The Rayaan / Jacob(smooth) Situation

[Tiberius]

As some of you will be aware from this thread, we were recently made aware of a violation of our privacy policy by one of our admins, Rayaan, involving the personal information of one of our members, Jacob(smooth) referred to as 'Jacob' from now on. Please note that this post will be very long, there is a lot of information to get through, and I feel we must include it all in order to properly deal with the issues.

From our internal investigation and conversations, we have determined that the course of events was as follows:

1. Shortly after Jacob had joined the forums (13th November 2013), Rayaan suspected him of being a poe (effectively, a person who claims to be a Christian but is in fact trying to trick people).
   
   
   
2. Using information that was posted publicly by Jacob (his username, profile content, and information in his posts), Rayaan used Google to try to find him on other forums and see if these profiles matched up.
   
   
   
3. After Jacob revealed his profession (podiatrist) in this post, Rayaan used his ability as an admin to access Jacob's email address (which all members give us when they register), and from this email address he was able to extract Jacob's full name. Using Jacob's full name with his profession in a Google search revealed a number of Jacob's accounts, including one on a forum in which he had publicly posted a photo of himself and his family.
   
   
   
4. Satisfied that Jacob was not a poe as he had previously suspected, Rayaan stopped searching.
   
   
   
5. On 27th December, Rayaan mentioned to Jacob in this thread (a split from the original) that:
   

   I read some of your stuff in a podiatrist forum. I know who you are.
   
   Skillz

   
   
   
6. Jacob, evidently expecting to have been "found" based on post style alone, responded:
   

   If you recognise the style I'll be impressed. Go, on, pm me who you think I is and I'll tell you if you're right.
   
   Wait, What The he'll were you doing on a podiatrist forum!?

   
   
   
7. Rayaan sent Jacob a PM that included Jacob's real name, a link to the aforementioned public photo of his family which was posted on another forum, the name of another forum in which Jacob had an account, and the name of Jacob's YouTube channel. In response to Jacob's query over what Rayaan was doing on a podiatrist forum, Rayaan responded:
   

   Just stalking your posts.

   
   
   
8. Knowing that the information Rayaan had obtained was accurate, Jacob asked:
   

   Ok, you're a scary person! Why the hell were you stalking me?!

   
   
   
9. To which Rayaan responded:
   

   Stalking is what I do when I'm bored.
   
   Plus, I'm an admin, so occasionally I like to put on my detective hat when I want to know more about certain members.

   
   
   
10. At this point, Jacob deduced what Rayaan had done to find his other accounts online, made this clear in the thread, and after a number of complaints in the thread, made an official complaint to myself via a PM. I asked Jacob to report the post in question so that the matter could be looked into by all staff members, which he did. He also forwarded me a copy of the PM that Rayaan had sent him. At the same time and completely separately, staff member Cthulhu Dreaming also reported the post.
    
    
    
11. After some posts back and forth between Rayaan and Jacob in the thread, I asked if all parties involved would refrain from posting so that the staff could handle the issue properly.
    

Having looked into the initial series of events and discussed them with the staff, it was agreed that:

Whilst Rayaan may have initially thought he had good reason to look up Jacob on other forums, he (1) used information that was entrusted to atheistforums.org in a way which was not covered by our privacy policy. He then (2) revealed to a user that he knew who they were. He also (3) then made it appear to this member (and everyone else in the thread) that this was a personal thing and not at all related to the running of the forum. Finally, he (4) didn't inform the staff of his initial suspicions, or that he was doing an investigation at any point.

It was further agreed that Rayaan was not purposefully violating our privacy policy, but that the violation occurred because staff had not had the policy properly explained to them when it was put into action.

Nevertheless, the staff asked Rayaan to apologise, and he did via PM to Jacob on 29th December 2013. This apology was not previewed by staff before it was sent, and it was unnecessarily wordy and came across as excuses rather than an actual apology. The PM conversation that followed between Rayaan and Jacob (some of which was posted on the forums by Jacob) did not go well either, and Rayaan made several statements that were not worded very well, and as such were misinterpreted by Jacob. Rayaan also quoted staff members to back up his position, despite the fact that these quotes were made when not all facts had been revealed.

The culmination of this PM conversation was Jacob's post on 30th December 2013 wherein he stated he was leaving the forum.

LastPoet posted a reply to Jacob's leaving post, saying he was "whining" and that "[Jacob] never fooled me.". These statements were not the opinions of the staff and were regretted by LastPoet (who apologized later in the thread). Before the apology however, the statements caused an understandable level of outrage and new accusations of abuses.

However, some of the outrage did go too far, and it is the opinion of the staff that any comparison to the "NSA" or "Edward Snowden" are ridiculous and highly exaggerated. This was a case of a single privacy violation. We do not spy on our members. We do not tap their internet connections, mobile phones, and we do not intercept their emails, etc. To suggest that Rayaan's violation is even remotely comparable to the NSA spying in the US is out of order and only serve to distract from the main issues.

There was a legitimate concern about financial records that we hold, and whether Rayaan has access to them. I can state absolutely that he does not. If you have ever donated to the forum, either via the PayPal button or to me directly, then the money went directly into my own personal (and private) PayPal account. The emails sent to confirm the transaction were sent to my personal email address. The only staff member to have access to any financial information involved in these transactions is myself.

I apologize if there were other concerns that have been missed; I have had to read over two threads (the public one and the staff one) multiple times just to write this post, and it is likely that some did not get properly covered. If there are specific things that people wish me to comment on, I will of course answer them in this thread and update this post.

Resolution

The final decision of the staff, based on the investigation of Rayaan's actions, is that Jacob deserves a full apology not just from Rayaan but from the entire staff team. I am personally appalled at some of the attitudes the staff have had in dealing with what should have been an open and shut case. This was not just a failing on Rayaan's part, but a failing by myself to properly educate the staff on what the new privacy policy meant in terms of user data and what we can do with it. This failing will be rectified within the next few weeks, and I will endeavor to write proper instructions for current and any new mods on how the privacy policy works and what counts as a violation of it. We cannot promise that violations will never occur, but we can at least deal with them in a much harsher way in future.

I am aware that a number of you have called for Rayaan's removal or resignation from staff. Whether Rayaan wants to resign is entirely up to him, but we will not be asking him to step down. This is for two main reasons:

1) He is a fantastic administrator with a (until now) clean record of conduct, and he is also well respected by the majority of the community here. His removal would be a loss to the team and to the forums.

2) Whilst he did violate the privacy policy, he did so unknowingly.

Not everyone will agree with our decision, but we hope that most of you will at least understand it. Rayaan's removal from staff would do us no favors and would be a great loss to the community.

[Rayaan]

This was an important disclosure of classified information. Hats off to you, Mr. Edward Snowberius.

Just to speak for myself, I'd like to apologize not just to Jacob (whom I've done to already), but also to everyone in this forum who I may have caused to feel anxious or creeped out to any extent because of my actions, whether directly or indirectly, whether intentionally or unintentionally.

Of course, I am not perfect; the staff team is not perfect either, so we are bound to make mistakes. What is important now is to learn from them, pick ourselves up, and move on. I thought it'd be better to stay with the staff and help them to resolve this issue instead of just resigning and then leaving all of this mess for them to clean up. Doing the latter wouldn't be fair to them nor to myself. The beautiful thing is, sometimes even a mistake may turn out to be something that eventually led to a worthwhile achievement if we just keep working at it.

Also, I appreciate all the staff members' diligent efforts in trying to resolve the issue, showing my errors so that I can correct them, and for bravely handling the situation altogether. Thank you, guys. I appreciate all the other members' honest opinions on the subject as well, which also helped me to a certain extent (and even the staff members) to become more aware of what I did wrong and what needs to be done to fix it now.

Thanks, everyone.

[KichigaiNeko]

Glad a resolution has been achieved.

"Warning: you put ANYTHING on the net you will be found. There is no such thing as privacy for any agency that wants to find you."
Just something I keep in mind when on the internet

[Bad Writer]

Glad a resolution has been achieved.

"Warning: you put ANYTHING on the net you will be found. There is no such thing as privacy for any agency that wants to find you."
Just something I keep in mind when on the internet

This is exactly what I tell my students when teaching them about social-networking sites.

[KichigaiNeko]

Glad a resolution has been achieved.

"Warning: you put ANYTHING on the net you will be found. There is no such thing as privacy for any agency that wants to find you."
Just something I keep in mind when on the internet

This is exactly what I tell my students when teaching them about social-networking sites.

Have you seen the experiments made by teachers? They post a pick with the request to like and then comment on where you are and then share to your own timeline? One such post that came across my news feed had something close to a million likes about half that amount in shares and comments. Naturally I shared it to prove a point to my own children.

[Jacob(smooth)]

I'm happy with this. So far as apology, that's a small thing. Both Rayaan and LastPoet have offered genuine and graceful apologies which are more than adequate for me.

I appreciate the time taken with this. Hopefully it is viewed as a broader issue of privacy rather than an interpersonal issue. issue. Rayaan and have, I think, made our peace.

If possible, could the updated guidelines for the privacy policy be placed in the public domain when they come out? Whether Rayaan followed the policy or not, knowingly or not, the one thing which is abundantly clear is that the existing wording is a little ambiguous and open to different interpretations. This, I think, is the nub of the issue and needs to be addressed to fully restore confidence.

Once again, thank you the patience and the time spent.

[Aractus]

Good, I'm glad a resolution has been made and I can finally say what I think.

I never thought Jacob was a Poe - and I don't understand why the staff couldn't simply ask him if he was a Poe if they had concerns.

Now as you know, I don't care for anonymity - however - some people do and do so for a variety of legitimate reasons. They may feel that they want somewhere where they can be just an internet persona and detach themselves from their mundane lives, it doesn't matter why, it's not something that I personally take issue with, it's up to members if they want to tell you everything about themselves. Hell we've got members here who fear for their lives if their identities were posted here as they live in the middle east!

I am appalled that such measures would to be taken over something as simple and unimportant as to whether a member is lying about who they are - if they're lying then sooner or later they'll contradict themselves. But because someone is maintaining a level of anonymity should not be a reason to mount investigations of this nature. What happens if you go onto that podiatry forum and Jacob's not said a single word anywhere about his beliefs - do you conclude that's because he doesn't have any?? What possible evidence could you gain that would prove he wasn't who he said he was? And all this when he had broken no rules at all (that I'm aware of).

[Jacob(smooth)]

Yeah, it was a bit much, as Rayaan was man enough to stand up and say in front of God and everyone. Which Btw makes him a big man IMO.

I think that the clarified and revised guidelines on this will clarify the situation for the future. The past is probably best let to rest.

Mind you, im not sure that Poe (noun) is being used appropriately in this context. As I understand it pops law is that without a smile or other indication, one cannot say something in jest which won't be taken seriously. Thus a Poe is presumably someone who state a view in jest which people believe is their genuine view. It's not something covert.

[pocaracas]

2) Whilst he did violate the privacy policy, he did so unknowingly.

I'm all for letting bygones be bygones...
And I have nothing special to hide from the world, although I do try to keep the internet part of me a bit separate from the work part of me.

But.... who's to say that Rayaan (or anyone else who is an admin) won't become bored again and use the information available to do some research on the people who are registered here?
I know this is a problem we have everywhere we go on the web, that's why I've always claimed that it's best to keep private stuff out of the reach of forums and other such sites.... but not everyone is that computer literate... not everyone is willing to open several e-mail accounts... not everyone is aware that they can have several e-mail accounts!

And this site, given its nature (catering to a, still, minority of the population which can, in some places of the world, become under real physical threat were it to be known that they were atheists), is expected to have some strict privacy rules in place, to avoid exactly that potential problem.
And it does and did!

But the fact that an admin with access to some private information came forward and claimed he could find much more private information about one member, leaves the invitation open for hackers and other kinds of sleuths to scourge the web in an attempt to actually dig up some info on that member... and maybe spread out to other members.
This, I think, is the most serious thing that happened here. The fact that admins can do that, is a given when you sign up anywhere. But the fact that an admin boasts about it, leaves the rest of the population a bit restless and really thinking that this admin (and maybe others) have indeed been snooping in on the members.
I guess, it's the difference between knowing it's possible, to knowing it's being done... possibly, on a regular basis...

Anyway, I hope you guys have learned your lesson.
And I hope Rayaan doesn't get bored again... although, judging by his photos... oh boy!

[Jacob(smooth)]

I guess, it's the difference between knowing it's possible, to knowing it's being done... possibly, on a regular basis...

Indeed. This is where I'm hoping that some clearer guidelines will be forthcoming (as Tiberius said). My personal view is that af should be like Vegas, what happens here, stays here. The rules are adequate and internal and I see no need to seek or bring in outside information.

However I think this is something which should be considered separately from the thread at hand because in truth it is far more involved than "the Rayaan / Jacob situation". I'd like to see this discussed and moved forward, but think it should be about the policy, not the people. There is certainly a broader issue.

I'd like to know when, why and how the Admin team find it needful to seek external information about people, and when they do (IF they do) what oversights are in place.