In January, one of Patreon's security engineers announced that the entire cybersecurity department had been dismissed. When asked about it, the company confirmed that five individuals had been dismissed "as part of a stategic shift of a portion of our security program". Guise Bule↱ of Secjuice explains: This of course prompted a lot of debate within the information security community, especially when it became clear that Patreon had surprised the whole security team with this move. According to industry insiders, Patreon had no plan in place to replace the security team, despite Patreon insisting it was part of a bigger strategy. But then even more sinister allegations began to emerge that the cybersecurity team had been dismissed because they had pushed back against Patreons alleged internal policy to not remove illegal child porn activity unless they received a court order or law enforcement request (this allegation came from an anonymous source). A Glassdoor post (qtd. in Bule) allegedly written by a former Patreon employer was more specific, calling for a federal investigation "because there's no way what we're doing is legal". The post claims Patreon workers "are being told specifically by management and executives NOT to take down content that is illegal or reported as sexual in nature involving minors unless the police make contact with legal or we have an order by the court." Moreover, the post claims that concerns about "an amalgamation of accounts that are selling lewd photographs of what appear to be children" are dismissed. The perspective is "all about advocating for customers who are Minor-attracted persons", according to the claim. Bule notes, however, that "real facts are still thin on the ground", and "some journalists are advising that reporting on this story is irresponsible". That is an excellent consideration in terms of journalistic responsibility compared to sensational stories that even major news media runs with. Meanwhile, Patreon has reacted strangely, or slowly, only today releasing an unequivocal statement↱ that the claims are false. Actually, it's not much of a staement, but we might consider this has been brewing since January, at least, and flared up in May; it is only in September, as more Patreon subscribers cancel their memberships and the story verges toward large-scale public discussion that the company made the business decision to issue a statement. What the statement doesn't say is that Patreon has investigated the claims, found them false, and can tell us how they came about. They did not say, for instance, that they never told anyone "to not remove illegal child porn activity unless they received a court order or law enforcement request"; nor did they tell us anything about the alleged "amalgamation of accounts that are selling lewd photographs of what appear to be children". Notably, the statement¹ is dated September 13, 2022, but referred to the January dismissals as "last week". What they don't tell us, for instance, is that they actually investigated the claims and what they found when they did. But what they did tell us is, "Recent changes we made to our security organization were designed to bolster security efforts through relevant in-house and partner expertise." The key words there are "in-house" and "partner". Well, that and the question of whose or what security is being bolstered. Then they tell us, "Those vital efforts are completely unrelated to the Trust & Safety Team’s charter to keep the platform safe from harmful and illegal content." The sentences almost read like vapid filler to keep up a façade, but if you read closely, they're well-crafted, and one thing that stands out is that they might have nothing to do with each other. Consider: Recent changes to bolster security are vital efforts "completely unrelated" to the team charter "to keep the platform safe from harmful and illegal content". There is a way in which that works out, but it describes a strangely blatant circumstance in which we acknowledge that bolstering security for problematic content is in itself separate from the effort to "keep the platform safe from harmful and illegal content". Indeed, at this point, we can wonder what it means to "keep the platform safe". As Patreon seeks to operate as a public company and hopes to double in size, this year, it would also be irresponsible to not read their statement in that context. While it is easy enough to suggests capitalists will be capitalist, and all that sort of stuff, remember that keeping the platform safe means, first and foremost, the company bottom line. This has been brewing in public view since January; the company waited until now, after at least two subsequent flare-ups over eight months, to release a generic statement that says nothing useful. Nothing in their six paragraphs say it didn't happen; the suggestions of denial are bureaucratically suitable language that the company cannot explicitly be held to, not even the part when Patreon says, "We want to let all of our creators and patrons know that these claims are unequivocally false." According to the basic rules of syntax, "these claims" that are "unequivocally false" are not explicitly enumerated; handed a record of accurate claims, they can always claim ignorance and say that isn't what they were talking about. Everything about those two sentences depends on how we define words like "unequivocally", and "false". The question that hangs like a pall is what actually happened. If, for instance, the answer is that five disgruntled former emloyees fabricated a story and none of it ever happened, Patreon has had eight months to make the point. If the answer is that what looks like an amalgamation of accounts selling child exploitation turns out to be a crass operation using short, youthful Asian women in children's swimsuits, Patreon has had eight months to say that. As a question of journalistic responsibility, it is true the story has stayed quiet over the period. As a PR question, Patreon has not really done much to help itself, and may even have made things worse with this new statement. But there is also a powerful ethical question afoot about spectacular questions. People making these claims against Patreon face powerfullegal and, ultimately, financial disincentives for being wrong. Patreon, meanwhile, still has a range of options to mitigate their culpability if the accusations are true. And in the tech industry, it is easy to suggest it is nearly impossible that no improper content passed through Patreon, but what happens, next, is a vital question. Is this a troll job, maliciously inflating one manager's circumstantial uncertainty and poor communication skills into a phantom child-exploitation conspiracy theory? Is it a disgruntled angry employee with a case that is distorted by overstatement? And then: What if it's actually true? Because the one thing we can't do is pretend that porn and the tech industry are so separate. Say it to yourself in the mirror: 「Pornography distribution on a business network? Preposterous!」 But even if we presume that someone, somewhere, found child exploitation on the network, and some manager screwed up the disposition, that doesn't actually meet the larger allegations. As this story continues to emerge, we will actually have opportunities to consider what went wrong along the way. We can watch both the accusations and defense develop. And there is an obvious sort of analogy here about sex crime, accusation, and false accusation. It is, of course, limited, as the vast majority of false-accusation lamentations over the years don't involve organizations worth multiple billions of dollars protecting their finances as they pursue an IPO while maintaining exclusive control over the resources in question within a business framework known to delay, dissimulate, and disinform. A question arises: Would a false accusation hurt Patreon more than if it was true? ____________________ Notes: ¹ The statement was found using basic search terms: patreon security allegation. If the company released a version of the statement in January, it was not evident in the return. The top Google result for the search was this morning's post. If Patreon released a version of this in January, we might wonder why not simply repost or otherwise boost it. Bule, Guise. "Are Child Porn Allegations At Patreon Connected To The Firing Of Their Security Team?" Secjuice. 13 September 2022. Secjuice.com. 13 September 2022. https://bit.ly/3S2zULm Patreon. "False allegations on social media". Patreon Blog. 13 September 2022. Blog.Patreon.com. 13 September 2022. https://bit.ly/3Lb6ckR
