Before AI, you needed to trust the recipient and the provider (Gmail, Signal, WhatsApp, discord). You could at least make educated guesses about both for the risk profile. Such as: if someone leaks the code to this repo, it’s likely a collaborator or GitHub.
Today, you invite someone to a private repo and the code gets exfiltrated by a collaborator running whatever AI tool simply by opening their IDE.
Or you send someone an e2ee message on Signal but their AI reads the screen/text to summarize and now that message is exfiltrated.
Yes, I know it’s ”nothing new” ”in principle this could happen because you don’t control the client”. But opsec is also about what happens when well-meaning participants being accomplices in data collection. I used to trust that my friends enough to not share our conversations. Now the default assumption is that text & media on even private messaging will be harvested.
Personally I’m not ever giving keys to the kingdom to a remote data-hungry company, no matter how reputable. I’ll reconsider when local or self-hosted AI is available.
DaiPlusPlus · 2h ago
Assuming the courts simplify Otter AI down to being a glorified call recording and transcribing tool (because the fact it's "AI" isn't really relevant here w.r.t. privacy/one/two-party-consent rules then doesn't the legal responsibility here lie with whichever person added Otter AI to group-calls without informing the other members?
----
EDIT: So the crux of the matter is whether-or-not having Otter AI automatically join meetings via their Slack/Zoom/etc integrations is by-itself legally wrong - or not:
> "In fact, if the meeting host is an Otter accountholder who has integrated their relevant Google Meet, Zoom, or Microsoft Teams accounts with Otter, an Otter Notetaker may join the meeting without obtaining the affirmative consent from any meeting participant, including the host," the lawsuit alleges. "What Otter has done is use its Otter Notetaker meeting assistant to record, transcribe, and utilize the contents of conversations without the Class members' informed consent."
I'm surprised the NPR article doesn't touch on the possible liability of whoever added Otter in the first place - surely the buck stops there?
gruez · 2h ago
>doesn't the legal responsibility here lie with whichever person added Otter AI to group-calls without informing the other members
IANAL but companies providing a product has certain responsibilities too, especially when they're intended to be used for a given purpose (ie. recording meetings with other people on it). Most call recording software I come across have a recording notice that can't be disabled, presumably to avoid lawsuits like this.
>EDIT: So the crux of the matter is whether-or-not having Otter AI automatically join meetings via their Slack/Zoom/etc integrations is by-itself legally wrong - or not:
Note the preceding paragraph also notes that even when the integrations aren't used, otter only obtains consent from the meeting host. In all-party consent states that's clearly not sufficient.
>because the fact it's "AI" isn't really relevant here
Again, IANAL, but "recording" laws might not apply if they're merely transcribing the audio? To take an extreme case, it's (probably) legal to hire a stenographer to sit next to you on meetings and transcribe everything on the call, even if you don't tell any other participants. Otter is a note-taking app, so they might have been in the clear if they weren't recording for AI training.
boothby · 2h ago
I had a conversation with a lawyer who had invited OtterAI to our confidential meeting. I was gobsmacked, and I quickly read Otter's privacy statement -- my impression was that they retain your data in a cloud service and use your "anonymized" (or was it "depersonalized"?) recordings as future training data. Even if they have a bona fide reason for all that, I question their ability to store the data securely and succeed in anonymizing data that contains unique identifiers that could be tied to future court records. I refused to continue in the presence of the bot.
And, even beyond security is their ability to hold promises made over the data in the event of a private equity takeover, a rogue employee, etc.
blitzar · 46m ago
I cant believe I am going to say this - but I am on the Ai company side.
They recorded the call and sent it to all participants. Its not their fault the users are idiots.
brendang_sd · 34m ago
That’s the problem though, getting the email with a copy of the recording may be the unwitting participants first indication that the call was recorded without their knowledge or consent.
Otters defense is that it’s up to their users to inform other participants and get their consent where necessary, the claim of the lawsuit is that Otter is deliberately making a product which does not make it obvious that the call is being recorded, and by default does not send a pre-meeting notice that it will be joining and recording.
athenot · 6m ago
I remember being on sensitive zoom calls and seeing Otter.ai join. Had to track down which person was using it, and even they were clueless as to how it got there, and the client kept rejoining despite the user trying to stop it.
I've never used this service so I don't know if the user was being particularly clueless or if some dark pattern was at play; I suspect it's probably a little bit of both.
matthewdgreen · 27m ago
I mean, the standard product experience here is that everyone gets a visual or audio warning that the meeting is being recorded.
bilekas · 1h ago
> Last year, an AI researcher and engineer said Otter had recorded a Zoom meeting with investors, then shared with him a transcription of the chat including "intimate, confidential details" about a business discussed after he had left the meeting. Those portions of the conversation ended up killing a deal,
I'm sorry but this is another example of not checking AI's work. Whatever about the excessive recording, that's one thing, but blindly trusting the AI's output and then using it blindly as a company document for a client is on you.
themanmaran · 44m ago
This just seems like massive user error. The same thing could have happened in a low tech environment. And the notetaker just made it more obvious.
Ex: Hop on a conference call with a group of people, Person A "leaves early" but doesn't hang up the phone, then the remaining group talks about sensitive info they didn't want Person A to hear.
bilekas · 40m ago
> Person A "leaves early" but doesn't hang up the phone, then the remaining group talks about sensitive info they didn't want Person A to hear.
I'm sorry but any conference software will make it extremely clear who is still on the call. Again I do put a lot of this scenario down to the User-fault. But the fact that this software is "always on" instead of "activated/deactivated" feels like incomplete software suite to me personally.
blitzar · 33m ago
> who is still on the call
On internet / app based systems yes ... but on legacy systems you have to remember all 16 of the '<Person> is joining the call' and mentally check them off when you get the '<Person> is leaving the call' on the way out.
You didnt even have to make the mistake once to know not to keep talking on the call anyone can dial into after you think everyone left.
kevingadd · 1h ago
I checked the original tweet to try and understand this better and what appears to have happened is that Otter kept recording after he left and the VCs stayed on the call chatting (for hours, according to the tweet). This violates the assumption baked into the recording agent (all participants of the call have a right to a transcript of the whole call) by repurposing a scheduled meeting into a party line/just chatting sort of situation.
You could fix this by training people not to use booked meetings this way but I'm not sure how realistic that is to do. I think it might be that services like Otter need to be adjusted to take into account that not every part of a meeting is of equal sensitivity.
i.e. my HOA's monthly meetings have a private period for the board only and a public period for all residents. If Otter were used in this configuration, it would broadcast the exact details of those private discussions to the whole building, which might include board members discussing details that shouldn't be shared with everyone.
bilekas · 42m ago
> I think it might be that services like Otter need to be adjusted to take into account that not every part of a meeting is of equal sensitivity.
One would like to think that a company transcribing company meetings of varying degrees of sensitivity would have the feature you're describing built into it. If nothing else other than the auditing process that's usually involved for new software.
Maybe just those companies in a rush to adopt the latest AI tooling are not fully considering what they're doing.
brendang_sd · 30m ago
That’s part of it too, the bigger issue is the knowledge and consent of other participants.
I know someone who is involved in a lawsuit regarding a child, and one of the lawyers used this service to record and transcribe a very confidential meeting. Their first awareness of the illegal wiretapping by this company was when a summary email showed up at the end of the meeting. Needless to say, they weren’t happy, not just about the surreptitious recording, but also the discovery that the contents of that confidential coal will live forever in Otter’s training set. When the company was asked about this, they dismissed any kind of responsibility of their own, and noted it the responsibility of their subscribers to use the product appropriately.
xnx · 2h ago
Why does Otter AI exist? Aren't those features built-in to videoconferencing now?
jorts · 2h ago
Most of the ones built into the video conferencing solutions aren't as good.
Today, you invite someone to a private repo and the code gets exfiltrated by a collaborator running whatever AI tool simply by opening their IDE.
Or you send someone an e2ee message on Signal but their AI reads the screen/text to summarize and now that message is exfiltrated.
Yes, I know it’s ”nothing new” ”in principle this could happen because you don’t control the client”. But opsec is also about what happens when well-meaning participants being accomplices in data collection. I used to trust that my friends enough to not share our conversations. Now the default assumption is that text & media on even private messaging will be harvested.
Personally I’m not ever giving keys to the kingdom to a remote data-hungry company, no matter how reputable. I’ll reconsider when local or self-hosted AI is available.
----
EDIT: So the crux of the matter is whether-or-not having Otter AI automatically join meetings via their Slack/Zoom/etc integrations is by-itself legally wrong - or not:
> "In fact, if the meeting host is an Otter accountholder who has integrated their relevant Google Meet, Zoom, or Microsoft Teams accounts with Otter, an Otter Notetaker may join the meeting without obtaining the affirmative consent from any meeting participant, including the host," the lawsuit alleges. "What Otter has done is use its Otter Notetaker meeting assistant to record, transcribe, and utilize the contents of conversations without the Class members' informed consent."
I'm surprised the NPR article doesn't touch on the possible liability of whoever added Otter in the first place - surely the buck stops there?
IANAL but companies providing a product has certain responsibilities too, especially when they're intended to be used for a given purpose (ie. recording meetings with other people on it). Most call recording software I come across have a recording notice that can't be disabled, presumably to avoid lawsuits like this.
>EDIT: So the crux of the matter is whether-or-not having Otter AI automatically join meetings via their Slack/Zoom/etc integrations is by-itself legally wrong - or not:
Note the preceding paragraph also notes that even when the integrations aren't used, otter only obtains consent from the meeting host. In all-party consent states that's clearly not sufficient.
>because the fact it's "AI" isn't really relevant here
Again, IANAL, but "recording" laws might not apply if they're merely transcribing the audio? To take an extreme case, it's (probably) legal to hire a stenographer to sit next to you on meetings and transcribe everything on the call, even if you don't tell any other participants. Otter is a note-taking app, so they might have been in the clear if they weren't recording for AI training.
And, even beyond security is their ability to hold promises made over the data in the event of a private equity takeover, a rogue employee, etc.
They recorded the call and sent it to all participants. Its not their fault the users are idiots.
Otters defense is that it’s up to their users to inform other participants and get their consent where necessary, the claim of the lawsuit is that Otter is deliberately making a product which does not make it obvious that the call is being recorded, and by default does not send a pre-meeting notice that it will be joining and recording.
I've never used this service so I don't know if the user was being particularly clueless or if some dark pattern was at play; I suspect it's probably a little bit of both.
I'm sorry but this is another example of not checking AI's work. Whatever about the excessive recording, that's one thing, but blindly trusting the AI's output and then using it blindly as a company document for a client is on you.
Ex: Hop on a conference call with a group of people, Person A "leaves early" but doesn't hang up the phone, then the remaining group talks about sensitive info they didn't want Person A to hear.
I'm sorry but any conference software will make it extremely clear who is still on the call. Again I do put a lot of this scenario down to the User-fault. But the fact that this software is "always on" instead of "activated/deactivated" feels like incomplete software suite to me personally.
On internet / app based systems yes ... but on legacy systems you have to remember all 16 of the '<Person> is joining the call' and mentally check them off when you get the '<Person> is leaving the call' on the way out.
You didnt even have to make the mistake once to know not to keep talking on the call anyone can dial into after you think everyone left.
You could fix this by training people not to use booked meetings this way but I'm not sure how realistic that is to do. I think it might be that services like Otter need to be adjusted to take into account that not every part of a meeting is of equal sensitivity.
i.e. my HOA's monthly meetings have a private period for the board only and a public period for all residents. If Otter were used in this configuration, it would broadcast the exact details of those private discussions to the whole building, which might include board members discussing details that shouldn't be shared with everyone.
One would like to think that a company transcribing company meetings of varying degrees of sensitivity would have the feature you're describing built into it. If nothing else other than the auditing process that's usually involved for new software.
Maybe just those companies in a rush to adopt the latest AI tooling are not fully considering what they're doing.
I know someone who is involved in a lawsuit regarding a child, and one of the lawyers used this service to record and transcribe a very confidential meeting. Their first awareness of the illegal wiretapping by this company was when a summary email showed up at the end of the meeting. Needless to say, they weren’t happy, not just about the surreptitious recording, but also the discovery that the contents of that confidential coal will live forever in Otter’s training set. When the company was asked about this, they dismissed any kind of responsibility of their own, and noted it the responsibility of their subscribers to use the product appropriately.