The Issue of Data Security and Machine Translation

As the world becomes more digital and the volume of mission-critical data flows continue to expand, it is becoming increasingly important for global enterprises to adapt to the rapid globalization, and the increasingly digital-first world we live in. As organizations change the way they operate, generate revenue and create value for their customers, new compliance risks are emerging — presenting a challenge to compliance, which must proactively monitor, identify, assess and mitigate risks like those tied to fundamentally new technologies and processes. Digital transformation is driven and enabled by data, and thus the value of data security and governance also rise in importance and organizational impact. At the WEF forum in Davos, CEOs have identified cybersecurity and data privacy as two of the most pressing issues of the day, and even regard breakdown with these issues as a general threat to enterprise, society, and government in general.

While C-level executives understand the need for cybersecurity as their organizations undergo digital transformation, they aren’t prioritizing it enough, according to a recent Deloitte report based on a survey of 500 executives. The report, “The Future of Cyber Survey 2019,” reveals that there is a disconnect between organizational aspirations for a “digital everywhere” future, and their actual cyber posture. Those surveyed view digital transformation as one of the most challenging aspects of cyber risk management, and yet indicated that less than 10% of cyber budgets are allocated to these digital transformation efforts. The report goes on to say that this larger cyber awareness is at the center of digital transformation. Understanding that is as transformative as cyber itself—and to be successful in this new era, organizations should embrace a “cyber everywhere” reality.

Cybersecurity breakdowns and data breach statistics

Are these growing concerns about cybersecurity justified? It certainly seems so when we consider these facts:

• A global survey in 2018 by CyberEdge across 17 countries and 20 industries found that 78% of respondents had experienced a network breach.
• The ISACA survey  of cybersecurity professionals points out that it is increasingly difficult to recruit and retain technically adept cybersecurity professionals. They also found that 50% of cyber pros believe that most organizations underreport cybercrime even if they are required to report it, and 60% said they expected at least one attack within the next year.
• Radware estimates that an average cyber-attack in 2018 costs an enterprise around $1.67M. The costs can be significantly higher, e.g. a breach at Maersk is estimated to have cost around $250 - $300 million, because of the brand damage, loss of productivity, loss of profitability, falling stock prices, and other negative business impacts in the wake of the breach.
• Risk-Based Security reports that there were over 6500 data breaches and that more than 5 billion records were exposed in 2018. The situation is not better in 2019, and over 4 billion records were exposed in the first six months of 2019.
• An IBM Security study revealed that the financial impact of data breaches on organizations. According to this study, the cost of a data breach has risen 12% over the past 5 years and now costs $3.92 million on average. The average cost of a data breach in the U.S. is $8.19 million, more than double the worldwide average.

As would be expected, with Hacking as the top breach type, attacks originating outside of the organization were also the most common threat source. However misconfigured services, data handling mistakes and other inadvertent exposure by authorized persons, exposed far more records than malicious actors were able to steal.

 Data security and cybersecurity in the legal profession

Third-party professional services firms are often a target for malicious attacks because of the possibility of acquiring high-value information is high. Records show that law firms relationships with third-party vendors are a frequent point of exposure to cyber breaches and accidental leaks. Law.com obtained a list of more than 100 law firms that had reported data breaches and estimate that even more are falling victim to this problem, but simply don’t report it to avoid scaring clients and minimize potential reputational damage.

Austin Berglas, former head of the FBI’s cyber branch in New York and now global head of professional services at cybersecurity company BlueVoyant, said law firms are a top target among hackers because of the extensive high-value client information they possess. Hackers understand that law firms are a “one-stop-shop” for sensitive and proprietary corporate information, merger & acquisitions related data, and emerging intellectual property information.

As custodians of highly sensitive information, law firms are inviting targets for hackers.

The American Bar Association reported in 2018 that 23% of firms had reported a breach at some point, up from 14% in 2016. Six percent of those breaches resulted in the exposure of sensitive client data. Legal documents have to pass through many hands as a matter of course, reams of sensitive information pass through the hands of lawyers and paralegals, and then they go through the process of being reviewed and signed by clients, clerks, opposing counsels, and judges. When they finally get to the location where records are stored, they are often inadvertently exposed to others—even firm outsiders—who shouldn’t have access to them at all.

A Logicforce legal industry score for cybersecurity health among law firms have increased from 54% in 2018 to 60% in 2019, but this is still lower than many other sectors. Increasingly clients are also asking for audits to ensure that security practices are current and robust. A recent ABA Formal Opinion states: “Indeed, the data security threat is so high that law enforcement officials regularly divide business entities into two categories: those that have been hacked and those that will be.”

Lawyers are failing on cybersecurity, according to the American Bar Association Legal Technology Resource Center’s ABA TechReport 2019. “The lack of effort on security has become a major cause for concern in the profession.”

“A lot of firms have been hacked, and like most entities that are hacked, they don’t know that for some period of time. Sometimes, it may not be discovered for a minute or months and even years.” Vincent I. Polley, a lawyer, and co-author of a recent book on cybersecurity for the ABA.

As the volume of multilingual content explodes, a new risk emerges: public, “free” machine translation provided by large internet services firms who systematically harvest and store the data that passes through these “free” services.  With the significantly higher volumes of cross-border partnerships, globalization in general, and growth in international business, employee use of public MT has become a new source of confidential data leakage.

Public machine translation use and data security

In the modern era, it is estimated that on any given day, several trillion words are run through the many public machine translation options available across the internet today. This huge volume of translation is done largely by the average web consumer, but there is increasing evidence that a growing portion of this usage is emanating from the enterprise when urgent global customer, collaboration, and communication needs are involved. This happens because publicly available tools are essentially frictionless and require little “buy-in” from a user who doesn’t understand the data leakage implications.  The rapid rate of increase in globalization has resulted in a substantial and ever-growing volume of multilingual information that needs to be translated instantly as a matter of ongoing business practice. This is a significant risk for the global enterprise or law firm as this short video points out. Content transmitted for translation by users is clearly subject to terms of use agreements that entitle the MT provider to store, modify, reproduce, distribute, and create derivative works. At the very least this content is fodder for machine learning algorithms that could also potentially be hacked or expose data inadvertently.

Consider the following:

• At the SDL Connect 2019 conference recently, a speaker from a major US semiconductor company described the use of public MT at his company. When this activity was carefully monitored by IT management, they found that as much as 3 to 5 GB of enterprise content was being cut and pasted into public MT portals for translation on a daily basis. Further analysis of the content revealed that the material submitted for translation included future product plans, customer problem-related communications, sensitive HR issues, and other confidential business process content.
• In September 2017, the Norwegian news agency NRK reported data that they found that had been free translated on a site called Translate.Com that included “notices of dismissal, plans of workforce reductions and outsourcing, passwords, code information, and contracts”. This was yet another site that offered free translation, but reserved the right to examine the data submitted “to improve the service.” Subsequently, searches by Slator uncovered other highly sensitive data of both personal and corporate content.
• A recent report from the Australian Strategic Policy Institute (ASPI) makes some claims about how China uses state-owned companies, which provide machine translation services, to collect data on users outside China. The author, Samantha Hoffman, argues that the most valuable tools in China’s data-collection campaign are technologies that users engage with for their own benefit; machine translation services being a prime example. This is done through a company called GTCOM, which Hoffman said describes itself as a “cross-language big data” business, offers hardware and software translation tools that collect data — lots of data. She estimated that GTCOM, which works with both corporate and government clients, handles the equivalent of up to five trillion words of plain text per day, across 65 languages and in over 200 countries. GTCOM is a subsidiary of a Chinese state-owned enterprise that the Central Propaganda Department directly supervises, and thus data collection is presumed to be an active and ongoing process.

After taking a close look at the enterprise market needs and the current realities of machine translation use we can summarize the situation as follows:

• There is a growing need for always-available, and secure enterprise MT solutions to support the digitally-driven globalization that we see happening in so many industries today. In the absence of having such a secure solution available, we can expect that there will be substantial amounts of “rogue use” of public MT portals with resultant confidential data leakage risks.
• The risks of using public MT portals are now beginning to be understood. The risk is not just related to inadvertent data leakage but is also closely tied to the various data security and privacy risks presented by submitting confidential content into the data-grabbing, machine learning infrastructure, that underlie these “free” MT portals. There is a growing list of US companies already subjected to GDPR-related EU regulatory actions, including, Amazon, Apple, Facebook, Google, Netflix, Spotify and Twitter. Experts have stated that Chinese companies are likely to be the next wave of regulatory enforcement, and the violators' list is expected to grow. 
• The executive focus on digital transformation is likely to drive more attention to the concurrent cybersecurity implications of hyper-digitalization. Information Governance is likely to become much more of a mission-critical function as the digital footprint of the modern enterprise grows and becomes much more strategic.

 The legal market requirement: an end to end solution

Thus, we see today, having language-translation-at-scale capabilities have become imperative for the modern global enterprise.  The needs for translation can range from rapid translation of millions of documents in an eDiscovery or compliance scenario, to the very careful and specialized translation of critical contract and court-ready documentation on to an associate collaborating with colleagues from a foreign outpost. Daily communications in global matters are increasingly multilingual. Given the volume, variety, and velocity of the information that needs translation, legal professionals must consider translation solutions that involve both technology and human services. The requirements can vary greatly and can require different combinations of man-machine collaboration, that includes some or all of these different translation production models:

• MT-Only for very high volumes like in eDiscovery, and daily communications
• MT + Human Terminology Optimization
• MT + Post-Editing
• Specialized Expert Human Translation

Machine Translation: designed for the Enterprise

MT for the enterprise will need all of the following (and solutions are available from several MT vendors in the market). The author provides consulting services to select and develop optimal solutions :

• Guaranteed data security & privacy
• Flexible deployment options that include on-premise, cloud or a combination of both as dictated by usage needs
• Broad range of adaptation and customization capabilities so that MT systems can be optimized for each individual client
• Integration with primary enterprise IT infrastructure and software e.g. Office, Translation Management Systems, Relativity, and other eDiscovery platforms
• Rest API that allows connectivity to any proprietary systems that you may employ. 
• Broad range of expert consulting services both on the MT technology aspects and the linguistic issues
• Tightly integrated with professional human translation services to handle end-to-end translation requirements.

This is a post that was originally published on SDL.COM in a modified form with more detail on SDL MT technology. 

The Global Data Explosion in the Legal Industry

As we consider and look at the various forces impacting the legal industry today, we see several ongoing trends which are increasingly demanding more attention from both inside and outside counsel. These forces are:

• The Digital Data Momentum
• Increasing Concern for Data Security
• The Growing Importance of Information Governance
• Increasing Globalization 

 

The Digital Data Momentum

Several studies by IDC, EMC and academics have predicted for years that we are facing an ever-growing data deluge and content explosion. The prediction that the digital universe will be 44 zettabytes by 2020 means little to most of us. But if you state that 500 million tweets, ~300 billion emails, 65 billion Whatsapp messages are sent, and 3.5 billion Google searches are made every single day, many more of us would understand the astounding scale of the modern digital world. While only a small fraction of this data will flow into the purview of the legal profession, the impact is significant and most legal teams will admit this increase in content is a major challenge today.

The enterprise is also affected by this content explosion, and a recent eDiscovery Business Confidence survey identified increasing data volumes as THE primary concern for the coming future. In eDiscovery settings, this also means that the information triage process is complicated since we are seeing not only significant increases in volume, but we are also seeing a greater variety of data types. The modern legal purview can include mobile data, voice and image data from various sources in addition to the data flowing in various enterprise IT systems. 

 Increasing Concern for Data Security

 

While data security has not been a concern in the past, it is increasingly being seen as a key concern. At recent Davos conferences, cybersecurity and data privacy breakdowns are seen as the biggest threats to businesses, economies, and societies around the world. According to the World Economic Forum (WEF), attacks against businesses have almost doubled in five years and the costs are rising too. “The world depends on digital infrastructure and people depend on their digital devices and what we’ve found is that these digital devices are under attack every single day,” said Brad Smith, president, and chief legal officer, Microsoft. He added that attacks by organized criminal enterprises are becoming “more prolific and more sophisticated”, often “operating in jurisdictions that are more difficult to reach through the rule of law but use the internet to seek out victims literally everywhere.”

This rise of artificial intelligence and machine learning also means that global enterprises are interested in acquiring and harvesting data, wherever and whenever they can. Businesses are looking to acquire as much information as possible, about customers, interactions, brand opinions, and extracting insights that might give them an edge over the competition. Data-guzzling machine learning processes promise to amplify businesses’ ability to predict, personalize, and produce. However, some of the world’s largest consumer-facing companies have fallen victim to data breaches affecting hundreds of millions of customers. By all measures, the disruptive, data-centric forces of the so-called fourth industrial revolution appear to be outpacing the world’s ability to control them.

Legal professionals will need to play a larger role in managing these new risks, which can be devastating and cost millions in reparations and negative consequences.  Increasingly these threats originate in foreign countries and sometimes even with support from foreign governments

 

 

The Growing Importance of Information Governance

 

The modern global enterprise has a very different risk tolerance profile from similar companies, even as recently as 10 years ago. The “datafication” of the modern enterprise creates special challenges for both inside and outside counsel.  Recent surveys by Gartner suggest that legal leaders have to start investing in digital skills and capabilities, reflecting the evolving role of the legal department as a strategic business partner.

“How legal departments build capabilities to govern risk within digital initiatives matter more than the legal advice they provide” says Christina Hertzler, Practice Vice President, Gartner.

To be digitally ready, legal departments must shift their approach to manage specific changes created by digitalization — more stakeholders, more speed and iteration, and the increased technical and collaborative nature of digital work, as well as handling new information-related risks.

As organizations change the way they operate, generate revenue and create value for their customers, new compliance risks are emerging — presenting a challenge to compliance, which must identify, assess and mitigate risks like those tied to fundamentally new technologies (e.g., artificial intelligence) and processes.

There is a growing list of US companies already subjected to GDPR-related EU regulatory actions, including, Amazon, Apple, Facebook, Google, Netflix, Spotify, and Twitter. Indeed, the French Data Protection Authority, CNIL, recently levied upon Google a record fine of approximately $57 million dollars for “lack of transparency, inadequate information and lack of valid consent regarding ads personalization.” The risks to US companies include providing proof of measures taken to protect, process, and transfer personal data from the EU to the US in connection with regulatory investigations or litigation.  A report published in late February by DLA Piper cited data from the first eight months of GDPR enforcement, during which 91 fines were imposed. "We expect that 2019 will see more fines for tens and potentially even hundreds of millions of euros, as regulators deal with the backlog of GDPR data breach notifications," the report said. Taking meaningful steps now toward GDPR compliance is the best way for US companies doing business of any kind involving EU personal data—including those with no physical presence in the EU—to prepare for and mitigate their risk.

The penalties of non-compliance with regulatory policies continue to mount.  Google was fined $170 million and asked to make changes to protect children’s privacy on YouTube, as regulators said the video site had knowingly and illegally harvested personal information from children and used it to profit by targeting them with ads. We can only expect that data privacy and compliance regulations will be taken more seriously in the future and that legal teams will play an expanding role in ensuring this.

Facebook agreed to pay a record-breaking $5 billion fine as part of a settlement with the Federal Trade Commission, by far the largest penalty ever imposed on a company for violating consumers' privacy rights. Facebook also agreed to adopt new protections for the data users share on the social network and to measures that limit the power of CEO Mark Zuckerberg. Under the settlement, which concludes a year-long investigation prompted by the 2018 Cambridge Analytica scandal, the social networking giant must expand its privacy protections across Facebook itself, as well as on Instagram and WhatsApp. It must also adopt a corporate system of checks and balances to remain compliant, according to the FTC order. Facebook must also maintain a data security program, which includes protections of information such as users' phone numbers. The issue of data privacy and compliance will continue to build momentum as more people understand the extent of the data harvesting that is going on.

Taking meaningful steps now toward robust information governance and compliance for all kinds of privileged and confidential data will be necessary for the modern digital-centric enterprise, and the modern legal department will need to be able to be an active partner and help the enterprise prepare for and mitigate their risk.

 

Increasing Globalization = More Multilingual Data

 

While these forces we have just described continue to build momentum, driven by increasing digitalization and the resultant ever expanding content flows, we also have an additional layer of complexity: language. The modern enterprise is now much more rapidly and naturally global, and thus now the modern legal department and outside counsel need to be able to process content and information flows in multiple languages on a regular basis. The variety and volumes of multilingual content that legal professionals need to process and monitor can include any and all of the following:

• International contract negotiations and disputes
• Patent-infringement litigation
• Human Resource communications in global enterprises
• Customer communications
• GDPR Compliance related monitoring and analysis 
• Cross-border regulatory compliance monitoring
• FCPA compliance monitoring 
• Anti-trust related matters

The volumes of multilingual content can vary greatly, from very large volumes that might involve tens of thousands of documents in litigation related eDiscovery, to specialized monitoring of customer communications to ensure regulatory compliance, to smaller volumes of sensitive communications with global employees.

Multilingual issues are especially present in cross-border partnerships and business dealings which are now increasingly common across many industries.

The AlixPartners Global Anticorruption Survey polled corporate counsel, legal, and compliance officers at companies based in the US, Europe, and Asia in more than 20 major industries. The perceived corruption risks are elevated in Latin America and China, and Russia, Africa, and the Middle East have emerged as regions of increasing concern. The survey found that 90% and 94% of companies with operations in Latin America and China, respectively, reported their industries are exposed to corruption risk. Of the 66% of respondents who said there are regions where it is impossible to avoid corrupt business practices, 31% said Russia is one such place and 27% cited Africa.

The sheer volume of information companies must collect, translate, and analyze is the biggest obstacle to tackling corruption, according to 75% of survey respondents. 

These concerns surrounding the management of data are expected to increase with increasing data privacy regulation such as the EU’s General Data Protection Regulation.

 

 

End-to-end translation solutions for the legal industry 

Thus, we see today that language translation production capabilities have become imperative for the modern global enterprise and that the needs for translation can range from rapid translation of millions of documents in an eDiscovery scenario to very careful and specialized translation of critical contract and court-ready documentation. Given the volume, variety, and velocity of the information that needs translation, legal professionals must consider a combination of technology and human services. Ideally, solving these kinds of varying translation challenges would be done by technologically informed professionals who solve complex and varied translation problems and who can adapt language technology and human expertise to the challenge at hand. 

Several MT and language service vendors provide an enterprise-class, vendor agnostic, secure translation platform that allows you to combine regulatory compliance and translation best practice. Securing the translation supply chain needn’t come at the cost of trusted suppliers, existing relationships or impact time to market.

This blog was originally published on SDL.COM with more SDL product information.

Data Security Risks with Generic and Free Machine Translation

Together with all the news of catastrophic hurricane activity in the US, that we are being bombarded with recently, we also are seeing stories of serious data security breaches of privileged information, even in the world of business translation. As always, the security and privacy of the data can only be as good as the data security practices and the sophistication of the technological implementations, and thus the knee-jerk response of pointing to “bad” MT technology per se, and assigning blame at MT use practices is not quite fair. It is indeed possible to make MT services available for public and/or corporate community uses safe and secure if you know what you are doing and are careful. It may seem obvious to some, but effective use of any technology requires both competence and skill, and we see too many cases of inept implementations that result in sub-optimal outcomes.

 

Generally, even professional translation work done entirely by humans requires source content to be distributed to translators and editors across the web to enable them to perform their specific tasks. The manner in which sensitive data or confidential information requiring translation can leak is twofold. First, information can be stolen "in transit" by transferring or accessing it over unsecured public Wi-fi hot spots or by storing it on unsecured cloud servers. Such risks have already been widely publicized and it is clear that weak processes and lax oversight are responsible for most of these data leakage cases.

Less considered, however, is what online machine translation providers do with the data users input. This risk was publicized by Slator last week, when employees of Norwegian state-run oil giant Statoil had “discovered text that had been typed in on [translate.com] could be found by anyone conducting a [Google] search.”

Slator reported that: “Anyone doing the same simple two-step Google search will concur. A few searches by Slator uncovered an astonishing variety of sensitive information that is freely accessible, ranging from a physician’s email exchange with a global pharmaceutical company on tax matters, late payment notices, a staff performance report of a global investment bank, and termination letters. In all instances, full names, emails, phone numbers, and other highly sensitive data were revealed.”

In this case, the injured parties apparently have little, or no recourse, as the “Terms of Use” policies of the MT supplier clearly stated that privacy is not guaranteed: “cannot and do not guarantee that any information provided to us by you will not become public under any circumstances. You should appreciate that all information submitted on the website might potentially be publicly accessible.”
Several others in the translation industry have pointed out other examples of the risks and have named other risky MT and shared data players involved with translation data.

Translation technology blogger Joseph Wojowski has written in some detail on the Google and Microsoft terms of use agreements in this post a few years ago. The information he presents is still quite current. From my vantage point these two MT services are the most secure and reliable “free” translation services available on the web today and a significant step above offerings like translate.com and many others. However, if you are really concerned about privacy these too have some risk, as the following analysis points out.

His opening statement is provocative and true at least to some extent:

“An issue that seems to have been brought up once in the industry and never addressed again are the data collection methods used by Microsoft, Google, Yahoo!, Skype, and Apple as well as the revelations of PRISM data collection from those same companies, thanks to Edward Snowden. More and more, it appears that the [translation] industry is moving closer and closer to full Machine Translation Integration and Usage, and with interesting, if alarming, findings being reported on Machine Translation’s usage when integrated into Translation Environments, the fact remains that Google Translate, Microsoft Bing Translator, and other publicly-available machine translation interfaces and APIs store every single word, phrase, segment, and sentence that is sent to them.”

The Google Terms of Service

Both Google and Microsoft very clearly state that any (or at least some) data used on their translation servers is viable for further processing and re-use, generally by machine learning technologies. (I would be surprised if any single individual does actually sit and watch this MT user data stream, even though it may be technically possible to do.) Their terms of use are considerably better than the one at translate.com who might as well have reduced it to: “User Beware: Use at your risk and we are not liable for anything that can go wrong in any way whatsoever.” Many people around the world use Google Translate daily, but very few of them are aware of the Google Terms of Service. Here is the specific legalese from the Google Translate Terms of Use Agreement that I include here, as it good to see it as specifically as possible to properly understand the potential risk.

“When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services.” (Google Terms of Service – April 14^th 2014 accessed on September 11^th 2017.

Some other highlights from the Google TOS which basically IMO mean, if something goes wrong, tough shit, and if you can somehow prove it is our fault, we only owe you what you paid us unless you can somehow prove it was reasonably foreseeable. The terms are even less favorable if you use the MT service for “Business Use”:

GOOGLE, AND GOOGLE’S SUPPLIERS AND DISTRIBUTORS, WILL NOT BE RESPONSIBLE FOR LOST PROFITS, REVENUES, OR DATA, FINANCIAL LOSSES OR INDIRECT, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES.

THE TOTAL LIABILITY OF GOOGLE, AND ITS SUPPLIERS AND DISTRIBUTORS, FOR ANY CLAIMS UNDER THESE TERMS, INCLUDING FOR ANY IMPLIED WARRANTIES, IS LIMITED TO THE AMOUNT YOU PAID US TO USE THE SERVICES (OR, IF WE CHOOSE, TO SUPPLYING YOU THE SERVICES AGAIN).

IN ALL CASES, GOOGLE, AND ITS SUPPLIERS AND DISTRIBUTORS, WILL NOT BE LIABLE FOR ANY LOSS OR DAMAGE THAT IS NOT REASONABLY FORESEEABLE.

The Microsoft Terms of Service

Microsoft is a little better, and they are more forthcoming about their use of your data in general, but you can judge for yourself. Heavy users even have a way to bypass the possibility of their data being used or analyzed at all with a paid, volume subscription. Heavy use is defined as 250 million characters per month or more, which by my calculations is anywhere from 30 million to 50 million words per month. Here are some key selections from the Microsoft Translator Terms of Use statement.

"Microsoft Translator does not use the text or speech audio you submit for translation for any purpose other than to provide and improve the quality of Microsoft’s translation and speech recognition services. For instance, we do not use the text or speech audio you submit for translation to identify specific individuals or for advertising. The text we use to improve Translator is limited to a sample of not more than 10% of randomly selected, non-consecutive sentences from the text you submit, and we mask or delete numeric strings of characters and email addresses that may be present in the samples of text. The portions of text that we do not use to improve Translator are deleted within 48 hours after they are no longer required to provide your translation. If Translator is embedded within another service or product, we may group together all text samples that come from that service or product, but we do not store them with any identifiers associated with specific users. We may keep all speech audio indefinitely for product improvement purposes. We do not share the text or speech audio samples with third parties without your consent or as otherwise described, below.

We may share or disclose personal information with other Microsoft controlled subsidiaries and affiliates, and with suppliers or agents working on our behalf to assist with management and improvement to the Translator service.

In addition, we may access, disclose and preserve information when we have a good faith belief that doing so is necessary to:

1. comply with applicable law or respond to valid legal process from competent authorities, including from law enforcement or other government agencies; (Like PRISM for the NSA)
2. protect our customers, for example to prevent spam or attempts to defraud users of the services, or to help prevent the loss of life or serious injury of anyone;"

And for those LSPs and Enterprises who customize (train) the MSFT Translator Baseline engines with their own TM data the following terms additionally apply:

"The Microsoft Translator Hub (the “Hub”) is an optional feature that allows you to create a personalized translation system with your preferred terminology and style by submitting your own documents to train on, or using community translations. The Hub retains and uses submitted documents in full in order to provide your personalized translation system and to improve the Translator service. After you remove a document from your Hub account we may continue to use it for improving the Translator service."

Again, if you are a 50 million words per month kind of user, you can choose (opt-out) for your data not to be used for anything else.

Blogger Joseph Wojowski concludes after his review of these tacit agreements, that translators need to be wary, even though he mentions that there are real and meaningful productivity benefits, in some cases, for translators by using MT.

“In the end, I still come to the same conclusion, we need to be more cognizant of what we send through free, public, and semi-public Machine Translation engines and educate ourselves on the risks associated with their use and the safer, more secure solutions available when working with confidential or restricted-access information.”

Invisible Access via Integration

If your source data already exists on the web anyway, some may say what is the big deal anyway? Some MT use cases I am aware of that focus on translating technical support knowledge bases or eCommerce product listings may not care about these re-use terms. But the larger risk is that once translation infrastructure is connected to MT via an API, users may inadvertently start sending out less suitable documents out for MT without understanding the risks and potential data exposure. For a random unsophisticated user in a translation management system (TMS), it is quite possible to inadvertently send out and translate an upcoming earnings announcement, internal memos to staff about emerging product designs, or other restricted data to an MT server that is governed by these terms of use. In global enterprises, there is an ongoing need to translate many types of truly confidential information. 

Memsource presented research recently on MT usage from within their TMS environment across their whole user base and showed that about 40 million segments are being translated/month via Microsoft Translator and Google through their API. Given that the volume barely meets the opt-out limits, we have to presume all the data is reused and analyzed. A previous post in the ATA Chronicle by Jost Zetzsche (page 26 in December 2014 issue) showed that almost 14,000 translators, were using the same “free” MT services in Memsource. If you add Trados and other TM and TMS systems that have integrated API access to these public MT systems, I am sure the volume of MT use is significant. Thus, if you care about privacy and security, the first thing you might need to do is address these MT API integrations that are cloaked within widely used TM and TMS products. While there are many cases where it might not matter, it would be good for users to understand the risks when it does.

Human error, often inadvertent, is a leading cause of data leakage

 Common Sense Advisory's Don DePalma writes that "employees and your suppliers are unconsciously conspiring to broadcast your confidential information, trade secrets, and intellectual property (IP) to the world.” CSA also reports that in a recent survey of Enterprise localization managers, 64% of them say their fellow employees use free MT frequently or very frequently. 62% also told Common Sense Advisory that they are concerned or very concerned about “sensitive content” (e-mails, text messages, project proposals, legal contracts, merger and acquisition documents) being translated. CSA points out two risks:

1. Information seen by hackers or geeks in transit across non-secure web connections
2. Look at the Google TOS section described above to see how and what Google can do even when you are not using the services anymore.

The problem is compounded because, while it may be possible to enforce usage policies within the firewall, suppliers and partners may lack the sophistication to do the same. This is especially so in an ever expanding global market. Many LSPs and their translators are now using MT through the API integration interfaces mentioned above. CSA lists these issues as follows:

• Service providers may not tell clients that they use MT.
• Most buyers haven’t caught up yet with data leakage.
• Subcontractors might not follow the agreed-upon rules.
• No matter what anyone says, linguists can and will use MT when it is convenient regardless of stated policies.

Within the localization groups, there may be some ways to control this. As CSA again points out by:

• Locking down content workflows (e.g. turn off MT access within TMS systems)
• Finding MT providers that will comply with your data security provisions

However, the real risk is in the larger enterprise, outside the localization department, where the acronym TMS is unknown. It may be possible to some extent, to anonymize all translation requests through specialized software, or block all free translation requests, or force them through special gateways that rinse the data before it goes out beyond the firewall. While these anonymization tools might be useful, they are still primitive, and much of the risk can be mitigated by establishing a corporate controlled MT capability that provides universal access to all employees and remains behind the firewall.

In addition to the Secure Corporate MT Service described above, I think we will also see much more use of MT in e-discovery applications. Both in litigation related applications and broad corporate governance and compliance applications. Here is another opinion on the risks of using Generic MT services in the corporate litigation scenario.

Considering Secure MT Deployment Options

Many global organizations are now beginning to realize the information leakage risk presented by unrestricted use and access to free MT. While one way to address this leakage risk is to build your own MT systems, it has also become clear to many that most DIY (Do It Yourself) systems tend to be inferior in terms of output quality to these free generic systems. When users are aware of the quality advantage of Free MT, they will often double-check on these "better" systems, thus defeating the purpose of private and controlled access on DIY systems. Controlled, optimized (for the corporate subject domain) and secure MT solutions from vendors who have certified competence in doing this, seems to me is the most logical and cost effective way to proceed to solve this data leakage problem. “On Premise” systems make sense for those who have the IT staff to do the ongoing management and are available, and able, to protect and manage MT servers at both the customer and the vendor end of the equation. Many large enterprises have this kind of internal IT competence, but very few LSPs do.

It is my opinion that the vendors that allow both on premise and scalable private clouds to be setup are amongst the best options available in the market today. Some say that a private cloud option provides both professional IT management and verifiable data security and is better for those with less qualified IT staff. Most MT vendors tend to provide cloud based solutions today, and for adaptive MT this may be the only option. There are few MT vendors that can do both cloud-based and on premise, and even fewer that can do both competently. MT vendors who tend to provide non-cloud solutions infrequently are less likely to provide reliable and stable offerings. Setting up a corporate MT server that may have hundreds or thousands of users is a non-trivial affair. Like most things in life, it takes repeated practice and broad experience in multiple different user scenarios to do both on premise and cloud solutions well. Thus, one would expect that those vendors who have a large and broad installed base of on premise and private cloud installations (e.g. more than 10 varying types of customers) are preferred to those who do it as an exception and have an installed base of less than at least 10 customer sites.  There are two companies who names start with S that I think meet these requirements best in terms of broad experience and widely demonstrated technical competence. As we head into a world where Neural MT is more pervasive, I think it is likely that Private Clouds will assume more importance in future and be a preferred option to actually having your own IT staff manage GPU or TPU or FPGA arrays and servers on site. However, it is still wise to ask your MT vendor to provide complete details on data security provisions in  their cloud offering.

What seems more and more certain is that MT definitely provides great value in keeping global enterprises actively sharing and communicating, and the need for better, more secure MT solutions has a bright future. And what incidents like this latest translate.com fiasco show is, that broadly available MT services are valuable enough for any globally focused enterprise to explore more seriously and carefully, rather than leave it to naïve users to find their own way to using risky “free” solutions that undermine corporate privacy and expose high-value confidential data to anyone who knows how to use a search engine or has basic hacking skills.

The Changing Legal Technology Landscape

We have been witnessing a dramatic, largely digitally-driven business transformation, affecting many industries over the last decade. The term most often used to describe this phenomenon is “digital transformation,” even though non-digital business structural changes most often accompany it. 

Digitization and datafication are key elements in this kind of transformation. We have seen the impact of this phenomenon most clearly in the retail industry, where giants of yesteryear like Sears and Borders have fallen to more digitally agile contenders like Amazon, who have changed the retail landscape fundamentally. The impact of digital transformation on the legal profession and function has been less dramatic, but after spending a week at LegalWeek20 in NYC in February, it is clear that change is coming to the enterprise-focused legal profession as well.

The emerging changes in the Legal Industry can be characterized along the following five dimensions:

• The changing relationship between Corporate General Counsel and outside counsel
• The changing legal services model
• The growing impact of the data deluge
• The evolving legal technology landscape
• The increasing importance of data security and privacy

The growing tension and disconnect between corporate general counsel and outside law firms

Experts suggest that the disruptive changes in the legal industry began after the 2008 downturn when companies started demanding more from their outside counsel. Today’s law firms find themselves under greater pressure from clients who demand value, efficiency, and transparency in a way that was uncommon ten years ago. The past decade has seen General Counsels (GCs), demanding more for less, but it has also seen a growing awareness that return on investment (ROI) is more important than just the cost.

The shift that began a decade ago, also began the gradual death of the traditional approach to legal billing, the venerated billable hour. Previously, outside counsel time was literally equivalent to money. Lawyers had little incentive to be more efficient and saw no reason to spend non-billable time exploring and deploying new technologies to make themselves more efficient. This traditional approach is changing now, as firms can no longer rely solely on their legal expertise; today, they must increasingly focus on how they deliver that expertise, which calls for increased use of technology and benefits early adopters of disruptive technologies. Legal services have been a buyers’ market for the past decade and corporate law departments now like to see clearly defined value and efficiency.

All this is happening against a backdrop of changing buyer behaviors accelerated by rapid globalization across the whole professional services market. The corporate legal department has historically often been viewed as “deal killers,” but the modern legal department is now often a much more engaged internal business partner in emerging corporate initiatives. Modern legal departments have increasingly shifted their approach to manage the specific changes created by digitalization — today, corporate legal counsel engages with more stakeholders, interacts with more speed and iteration, and are accustomed to the increased technical and collaborative nature of digital work, in addition to handling new information-related risks. The increasingly technologically aware workforce is upping its expectations in terms of the use of technology and effective, rapid communication between service providers and clients.

Technology is changing the general counsel’s role, and law firms need to react to remain competitive. The time has come to embrace emerging technologies that provide clients with efficient solutions to manage and service their current and future needs. Client expectations are changing, technology is having an increasing impact, and new, low-cost legal service competitors are emerging to take a slice of the market. What was already a buyer’s market is becoming more so, with increasingly powerful in-house legal departments stoking up the market for alternative legal service providers (ALSPs).

Some GCs and consultants have even developed tests to measure their outside law firms on how efficiently they perform with commonly used productivity tools and measure competence with widely used technology. These tests reward efficiency, which goes against the yardstick that old-style lawyers have traditionally used to value their work: time. Firms whose working cultures do not evolve to service current market needs efficiently, are likely an endangered species. Law firms need to deliver better quality service, and they need to do it cheaper and faster, which demands more automation and competence with technology. Clients are now much less tolerant of old-style lawyers who resist or refuse to use technology that enables expedited and efficient work production.

In his book “The End of Lawyers?” author and legal tech expert Richard Susskind writes: “It is not easy to convince a group of millionaires [Old Partners at Law Firms]... that their business model [the billable hour] is wrong.”

Law departments are now at what Judith Flournoy, CIO at international law firm Kelley Drye & Warren terms “an inflection point,” where they are likely to have to accelerate their uptake of technological innovations to stay competitive. Competence with analytics, collaboration and office productivity software is increasingly a base requirement for the client today.

The changing legal services market

As the needs of GCs change, we see corporate law departments are in-sourcing more legal work, using more tools and technology that reduces the need for outside counsel, and are using more boutique law firms and quasi legal-service providers (Alternate Legal Service Providers - ALSP).

The traditional structure of partners effectively running the business, with some carefully supervised and limited support services, is outdated today. The General Counsel today can not only shift to another law firm, but could also work with small specialist boutique law firms, and global accounting firms who are increasing their involvement with legal services. The smaller firms tend to be much more innovative, specialized, tech-savvy, and run leaner practices enabled by technology; and thus are often more competitive than large firms. The growing importance and practice of technology-enabled collaboration allow these new service providers to deliver much more integrated, efficient services resulting in deeper client relationships.

The 2017 Litera Report on the State of the Legal Market states: “The potential impact of the Big Four accounting firms on the future market for law firm services cannot be overstated [for firms in jurisdictions where alternative business structures are permitted]. As the ALSP market evolves, the Big Four are likely to play an ever-expanding role.” The Alternative Legal Service Providers market revenue grew from $8.4 billion in 2015 to about $10.7 billion in 2017 and continues to grow rapidly.

ALSPs perform many of the tasks traditionally done by law firms, with the top five tasks identified in a Thomson Reuters survey as:

• Litigation and Investigation Support
• Legal Research
• Document Review
• eDiscovery, and
• Regulatory Risk and Compliance

Ron Friedmann, a partner at Fireman & Company, a legal industry-focused management consulting firm, believes firms need to leverage an ecosystem of players. He says many of the future lawyers will not be lawyers at all. According to Friedmann, “In ten to fifteen years, law firms will be a much smaller share of the total legal market.”

 The ongoing data explosion

The volume and complexity of data have always been a part of the landscape in the legal industry. What is changing is the deluge of data is coming at ever-increasing speeds, increasing variety, and formats, and is also increasingly global and multilingual. The impact of this data explosion is significant, and most legal teams will admit this increase in content is a major challenge facing the legal profession today.

In eDiscovery settings, this also means that the information triage process is more challenging and requires much more automation to handle data volume and variety and increase the capability to deal with much more multilingual data.

The modern enterprise is now much more rapidly and naturally global, and thus the modern legal department and outside counsel need to be able to process content and information-flows in multiple languages regularly. The variety and volumes of multilingual content that legal professionals need to process and monitor can include any of the following:

• International contract negotiations and disputes
• Patent-infringement litigation
• Human Resource communications in global enterprises
• Customer communications
• GDPR compliance-related monitoring and analysis
• Cross-border regulatory compliance monitoring
• FCPA compliance monitoring

The volumes of multilingual content can vary greatly, from very large volumes that might involve terabytes of documents in litigation related eDiscovery, to specialized monitoring of customer communications to ensure regulatory compliance, to smaller volumes of sensitive communications with global employees. Multilingual issues are especially present in cross-border partnerships and business dealings, which are now increasingly common across many industries. Being able to process and analyze large volumes of multilingual data is becoming an increasingly more important requirement.

 The emerging legal technology landscape

Law firms can help general counsel drive efficiencies in business decisions by working together to determine what technology is most beneficial. Firms need to start adopting a collaborative teamwork approach not only with general counsel but also by cooperating with alternative service providers and the Big Four as collaborative partners. The general counsel is also looking for outside counsel to adopt a more client-centric model.

As automation penetrates more deeply into legal practice, we see that the role of technology grows in scope and breadth. Tools can range from a variety of analytics and collaboration tools to structured document management tools, end-to-end litigation, and eDiscovery platforms. More recently, comprehensive information governance tools are emerging to handle the increasing datafication of the modern enterprise, and manage the growing compliance risks involved in conducting business with an increasing digital footprint.

Rather than simply upgrading existing technologies, the true transformation only comes when law firms adopt a robust IT strategy that overhauls their services completely. Automation also only makes sense if it delivers on providing high-quality work more efficiently and delivers predictable value to the client.

“After all, if you’re paying for a service and one supplier, says, ‘that will take two weeks, and we’ll charge you by the hour,’ and another says, ‘that will take us two days, and we’ll charge a fixed fee’—which would you choose?”

Legaltech, notes Richard Tromans, founder of Tromans Consulting, is a “very wide spectrum.” At one end, there is document assembly and robotic process automation, taking the grind out of standard, repetitive work while reducing the time taken to perform tasks, saving costs, removing errors, and improving compliance. This kind of automation falls into the category of optimization. At the other end is natural language processing, artificial intelligence, and virtual assistants, which offer the possibility of really revolutionizing the future of legal services — and opens the door to the prospect of robot lawyers.”

As the volumes of data climb, tools that help lawyers to extract relevance and identify core patterns that become increasingly important. The legal technology community needs to move beyond making vague claims of being AI-based, to showing clearly how machine learning and data-driven algorithms can assist in delivering higher value to an expanding variety of legal tasks and processes.

The increasing importance of data security and privacy

Data security involves both preventing malicious attacks and limiting accidental data loss. However, the distributed nature of technology, enhanced by cloud services, creates vulnerability with employees increasingly working from remote locations, making it harder to secure data.

As DLA Piper partner—and former US Department of Justice cybercrime coordinator—Ed McAndrew observed, “The best evidence is now held in mobile devices and the apps, social networks, and cloud services we utilize with those devices. Any investigator or litigator who ignores that evidence may be committing malpractice in many instances.”

Recent surveys by Gartner suggest that legal leaders have to start investing in digital skills and capabilities, reflecting the evolving role of the legal department as a strategic business partner. “How legal departments build capabilities to govern risk within digital initiatives matters more than the legal advice they provide” says Christina Hertzler, Practice Vice President, Gartner.

Striking a reasonable balance between security and convenience is a challenge faced by all law firms. As organizations change the way they operate, generate revenue, and create value for their customers, new compliance risks are emerging — presenting a challenge to compliance oversight, which must identify, assess, and mitigate risks like those tied to fundamentally new technologies (e.g., artificial intelligence) and processes.

GDPR, CCPA, and other privacy protection regulations will present special challenges for the modern enterprise. Thus, while digital transformation initiatives require active data harvesting to enable better personalization, this data acquisition effort also needs to respect the privacy rights of consumers and customers who may or may not be aware of the extent of the data collection activities. Debbie Reynolds noted the information governance requirements of these regulations at LegalWeek recently. “The new reality is that navigating the data privacy rights of individuals everywhere will be an operational necessity for businesses to thrive in the digital age,” she said.

Legal professionals will need to play a larger role in managing these new risks, which can be devastating and cost millions in reparations and negative consequences. Increasingly these threats originate in foreign countries and sometimes even with support from foreign governments.

Apart from the compliance risks that clients face, law firms themselves are sought-after targets as repositories of privileged data. Law firms are a top target among hackers because of the extensive high-value client information they possess. Hackers understand that law firms are a “one-stop-shop” for sensitive and proprietary corporate information, merger & acquisitions related data, and emerging intellectual property information.

Lawyers are failing on cybersecurity, according to the American Bar Association Legal Technology Resource Center’s ABA TechReport 2019. “The lack of effort on security has become a major cause for concern in the profession.”

As more rapidly flowing multilingual data becomes the norm in global enterprises, new data security risks emerge as employees start using public machine translation to translate privileged business content. The risk is high because publicly available tools are essentially frictionless and require little “buy-in” from users who don’t understand the data leakage implications as they pass privileged content through these systems. The rapid rate of increase in globalization has resulted in a substantial and ever-growing volume of multilingual information that needs to be translated instantly as a matter of ongoing business practice. Multilingual data will become much more pervasive over the coming future as the forces of globalization march onwards.

However, this situation evolves, it seems clear that robust machine translation solutions will be needed for any enterprise or law firm with global ambitions.

About Clever CATs and TeMpTing Free MT Offers

This is a guest post by Christine Bruckner, that looks into the Data and Information Security issue with free online MT services from a translators perspective. She was kind enough to do a summary translation of a longer article she recently wrote in German, referenced below.This subject is closely related to my previous post and shows that this issue is gaining in visibility and prominence.

Jost Zetzsche has also written about this MT security and data privacy issue, and some of you may have noticed our Twitter banter on the Google Translate security policy. Jost feels that this text from a FAQ suggests that use of the Translator API overrides the "Your Content in our Services" policy, even though the legal language in the Terms of Service very clearly states the following: "When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones." I guess it is a matter of interpretation, and my lack of trust perhaps, given how Google presents facts sometimes. Knowing what I do about how an API works, I see that the GT GUI (which is just a front-end software interface like any other,) connects via an API to the Translate Service, thus, I maintain that the aforementioned TOS is very much in effect whenever your data touches the Translate Service. Good luck to anyone who wants Google to confirm or deny this, because they tend to NOT RESPOND.  Don DePalma's quote from his 2014 article shown below, also seems to support the view that the TOS is in effect. It is up to you to decide for yourself, my sense is that they tell you very clearly what they have  the right to do, so be wary if you don't like this policy. 

It is good that this issue is getting attention, so that all MT use in professional settings can be more informed on the data security issue. I thank Christine for also clarifying the MyMemory privacy policy below and also alerting us to the more stringent security requirements in the EU. We should not fault these MT service providers for using your data if you use their services for free, as it can sometimes be useful to improve the MT capabilities. "There is no such thing as a free lunch" , as they say in America. Given the sheer volume of the MT use on any given day, I doubt it is possible to analyze the translated text in any way other than through some machine learning process. The risks are always higher when you have a case of incompetence like translate.com, or when the MT provider is under-resourced  and unable to implement proper safeguards. Some providers do give you an option to buy the privacy and that too is a fair and reasonable policy, as the options to go on-premise and private cloud also come at a cost.

------------------------

Most of the CAT (computer-aided translation) tools used in the professional translator’s workplace offer integrations with online machine translation (MT) solutions. Better MT quality and self-learning capabilities thanks to neural and adaptive MT technologies make the classic TM (translation memory) and innovative MT combination (also called “augmented translation”) more attractive for professional translators, too.

Much has been written and said about MT post-editing, quality, pricing, process impacts, etc. – but it seems that so far, minimal awareness has been provided about potential and actual information security leaks when professional translators plug-in free online MT into their translation environments.

For an article written in August 2017 for the 04/17 edition of MDÜ (the journal of Germany’s Association of Interpreters and Translators, BDÜ), I have taken a closer look at the most popular MT plugins that are available for common CAT tools and the information security aspects of such MT offers. A free reading sample of my German article is available under http://www.bdue-fachverlag.de/download/mdue/1870).

Recently, Slator called MDÜ’s spotlight on information security “timely”, as one day after publication of this MDÜ edition, news spread about the massive data privacy breach in Norway due to use of free online MT (see https://slator.com/technology/translate-com-exposes-highly-sensitive-information-massive-privacy-breach). In my opinion and experience, such problems have also existed in the past, but have been largely unnoticed by a wider audience. But now with several MT solutions providers heavily advertising their secure MT solutions, the marketing departments of MT solution providers and the media seem to be much more attentive to such issues. (The elevated  concern for data security may also have been exacerbated by incidents like the Equifax and Russian hacker stories that fill our news sources today.)

MT Integration within CAT tools

In my MDÜ article, I have focused on the four CAT tools that, according to a Slator research in April 2017 are the most popular ones among German technical translators: SDL Trados Studio, Across, memoQ and STAR Transit.

The plug-ins available for these CAT tools offer access to MT technology solutions in two modes:

• batch mode / via pre-translation
• interactive lookup and use during translation

CAT Tools	Plugins for Free Online MT	Other MT Plugins for Paid MT Solutions
SDL Trados Studio 2017	SDL Language Cloud, Google Cloud Translation, MyMemory, Microsoft Translator (via Enhanced MT Plugin), iTranslate4.eu; additional free MT plugins available via SDL AppStore	Systran, Omniscien, KantanMT, CrossLang Gateway MT, Promt, LucyLT (now OctaveMT) and other providers (available via SDL AppStore or directly from the MT vendor)
Across 6.3	Google MT	Moses, Omniscien, Reverso, SmartMATE, LucyLT (now OctaveMT), Systran; additional connectors can be ordered from Across
MemoQ 8.1.5	MyMemory, Google MT, Bing/Microsoft Translator, iTranslate4.eu	KantanMT, Omniscien, CrossLang Gateway MT, Iconic IPTranslator MT, Let’sMT!, PangeaMT, Systran, Slate Desktop, tauyou, Tilde MT and other providers
Transit NXT SP 9	Google MT, Microsoft Translator, MyMemory, iTranslate4.eu (all of them only in interactive mode)	Systran, SmartMATE, Omniscien, STAR-MT (also for pre-translation; only available in Transit Freelance Pro and Professional versions; needs to be activated via license number)

These modes of integrating MT with TM are by no means recent advances, such combinations were already available in the 1990s, for example in the Trados Translator's Workbench (see article by Matthias Heyn on pp. 111-123 of the MT archive).

The interaction between CAT tool and MT solution takes place on the segment (i.e. usually sentence) level. The MT suggestions are returned to the CAT tool both on the segment level, and often also on the sub-segment level: individual words or phrases from the MT system are presented interactively via predictive typing to the translator, or via MT enhanced (repaired) fuzzy matches in pre-translation and / or interactive mode.

I have selected the following online MT services for my further investigation:

• Google Cloud Translation (integrated in all four CAT tools)
• Microsoft Translator (available in three of the CAT tools)
• MyMemory (available in three CAT tools)
• SDL Language Cloud AdaptiveMT (available since SDL Trados Studio version 2017 for some language directions; free access for owners of a Studio Freelance or Professional license)

I have only taken into consideration the respective free, non-payable MT service offers: This means that the MT service is generally restricted regarding translation volume and, in some solutions, also restricted in features (e.g. only SMT and no NMT). Except for the MyMemory MT service, all of these free MT services require user registration.

Figure 1: MT plug-ins and MT pre-translation in SDL Trados Studio 2017 SR-1 via Google Cloud Translation API with NMT option

Information Security Aspects

When talking about sending/uploading data – or in the context of professional translation, often complete text – on the internet, there are two main aspects that need to be considered: data privacy and information security.

In my BDÜ article, I focused on information security aspects (as this was the topic of this MDÜ edition; for data privacy aspects see Addendum 1 below), and its 3 three basic components: confidentiality, availability, and integrity.

Availability of free MT online services is usually not crucial for professional translators: they will still be able to work if the online MT system fails. And in the free MT offering range, none of the service providers guarantee availability anyway.

Integrity is also a minor concern for professional translators as they do not expect that the machine-translated data will be "complete" and "unchanged" – neither in terms of content nor structure (formatting, tags, etc. are often lost during MT processing).

The crucial topics are related to the question of data confidentiality.

In an article published in 2014, Don DePalma of Common Sense Advisory mentioned two problem areas associated with using online MT in general:

• a) The “wrong” people can see information in transit.
• b) MT sites can use your data in ways you did not intend.

My research regarding aspect a) for the TeMpTing MT plugins showed:
The API of some cloud MT providers such as Google or Microsoft offer encrypted data transfer options (e. g. via SSL protocol), but this is not used in most CAT tool integrations or not available in the free version or not recognizable by a normal user. Only the CAT tools MemoQ and Across provide an option to configure the own computer or server as the referrer in the API key.

And concerning aspect b): With the help of AI methods, Internet data collectors are able to re-construct the whole text even when the free TeMpTing MT plug-ins are used only in interactive translation mode, whereby the individual segments are sent to the online MT provider at irregular intervals.

And what Don DePalma found in 2014: "While content ownership remains with the creator, free MT providers claim usage rights under their terms and conditions. For example, Google notes that it “does not claim any ownership in the content that you submit or in the translations of that content returned by the API.” However, as you follow the policy links, you learn that “When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content.”, still seems to be true.

I started to look for links to the Terms of Service of the free online MT offers in the CAT tool interfaces and documentation, but I have found only a few “road signs” with warnings and links.

Figure 2: MT connection screen in Across Freelance Edition

When I dug deeper and went into the “jungle” of the Terms of Service on the websites of the MT service providers, I found some quite worrisome facts: In their long and dispersed terms of use and service, providers like Google, Microsoft, and SDL try to assure the user that they really care about your data as much as you do and that your data belongs to you. But none of these three providers offer MT as a regional service, which means that the servers are not guaranteed to be located in the EU (even SDL’s servers are located in the US) – and the stricter European terms of service of these vendors and/or European data protection regulations might not apply.

SDL explains in the SDL Language Cloud FAQs that "With SDL Language Cloud Machine Translation you can rest assured that your content is safe. SDL guarantees that your data is not saved or used outside of the scope or timeframe that is necessary to provide you with the service”. However, when you read the Internet Security section of SDL’s Terms and Conditions for Language Cloud Translation Services, they also warn: "Because the Internet is an inherently open and insecure means of communication, any Data or information a user transmits over the Internet may be susceptible to interception and alteration. SDL makes no guarantee regarding, and assumes no liability for, the security and integrity of any Data or information you transmit over the Internet, including any Data or information transmitted via any server designated as "secure". You should not have an expectation of privacy in any content, including accounts of files transmitted through the internet.”

And according to an SDL statement at the European Trados User Group Conference in June 2017, the SDL Servers for Language Cloud Machine Translation are located in the US, and none in Europe.


For further details on the Terms of Service of Microsoft and Google, see also Kirti Vashee's most recent blog on Data Security Risks with Generic and Free Machine Translation.
 
Translated srl, the Italian service provider behind MyMemory, even boldly claims in its Service Terms and Conditions of Use:  "We collect any segment submitted and store it on a long term basis, whether it’s public or private. [..] The contributions to the archive, whether they are "Public Data" or "Private Data", are collected, processed and used by Translated to create statistics, set up new services and improve existing ones.”

Clever CAT Recommendations for Translators

So should translators and companies employing translators keep their fingers away from any MT plugin in CAT tools? This is, of course, true for confidential or otherwise classified texts, and whenever use of online MT services for processing texts is explicitly forbidden by the client or company.

If the classification status of the texts is not clear, translators are advised to apply common sense and beware of the dog behind the MT-augmented CATs by taking a closer look at the Terms of Use / Service of online MT services.

While companies and (large) LSPs can buy or build their own secure MT solution (on-premises or in a secure private cloud environment), individual translators could – and should - also benefit from and keep up-to-date with advances in MT technology by:

• using free (unsecured) online MT for freely available test texts or translation jobs where they have the consent of the author or client
• use offline MT solutions which can be acquired for a few hundred euros/dollars. In addition to being free from information security issues, they also provide more customization options like terminology import.

Addendum 1: Data Privacy Aspects when Using MT

The recommendation to use offline or secure cloud-based MT solutions also holds true for the data protection aspect – for online MT use in general. The authors of a recent, very informing article on “Data protection in Machine Translation under the GDPR” (GDPR = General Data Protection Regulation) confirm: “Offline MT […] does not pose any special problems with regards to personal data processing.”[1]

With regards to online MT services and protection of personal data, they recommend: “The user should generally avoid online MT services where he wishes to have information translated that concerns a third party (or is not sure whether it does or not).” And in a footnote, they even conclude: “This means users may be advised to use online MT services only for translating text from their own language into another language, and not vice versa (where they cannot be sure of the content)”[2].

The General Data Protection Regulation (GDPR) will enter into force on 25 May 2018, and although it is EU legislation, “[…] the GDPR expressly applies to the processing by controllers outside the EU, as long as the controller offers services to EU citizens (art. 3(2) of the GDPR).”[3]

[1] Kamocki, Dr. Tauch (2017): Data protection in Machine Translation under the GDPR, in: Porsiel, Jörg (ed.): Machine Translation - What Language Professionals Need to Know, 2017, p. 71 ff.
[2] ibid. p. 81
[3] ibid. p. 69

 

Addendum 2: DeepL – a TeMpTing New MT Player?

At the end of August 2017, a new NMT player with headquarters in Germany and servers in Iceland (by the way, not an EU member state) has entered the scene – DeepL

Their free MT offer is currently only accessible via their website. However, Jost Zetzsche mentions in his 278th Tool Box Journal published on Sept 9, 2017, that DeepL will develop an API and this “is particularly important if DeepL is to be used by professional translators who would want to use it not on a web page but integrated into a translation environment tool”. Jost writes that according to his conversation with DeepL's CTO there seems to be some hope that “DeepL would commit itself to not using the data that is being translated for training purposes (which it does right now)” – in exchange for payment for this use of such API.

Post Script

Regarding EU aspects and Jost’s comments: Google actually has Terms of Service for Germany (and possibly for other EU countries) that do not include the passage regarding “you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works “

The German TOS are more recent than the international ones, probably they have been updated in order to prepare for the EU General Data Protection Regulation. But given that Google MT is not a regional service, it remains unclear which TOS apply.

I have explained this in my German article in more detail, but left this out in my “international” article as I have considered this too Germany/EU-specific.

=================

Christine Bruckner has more than 20 years of professional experience as a freelance translator and in CAT/term/MT administration, support, training & consulting in the German government/military, corporate and LSP area. Since 2014, she leads the Technical Services team at a German LSP.

Christine holds university degrees in translation and in computational linguistics; she has been one of the early adopters of TM technology in the early 1990s and has introduced and administrated several MT solutions and translation memory and management systems at different employers. She is a member of EAMT (www.eamt.org) and BDÜ (www.bdue.de), enjoys reading MT research and testing TM+MT combinations. She tries to get the best out of the TM+MT coupling in her occasional translations, mostly in the human rights' area.

Web site: http://www.cattmatters.de/English/