Question about DCUM's new privacy policy

[Anonymous]

I am sorry if this is a dumb question about a provision in the new privacy policy. Can you give me some specific examples of when posters information would be exchanged with other organizations for fraud protection and risk reduction? The full provision is "as necessary to protect the rights, safety, or property of DC Urban Moms and Dads, its users, or others; this may include (for example) exchanging information with other organizations for fraud protection and/or risk reduction."

TIA.

[jsteele]

Yes. But, first of all, remember that this provision applies to Personally Identifiable Information (PII). I collect very little PII and even that is only in cases in which users register.

But here is one hypothetical example based on a real world case:

The other day someone posted what they described as the contents of an email which advertised an open house involving a number of schools. The post included a link to a Google Docs to register for the event.

Subsequent to that posting, another user posted what they also described as the contents of an email which warned that the first post was not trustworthy and that it might be aimed at illicitly collecting personal data.

As it happens, I had also been contacted about the first post and asked to remove the link because it was supposed to be used for internal uses only. Strangely, I wasn't contacted by the senders of the second email. But, let's assume that I was contacted and told that it appeared that someone was using DCUM to illicitly collect personal data. Let's further assume that the link was not so easily explained and that there was not a good explanation for why personal data was being collected. Finally, let's assume that I had knowledge of the name, email address, DCUM username, and/or password of the poster of the link. In that case, I might share that data with those trying to determine the legitimacy of the data collection.

I also want to further clarify again that this provision applies to PII. The bar for information I collect that is not PII -- such as IP addresses -- is lower. I will not share IP addresses willy-nilly, but I will not protect them like the family jewels either.

[Anonymous]

Thanks for the clarification.

[Anonymous]

Under what circumstances do you share ip addresses?

[Anonymous]

15:07 here. I meant to clarify beyond a legal obligation to produce ip addresses.

[jsteele]

Anonymous wrote:Under what circumstances do you share ip addresses?

It's really a judgement call. In all the years we've operated this website, I can probably count the times I've shared IP addresses on one hand. Most of those cases were related to misuse of the website. One case was related to a law enforcement issue.

[Anonymous]

Can you clarify what qualifies as "misuse of website"? I am trying to get a handle on how much expectation of anonymity anyone has on the board. If the rule of thumb is "a judgment call," and not established, identifiable circumstances, then in reality we can have no such expectation--unless, of course I misunderstand--although I suppose that holds true for most forums.

[jsteele]

Anonymous wrote:Can you clarify what qualifies as "misuse of website"? I am trying to get a handle on how much expectation of anonymity anyone has on the board. If the rule of thumb is "a judgment call," and not established, identifiable circumstances, then in reality we can have no such expectation--unless, of course I misunderstand--although I suppose that holds true for most forums.

What I believe you are misunderstanding is the disconnect between IP addresses and anonymity. An IP address does not identify a user. It may narrow it down, but it is networking information, not personally identifiable information. It is easier to define "misuse of the website" by explaining what appropriate use is. The discussion forums are meant for users to ask questions, respond to questions, and engage in general conversation. As long as you are simply doing those things, you have nothing to worry about. If you are spamming, sock puppetting, trolling, attempting to spread malware, committing libel, or committing any number of other activities that can be deemed as malicious, I may share your IP address. However, generally, I can deal with any of these things myself and don't have to share your IP address. But, there have been a small number of cases over the years when a user's behavior was such that I found it appropriate to share IP addresses with other organizations.

[Anonymous]

jsteele wrote:

Anonymous wrote:Can you clarify what qualifies as "misuse of website"? I am trying to get a handle on how much expectation of anonymity anyone has on the board. If the rule of thumb is "a judgment call," and not established, identifiable circumstances, then in reality we can have no such expectation--unless, of course I misunderstand--although I suppose that holds true for most forums.

What I believe you are misunderstanding is the disconnect between IP addresses and anonymity. An IP address does not identify a user. It may narrow it down, but it is networking information, not personally identifiable information. It is easier to define "misuse of the website" by explaining what appropriate use is. The discussion forums are meant for users to ask questions, respond to questions, and engage in general conversation. As long as you are simply doing those things, you have nothing to worry about. If you are spamming, sock puppetting, trolling, attempting to spread malware, committing libel, or committing any number of other activities that can be deemed as malicious, I may share your IP address. However, generally, I can deal with any of these things myself and don't have to share your IP address. But, there have been a small number of cases over the years when a user's behavior was such that I found it appropriate to share IP addresses with other organizations.

Why would the misuse of conduct on this site have to do with other organizations? What's the gain on your part?

[jsteele]

Anonymous wrote:

jsteele wrote:

Anonymous wrote:Can you clarify what qualifies as "misuse of website"? I am trying to get a handle on how much expectation of anonymity anyone has on the board. If the rule of thumb is "a judgment call," and not established, identifiable circumstances, then in reality we can have no such expectation--unless, of course I misunderstand--although I suppose that holds true for most forums.

What I believe you are misunderstanding is the disconnect between IP addresses and anonymity. An IP address does not identify a user. It may narrow it down, but it is networking information, not personally identifiable information. It is easier to define "misuse of the website" by explaining what appropriate use is. The discussion forums are meant for users to ask questions, respond to questions, and engage in general conversation. As long as you are simply doing those things, you have nothing to worry about. If you are spamming, sock puppetting, trolling, attempting to spread malware, committing libel, or committing any number of other activities that can be deemed as malicious, I may share your IP address. However, generally, I can deal with any of these things myself and don't have to share your IP address. But, there have been a small number of cases over the years when a user's behavior was such that I found it appropriate to share IP addresses with other organizations.

Why would the misuse of conduct on this site have to do with other organizations? What's the gain on your part?

I don't know that there is any gain on my part. It's not like I would be selling the information. But, as I said, IP addresses are networking information. DCUM is one end of the network connection and the IP address represents the other end. Investigation and/or confirmation of whatever misbehavior is at issue often requires working with those in control of the other end. BTW, the privacy policy is new, but our treatment of IP addresses has been documented in our Frequently Asked Questions document since March 2009:

What is an IP address and is it private?

An Internet Protocol, or IP, address is a numerical address that shows the source of connections to a website (this is a vast over-simplification, but close enough for this discussion). Hostnames, such as "www.dcurbanmom.com", are translated to numeric IP addresses. Similarly, a numeric address can often be translated to a hostname. This "reverse translation" can reveal information concerning the source of a post, such as the poster's employer (if the poster is accessing DCUM from work), ISP, or the country in which the poster is present. DCUM Administrators reserve the right to reveal both IP addresses and details learned from them either publicly or privately in connection with abuse or misuse of the DCUM website. Abuse and misuse include, but are not limited to, trolling (posting inflammatory messages in order to elicit a response), sock puppeting (posting multiple messages as if you were a different poster in each case), spamming, and chronic rudeness.

[Anonymous]

How often do you called up/search responses from a single IP Address? Do you or your staff draw a composite of posters and respond to posts based on your perceived strengths, weaknesses, and passions of individuals rather than responding strictly to what is being discussed in individual threads??

[jsteele]

Anonymous wrote:How often do you called up/search responses from a single IP Address? Do you or your staff draw a composite of posters and respond to posts based on your perceived strengths, weaknesses, and passions of individuals rather than responding strictly to what is being discussed in individual threads??

I have to smile about your use of "staff". There is me and my wife Maria. She would object if I described her as staff, so that probably makes me the "staff'.

If I am engaged in a discussion, I barely pay attention to the IP address. I try to respond to the message based its content alone. However, the IP addresses are visible to me and having looked at them daily for so many years, I can normally recognize Verizon, Comcast, and RCN addresses. Some addresses are memorable enough that I sort of recognize the user (without actually knowing who the user is except in a couple of cases where the user is a friend).

As for searching responses from a single address, I do that when I suspect a user of sock puppetting, trolling, or other inappropriate behavior. The only response I would make after doing this would be to out someone as a troll or comment on their innocence. I do this a couple of times a week, though it varies.

[Anonymous]

Okay thanks. In regards to staff I've seen more names as moderators and more advertising appear during the past couple years so my assumption was that your DCUM
Business /operation had expanded.

Thanks for the information. Your practices seem reasonable to me.