sPHENIX discussion of software

[Martin Purschke <purschke AT bnl.gov>]

Hi Justin, all,

let me briefly come back to the recording-of-meetings issue; first from 
a technical standpoint, and then a bit of privacy musings.

> The other thing is, it DID appear that the meeting was recorded 
> automatically (it gave the warning to everyone when they entered the 
> meeting) but Chris emailed that he did not see the video afterwards,  
> but he did find one from a long time ago that we didn't think had 
> successfully been recorded.   So I think it's possible that it may have 
> just been still "processing" (which in my experience takes a while when 
> I make local zoom recordings) , so I think it's still possible the 
> recording MAY be available at some point, anyway we were going to try to 
> make that available only if anyone was interested--fyi.

I have in the past recorded "meetings with myself", as it is the easiest 
way to make a brief recorded presentation that is often asked for at 
conferences, like in poster sessions or (in a particular committee 
meeting) a pre-recorded status report to expedite the schedule. What has 
worked for me in zoom is to "Record on this computer". At the end of the 
meeting you will find the mp4 file in a OS-specific directory (like 
Documents/Zoom on a Mac). It takes zoom a while to prepare the file. 
This has the advantage that you can still sanitize the recording, for 
example, if someone verbally told the audience some password or so.

With that said - we all know that the recording requirement that we 
adopted has not been without controversy. Not everyone has read Zoom's 
privacy policies in full detail, but I always would try to err on the 
side of caution. The so-stored recordings are just a data breach away 
from getting out. Not just the Zoom "cloud", that would also be true if 
we store them, say, with the Indico page.

The reason we should be extremely concerned about this is that those 
recordings, IMHO, must be considered PII. At least we as BNL employees, 
and others by using BNL's resources, are bound by the rules governing 
the collection of PII (that we all agreed to by signing the Computer Use 
Agreement). What is PII? From SBMS:

A combination of two or more of

1. First/last name
...
6. Biometrics, which includes unique physical characteristics such as 
fingerprints and irises
...

As you can see, my concerns are less about the *content* - I'm not 
particularly worried about the world learning what we think our Upsilon 
resolution might be. My main concern is the voice recording itself, 
which is on a path to becoming the next big privacy issue. Many systems 
can already use biometric values such as your voiceprint for 
authentication (the above point 6). We all had robocalls where you were 
tricked into answering "Yes!" to some question, where that recording was 
later used as proof that you consented to something, like paying money. 
A good article outlining the dangers (and that reinforces my belief that 
a PII classification would stick) is at
https://www.wired.com/story/voice-recognition-privacy-speech-changer/

My worry is that we (again) will get into hot water by inadvertently 
storing PII (read up on the protective measures that need to be in place 
to do so), and that we push that responsibility down to conveners and 
other meeting organizers and throw them under the bus this way. I know 
that sPHENIX consulted the BNL legal council about the rules in general 
but I don't recall if that also explicitly covered the recordings.

Speaking of consent: I would agree that clicking "ok" to the "This 
meeting is being recorded" box constitutes such consent. But I have seen 
many meetings that went, "oh, shouldn't we record this?" and then the 
recording started without such a record of consent. Just pointing out 
that we are recording will not be enough - I believe that this takes an 
explicit recorded action, such as that click, and the passive remaining 
in the meeting will not count.

My 2cts in the role of today's devil's advocate...

        Martin

--
Martin L. Purschke, Ph.D.        ;   purschke AT bnl.gov
                                 ;   http://www.phenix.bnl.gov/~purschke
                                 ;
Brookhaven National Laboratory   ;   phone: +1-631-344-5244
Physics Department Bldg 510 C    ;   fax:   +1-631-344-3253
Upton, NY 11973-5000             ;   skype: mpurschke
-----------------------------------------------------------------------