Tell HN: Otter.ai bot recording meetings without consent
I occasionally use Otter.ai to transcribe when I'm multitasking. Recently they made an update, which I carefully opted out of, to automatically join every meeting through my Google Calendar and transcribe it. Screenshots prove I had the feature disabled.
The bot proceeded to join two confidential meetings on my behalf and record the whole thing, then email every member an absurd, inaccurate "outline" after.
I am not much of a privacy person but I feel completely abused in this situation. I have opened a support ticket with screenshots but there is no response, and according to Twitter they are essentially not reviewing tickets from free users at the moment.
So just a heads-up to the HN community!
Are there other, more privacy oriented transcription services anyone can recommend?
190 comments
[ 3.3 ms ] story [ 240 ms ] threadImportant thing here is, you're not a customer.
> Are there other, more privacy oriented transcription services anyone can recommend?
Probably not, since this is probably a bug that can affect any of these applications. And privacy focused apps are a niche and a niche that isn't that much fun to develop. The nature of these apps lean towards people who aren't privacy focused since you would be allowing a third party to listen to calls which is the opposite of privacy. You don't need a more privacy focused app, you just need another app and probably to become a customer so you can get the support you clearly want.
That’s not the important thing at all. The important thing is the Otter.ai is violating the privacy of its users, potentially even breaking laws in some jurisdictions.
If anything, it raises some more red flags that they’re ignoring consent for free users, since that could be interpreted as an attempt to monetize them by collecting data (again, without consent)
If you don’t want non-paying users, then don’t offer a free tier. You don’t get a free pass to do whatever you want to a user just because they aren’t using your paid plan.
I would derive great enjoyment of them in court in a 2 party state telling a judge "well since they weren't really a customer....."
If you install recording software, you're liable for what it records. Bug or not bug, the liablity is yours. The only way you would get Otter.ai in a courtroom would be a civil case and then the not being a paying customer therefore no expectations of a warranty applies.
Seriously, this thread is "I installed recording software and it worked on things I didn't think it would. This company is terrible." while most of us work in tech and know that bugs exist and have generally written some bugs. Worse case, it's a bug. The solution is to stop using it and move on. Or pay for support and have them fix it.
not if it's recording without your consent
> Seriously, this thread is "I installed recording software and it worked on things I didn't think it would.
a poor attempt to reframe the thread, which is actually about a company monitoring confidential meetings without consent
if affirmative consent is such a non-issue here, why couldn't the company get it?
Because some company figured out a 'hack' to make more money, somehow turns from illegal to "legal". And so many users here will defend that.
In this case, it's violating interstate wiretapping laws and state-based 2 party consent laws. But.. they just squint hard and go "Hey we can violate the law and make MORE money".
Uber is exactly that. So is AirBNB. So is Lime/Bird. Just go look at much of the tech companies, and it's "Offline company + way to break law to get money + ONLINE!!!!1!!1!"
A local transcription, manually triggered service would solve the concern I think.
> You don't need a more privacy focused app, you just need another app and probably to become a customer so you can get the support you clearly want.
I think there's a difference between free users with a "hey, my app is broken" complaint and "hey, you just did something incredibly wrong" complaint. It would be like if free Dropbox started uploading random files that it wasn't allowed to in the settings.
The thing is, you would need to review each of the complaints to know which is which. If you're providing no support and because you're not taking money for the service there is no real liability (depending on the contract) being a non-customer would mean, if they do something incredibly wrong you need to get a new provider.
If you're not a customer, you can't expect support. If you want support, pay $10 and then fill the ticket. It just annoys me when people complain about not getting support when they've not paid for anything.
Just because you're not taking money doesn't mean you can break the law without liability! Even outside of GDPR/CCPA, most states require all parties to consent in recording and every state requires at least one party to consent in recording.
I do agree that this is the kind of service worth paying for if you want privacy and I'm not a lawyer so I can't say that this is actually illegal, but if you're ignoring not just "hey this is incredibly wrong" tickets but "hey this is illegal and I'm warning you before I file an official complaint" that seems like it will end poorly.
I think the support ticket was only mentioned in the sense that a journalist would: "we contacted the company; they did not respond to the allegations."
- if it's my memory against their database, I'd probably lose.
- if it's my video capture against their database, it could go either way.
- if it's me and several others' videos against their database, we'd likely win.
But besides the win-lose proposition, it'd be worth something to me to be confident whether I was right or not.
If it's them, they can just say "ok so what" to your footage, it existing or not or coming from multiple people or not is not entirely relevant, as a company they can choose to use it or throw it away.
If it's everyone else, why? What benefit does it get you to have others know you're right? You're still in the same position, with your choice discarded.
It could be a government consumer protection agency investigating the company, or a court asked to fine the company.
You could sign the screenshot with a timestamp (out of my league though to get that right) from an untamperable source to show it hasn't been tampered with. Did you mean that?
Write the procedure up, and have a VP attest that they ordered this done and have audited a random sample to ensure that it was done to spec. Get the attestation notarized. Repeat once a quarter or so. If the VP moves on or dies, make sure the new VP is on board immediately.
No need to have a screenshot, it's email. When a court requires you to show evidence, you bring in the VP, the notarized statement, a copy of the code, and the encrypted and unencrypted archive for that day.
> record my screen with OBS (https://obsproject.com/)
>> 1080p in 10fps might be enough and it won't take ridiculous amount of space (ffmpeg de-dupe afterward: https://news.ycombinator.com/item?id=32215277#32223240)
--
> The space requirements can be very low capturing something like writing code (ffmpeg low fps: https://news.ycombinator.com/item?id=32215277#32235012)
--
> (Mac shell command & AppleScript: https://news.ycombinator.com/item?id=32215277#32219314)
--
Other OSS recommendations (there are a couple good offline Mac software recommendations as well):
https://getsharex.com - Windows
> You can also configure sharex to run tesseract ocr locally on the images
https://github.com/soruly/TimeSnap - Windows, archived
https://github.com/wanderingstan/Lifeslice - Mac
https://flameshot.org
https://tropy.org - organize images
1: https://www.realartists.com/
Are you living somewhere covered by GDPR (=EU, UK, nordic states) or in California? If yes, complain at the data protection agency.
Overall, sounds like a VERY unscrupulous company, that you shouldn’t trust with your personal data.
Especially if it was some unaccountable third party recording agent! Who knows where that data is going?
And he did have it configured to send out emails. So that part is true.
If you have some kind of insight into the specific configuration of otter.ai, or evidence that this specific person has made a mistake (and that all of the other people that have also seen this behavior are also mistaken) that would be constructive. As it is, you're not even carrying water for a company, you're offering water to a company that didn't ask for it by denigrating the people around you.
Like I explained in the other comment, while mistaken configurations are frequently a user mistake, I was exceptionally careful in this instance because the same thing had just happened to my boss and I was wondering what the mistake she made was.
Also, I was hoping for a quality investigation and response from otter.ai but I think anyone can compare the credibility of my account to their response in this thread to figure out who they believe.
This isn't true at all. This feature was and is disabled on my account.
> How many times has a user said they didn't configure something that way and when you checked they did and they were thinking about a different setting for something else? Realisitically, it's actually the most likely thing that happened.
Normally I would agree with you - the same thing happened to my boss earlier in the day, the Otter bot joined a call before she did and she was baffled how it was there. I thought she must have accidentally enabled a new feature.
So when I looked at my otter.ai account after that I was exceptionally careful to not just click through the big blue "Enable Otter Assistant" button and find the light grey "Skip" button in the upper right. To no avail, as the Otter bot started to invade my meetings after that.
I only stopped it by disabling the Google Calendar integration they had had prior, which was only to suggest which meeting to link recordings to, and not the new "Otter Assistant" feature that automatically joins meetings.
If, for custom software/configuration, you specify software to do something automatically that is a breach, then yes also.
If the software does it without your instruction, especially if you explicitly opted out, that is in beach, then the service responsible for the software may be liable instead.
How enforceable this is, is a different discussion…
https://www.romanolaw.com/2022/05/09/are-recorded-conversati....
[1] https://recordinglaw.com/party-two-party-consent-states/
but this is capitalism afterall, kind of the point
Maya Angelou is apposite: “When people show you who they are, believe them the first time.”
https://recordinglaw.com/party-two-party-consent-states/
Also, this marketing copy makes your product sound a lot more like some kind of AI hype scam than an actual product:
> What if we could use technology to augment our memory the same way a hearing aid can augment our hearing? This question is why we founded Rewind. > > Our vision is to give humans perfect memory. > > We are building a search engine for your life.
The biggest difference is that I believe we would all be more honest with one another if we had perfect memory.
It would prevent more marital strife than it would create.
The biggest difference is that I believe we would all be more honest with one another if we had perfect memory.
This reminds me of Mark Zuckerberg believing the world would be a better place if we couldn't have multiple identities, because multiple identities showed a lack of integrity.
It would prevent more marital strife than it would create.
It depends on which way the causality goes in "forgive and forget"!
To be more precise, my point was more practical and less utopian.
The main characters in this episode lie in a way that could easily be proven wrong. It’s fun to watch and dramatic, but I think unrealistic in a world of perfect memory.
It runs locally on your machine.
> Also, this marketing copy makes your product sound a lot more like some kind of AI hype scam than an actual product
Yea, I can see your perspective. We're still in stealth mode so will be more forthcoming soon. For more context, here is the full founding story:
I started to go deaf in my 20s. When I turned 30, a hearing aid changed my life. To lose a sense and gain it back again feels like gaining a superpower. Ever since that moment, I’ve been on a hunt for ways technology can augment human capabilities and give us superpowers.
That hunt ultimately led me to memory. Studies show 90% of memories are forgotten after a week. Just like going deaf, our memory gets worse as we get older. But does it have to? If we have hearing aids for hearing and glasses for vision, what’s the equivalent for memory?
What if we could use technology to augment our memory the same way a hearing aid can augment our hearing? This question is why we founded Rewind. Our vision is to give humans perfect memory. We are building a search engine for your life.
I suppose those are part of paid plans, and they trigger the "your shit is being recorded, dude." warnings.
The point is the app isn't recording without telling people just to do captioning.
No app prevents bad actors from recording.
In such a place, someone has already long ago submitted a ticket to have Google Chrome blessed and the employee installing Chrome is following regs.
It's not that we didn't want to use it sometimes, it's that I had no desire to use it for these times and it went completely rogue. That could happen with any software, even an OS itself.
If the transcription service's presence in the call isn't hidden from other participants, is it still wiretapping?
https://www.legaltranscriptionservice.com/wire-tap-transcrip...
https://reportfraud.ftc.gov/
If you're in a two party consent state, probably worth the effort to file a complaint with your state's attorney general.
If anything, this "warning" only makes me trust this service more because I don't have to wonder if this service is listening in.
These tools need a lot more UX work considering the sensitivity of the outcomes.
OP mentioned multitasking so maybe they had a similar version of this problem. People aren't going to be happily recorded just for the purpose of someone wanting to preserve their own energy during meetings.
Okay, so maybe it's best if you don't do it then?
It's a bit like those 'wait I can explain' situations in sitcoms.
mp4grep works and I've been using it but it has some unnecessary features if this is all you want to do (it's mainly designed to cache the transcriptions and let you search them rather than just write them to a text file) and hopefully someone will make a simpler command line transcription tool.
I wasn't able to play with https://github.com/o-oconnell/mp4grep on ARM.
https://www.maketecheasier.com/enable-live-captions-ios-maco...
Google meet also has it built in on the client.
Edit: previously incorrectly linked to https://support.apple.com/en-au/guide/mac-help/mchlc1cb8d54/...
Details: https://www.maketecheasier.com/enable-live-captions-ios-maco...
On the plus side you have been given a valuable lesson.
For example: you may be more of a privacy person that you thought, you may want to be more careful about sharing your data. You may want to consider if you are paying for a service or not makes any difference in the way your data is handled.
Every day a company is not selling your data, it is "leaving money on the table" - a mortal sin.
https://en.wikipedia.org/wiki/Telephone_call_recording_laws#...
If you're not the head of the company, you could raise it with a higher level of management, or ask in-house counsel.
That being said, most services do announce themselves in someway to cover the legal grey areas. Plus it's the right thing to do ethically.
https://www.politico.com/news/2022/02/16/my-journey-down-the...
I use Otter for that purpose exclusively, and between this news and their recent UI changes to make the record/stop button tiny on their iOS app I'd like to seek an alternative.
I use DayOne for written journals and know it offers voice capabilities, but the limits are pretty short. I'd like something more akin to Otter.
Can you explain how it was able to do this, apparently without people noticing? From what I understand it joins the meeting as a participant, which would be pretty obvious?
The automatically emailed outline afterwards was the cherry on top, though, as it was filled with AI generated questions that I absolutely did not need answered. I got one response from someone that patiently explained some of the answers to the (idiotic) questions - how embarrassing.
This is part of the reason why it's important to have strong privacy protections, even if it doesn't feel like privacy issues have impacted you personally. Eventually everyone has their private data abused.