"Can you keep this confidential? How do you know?"
"Can you keep this confidential? How do you know?"
It's not really workable to say "oh yeah, I can keep secrets, I keep so many secrets, like for example," so I tend to describe my surface area - things like "sometimes my literate three year old looks at my screen and asks me what a phrase means in front of the contents of my living room, I'm not good at not laughing at things I read if they're funny, I consider it morally wrong to lie and am not volunteering to do it anyway for you but am good at deflecting with the truth so cannot guarantee to conceal the existence of a secret but can decline to elaborate on it to inquisitors, if it seems to me like it legitimately concerns a third party I would try to ask you first but if it were time sensitive might make a judgment call and can take into account whatever you'd like to say now about that eventuality, given all this do you want to tell me?"
This post was presented as a brief talk during the LessWrong curated talks event on July 19.
Here is a transcription of the Q&A session following the talk.
---
mr-hire: I'm curious if you've thought about what training this at scale would look like. When I was younger, I remember being trained a little bit on how to keep secrets, just with friends and stuff, but what would it look like if you had ways to train more deliberately?
Raemon: I know some people who have actually thought about this a lot and have entire world views and practices oriented around it. For me, I noticed that I wasn’t good at keeping secrets, which was at times a problem for my relationships. So I actively thought about it for a while and increased my ability.
So the short answer is: do lots of thinking and practicing. To answer your question about training at scale, I have two ways that you can teach this.
First, you can teach people trigger-action plans for dealing with secrets. A key piece of such trigger-action plans is the ability to notice when you're in a conversation that might create sensitive information or bear on information you already have that is confidential.
Being able to notice that is much of the battle, and then having follow up actions like “slow down and think before you say each new thing”, or “deflect the conversation in a new direction”. So that's a skill I came up with on my own.
Another skill someone else pointed out, for situations where you find out confidential information about an organization, is to have different mental models for storing public and private information and keeping track of them differently.
And then, when having a conversation, live inside one of the two different models. This doesn't work for me yet. I haven't really tried to do it, but it's a thing that seems to work for at least two people that I know of.
---
johnswentworth: So given that a big part of a secret is the fact that a secret exists, how do you ever trust that someone can keep secrets if they tell you that they have kept secrets before?
Raemon: Well, there technically was a whole second half of this talk. I have multiple blog posts coming that deal with a lot of like, "Hmm, this topic sucks. What do we do?" One of the problems is that people don't even necessarily mean the same thing by secret. Sometimes it means they just don't bring it up. Sometimes, it means they do not reveal any Bayesian information that can possibly inform people that the secret even exists.
And sometimes, it's just like Alice saying, "Bob, just don't tell Charlie. You can tell Dave. Just make sure it doesn't get back to Charlie." So what I try to do, noticing that we’re getting into a sensitive situation (or ideally if I have detected that the person I am speaking with has an ongoing, long-term relationship with the person where secrets are likely to come up), I try to have a meta-conversation about what secrecy means to them, discussing what the various parameters of secrecy are and which ones are the most important to them, before a specific secret comes up.
Sometimes, the duration of a secret matters and you need to keep it to your grave. Other times it could simply be a controversial thing happening in the next three months and I need you to keep it quiet until it is over.
Generally, I don’t think it is actually tractable to not give Bayesian information that you have any secrets. I think a slightly better equilibrium is where there's some glomarization of “I can neither confirm nor deny that I have secrets relating to this thing”, and you just always say that whenever this conversation comes up. And then, you get into the meta a bit. A practice that I like to do while having this meta-conversation is avoid making eye contact. Not looking at each other while having the conversation ensures our micro-expressions aren't betraying any information until we have built up a little bit of trust.
Ben Pace: I am also much more likely to accept a secret if it's on a three-month scale rather than a four-year or permanent time scale.
---
ricraz: I guess if we take a Hansonian perspective and we say, "Is keeping secrets really actually about keeping secrets...?"
Raemon: Oh my.
ricraz: A lot of people around here have quite high scrupulosity. I am fairly low on this. A lot of the time when I say to somebody, "Please keep it a secret," it's just mostly a social nicety. Maybe it reveals some information about them if they don't keep it secret, and maybe I'd feel a bit annoyed... But it feels much more like it's a standard part of the interaction I'm having with them. Maybe I'm ticking a box or something.
It feels fairly rare that I'm telling somebody information that it's crucial for them to keep secret. And so, I wonder if actually outside a corporate context like, "Please don't give away our secret product plan," and stuff like that, how relevant is this actually in most social interactions?
Raemon: So another pet peeve is that, most of the time, I think people are doing something like what you just said--keep it on the downlow. Keep R0 of the secret <1 if you can.
The tricky bit is that's what people need most of the time, but if the secret ends up causing them more damage than they expected, then they're like, "No, you said you would keep it a secret," and then retroactively judge you harsher than you might have assumed.
So one of the key things I want is transparency about what level of secret we're talking about. So if people start telling me anything confidential, one of the first things I say is, "FYI, the default thing I am going to offer you is, I will try a little bit to keep R0 of the secret less than one, but I'm not going to try that hard. And if you want more than that, you are asking me a favor and I'm checking if you want to ask me that favor."
And most of the time, they don't actually care about that, the more high-level secret. I do think in the rational sphere and the ecosystem, there's a lot of blurry lines between, "Ah, I'm just commenting about my friend," and, "Oh, my comments about my friend actually directly inform whether some other person's going to give that friend a grant," which makes this all a bit trickier. So the main thing I want to get out of this is to have common knowledge of what the default norms are and of what favors you're actually asking of people.
jacobjacob: So I heard you ask, Richard, if this really matters or if it matters only if you know some important intellectual property due to your work? And I think there's a thing where a small secret with someone might be fine, but if you need to keep track of 10 or 100 small secrets across a large number of people, then whenever you say a sentence, you have to run this working-memory process which checks the sentence against all these secrets you have to keep track of, in various weird interactions. And you get to a point where this messes up your ability to have conversations or to think clearly, even if the individual secrets themselves are not super important.
Ben Pace: Yeah. I don't enjoy how much obfuscating some people have to do in conversations with me when we're trying to talk about the same thing, but they can't say anything because it would betray that they know some information that I also know. I was expecting you to say something like “it's also hard to tell if someone's good at keeping secrets, and so, being able to keep secrets about small things is often the only way you can even check. If someone only keeps secrets about massive important things, it's often hard to know about those things, because you're not privy to them”. And so, it helps the person doing the right thing in smaller iterated games.
---
George Lanetz: When I thought about this problem a while back, I decided it's impossible to really keep my privacy. So I committed to a life that won't require that. From your talks with other people, how often did you find that they actually care about their privacy? And how many people do that if they are not presidents or something like that?
Raemon: I run into social circles that are one or two steps removed from a lot of EA grants, and this comes up a lot there, where there's informal situations that turn out to have fairly strong financial stakes. So I think I've probably interacted with 10 people, plus or minus a few, where some kind of common understanding of what secrecy meant mattered.
Ben Pace: I also have really strong feelings about the things George said. I think Vitalik Buterin has said something relevant here. Namely that the less privacy you have, the more Hansonian things get: the more signaling that you're doing on all of your supposedly “private” conversations. I think the internet has generally done this a lot. People used to be able to have informal bonds of trust, but then suddenly it gets recorded and put online.
And then, a million people see it and you're like, "I can't live my life where a million people are watching all of my interactions, all of my moves, checking whether or not they're good." It would talk more time to make this point in full.
People have different "privacy settings".
The person with the strongest expectation of privacy I know would plausibly be unhappy with me writing this sentence. Because this is a personal piece of information about him that I'm sharing without his consent - you might be able to find out who he might be and then know that he has this expectation.
I'm not sure what the person with the most public setting is but I know at least one person who has no problems talking with total strangers about her most private details. She does keep other people's info confidential to a typical level. So it is not an extreme case like the marytavy mentioned elsewhere.
And I know many other people in-between.
When I figured this out my lesson was to ask people about their privacy settings. It's a nice analogy with many people knowing these settings from FB. And if not that is also a nice nerd conversation starter.
What kind of settings do you ask about? Is it just sort of a sliding scale with your first example at one end and your second example at the other, or are there dimensions to it?
I will not bring up the topic until personal details are mentioned. Things that are likely not already known to a number of people. I may bring it up anyway if the conversation is longer and thus constitutes something of private detail itself. I will refer to the detail and ask for example:
"Do you want me to keep this details private? You didn't say so and I have noticed that people have widely different expectations about that."
"Normally, I would not share personal details but I would like to able to pass on things I learned from it. So may I share anonymized information from this conversion? For example: 'A person I once talked to recommended to do X.'"
"Please also note that I would share anything you tell me with a significant other (of which I currently do not have any). If you don't want me to share something with them we would have to discuss this in more detail."
I will make an extra effort on topics that are typically seen as confidential for example about relationships, conflicts, or other details you'd share with a professional advisor. In such a case I might say:
"I will treat all we say from now on as confidential. No private details leave this room without talking to you beforehand."
Another type of question might be:
"Are you public by default or private by default?"
Someone pointed out to me that according to Danah Boyd the younger generation seems to run on "Public by Default, Private through Effort".
Tangentially relevant:
marytavy (n.) A person to whom, under dire injunctions of silence, you tell a secret which you wish to be far more widely known. (From "The Meaning of Liff" by Douglas Adams and John Lloyd.)
A couple of times I have had the impression that someone was trying to use me as a marytavy. My unspoken thought was "I have no independent knowledge of whether what you have just told me is true, and the only update I am going to make is that I now believe that you have said this thing. I shall speak of the matter to no-one."
A related concern is that you might be the recipient of information spread by a marytavy, instead of either you or the person transmitting the information to you being the marytavy. This can be tricky because receiving the information N-hand often has a different tone than it does firsthand.
This problem (receiving secrets N-hand) doesn't even need to involve a marytavy, just 1+ unauthorized information transmitters.
Everywhere I've worked for the last 20+ years had formal NDAs and training on business confidentiality. Working at smaller companies before that was less formal. Some projects have formal disclosure procedures and lists, most do not, and that means "we trust your judgement about who needs to know". Note that just hearing that phrase, coming from a Director or CxO, carries a lot of info about how seriously to take it.
Everywhere I've been, there is a bright line for use of the phrase "privileged and confidential", with a requirement that the communication be to or from a lawyer on a topic the lawyer is engaged in.
For me, business confidentiality is pretty easy - the harm from over-sharing non-public information is usually easy to see.
Non-business confidentiality is much fuzzier, and I think fundamentally so (in the territory of harms for failure, not just the map of norms and expectations). A lot of "secrets" aren't really that important, and the harm from sharing may be unclear or contentious (Bob might believe that disclosure to Carol is overall a benefit, even if Alice is annoyed). Perceived harm may be from sense of betrayal rather than actual harm of information.
I think, even if your question isn't coming from general aspie/autism tendencies, you might do well on this topic to borrow some techniques. First and foremost , recognize the hole in your perception, and ask people or proactively tell them if they seem to be making assumptions you don't understand. Generally, use more words - describe what level of secrecy you are willing/able to provide.
Everywhere I've worked for the last 20+ years had formal NDAs and training on business confidentiality. Working at smaller companies before that was less formal.
I think I mostly formed my sense of "haven't seen companies actually taking this seriously" at smaller new orgs, good to know it's more common. I figured it'd be common for, like, lawyers and therapists, but hadn't heard of it in other contexts. I'm curious what the training entails?
(There was one 3000 person company I worked at that didn't seem to have any training re: privacy, although I was also only hired there as a contractor so not too surprising if I just missed it)
"training" may imply more than I intended. We have an annual stupid video to watch and a bunch of wiki pages about basic infosec behaviors and mechanisms to keep some info off of shared build systems, and some "loose lips sink ships" posters. It does include guidance on baseline "company confidential" behavior and not talking with outsiders except on the narrow topics related to their work. We do have formal classes (with tests and mock presentations) before we're allowed to give talks or speak to groups on behalf of the company.
There remains a _LOT_ of cultural and ad-hoc expectations on the topic, far more than official policy or training. And there are ongoing debates about the very large value in open sharing of information compared with the cost of leaks. This leads to a fair bit of nuance regarding which topics are "just don't talk about" and which are "have a good reason before discussing with someone" and which are "don't advertise widely, but feel free to discuss if it's relevant".
At a very basic level, for both private and commercial secrets, you have a LOT of evidence about how seriously it's taken, just by the fact and manner that the secret is given to you. "If you want it kept secret, why are you telling ME?" Asking this question is a great opener for understanding what the specific expectations are.
It seems likely to me that when a person is saying 'can you keep a secret', to some level they are saying 'here is a piece of gossip'. Gossip seems to be one of the backbones of any society, enforcing social norms, and possibly disciplining otherwise impervious leaders/rulers who violate those norms. The 'secret' then is really, 'please keep it secret that I told you this from anyone who might punish me, or use this against me in any way.'
If you have a true secret that must be shared, a real threat of repercussions (violence) is all that may enforce this. Or not.
Sort of a meta response:
So, I went back and forth on whether to title this post "can you keep a secret" vs "can you you keep this confidential?" or "can you keep this private?", which each have slightly different connotations. "Secret" pattern-matches most to "gossip", and it's not actually what I meant to focus on necessarily. (I do mean to include gossip as a subset of what I'm talking about, but not the central example)
The original published version (which you were replying to) had the title "can you keep a secret?", partly because "can you keep a secret?" is a more common phrase, and partly because it was a little more clickbaity a title that I thought people would actually click on. But, this comment made me kinda regret that choice.
That didn't really address your comment, but I wanted to clarify first that I think "gossip" isn't necessarily the right frame here.
I do think it is often the case that when people ask for confidentiality, the most important thing they care about is information not being shared in contexts that will damage them. (And, indeed, people are often much more okay with you sharing something outside of the original social circle)
Very true. I think "can you keep a secret", in the context of true secrets, is a bit of a non-question. What kind of secret? Sometimes, even revealing the type of the secret in question reveals bits about the secret itself (sometimes through multiple layers). How do you communicate about the meta-parts of said secret? What are your skills in behaving around true-secret material? Doing a " Can you keep a secret?" "Yeah I can keep a secret!" interaction doesn't really tell you much at all and seems to me more just a social dance to initiate gossip (or a similar interaction).
Question: are you neurotyoical and/or have you had neurotypical people express the same concerns? My understanding is that there is a default rule that covers 80% of "can you keep a secret" and exceptions in either direction are either explicitly defined (eg Boeing does annual proprietary information training) or the alternate norm is known by the group (gossiping teenagers)
I think I am actually pretty neurotypical.
There are a couple reasons I think this is important:
- Many people in the rationalsphere tend towards being the sort of person who takes rules more seriously (and thus are more likely to feel betrayed). People seem to vary a lot in how much they care about privacy. By default, I don't actually care about privacy that much, but I interact with people who do, and thinking through this more seriously was necessary for me to not inadvertently leave them feeling betrayed.
- The status quo of "there's an approximate norm that most people know" creates a world of plausible deniability, where it seems like everything is mostly working, up until someone decides they were harmed by a secret they think you leaked, and then retroactively leverage the ambiguity into a political weapon against you. (This is precisely the sort of game neurotypical people do play, and I think it's bad)
- I honestly just live in social circles where some people are earnestly trying to do big important things, where the line between propriety information and random gossip is blurrier. It is actually important to keep some secrets. Other secrets might or might not be more important than usual gossip, but the ambiguity makes people's personal lives worse.
- It makes sense that large companies like Boeing actually have formal policies and training here. Many smaller and even mid-sized companies don't. In particular, small grass roots community organizations might not feel like they need to, but it's actually fairly important.
(There's a good chance that if you don't find yourself running into problems here, this post isn't meant for you. But it's meant for a large chunk of my social circle)
#2 is a big deal. In many social circles, gossip is among the primary entertainments. It's SIMULTANEOUSLY a loyalty test, to be used against you as needed, AND a source of status, to elevate the secret-tellers. My general advice in such groups is to go ahead and lose the status, exit or down-value that group membership, and get on with your life.
I am very good at keeping info secret including when the other party hasn't explicitly said it's confidential but I have some reason to believe they might have wanted it to be if asked.
It is costly.
I am worst at figuring out when future me might have wanted it to be confidential if asked.
Conversations with Ray clarified for me how much secret keeping is a skill, separate from any principles about when would agree keeping a secret was good in principle, which has been very helpful in thinking through confidentiality agreements/decisions.
One thing to consider here is legal duty to disclose certain information and that should form a part of such meta discussions.
Brief review: I think this post represents a realization many people around here have made, and says it clearly. I think it's fine to keep it as a record that people used to be blasé about the ease of secrecy, and later learned that it was much more complex than they thought. I think I'm at +1.
Promoted to curated: I think the consequences of privacy and how to navigate is a topic that isn't covered well enough on LessWrong. A lot of information I interact with these days is confidential, and I've had to do a lot of work to figure out good norms and rules about how to navigate these situations, and have seen many people get into quite a bit of conflict over differing norms around privacy. I think this post covers one of the most important norms/questions in this space, which is to allow open and transparent communication about those differing norms.
I think about this alot with regards to sexuality. I've always found the expectations of closet gays with whom I've had encounters to keep the encounter secret to be unfair, theres a cost to me in conversation with friends, and like everyone I talk about my relationships with friends for advice and I think this important for my mental health. When I share this secret, its in the vein that I'm confiding knowledge X with you, and you can share it (with your circle of trusted confidants) provided it doesn't get back to the person its about or someone whom may act differently towards that person because of now knowing X. This is my default. But if I'm telling a 'super secret' I'll emphasise to my friends that it really can't go outside the room, or the consequences if it does, getting the mutual understanding this post advocates for. I think that usually I leave it to the other person to make their own risk evaluation on further spreading X: but they know if caught spreading X willfully with insufficient effort to not spread X, that they will have 'broken my trust' and henceforth loose access to my secrets. In effect, they evaluate the risk to loosing my close friendship. But when they trust another to not further spread X, they build trust which is foundational for friendship. Thus secrets and gossip are both useful and risky regarding friendships.
For personal communications, meta-conversations seem fine.
If you're setting up an organization, though, you should consider adopting some existing, time-tested system for maintaining secrets. For example, you could classify secrets into categories--those which would cause exceptionally grave harm to the secret's originator's values (call this category, say, "TS"); those which would cause serious harm ("S"), and those which would cause some noticeable harm ("C"). Set down appropriate rules for the handling of each type of secret--for example, you might not even write down the TS ones unless you had a very secure safe to store them in, or verbally discuss them outside of protected meeting rooms; and you might not do anything with the S secrets on an internet-connected computer. Anything above C might require a written chain of custody, with people taking responsibility for both the creation and destruction of any recorded form of the information.
You would then have to watch for mutual information in your communications, and see that no combination of the information that you publicly released could cause a large update toward one of the secrets you were keeping. You'd also want to think of some general steps to take after an unplanned disclosure of each type of secret.
It may not sound like the most efficient way to do things, but there's some pretty high Chesterton's Fences around this kind of policy.
I run into frustration about this. People with monolithic assumptions about how identities function seem untrustworthy to me (even those with trustworthiness as part of their identity) because they often don't seem to fundamentally grasp the idea of exploring un-endorsed emotional reactions, even if they claim to get it on an intellectual level.
i.e. if I hear a person talking about what counts as their 'true self' or 'deeply held values' I won't be fully candid around them.
For a while I had almost the reverse direction - if people didn't have a sense of their deepest values or a strong sense of identity, I had trouble trusting them because they could be anyone or take on any value at any moment, I didn't know if the "them" I told the secret to would be the same "them" that had a chance to tell the secret to someone else.
Since then I've realized there's multiple levels of consistency and meta-consistency both above and below identity, and just look for some level of consistency to see in what ways I can trust a person.
Could you give an example of exploring un-endorsed emotional reactions? How is this related to having deeply held values?
Can you keep a secret?
As far as I know: yes I am good at keeping secrets.
How do you know?
People have observed, that I am very concious about talking about other people. I say things like "you better ask them this in Person" or changing topic when permission groups don't match (e. g. more people present than previously). Like many people, I am concious what's on red tape and what's not. Personally I advocate for transparency but I've learned that some people only make deals when off-tape.
This results in people telling me more secrets. They know I can keep them - they have observed, how I not crack when asked about information I probably have.
Person in my sports club once told me about patients of them. After describing vague psychological behaviour I stopped them and said something along the line of "I probably don't know the person but it's easier than you might think, to pin down individuals based on behaviour". I have a degree in computer science with focus on information management, information transportation, analysis... etc. Maybe that's because I sort of know how much information can be contained inside random excerps. I advocate in fahour of the GDPR and am fairly privacy-minded. I know how e-mail addresses can be used to trivially match online accounts. Thats's why my LessWrong account has a randomly generated e-mail address. Etc.
What exactly do you mean by secret?
'Secret' is someone not to be shared. It's very different from 'not telling'. 'Not telling' means that I say it thruthfully when directly confronted. For example the question "Are you seeing other girls?" is a classic question which I would put under 'not telling'. There's nothing to be gained from yelling it into the world. But if someone asks I'd answer the truth (example completely fictional). 'Secret' on the other hand requires some more active work. Tracking the information which a person knows or knows not. Knowing the relationship between the people. If A told me this and B is a trustee of A then this person probably either knows it already of A hides it from B. That sort of stuff. I think the easiest way to solve this is by containerizing 'Secrets'. Like in a way of 'never say this unless you double checked that it's okay to say right now'. Usually I say the truth. There are no logical loopholes if you answer "can't tell" instead of faking something.
Also helpful: I have a reputation for being a really bad liar. That's good. Because 'acting like a liar' is a good thing when you want to tell the truth on paper while still gaining no acceptancy.
I think my definiton of secret is a bit wonky and might need adjusting. Overall I think the term 'Secret' ist used for too many vague things.
i haven't read all of the comments so idk if someone mentioned this further down, but there was a whole tumblr ordeal with this a few weeks back, and the conclusion that made the most sense to me was "don't share information about someone that could make them the victim of a hate crime," even if you think you know that the person you're about to disclose to would be a safe person. You don't know who that person in turn is going to share with.
i struggle with the topic of this post a Lot, and the tumblr rule of thumb has been helpful for me.
Is this in the context of de-anonymization?
This rule seems like it might make sense in some circles and circumstances, but taken at face value means basically never sharing any information about anyone, which seems too strong to be a general rule. I'm not 100% sure I understand the context.
But, if someone is blogging on tumblr, pseudononymously, I do think it's probably default to not to sharing private info about them with most people.
I say burn this with fire. First comment btw.
I am not good at keeping secrets. I do not enjoy keeping secrets. And they are counterproductive to both the greater good, a rational society, and the glory of Saturn. Excelsior!
Secrets seem necessary for maintaining people's privacy, and privacy seems like it's necessary for thinking clearly.
I think this post is still mostly aligned with your goals, because the status quo is that everyone sort of assumes you can, and are supposed to, keep secrets. The tl;dr of this posts is "have metaconversations about secrecy instead of assuming everyone is has the same assumptions about them".
I don’t personally find keeping secrets a significant enough hardship to be worth asking people to tell me fewer secrets. I just asked a friend of mine, and they feel the same as me.
My hypothesis is that you feel differently because you hear a lot more secrets, and each additional secret carries an additional mental burden to not reveal it. Perhaps when you know too many secrets, you have a greater meta-challenge of separating them from each other and remembering which groups each secret can and cannot be discussed with.
What are the factors behind one’s mental burden of keeping secrets? I think the number of secrets one hears depends on both the number of people you converse with regularly and those people’s propensities to share secrets. And since secrets are only a burden during conversations, the frequency that one converses with others is also a factor. Thus, if someone has less social interaction in general, they would be more likely to would not think of secrets as a big deal.
As for why people don’t self-evaluate whether they have the ability to keep secrets, after thinking about it now, neither me nor my friend can remember a time we leaked a personal secret that was explicitly labeled as one. (It probably happened when I was a young child and didn’t understand secrets, but I can’t remember it.) So that’s two data points towards it being okay for most people to assume that other people are able to keep secrets.
Upon reflection, I do realize that I have sometimes shared secrets that weren’t labeled as such. In such cases, one person assumed I wouldn’t tell another person the news they were sharing, but I didn’t see the harm in it. I wouldn’t call those failures to keep secrets, though; they are more like failures to understand social norms or failures to guess at someone’s unstated feelings. The secret-sharer can easily solve that problem once they know about it: just say “please don’t tell so-and-so about this; I’d like to keep this private”.
I've also been working on gaining skills that make me more reliable at keeping things private, and making it lower cost for myself to take on confidential information.
Although we may be able to introduce and encourage good privacy etiquette in smaller groups, I doubt society at large will embrace such etiquette for a long time, if ever. Thus, I am interested to hear more about such skills/techniques to make confidentiality-bearing less costly to myself.
may be able to introduce and encourage good privacy etiquette in smaller groups
It's worth exploring what dimensions you're worried about. You'll come up with different mechanisms and different expectations (for yourself and others) if you frame it as "etiquette" or "norms" than if you frame it as "value or harm from additional disclosure".
Do you mean that the mechanisms and expectations will be more severe if it's framed as value/harm rather than etiquette? If so, I wasn't intending to reduce the potential seriousness with my phrasing.
I suspect that "severity of mechanism" will have the same range for the two framings. I think the complexity and utility of the ruleset will be different.
Trying to work from human norms and politeness/guess-culture assumptions will lead to weird exceptions and hard-to-predict behaviors. Working from a consequentialist harm/benefit framework seems likely to navigate those nuances and exceptions.
something something something....the triumph of truth over etiquette....something something something.....complete :)
Yeah, the use case I have for this post is mostly for small-to-medium sized groups of people (who disproportionately read LessWrong or hang out with people who do). Agreed it's unlikely to help with society as a whole, or at companies/social-groups that aren't predisposed to reading blogposts like this.
Nevertheless, even if there are confidentiality-bearing cost reduction skills which aren't widely applicable outside of this use case, I think they would be useful to know.
Were you mostly referring to the TAP you outlined about having meta-conversations? If so, that's definitely a good start, but I wonder if there's anything else possible.
Pet peeve about privacy: I think people are woefully inadequate at asking, and answering, "Can you keep this confidential?"
Disclosure: I am not inherently great at keeping information private. By default, if a topic came up in conversation, I would accidentally sometimes say my thoughts before I had time to realize "oh, right, this was private information I shouldn't share."
I've worked over the past few years to become better at this – I've learned several specific skills and habits that make it easier. But I didn't learn those skills in school, and no one even really suggested I was supposed to learn them. People seemed to just assume "people can keep secrets, and it's low cost for them to do so."
And... maybe this is just me. But, people say to me "hey, can you keep this private?", in a tone that implies I'm not really supposed to say no. And that's the best case. I've also observed things like...
...people saying "hey, this is confidential", and then just saying the thing without checking in.
...people saying "sign this NDA", without really checking I have the skills to honor that agreement, and if I were to not sign, I'd... probably get fired? Unclear.
...people gathering for a Circle or other private safe space, and saying (best case) "do we all agree to keep things here confidential? Raise you hand?" and worst case, just flatly asserting "This is a safe space, things are confidential here". (And I have seen at least one instance where someone I actively trusted later betrayed that trust)
...people saying "You can report things to our [org / HR department / point-person], and they will keep things confidential." But, I know that in the hiring process for that org or department, no one ever checked that people actually had privacy skills.
And meanwhile, I have almost never heard anyone say something like "I have been given 10 bits of private-info over the past few years, and I accidentally leaked two of them", or even "I have paid any attention at all to how leaky I am with regards to confidential information."
What is a secret, even?
Meanwhile, people seem to vary in what they even mean by "secret" or "private information." Some people take them as serious oaths, some people just kinda sorta try to keep the R0 of the info lower than 1. Sometimes it seems to mean "carry this information to your grave", and sometimes it means "I dunno keep this on the down-low for awhile until the current controversy blows over."
Some people reading this might be surprised this is even a big deal. I gave a lightning-talk version of this blogpost last weekend, and one person asked "does this really matter that much, outside of major company NDAs or state-secrets?" Another person expressed similar skepticism.
I think it varies. The problem is exactly that most of the time, secrets aren't that big of a deal. But people don't seem to take time to get on the same page of exactly how big a deal they are, which is a recipe for mismatched expectations.
It's a bigger deal for me, because I live in social and professional circles adjacent to EA Grantmaking where line between the personal and professional is (perhaps unfortunately) a bit blurry. Sometimes, I talk to people exploring ideas that are legit infohazardous. Sometimes, people are hesitant to talk because they're worried it may affect their career.
It's also important to me from a Robust Agency standpoint – I'd like to be a reliable agent that people can coordinate with in complicated domains. Many other people in the x-risk ecosystem also seem interested in that. I think "the ability to exchange information, or reliably not exchange it" is a key skill, and worth cultivating because it enables higher order strategies.
What to do with all this?
I don't have a clear next action with all this. Right now, there's a vague social norm that you're supposed to be able to keep secrets, and that certain types of information tend to be private-by-default, but outside of things like "your social security number", there's not much agreement on what.
What I've personally taken to doing is giving myself a TAP, where as soon as I notice that a conversation or relationship is moving in the direction where someone might want to give me private information (or vice versa), I say "hey, I'd like to have a little meta-discussion about privacy."
And then we have a chat. If the conversation literally just broached the idea that one of us share private info, I try to avoid face-to-face contact to avoid micro-expressions revealing information. (Someone else recently suggested leaving more pauses in the conversation, so that reaction-time didn't reveal information either).
Then, I ask some questions like:
Can you keep a secret?
How do you know?
What exactly do you mean by secret?
Meanwhile, acknowledging: "Hey, so, in the past few years I've leaked at least one important bit of private-info. I haven't kept track of how much private info I didn't leak. But, I've also been working on gaining skills that make me more reliable at keeping things private, and making it lower cost for myself to take on confidential information. I'm fairly confident I can keep things private if I have to, but it's still a moderate cost to myself and I have to choose to do it on purpose. So please don't assume I'm keeping anything private unless I've specifically told you so."
I think it'd be good if such meta-conversations became more common.
I think they most importantly should be common if you are creating an organization that relies a lot on confidentiality. If you're promising to your clients that their information is private, but you aren't actually checking that your employees can keep confidence, you're creating integrity debt for yourself. You will need to pay it down sooner or later.
This is (hopefully) the first post in the Privacy Practices sequences. The next post will (probably) be "Parameters of Privacy."