    Yeah, I agree - if you're sending data to some OpenAI wrapping company you have much less insight into whether or not they are permanently logging the data that you send them.
cj 2y ago
> Before things like this become widespread, can we get some etiquette (and legal awareness)? I was watching CNBC interview last week with the founder of https://mercor.com/ https://mercor.com/ (backed by Benchmark, $250m valuation). The founder was pitching that their company would take every employee's employment and payroll history (even from prior roles) and use that to make AI recommendations to employers on things like compensation, employee retention, employee performance, etc. The majority of what the founder was describing would clearly be illegal if any human did it by hand. But somehow because a LLM is doing it, it becomes legal. Specific example: In most states it's illegal for a company to ask job candidates what their salary was in prior roles. But suddenly it's no longer illegal if a big company like ADP feeds all the data into a LLM and query against the LLM instead of the raw dataset. Copyright issues wasn't enough to regulate LLMs. But I suspect once we start seeing LLMs used in HR, performance reviews, pay raise decisions, hiring decisions, etc, people will start to care. [0] https://www.cnbc.com/video/2024/09/27/streamlining-hiring-with-ai-benchmark-backs-ai-start-up-mercor.html https://www.cnbc.com/video/2024/09/27/streamlining-hiring-wi...
- roywiggins 2y ago
  You don't need AI to get this data, Equifax already hoovers it all up and offers it as a service. https://theworknumber.com/solutions/products/income-employment-verification https://theworknumber.com/solutions/products/income-employme...
- drdaeman 2y ago
  > But somehow because a LLM is doing it, it becomes legal. IANAL, but I believe it does not. As it was famously said way back in the day, a computer can never be held accountable, therefore a computer must never make a management decision. There is always a human in the loop who makes the actual decision (even if that's just a formality), and if this decision is based on a flawed computer's recommendation, the flaws still apply. I think it was repeatedly proven that "company's computer says so" is not a legal defense.
  - sterlind 2y ago
    aren't credit score checks literally this? credit scores are assigned to you based on feeding your personal data into some proprietary model. that score determines whether you get a loan, or a job, or a security clearance. there are policies that use hard cut-offs. how is that not exactly this?

by neilv 2y ago

goldfeld 2y ago

If really it is to become widespread it means we as society really got completely lost in the fold. It would be an act of defeat of the human element. But the magnates gonna love it.

grendelt 2y ago

A number of states have laws where you must disclose if the call is being recorded. I pointed this out to a former supervisor that was using otter.ai to record and transcribe calls he would make with potential leads and conference contacts. He said that law didn't apply in the state of our home-office. I told him it applies on calls made to subjects in other states. He disagreed. Not a lawyer, but I don't think that's how it works. And something like this... yikes. Sure, boss, you're not doing eyeball tracking, but all they would have to do is install this on a work computer and just ask AI for a percentage of time not directly spent hammering out code and pay you piecemeal per keystroke or something truly awful. (and the webcam module is coming later, I'm sure.) The future is dystopian.

SparkyMcUnicorn 2y ago
IANAL. I asked a lawyer about this and they said that recording a phone call from a one-party consent state to someone in any other state is typically legal without consent, as long as the the person recording is on the call. Personally, I think it's courteous to at least inform that it's being recorded, legality aside. > typically the law applies to the state where the recording is made. https://recordinglaw.com/united-states-recording-laws/one-party-consent-states/ https://recordinglaw.com/united-states-recording-laws/one-pa...
eightysixfour 2y ago
These are called one-party vs two(/all)-party consent states, states that are one-party only require a single party in the conversation to consent to being recorded. When the call is across state lines, the ECPA is the federal law, which only requires the consent of one-party, although in theory you could take them to court in the state which had an all-party rule. In general it is considered "nice" to ask, but the court case across state lines probably isn't going to go in favor of the person with the complaint. There are far more one-party states, 37, then two-party.

simonw 2y ago

"But some AI company probably still has that private data, and if so, presumably will go on to leak it various ways." Both OpenAI and Anthropic don't train on data sent to them via their API. If they leak that private data it was from a security breach, not because they piped it into their training run. (Cue a dozen comments saying "if you believe them about that you're naive", to which I have no useful response.)

roywiggins 2y ago
I moderately trust them not to egregiously lie, but what about every AI startup that's just a thin layer around an OpenAI API- what are their privacy policies, has it changed in the last 12 hours, and what happens when they go bust and sell their assets off?
- simonw 2y ago
  Yeah, I agree - if you're sending data to some OpenAI wrapping company you have much less insight into whether or not they are permanently logging the data that you send them.

cj 2y ago

> Before things like this become widespread, can we get some etiquette (and legal awareness)? I was watching CNBC interview last week with the founder of https://mercor.com/ https://mercor.com/ (backed by Benchmark, $250m valuation). The founder was pitching that their company would take every employee's employment and payroll history (even from prior roles) and use that to make AI recommendations to employers on things like compensation, employee retention, employee performance, etc. The majority of what the founder was describing would clearly be illegal if any human did it by hand. But somehow because a LLM is doing it, it becomes legal. Specific example: In most states it's illegal for a company to ask job candidates what their salary was in prior roles. But suddenly it's no longer illegal if a big company like ADP feeds all the data into a LLM and query against the LLM instead of the raw dataset. Copyright issues wasn't enough to regulate LLMs. But I suspect once we start seeing LLMs used in HR, performance reviews, pay raise decisions, hiring decisions, etc, people will start to care. [0] https://www.cnbc.com/video/2024/09/27/streamlining-hiring-with-ai-benchmark-backs-ai-start-up-mercor.html https://www.cnbc.com/video/2024/09/27/streamlining-hiring-wi...

roywiggins 2y ago
You don't need AI to get this data, Equifax already hoovers it all up and offers it as a service. https://theworknumber.com/solutions/products/income-employment-verification https://theworknumber.com/solutions/products/income-employme...
drdaeman 2y ago
> But somehow because a LLM is doing it, it becomes legal. IANAL, but I believe it does not. As it was famously said way back in the day, a computer can never be held accountable, therefore a computer must never make a management decision. There is always a human in the loop who makes the actual decision (even if that's just a formality), and if this decision is based on a flawed computer's recommendation, the flaws still apply. I think it was repeatedly proven that "company's computer says so" is not a legal defense.
- sterlind 2y ago
  aren't credit score checks literally this? credit scores are assigned to you based on feeding your personal data into some proprietary model. that score determines whether you get a loan, or a job, or a security clearance. there are policies that use hard cut-offs. how is that not exactly this?