Clarify notification failure must be due to exigent circumstance, not merely rare about site-policy

[wking]

On Fri, Jul 28, 2017 at 10:25:52AM -0700, Denver Gingerich wrote: Replace "rare, exigent circumstances" with "exigent circumstances (such circumstances are rare)"… The previous wording is somewhat ambiguous as to whether the list is "and" or "or" and this change corrects that.

I'm less convinced that the original wording was unclear in this way. But are those conditions really true? It sounds like GitHub will tell you about disclosing your data when they're allowed to, except sometimes when they choose not to. Can we just drop that loophole and say: We will make a reasonable effort to notify users of any disclosure of their information, unless we are prohibited by law or court order from doing so. “reasonable effort” already gives GitHub some wiggle room. And there's no commitment to timeliness, so exigency seems orthogonal. When GitHub has to disclose something *right now* but doesn't want to tell you then, they can always loop back around and make a reasonable effort to tell you in a month.

[nsqe]

Thanks for the discussion, @ossguy and @wking.

I left this open for a bit so I could give it some thought. What I keep coming back to, though, is that I agree with @wking: I don't believe that the wording is unclear.

But are those conditions really true?

Yep. Those conditions are true.

To clarify, GitHub will make a reasonable effort to notify users of any disclosure of their information, unless:

• we are prohibited by law or court order from doing so, OR
• in rare, exigent circumstances.

There may be times when there is an emergency — you can probably imagine that people post all kinds of stuff on GitHub, and not all of it is code-related — and for, say, public health reasons, we may need to speak with law enforcement agencies without immediately letting a user know we have done so. Those circumstances are extremely rare, but we need the ability to respond to emergencies.

No, "reasonable effort" does not give us that wiggle room, and I think what you may be missing is that we don't want wiggle room. We want to be very clear in what we're doing with our users' data, when, and why.

The wording we have gives clarity.

[wking]

On Tue, Aug 01, 2017 at 06:11:25PM -0700, Hannah Poteat wrote: There may be times when there is an emergency — you can probably imagine that people post all kinds of stuff on GitHub, and not all of it is code-related — and for, say, public health reasons, we may need to speak with law enforcement agencies _without immediately letting a user know we have done so_. Those circumstances are extremely rare, but we need the ability to respond to emergencies.

Can you give more details on this hypothetical (public health?) example, where you are not prohibited by law or court order from notifying the user, but decide to *never* notify the user anyway? That certainly sounds like you want wiggle room to me ;). Note that there are currently no claims about "immediately" in the ToS.

[nsqe]

Can you give more details on this hypothetical (public health?) example, where you are not prohibited by law or court order from notifying the user, but decide to never notify the user anyway?

This is somewhat hard to answer without going into specifics. The best answer I can give is, remember when this happened? We sometimes need to not risk that.

[wking]

On Thu, Aug 03, 2017 at 09:49:26AM -0700, Hannah Poteat wrote: > Can you give more details on this hypothetical (public health?) > example, where you are not prohibited by law or court order from > notifying the user, but decide to *never* notify the user anyway? This is somewhat hard to answer without going into specifics.

Yeah. Hypotheticals or public historical examples are certainly the way to go for explaining this.

The best answer I can give is, remember when [this happened](https://www.theguardian.com/technology/2017/jun/16/facebook-moderators-identity-exposed-terrorist-groups)? We sometimes need to not risk that.

That sounds like “big oops, we accidentally leaked personal information”, while [1] seems to be about intentional (possibly compelled) disclosure. It may be worth describing how GitHub will notify users if a security vulnerability may have leaked their information (the closest things I can find are [2,3], which don't seem to address notifying potentially affected users), but that seems orthogonal to this issue. To get back to this issue, suppose the Facebook leak was intentional. They also have “Craig D’Souza, Facebook’s head of global investigations, liaised directly with some of the affected contractors”, which sounds like making “a reasonable effort to notify users of any disclosure of their information” [1]. So I'm not sure why that example is a reason you want a condition to avoid notifying users about disclosing their information when you are legally allowed to notify that user. [1]: https://github.com/github/site-policy/blob/75c016d80fe819c192f5c953eb3829bee63462a2/Policies/github-privacy-statement.md#how-we-respond-to-compelled-disclosure [2]: https://github.com/github/site-policy/blob/75c016d80fe819c192f5c953eb3829bee63462a2/Policies/responsible-disclosure-of-security-vulnerabilities.md [3]: https://help.github.com/articles/github-security/