51

In an answer to Crystal Reporting - Multiple Colums of Data a poster had offered their telephone number for further help.

I flagged as Other and request a mod redact the edit history, informed by community consensus on How to handle a publicly posted API key (or password, or other sensitive information)? :

Flagging is the appropriate action here. The moderator will redact the revisions affected by the sensitive information, hiding them from everyone who might see it; another moderator will then review and approve the redaction. An internal log is kept of these redactions to prevent abuse.

Sometimes the moderators may choose to omit the redaction and instead just delete the post thus removing it from searches and future data-dumps. That's really up to them, based on their experience and evaluation of the situation.

The answer in question has since been deleted; at my current reputation I cannot determine whether OP removed their answer or a mod did (which would fall under the second part of the cited answer).

The question remains, why was this flag

Please purge user's phone number from edit history; thanks! – msanford Apr 12 at 20:38

declined - redaction must be requested by OP

If memory serves, OP was a low-rep or brand new user, so I infer they have very little knowledge of how Stack Overflow works.

Why should the onus have been on OP even to know they even could make that request? I see part of my job as a (hopefully) responsible member of this community to help protect new users from themselves.

14
  • 5
    Not the first time that user has posted their phone number either. stackoverflow.com/questions/49776667/… - answer was deleted at -2 with it still in.
    – Andrew
    Apr 16, 2018 at 15:23
  • 9
    I certainly have raised flags before to request posts to be redacted and those have been marked helpful.
    – rene
    Apr 16, 2018 at 15:23
  • 3
    According to the timeline of the post, the author himself has been deleted: "2018-04-15 23:16:34Z history deleted Community♦ User 9632012 deleted"
    – Tensibai
    Apr 16, 2018 at 15:30
  • Thanks for adding that @Tensibai. For future reference, how can I view a post's timeline? Is that a mod- or rep-restricted feature? Also, it's my understanding that a user can be deleted without their posts being deleted?
    – msanford
    Apr 16, 2018 at 15:45
  • 23
    Not the mod that handled this but that’s someone deliberately posting their own phone number inviting the OP the call them. This was a deliberate act, not an accidental disclosure of PII. I would have declined the request for that reason; it is up to the poster to decide if they want that removed, not a third party.
    – Martijn Pieters Mod
    Apr 16, 2018 at 15:46
  • 15
    @MartijnPieters bah, it is kind of impossible for those that are flagging in good faith to get that right ...
    – rene
    Apr 16, 2018 at 15:55
  • 3
    @MartijnPieters Were those phone numbers all the same or did they had several posted?
    – rene
    Apr 16, 2018 at 15:58
  • 10
    @rene they had 3 posts that I can see with the same number all along the lines of: "need more help - give me a call <name> <phone number>"... it seems they were deliberately disclosing their own details. Apr 16, 2018 at 16:02
  • 4
    @rene how is that hard to determine? They posted need additional help call me [phonenumber]. They did the same in stackoverflow.com/a/49785639, but not in any of their other posts (there were about a dozen).
    – Martijn Pieters Mod
    Apr 16, 2018 at 16:03
  • @MartijnPieters if at the time of flagging those posts were still up, then yes, you're right.
    – rene
    Apr 16, 2018 at 16:04
  • 2
    @msanford You can see the timeline with https://stackoverflow.com/posts/<post-id>/timeline (seing it on deleted posts require being 10k rep to see deleted post of course)
    – Tensibai
    Apr 16, 2018 at 16:05
  • 1
    @msanford and for what is about the posts, I can't find a real faq post on Meta about what happens on user deletion and can't tell if the user has asked for deletion or if it was a Moderator action.
    – Tensibai
    Apr 16, 2018 at 16:11
  • @MartijnPieters That seems to be a logical rationale; would you like to post that as a response (visibility and citability)?
    – msanford
    Apr 16, 2018 at 16:54
  • 13
    @MartijnPieters You are ignoring the possibility that it wasn't the OP's phone number, but an attempt to harass the owner of that phone number (not likely, but still possible). Apr 17, 2018 at 15:57

2 Answers 2

45

Declining the flag is not the action I would take here. Any posting of personal information like home addresses, phone numbers, medical records (yes, people do post those as sample data), and so on should be brought to the attention of moderators. Even if it's a false alarm, I appreciate being able to review that. I mark all of these flags as helpful, unless someone is doing something like abusing these flags to hide things like homework assignments.

This also doesn't need to be brought to our attention by the original poster.

That said, I wouldn't apply redaction for this. I'd edit to remove the phone number and most likely delete the post. If someone is voluntarily posting their own phone number and / or email address, they're only exposing themselves and not an innocent third party. Editing and deletion is enough to hide that from general perusal. People post their email, Skype IDs, and phone numbers all the time to try to get people to contact them, and we regularly edit those out or delete posts containing that information.

Redaction completely erases history and cannot be undone, so it requires two moderators to turn the key. We reserve that for more extreme public disclosures, like those involving innocent third parties or things we think could cause immediate damage to someone by remaining even in a deleted state. In those cases, we delete first, submit a redaction for review, and have to have another moderator look it over before activating it. We want to be very careful with anything that permanently rewrites history here.

4
  • 19
    Redaction completely erases history and cannot be undone, so it requires two moderators to turn the key. I did not know this from the other linked Meta question. Thank you for elaborating.
    – msanford
    Apr 16, 2018 at 19:12
  • Redaction completely erases history from the site served to the browser; IIRC the developers can still see the redacted content if necessary in the database (I guess if there were ever some legal suit filed about a post getting redacted).
    – TylerH
    Apr 17, 2018 at 16:18
  • 25
    "If someone is voluntarily posting their own phone number and / or email address, they're only exposing themselves and not an innocent third party." Actually, we don't know this to be true. The information may not belong to the poster; we have no way of verifying, short of actually attempting to contact them using it. For example, a malicious student might post someone else's e-mail to get them in trouble if the professor found the post. (I do think this is a little far fetched, but we can't rule it out completely or even measure how common it is.)
    – jpmc26
    Apr 17, 2018 at 18:03
  • 2
    Deliberately posting someone else's contact information in a public place as a way to harass them is a well-known tactic, it's not at all far-fetched.
    – barbecue
    Apr 19, 2018 at 13:52
2

Here's how I'm interpreting this policy.

  • OP decides to post a question or an answer.
  • Said post contains sensitive credentials or sensitive information, such as sensitive IP addresses, or credentials to access a database. (It's happened before.)
  • OP has a panic attack about this because they've risked compromising their job security, so they flag their post to have the sensitive content redacted.
  • (Typically, we can also flag this if we believe this to be confidential/sensitive information, in that we see someone posting their database credentials here. In that context, we would be flagging on behalf of the OP.)

Now, here's where things get murky. The OP in this answer posted their phone number. This is not sensitive and would likely not be eligible for redaction for a couple of reasons.

  • They could post this in their profile and we'd be powerless to stop them.
  • They willfully volunteered this information, so they likely have no qualms with it remaining on the Internet for all time. (Maybe.)

In this context, editing it out would be enough. At that point in time, maybe the OP will learn a lesson about advertising their phone number in a very public place.

14
  • 14
    We need to have a discussion where the line is but a telephone number (assuming it is not spam) is sensitive in my book. I mean for a leaked email you have tools to counter abuse, Having to take a call every 2 minutes is a different thing.
    – rene
    Apr 16, 2018 at 15:28
  • 1
    @rene I agree. I have no context on the telephone number. Perhaps it's a consultancy and that's their reception (thereby safe, but spam?), or maybe it's their personal cell phone number. Either way, I'd err on the side of caution.
    – msanford
    Apr 16, 2018 at 15:29
  • 4
    @rene: I could see that argument if they had inadvertently posted a phone number. This looks intentional to me. They should be prepared for this scenario. And yes, I realize this is a harsh standpoint/viewpoint.
    – Makoto
    Apr 16, 2018 at 15:29
  • 4
    Let's assume for a moment the OP is 14 years of age ...
    – rene
    Apr 16, 2018 at 15:31
  • 1
    @rene: They wouldn't be shielded by COPPA, which Stack Overflow is beholden to (and they wouldn't knowingly allow users < 13 years old to register anyway). The scenario you describe is definitely "worst case", though.
    – Makoto
    Apr 16, 2018 at 15:34
  • 6
    There are other cases to consider. It could be a consultancy firm. It could be a robocaller. It could be a prank. The phone number might not belong to them. All of these are valid things to think about.
    – Makoto
    Apr 16, 2018 at 15:36
  • 2
    I suppose I'm not entirely sold on this needing to be forcefully redacted. I'll patiently await the explanation of the moderator who handled this flag, though.
    – Makoto
    Apr 16, 2018 at 15:36
  • 2
    If the post didn't catch a spam flag and the account and other contextual info doesn't indicate trouble, I wouldn't see why a mod would decline such request if the info to be removed falls in the PII category. I mean the mod could decide to instead spam flag the post, still the flag should be marked valid (if you see something fishy, flag)
    – rene
    Apr 16, 2018 at 15:41
  • I wonder if the OP appreciated though that posting a name and phone number allows complete strangers to use sites like above to know your age and address and lookup the house on Google Maps. Apr 16, 2018 at 16:14
  • 5
    So what if I go post some target's number with the intent of getting it abused and claim its my own? Suppose especially that person is not an SO user. There's a good reason to declare ANY identifying information banned on public forums like this.
    – CollinD
    Apr 16, 2018 at 17:06
  • 3
    @CollinD: Yes, I acknowledge that as a concern in the comments. In this very narrow and specific scenario, given that the user has posted their phone number in several other answers, it's reasonable to surmise that this is being volunteered by them. You're welcome to disagree with the policy if you wish...
    – Makoto
    Apr 16, 2018 at 17:14
  • They could post this in their profile and we'd be powerless to stop them - not true, process is basically the same as for redacting: flag -> mod takes action -> phone number removed.
    – anonymous2
    Apr 16, 2018 at 18:35
  • 1
    @anonymous2: Unless the phone number is intentionally fraudulent or otherwise misleading, there's no real action item to flag there. A person posting their contact information isn't against the policy of the site.
    – Makoto
    Apr 16, 2018 at 20:00
  • 1
    Every 14-year-old knows not to give personally identifiable information to strangers because bad things will happen... why is the internet any different? It's not Stack Overflow's responsibility to shield people from the consequences of their poor decisions, and nor should it be; any redaction of information (whether it's personal details, company code, etc.) is a helpful service that SO provides, not a right. tl;dr don't be stupid.
    – Ian Kemp
    Apr 17, 2018 at 6:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .