🦊 welcome to the vulpe zone 🦊

🔮 adult furry artist and programmer 🔮

be advised some of the posts here might be nsfw! for now most of them will sfw be though.

ive posted a few game titles to itch now! feel free to check em out!
i sure am gonna miss this place
https://foxball.carrd.co/


arborelia
@arborelia

In Part 1, I tried to get Software Heritage (SWH) to stop crediting my software called ftfy to my deadname. After I brought it up on Twitter, one of their developers DMed me to tell me that was impossible, because changing names would ruin the “integrity” of their data structures.

I give zero shits about the integrity of their data structures. I had already sent them a second email invoking the Right to Rectification, which it seemed like they ignored again, so it was time to get more formal.

SWH is run by Inria, a French government-supported research organization. I was convinced that the reason their Data Protection Officer felt they could ignore my e-mails was that I was writing them in English.

My level of being able to put together a French sentence is somewhere around « Je vais au supermarché en tren train », but I can kinda read it when there's enough cognates. With a combination of Microsoft Word with grammar checking, Wiktionary, machine translation to suggest sentences, a guide to writing formal GDPR requests in French, and a French acquaintance who was busy but could proofread the result, I got to it.

In the replies to part 1, @IkomaTanomori described “getting legally angry in French” as Western civilization's equivalent of going super saiyan, and that sounds pretty much right.


I sent a PDF formatted like a formal letter, addressed to « La déléguée à la protection des données, INRIA, Domaine de Voluceau Rocquencourt ». I had to look up who would be receiving the e-mail to get the gender right on « La déléguée ».

Here's how the message started:

Madame,

En application de l’article 21.1 du Règlement général sur la protection des données (RGPD), je m’oppose au traitement de mes données à caractère personnel par votre organisme, l’archive Software Héritage.

L’archive Software Héritage a archivé certains de mes projets logiciels en créditant mon
deadname. L’archive répertorie également certaines adresses électroniques contenant mon deadname. Mon deadname est un nom que je n’utilise plus et que personne ne devrait utiliser pour moi, car il ne correspond pas à mon sexe.

(I added to the above since my original post, to include more of the message)

I described my request (including a lot of personal details), and concluded:

Dès lors, vous voudrez bien :
  • supprimer mes données de vos fichiers et notifier ma demande aux organismes auxquels vous les auriez communiquées (articles 17.1.c. et 19 du RGPD) ;
  • si vous en avez l’obligation légale, m’indiquer la durée de conservation de mes données dans vos bases archives ;
  • m'informer de ces éléments dans les meilleurs délais et au plus tard dans un délai d’un mois à compter de la réception de ce courrier (article 12.3 du RGPD).

À défaut de réponse de votre part dans les délais impartis ou en cas de réponse incomplète, je saisirai la Commission nationale de l’informatique et des libertés (CNIL) d’une réclamation.

This is satisfying already. It doesn't hurt that French has cognates with all the fanciest words in English. But also, apparently how you write the salutation in French has none of this indirect English “to whom it may concern” stuff. I'm talking to you, madame. This concerns you.

It concerned her. Anne Combe responded the next morning to the email thread of messages I had sent.

Good morning

I have registered your request

But I didn't received your first request of Dec 9, 2021, neither by dpo@inria.fr nor by takedown takedown@softwareheritage.org. Just to understand why I didn't received your first request, can you tell me the email adress you used ?

I'd been using the same email address the whole time. After some follow-up, she claimed that my first message (which was quoted in all the others) had been caught by a spam filter. I don’t believe this, given all the other untrue things she’s told me by now, but I let it be.

A digression about French

French is a very gender-essentialist language. If I were non-binary, this would have made my task much, much harder. As it is, in reference to myself, I just had to make sure I was using all the correct feminine-gendered words.

One phrase that fascinated me was « mon nom de jeune fille » for “my maiden name”, because I needed to request that she correct my deadname to my maiden name, not to my current legal name (which I'd changed again by getting married a few months before). When both Google Translate and DeepL output a phrase that just means “my name of young girl”, I was sure they were doing an overly-literal mistranslation.

But I looked into it, and apparently that's really the phrase, used the same way as “maiden name”. The French language is being surprisingly affirming of my ability to retcon my name. The name I had from when I was 34 to 37 years old, but which I wish I had from when I was 0 to 37 years old: that's my young girl name.

It's open source, finders keepers

So here's a part of the problem that I haven't gone into yet. ftfy is a project on GitHub. One of the basic verbs you can do on GitHub is to “fork” code, making a copy of someone's repository in your own namespace, where you can edit it.

I had corrected my own code, but there were hundreds of forks. Some of them had been made in order to make pull requests. Most of them were absolutely trivial -- people had clicked the fork button and then done nothing at all with their exact copy of my code. That much is fine, except almost all of these copies refer to my deadname as the author of the software.

In previous e-mails, I had made a list of URLs of these incorrect forks that were clearly showing my deadname, and asked for them to be corrected. I was very clear about what needed to be corrected, and I followed up with all of Anne Combe's requests for information. I had provided my deadname, legal name, address, and a scan of my ID. And then she said no.

Unfortunately, the deletion or modification of the software repositories you requested cannot be performed, for several reasons:
  • On the one hand, these developments involve several authors and are made available under open source licenses, which explicitly allow copying and redistribution
  • On the other hand, the mission of Software Heritage archive is to guarantee the availability of all versions of all publicly available source codes, and to ensure the integrity of these codes

We understand the concern about the display of outdated identities, and for this reason a mechanism has been put in place to display a preferred identity across all the Software Heritage archive.

This renaming will be put in place for you as soon as possible once you provide the information required.

We would like to stress that the approach taken by Software Heritage is in line with what is proposed today by large collaborative development platforms, such as GitHub, which also do not allow to remove or modify copies/forks of existing repositories

There's so much I needed to respond to:

  • I had provided all the information she ever asked for, which was way too much
  • A mechanism had not, in fact, been put in place to “display a preferred identity across the SWH”. It still hasn't.
  • I was not asking them to develop such a mechanism. I don't just want them to cosmetically change what they display, I want them to change the data. I can't trust the organization that contains the transphobe who had written their previous content policy to hold on to a substitution rule involving my deadname forever.
  • I don't have any leverage against Microsoft to get them to change GitHub, and what GitHub does is not relevant.

Why do I care so much about the Software Heritage Archive compared to these forks on GitHub? Because these GitHub forks are just Internet detritus that nobody will look at. One day, GitHub will go down, just like SourceForge did and BitBucket mostly did. SWH knows that, it's a big reason for their mission.

So the problem is that they want to take this detritus that credits my deadname and record it forever. From what I heard they want to put a copy of it in a vault in Svalbard or something. And they don't even have my correct copy of the code.

Why are you hitting yourself?

I kept responding to the thread with no assumption of malice from Anne, just assuming that it was a series of misunderstandings due to the two of us speaking different first languages. Then she sent:

In order to better understand the situation, can you tell us why you want your deadname to be rectified in the Software Heritage archive while your deadname still appears in the history of your own project on Github as well as in all the forks that you have communicated to us?

Fuck that. She went to the "why are you hitting yourself" defense of deadnaming. And it's not even true.

I'm going to include my response in full:

Thanks for asking for this additional clarification.

My deadname does not appear in the history of python-ftfy on GitHub, to the best of my knowledge. I ran git-filter-repo on that project. But if there's a place that it remains, that's still not a justification for what your organization is doing.

Trans people should not be blamed for the places where their deadnames continue to appear. Trans people can keep their personal connections, keep their jobs, keep working on the same projects. In many places (including where I live) you're even required to publish your deadname in a newspaper ad when you change names. That means that deadnames will be visible to anyone determined enough to dig for them. But we need to be clear that this is an unethical thing to do.

The issue is, computer databases don't have any concept of data that's unethical to propagate, and the people designing them rarely show any concern about deadnames. This is one of my major areas of concern for my own name: how can I stop my deadname from constantly being propagated into new databases?

This has been particularly important where it intersects with academic citations: my deadname keeps propagating in citation databases, particularly Google Scholar. Even though I've changed my name on academic papers (having to overcome the objections of many publishers concerned about "integrity"), people find those papers via Google Scholar, which will not update names in a timely manner, and credit my deadname for them as a result. This undermines progress on my name change and leads to the concrete harm of me being denied credit for my work. I would use the GDPR on Google, too, if I could.

SWH's GitHub-scraping process has added to the list of databases that I have to be concerned about.

I have no control over the forks that others have made on GitHub (most of which are trivial artifacts related to pull requests, not forks in the software-development sense). I have no way to make these forks disappear from GitHub, but I can still be concerned about an organization that is scraping all forks that have ever appeared on GitHub. SWH is propagating information from those forks, and returning it at the top of search results, when it would otherwise be obscure and unseen.

If SWH were to remove those forks from its data, block them from the archiving process, and update the archive of my own repository, my deadname would not resurface in this way.

The GDPR provides an excellent tool for me to oppose the propagation of my deadname. This is a case that fits very well with the intent of the GDPR: it's personal data about me, it's harmful, I oppose the ways you are using it, and I want you to not have that data anymore.

The GDPR does not make an exception for organizations that are concerned about the "integrity" of the personal data they store (given a narrow and amoral definition of "integrity"), and if it did, everyone harvesting data would use that exception to defend the data's "integrity" from the GDPR.

I don't approve of the cosmetic fix that SWH has proposed instead. It's an insufficient proposal, made with no input from trans people. Before providing any data toward that cosmetic fix, I would need to know:

  • Where is the mapping from my deadname to my real name going to be stored?
  • For how long?
  • Who will have access to that mapping?
  • How will Inria employees who cannot be trusted with data about trans people, such as the one who rewrote the Content Policy on December 9, 2021 to something that was particularly callous toward trans people, be prevented from accessing that mapping?
  • Will the mapping be applied whenever the data is exported to others? How will that be guaranteed? (arXiV implemented name changes in a somewhat similar way to what SWH is proposing, and unfortunately neglected to apply them to their data exports.)
  • How will this interact with my GDPR request?

I don't intend to abandon the GDPR request, and a specific action that SWH could take toward fulfilling it is to remove the forks of my code that I listed from its archive.

I don't need to repeat the rest of the thread. She answered me with more bullshit and deflection, and a vague promise that SWH would be able to eventually write code to cosmetically change my deadname. (That code is still unwritten in 2024.)

At one point she took my description of how arXiV did it wrong as a suggestion for how SWH should do it.

And she never responded to a single time that I mentioned the GDPR.

I let her know that the undue delay constituted a denial of my GDPR request, and that I planned to escalate it to CNIL, the French data regulator.

Escalating it to CNIL

This took me a while. The whole conversation had worn me down, and now I needed to write a longer message in French, and fill in a form in French, to make a complaint about Inria to the CNIL.

While navigating CNIL's web site trying to figure out how to do this, I saw a portentious banner announcing their partnership with Inria.

I wrote a description in French of everything that had happened so far, and included PDFs of the e-mail thread (which are necessarily in English) as evidence, and sent it to CNIL. It was October 2022, seven months after Anne Combe's final refusal, when I managed to do this.

I got this form reply:

Madame,

Nous vous informons que votre demande n° 44-2161 a été transmise au service de l'exercice des droits et des plaintes de la CNIL.

Vous pouvez suivre l'évolution de votre demande depuis votre compte CNIL.

Well, good. They've received my request (demande is French for “request”), and I can go to their website to see its progress.

It has never made any progress.

I don't think they've rejected it as invalid, or even as “do you really expect us to read this long thread of English text”. It's just sitting there, years later.

I heard from the woman who I'd originally heard about SWH's deadnaming problem from, who was also trying to change her name. She said that she had gotten a response from CNIL -- and it was that the case was closed, because SWH claimed they'd implemented a cosmetic name-substituting mechanism (they have not) and that she was happy with the result (she is not).

The explanation I can come up with is that CNIL and Inria are friends, and CNIL will never take action against Inria.

I've looked at what my options are to proceed with trying to use the GDPR. Supposedly, if CNIL won't act, I'm supposed to be able to bring it up with my local GDPR regulator. Which doesn't exist, because I'm in the United States.

Apparently, according to the GDPR, I might be able to seek a "judicial remedy". Which is to say, it sounds like I would need to bring a lawsuit against CNIL, in France for their inaction.

I am not capable of doing this myself. I think my best follow-up here is to find someone who has the same problem and lives in the EU.

Okay, I'm mad on your behalf, is there anything I can do to help?

The most helpful thing is: if you are, or can connect me to, someone in the EU with a similar claim against SWH, you should let me know -- via a Cohost ask, a discord DM to arborelia, or @arborelia@computerfairi.es on the Fediverse, though I might be about to move to @arborelia@kind.social.

Or, if you happen to want to draw fan-art of my character throwing down a Power Glove and shouting “MADAME.”, it would make my entire year and give me the motivation to keep working on this.

In part 3, SWH writes a name change policy with no ability to implement it, and I try to play along.


You must log in to comment.

in reply to @arborelia's post:

But also, apparently how you write the salutation in French has none of this indirect English “to whom it may concern” stuff. I'm talking to you, madame. This concerns you.

It does actually:
À l'intention de quiconque cela concerne. Literally, "to the intention of whom it concerns."
"Quiconque" means "whoever."

I'm unsure about Right to Rectification specifically, but they were just as dismissive as CNIL was when I tried using Right to Erasure with Twitter. I'm under the impression that the ICO only pays lip service to GDPR, and either can't - or won't - actually enforce it because we're no longer in the EU.

meanwhile in the civilized world you write to the webmaster and ask them to change your name because your name has changed and they just do it because why wouldn't they

So suppose you'd changed your name through marriage, as many people do... would they have refused to change it then?

I prefer to not make this the same issue as marriage. Marriage doesn’t usually require a retroactive name change, and in my case, I'm specifically asking them to credit my maiden name, not my married name.

And the simple answer is yes, they'd refuse. They are refusing to change anything they've scraped.

Le soi-disant pays des droits et des libertés portant atteinte à la liberté la plus fondamentale de toutes... le droit de s'autodéfinir.

anyway, angry on your behalf, yes, incredibly so. but surprised? not one bit. france is just as transphobic as the rest.

If I had a claim of my own against SWH I would be jumping at the opportunity to help you, sadly I am not, and I am busy with a different kind of legally angry in French right now, but if the opportunity comes up I'll do whatever I can.

The bit about French being Gender essentialist hits especially hard. My family speaks French primarily. I'm not out as nonbinary to them because i have no way of being addressed or mentioned. Adjectives, verbs, nouns, none of those can be used to describe me accurately in French.

I'm unfortunately probably not going to be able to be out to my family in any meaningful way that i find satisfactory. Because French decided there's only two genders.

Feeling this so hard I can hold it in my hands. Haven't really been out out with my family either because I haven't solved the problem of asking for they/them in French.

Think the literal only reason I'm still officially they/he is just that, the Gendered Language problem, and not wanting to fight an entire language and its resulting perception of all of reality because it really shouldn't be up to me. I actually cringe a bit when I hear a he/him/il/lui... I just bear with it.

The integrity attack makes me so mad. It's much better integrity to update names. Author credits aren't supposed to be a personal history of the author. They're supposed to make it simple to find who authored a work so one could look them up elsewhere.

ugh. I swear I have done both at different times but I will have to check what happened.

but of course, even if the filter-repo didn't stick, that doesn't justify their "why are you hitting yourself" defense

btw now that I've seen it, could you delete the comment?