
Montana Standard newspaper plans to retroactively unmask anonymous commenters - uptown
https://www.washingtonpost.com/news/volokh-conspiracy/wp/2015/11/25/montana-standard-newspaper-plans-to-retroactively-unmask-anonymous-commenters/
======
ncallaway
This seems like a pretty clear-cut violation of their privacy policy. As Mr.
Volokh has noted they have promised in their privacy policy to not share this
information with third parties:

"We will not share individual user information with third parties unless the
user has specifically approved the release of that information. "

Further, they have even explicitly stated that they cannot retroactively
change the privacy policy to affect old comments:

"Of course, our use of information gathered while the current policy is in
effect will always be consistent with the current policy, even if we change
that policy later."

Given that, I don't see how this isn't a violation of their privacy policy.
The FTC suggests that they are willing to enforce companies that mis-use
personal information [1]. Given all of this, I highly encourage anyone who has
posted anonymously on the MT Standard to report them to the FTC using the
following form:
[https://www.ftccomplaintassistant.gov/Company#crnt](https://www.ftccomplaintassistant.gov/Company#crnt)

[1] [https://www.ftc.gov/news-events/media-
resources/protecting-c...](https://www.ftc.gov/news-events/media-
resources/protecting-consumer-privacy/enforcing-privacy-promises)

------
matt4077
"It is not that I am “unwilling to configure our software so that comments
posted before the new policy is implemented remain under chosen screen names.”
I extensively investigated that possibility and was unfortunately told by our
content-management software experts that such a configuration is impossible."

Is there actually any possible CMS where this problem cannot be solved in one
line of code? It's either a terrible excuse/lie or one of those examples of
why I'm so happy not to be working at a large organisation wrangling ancient
legacy systems.

~~~
briandh
A quick look at their source suggests that they are using something called
BLOX CMS, and their nameservers are run by TownNews, which is apparently the
company behind BLOX.

BLOX is advertised as "Cloud-based" with "No hardware or software to install &
maintain".

This all suggests that they actually cannot make such a change, by virtue of
using an SaaS solution they have no control over.

~~~
brazzledazzle
Sure, but they could change all old accounts to use the screen name as the
username, change their email address (locking them out of it) and force
everyone to reregister. It's a pain in the ass but it's the only practical
solution given the constraints.

But do they really need those comments on old articles? Why not just delete
them? This is a community paper. How often are people reading old articles and
how often are those people reading the comments? I have to question if the
management of the paper are motivated more by unmasking certain shitty
commenters than by anything else.

~~~
degenerate
Or:

UPDATE user SET realname=screenname WHERE screenname IS NOT NULL;

Done!

~~~
chris_wot
It's a cloud service, I doubt they have database access.

But remind me never to ever use BLOX. This seems like the MOST basic thing
you'd want to be able to do.

~~~
fleitz
Doubtful, I'd 86 this feature as a PM. Way too much complexity for too little
benefit.

~~~
chris_wot
Hardly. You'd simply just keep the status of existing posts as anonymous and
any posts after turning on the feature would show the posters real name.

~~~
fleitz
I understand how to make the implementation work initially, however I would
tell the client no we don't support that, and then wait for them to offer an
amount of money to make it worthwhile.

It's not hard, however, it complicates the software leading to subtle non-
obvious bugs, and then you need to support this features with all the other
features you're adding, etc.

PS. What happens when they turn if off? ...and then back on? And then the 20
other subtle bugs that this feature introduces... And how many other features
that lots of customers want are we delaying while we implement this?

All this work for $24.95 a month... yeah... no, 86'd.

~~~
chris_wot
I'd 86 the decision to purchase your software :-)

------
racerror
I'm pretty sure this is why their experts deem this impossible:

"[x] Display Screen Names [] Display Real Names"

[http://docs.townnews.com/kbpublisher/Comment-Manager-
Setting...](http://docs.townnews.com/kbpublisher/Comment-Manager-
Settings_7971.html#Presentation_subpanel)

------
chris_wot
_It is not that I am “unwilling to configure our software so that comments
posted before the new policy is implemented remain under chosen screen names.”
I extensively investigated that possibility and was unfortunately told by our
content-management software experts that such a configuration is impossible._

So what? If it is impossible, then your privacy policy was clear you will
protect the identity of posters.

Heaven help journalistic sources if they apply the same policy to anonymous
sources!

Here are your options:

1\. Tell the CRM writers the situation is unacceptable, and force them to fix
the issue

2\. Get a new, sane CRM that can actually do something that should be a
complete no brainer: allow previous posts to remain as-is. Then fire the
person who chose the unbelievable bad CRM you actually forked over money for.

3\. If neither of those options are possible, then do not proceed with you new
policy until which time you make the impossible, possible.

Frankly, you have Paul Levy on your tail. Be prepared for some substantial
lawsuits from an incredibly tenacious and effective lawyer.

------
andrewbinstock
If commenters can opt out of having their old comments posted, then the
Standard can opt out everyone who has not opted in. The only reason the
Standard has this problem is because they want to retain old comments _even
though doing so would violate their privacy policy._

------
such_a_casual
I hope this reinforces the idea that you should not give your real information
to any source unless absolutely necessary (website or otherwise). Privacy is
not a right in the digital age.

------
asciimo
Why not create a new user named Legacy Anonymous and reassign all anonymous
comments to it?

~~~
pavel_lishin
It might make comment chains really difficult to follow.

~~~
Riseed
True. But that's preferable to de-anonymizing information.

------
iamsohungry
This is both incompetent and dangerously irresponsible.

------
mansilladev
The legal exposure they're opening up is irresponsible to the business, aside
from the betrayal of trust to their readership. All of us developers here know
how easy of a workaround this is even without making mods to a SaaS app that
they have no control over. Just convert all old legacy comments to new faux
accounts. The SaaS provider can do this with a script, or the newspaper could
just do this all my hand in an admin UI. None of this makes sense. It's pure
laziness.

------
eveningcoffee
Lesson learned - never give out your real name if you do not want it to be
published or apply heavy self censoring if you do.

~~~
jacquesm
That's actually two lessons. The second one is that if you write something
online you should assume that it is tied to your real identity.

~~~
eveningcoffee
Well, if you advertise your name, then of course.

In any other case the answer is like in the real life: it depends.

------
klean92
Some people may have died, therefore have a hard time opt-out. Exposing them
after their death is so wrong.

------
tosseraccount
I'm in serious trouble.

------
killface
While all of us call BS on the tech team saying it "can't" be done [1], I'm
all for this. If you're saying mean/hateful stuff online, you deserve to have
your real name attached to it. It's amazing how much more polite people are
when they don't have a wall of anonymity protecting them.

[1]: My bet's on people who can barely use a computer stood up a wordpress or
joomla site, and only really understands how to edit configs, not actually
change the programming.

~~~
dewitt
If that's an exercise in irony, you nailed it, "killface".

~~~
brazzledazzle
Even though it's not an employer I would want to work for I do wonder if his
is the type that would at least make a concerned mental note that he has a
pseudonym like "killface". It's easy to call for the unmasking of anonymous
people when you're not the one that has to worry about the consequences.

