Cartography is an artform. Besides being used for art, it is a practice rooted in subjectivity. For most people, it may be only a means of navigation, but any cartographer acknowledges that they make decisions based on their own opinions when making maps. OpenStreetMap is one of the more objective maps out there, but it’s still not always clear how to map things. As a community, we’ve had to make numerous decisions on the “best” way to map something. Sometimes, we don’t have a singular answer. Users of OpenStreetMap data must interpret these decisions as best they can. Tagging is usually what comes to mind when considering what comes into dispute here, but scope is important as well. And this is where privacy comes in.

Privacy status quo

We have some privacy standards. Besides GDPR compliance, the Data Working Group redacts edits that introduce personal information, such as annotations intended for an individual that may link their account to a real person. It generally isn’t acceptable to map features inside private residences either, like rooms or toilets. These may come as common sense to most, but others still could have counterpoints. The level of detail most are comfortable with is what is visible from street level or the sky. I think this is a good standard, but some are still left uncomfortable. There’s the occasional new mapper who deletes driveways leading to single-family homes. It may not even be their own driveway, but some may be unfamiliar with OpenStreetMap’s tagging system that makes it clear when a driveway is private and that it is, indeed, a driveway. One cannot fault a person for wanting privacy; the concern then is about damaging data (digital vandalism). At least where OpenStreetMap is based, there is no law against making a map of someone else’s property. Legal concerns about cartography are a separate matter not related to individual privacy, which is my focus here.

Does OpenStreetMap protect individual privacy? Depends on who you ask. I’d say so, but this essay isn’t about my opinions on privacy. It’s about ensuring people feel their privacy is respected by the site, within reason. Why? Because last year, I found someone who saw OpenStreetMap as a threat. So much so that they spent multiple days edit-warring, creating several accounts, and making vague legal-tinged threats at me for mapping their house and driveway. I was poorly equipped to deal with the user, and even though the Data Working Group was involved, the conflict only ended because the offending user gave up. My conduct began acceptable, but as I became exasperated turned pseudo-professional. It is important that users can deal with these issues before they are turned over to the Data Working Group, but I had nothing to go off.

The dispute

I was confident I was in the right, but not all mappers might feel that way. Some might even take the vandal’s side. Because only I and the Data Working Group had any lasting involvement in the dispute, this issue has been forgotten. Nothing has been written about it. Only a brief discussion occurred in the OpenStreetMap US Slack server. As it happened over a year ago and was not recurring, I’d stopped paying it mind a while ago. I am sure that similar disputes exist, but I have not noticed them. I personally feel like I know what to do if I am involved in the following situation again, but it is just as important that others feel the same.

Enter June 2020. A user going by Hans Thompson has added AI-generated buildings in the outskirts of Anchorage, Alaska, using RapiD. Among these buildings is an unnotable house with a detached garage. The only tag on these buildings is building=yes.

February 2021 rolls around and someone signs up for an OpenStreetMap account under the username Privacy1. This user had previously created an account called Map_Manager that was used two years earlier to delete a litany of tracks and trails on private property. It is unclear if this was their own property. A week before creating this new account, they had returned to delete more trails from this property, but did not touch the house. One day before the new account was created, Hans also mapped the driveway leading to the house. This likely spurred the account creation, but no deletions were made until five days later. The edit was posted to Slack, prompting me to comment. My focus was made particularly on the changeset comment, which indicated to me that the user did not understand how OpenStreetMap functions. The user left a reply rehashing their changeset comment, leading to two other users explaining in other terms what I’d said.

Eight hours later, I reverted the changeset. Less than four hours later, they deleted the feature again, with the same comment. I requested they reply to my original comment, but to no avail. After just 20 minutes, I again reverted their deletions. Three hours passed and once again, they deleted the house, garage, and driveway, still with the same changeset comment. I left another comment notifying them that I had contacted the Data Working Group. At this point, I had quickened my pace, reverting their edit in just over seven minutes. At the same time, I started becoming irritated, and rather than use boilerplate about the changeset I reverted, I communicated my willingness to revert their vandalism as many times as was necessary. Four hours later, they returned, but this time with a new changeset comment, oddly accompanied by a French translation. This time, they pleaded for their privacy and to be left alone. Another user chimed in, explaining that their privacy was not threatened by the map features. At this point, I was asleep, so it took two hours, but I did come back. Refreshed, I switched back to boilerplate with my new reversion. They responded in equal time, but with a simpler message firmly requesting no “annotation” be made to their private property. Yet another user told them off, but still nothing was heard directly. Being a school day, it was nine hours before I could revert the changeset, but I persisted. They seemed to have caught on, as they set a new record with just a two-and-a-half-hour delay. No updates in the changeset comment department to report.. I left them another comment explaining what was wrong with their actions, but to no avail. I waited an hour for a vain attempt at submitting the 100 millionth changeset, but was slightly too late, and got number 100000019. Another new record was set by their hour and a half response time. One of the users that had told them off earlier in the dispute chimed in again, and I let him know the issue. I was a little passive-aggressive in expressing my disapproval that the Data Working Group had not yet taken action. This user reverted the deletion himself, which was greatly appreciated but in vain, as two hours later the user came back. Sick of writing changeset comments, an hour later I said nothing at all. They returned with a slightly revised changeset comment which I called out, but no one heard it. I decided to create a Wikidata entry for the home in the hopes that they would be unable to figure out how to delete it, but it did not help. I also used the city’s property information website to add the year the home was built. This mapping was done out of spite; call it silly, but it is a good act, or at least a neutral one. They had no more trouble deleting this, though. The aforementioned other editor again reverted the deletion, and added an explanation in the source tag of their changeset. It took eleven hours, but they did return, and deleted some other nearby features that weren’t even on their property to boot. We were clearly talking in circles at this point; I merely link every single changeset here to illustrate the user’s persistence. I laid out as clearly as I could in ten minutes that the user needed to stop in my next reversion comment, and that while I did respect their privacy, their privacy rights do not go as far as they claim. An hour and a half, a deletion, eight minutes, a reply quoting the dictionary at the user, a reversion, and then finally, a year long block. This was only a temporary roadblock (no pun intended) to them; 22 hours later, they returned with a new account they were clearly trying to pass off as a different person with a changeset comment insinuating the features in dispute were “mapping errors”, while talking only in French and using a French username. This one was blocked too, with a much more threatening comment. Perhaps the idea of legal action got them to wise up? A ten-year block finally scared them off. And so the features stand, with even more detail thanks to wonderful members of the community.

The aftermath

This subject has undoubtedly come up elsewhere, but there’s no guidance I could find on the wiki. I still have lingering questions, and here, now, I hope to pose them to other OpenStreetMap users so that we can all feel respected and be more welcoming to users with legitimate concerns. I’d love to hear your thoughts on the situation and these questions, or links to similar discussions.

• Was it unethical for this user to access someone else’s computer (OpenStreetMap servers) after they had been banned from doing so for the sake of protecting their privacy in an extralegal manner?
• What could I have done better?
• Is it acceptable for the Data Working Group to move straight to a long block just because other users attempted to explain the site’s policies to them first?
• What do we say to other users with a similar concern? Is being upfront about the legal problems threatening, or merely truthful and effective?

Update (May 22, 2022)

It seems that by linking the Wikidata entry, it was brought to an administrator’s attention and deleted for not meeting the notability criteria. I was under the impression that it fell under criterion 2. Now knowing that this dispute affected another unrelated wiki-based project (though minimally), I regret that decision even more. Should a similar dispute occur again, I will leave only a single thorough comment on their first deletion and use the same changeset comment on each reversion. Should they delete a feature a second time, I will contact the Data Working Group.