28

Sometimes it is useful to show certain PII (Personally identifiable information) to other moderators when asking them for help. The most common case would be asking for help when dealing with sock puppets or vote fraud. Especially for new moderators, these can be difficult without help.

In the case that the other moderators are neither from the same site nor SE employees, sharing the link does not work. Making a screenshot would work, but then it has to be hosted somewhere. Imgur is the default image host for SE, but the images are publicly accessible if you know the URL. Now, the Imgur URLs are short enough that it is possible that user stumble upon random images.

Is is acceptable according to SE policy and the moderator agreement for moderators to use Imgur to share images containing PII in the Teacher's Lounge? If not, how should moderators handle these cases?

  • 1
    It would be worth pointing out that if the PII is completely obscured it may well, at worst. make the image useless or, at best, only partially helpful to others. Partially obscuring the PII may be possible. – ChrisF Aug 23 '17 at 12:43
  • 15
    ChrisF outlines a potential approach in his answer, but just to be clear... As you said yourself, the images on our instance of Imgur are publicly accessible. As a result, uploading images containing PII is not acceptable. – Adam Lear Aug 23 '17 at 13:15
  • 1
    @AdamLear Does that also cover images containing info which is supposed to be mod-only but isn't PII? Like the occasional TL screenshot posted in TL, for example. – Rand al'Thor Aug 23 '17 at 14:20
  • 1
    @Randal'Thor Most mod tools aren't really secret. Use your best judgement there, especially when talking about things like spam fighting, sock puppet identification, etc. – Adam Lear Aug 23 '17 at 14:25
31

We discussed this a bit on our Community Manager team call earlier... So I figured I'd share some notes.

First, some practical notes:

  • Our imgur host URLs rely on randomly-generated filenames of 5 digits, each with one of 62 possible values - that puts the total number of potential image URLs somewhere north of 900 million.
  • Imgur appears to be rather permissive in how it rate-limits requests. So it may be possible to scrape the entire set of images, although it'd probably take you weeks if not months to do it.
  • Identifying PII within these images would also be challenging and likely time-consuming.

I'd say it's reasonably likely that someone has access to a bunch of sensitive information contained in i.stack.imgur images... Whether it's worth their time to extract it is debatable.

I wouldn't be overly concerned about leaking PII to random individuals via the choice of image host. It's not impossible that it could happen, or even particularly unlikely if you're, say, uploading full screenshots of a user page... But there are more realistic concerns in the specific context of your post. At the point where you're thinking about redacting specific parts of an image to keep it away from scrapers, you should stop and think about whether it even belongs in the hands of those you intended to share it with...

Leaking PII to specific individuals

An IP address - bereft of context - is not PII. A message to the effect of "user3829384298329 appeared from 151.101.129.69 at 3:51 on July 18th 2017" could be, so if nothing else be wary about the context you're including along with information like that.

But if you're revealing information about a specific user, their last-known IP address is probably the least of your worries; things like their real name, email or birthdate are problematic even if you're careful to exclude any other context.

And that stuff is still problematic even if you put it in text instead of an image.

If the person you're communicating with doesn't have access to the information you're providing them, then per the moderator agreement you should not be giving them that information - not in an image, not in text, not in public nor in private. You shouldn't be storing it on a "temporary" image host nor a private pastebin nor an access-controlled Google Doc or Trello card.

The security of the medium itself stops being relevant when the people you're intentionally giving access aren't supposed to have that access to begin with.

Err on the side of revealing as little private information as possible, ideally none at all. When necessary, you can share your observations of user behavior with moderators on other sites for the benefit of both sites... But you should rarely need to share the raw data from which those observations were derived. "These three users are connected" is both more useful and less dangerous than sharing raw access logs, regardless of whether those logs are in text or image form.

  • 3
    Sometimes in per-site mod rooms (which only mods on that site have access to, plus SE of course), people use either images or text to record stuff that might be useful later but is volatile. For example, when an account is deleted so is certain identifying information, but if, say, it was a troll and a new account pops up with that same info we'd like to be able to double-check it. I have other examples that I can share privately. Could you address the much smaller audience of site mod rooms? – Monica Cellio Aug 25 '17 at 0:47
  • 3
    Assuming you never give access to anyone (which you should never do), there's no issue with text in a per-site room. – Shog9 Aug 25 '17 at 0:59
16

If the rules are interpreted strictly, then you are breaking the moderator agreement anyway by sharing PII with people who aren't SE employees or moderators on your site regardless of where you host the image. So the short answer would be that you're not allowed to post the image anywhere.

However, I agree (hence my comment) that it is sometimes necessary to share some information about the situation with moderators from other sites. These situations would include:

  1. When you are discussing behaviour that is spread across multiple sites.
  2. When no staff member or fellow mod is available and the situation is urgent.

In these cases, I think you have to obscure enough of the PII to render it anonymous but leave enough visible to get your point across. For example, in the case of IP addresses you could obscure the second and third groups of numbers:

176.XXX.YYY.45

or for e-mail addresses obscure most of the name part and/or all of the domain:

abcXXXXXXX@ZZZZ.com

You can always reveal more of the information as a chat message in Teachers' Lounge where you can be sure it won't be leaked.

  • A chat message in Teachers' Lounge? Aren't chat messages public? – Steven M. Vascellaro Aug 24 '17 at 18:41
  • 7
    @Steven - Teachers' Lounge is only accessible to moderators and staff. It's not indexed by Google. – ChrisF Aug 24 '17 at 18:46
  • I like this idea and have implemented it into Redacted Screenshots – Samuel Liew Sep 7 '18 at 1:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .