sPHENIX discussion of software

[pinkenburg <pinkenburg AT bnl.gov>]

Hi Justin,

the automatic recording seems to have worked after all. But I really 
have second thoughts about this. The PII issues Martin brings up are 
definitely valid and BNL actually does pay attention to this (last week 
I spend an hour to remove covid test pictures which are considered PII 
from a signup). I don't have time to scrub those recordings. I have seen 
yesterday another (quite hilarious) slip because of an open mike. While 
this was definitely funny for us - you really don't want this to show up 
on reddit, DOE is not known for a sense of humor.

I disabled the automatic recording again.

Chris

On 6/7/2022 9:26 AM, Martin Purschke via sPHENIX-software-l wrote:
> Hi Justin, all,
>
> let me briefly come back to the recording-of-meetings issue; first 
> from a technical standpoint, and then a bit of privacy musings.
>
> > The other thing is, it DID appear that the meeting was recorded 
> > automatically (it gave the warning to everyone when they entered the 
> > meeting) but Chris emailed that he did not see the video afterwards,  
> > but he did find one from a long time ago that we didn't think had 
> > successfully been recorded.   So I think it's possible that it may 
> > have just been still "processing" (which in my experience takes a 
> > while when I make local zoom recordings) , so I think it's still 
> > possible the recording MAY be available at some point, anyway we were 
> > going to try to make that available only if anyone was interested--fyi.
>
> I have in the past recorded "meetings with myself", as it is the 
> easiest way to make a brief recorded presentation that is often asked 
> for at conferences, like in poster sessions or (in a particular 
> committee meeting) a pre-recorded status report to expedite the 
> schedule. What has worked for me in zoom is to "Record on this 
> computer". At the end of the meeting you will find the mp4 file in a 
> OS-specific directory (like Documents/Zoom on a Mac). It takes zoom a 
> while to prepare the file. This has the advantage that you can still 
> sanitize the recording, for example, if someone verbally told the 
> audience some password or so.
>
> With that said - we all know that the recording requirement that we 
> adopted has not been without controversy. Not everyone has read Zoom's 
> privacy policies in full detail, but I always would try to err on the 
> side of caution. The so-stored recordings are just a data breach away 
> from getting out. Not just the Zoom "cloud", that would also be true 
> if we store them, say, with the Indico page.
>
> The reason we should be extremely concerned about this is that those 
> recordings, IMHO, must be considered PII. At least we as BNL 
> employees, and others by using BNL's resources, are bound by the rules 
> governing the collection of PII (that we all agreed to by signing the 
> Computer Use Agreement). What is PII? From SBMS:
>
> A combination of two or more of
>
> 1. First/last name
> ...
> 6. Biometrics, which includes unique physical characteristics such as 
> fingerprints and irises
> ...
>
> As you can see, my concerns are less about the *content* - I'm not 
> particularly worried about the world learning what we think our 
> Upsilon resolution might be. My main concern is the voice recording 
> itself, which is on a path to becoming the next big privacy issue. 
> Many systems can already use biometric values such as your voiceprint 
> for authentication (the above point 6). We all had robocalls where you 
> were tricked into answering "Yes!" to some question, where that 
> recording was later used as proof that you consented to something, 
> like paying money. A good article outlining the dangers (and that 
> reinforces my belief that a PII classification would stick) is at
> https://www.wired.com/story/voice-recognition-privacy-speech-changer/
>
> My worry is that we (again) will get into hot water by inadvertently 
> storing PII (read up on the protective measures that need to be in 
> place to do so), and that we push that responsibility down to 
> conveners and other meeting organizers and throw them under the bus 
> this way. I know that sPHENIX consulted the BNL legal council about 
> the rules in general but I don't recall if that also explicitly 
> covered the recordings.
>
> Speaking of consent: I would agree that clicking "ok" to the "This 
> meeting is being recorded" box constitutes such consent. But I have 
> seen many meetings that went, "oh, shouldn't we record this?" and then 
> the recording started without such a record of consent. Just pointing 
> out that we are recording will not be enough - I believe that this 
> takes an explicit recorded action, such as that click, and the passive 
> remaining in the meeting will not count.
>
> My 2cts in the role of today's devil's advocate...
>
>     Martin

--
*************************************************************

Christopher H. Pinkenburg       ;    pinkenburg AT bnl.gov
                                ;    http://www.phenix.bnl.gov/~pinkenbu

Brookhaven National Laboratory  ;    phone: (631) 344-5692
Physics Department Bldg 510 C   ;    fax:   (631) 344-3253
Upton, NY 11973-5000

*************************************************************