Chapter 8
The foundation’s next scandal arrived through a licensing contract.
No hidden canvas.
No family feud.
A spreadsheet.
By then I was forty-seven and Director of Collections Operations.
The foundation had spent three years digitizing:
paintings,
frames,
restoration photos,
catalog cards,
loan records,
and selected archives.
Purpose:
research access.
insurance.
condition comparison.
education.
A technology vendor offered:
high-resolution image hosting,
search,
metadata tools,
automatic transcription,
public gallery pages.
Good.
Contract also contained:
commercial content-development rights.
Legal reviewed.
Marketing loved.
Collections raised concerns.
I read the clause.
It allowed the vendor to use “non-confidential digital assets and derivative metadata to improve services, develop visual products, and promote platform capabilities.”
Broad.
I asked:
“Does that mean ads?”
Vendor said:
“Only where rights permit.”
I asked:
“Merchandise?”
“Not without separate approval.”
I asked:
“Model training?”
They said:
“Service improvement may include machine-learning analysis.”
I should have stopped there.
Instead, I thought:
low risk.
Most public images were:
foundation-owned works,
public-domain art,
our own photography.
I approved collections-side implementation subject to legal signoff.
Legal approved.
Six months later, an intern found a vendor demo page.
It showed:
automatically generated room designs using images from foundation collection.
One featured:
Elena and Mara’s foyer portrait.
The portrait had been transformed into:
wallpaper patterns.
stylized family-room mockups.
cropped baby Luca.
recolored dresses.
I stared.
The foundation owned the physical painting.
Ownership of the physical painting did not automatically include reproduction rights.
Artist Celia Novak had died in 2016.
Copyright had passed to her estate.
Our 1987 commission agreement gave:
display rights,
limited catalog reproduction,
not broad commercial derivative rights.
There.
We had allowed a vendor to use an image beyond our rights.
No money from wallpaper sales.
Demo only.
Still:
unauthorized use.
Then other works.
Twenty-three images had similar rights uncertainty.
Some:
public domain.
Fine.
Some:
artist estate rights.
Not fine.
One:
Holy Cross loan.
We did not even own the object.
Our loan agreement allowed:
educational photography.
Not commercial platform demos.
I felt sick.
This was exactly the type of category error I taught interns about.
Object ownership.
Image rights.
Loan rights.
Data rights.
Different.
I knew exactly how I had missed it once the audit reconstructed the decision.
Because I wanted the digitization project to work.
Because the vendor was respected.
Because legal had signed.
Because “where rights permit” felt like somebody else’s check.
There.
Responsibility diffusion.
Then foundation response.
Immediate:
disable vendor public demo access.
freeze derivative uses.
preserve logs.
notify rights holders where appropriate.
independent contract review.
No attempt to quietly swap images.
Good.
Then board meeting.
One trustee said:
“This is a vendor breach.”
Partly.
The vendor contract had a clause requiring rights compliance.
But foundation supplied assets tagged:
PUBLIC.
The tagging error came from how our metadata team used the word PUBLIC.
Our metadata team used PUBLIC to mean:
visible in public collection site.
Vendor interpreted:
available for public reuse.
Taxonomy failure.
Shared.
Then audit.
My department had approved mapping:
PUBLIC_DISPLAY = PUBLIC.
I signed final workflow.
There.
I could not blame vendor alone.
Board chair asked:
“Did you understand vendor would create derivative visual products?”
“I understood it could under rights-permitted assets.”
“I failed to ensure our permission field matched that use.”
Specific.
Then:
“Did anyone raise this?”
Yes.
A rights coordinator named Priya Lang—not the forensic accountant, different Priya—had emailed:
Public visibility does not equal derivative-use clearance.
I had replied:
Legal is addressing in master agreement.
That was bad.
Not evil.
Bad.
I had received the exact warning.
The missing step was follow-up after the warning.
Deadline.
Grant milestone.
Board demo.
Vendor migration window.
Institutional pressure.
Same shape as many failures:
not a villain,
a shortcut around a question someone already asked.
Then consequences.
Board reduced my annual bonus.
Formal performance action.
Independent rights audit.
New approval matrix.
I offered my resignation.
The board chair said:
“No.”
I asked:
“Why?”
“Because your job is not to prove you never repeat the category of mistake you study.”
“It is to correct the specific one you made.”
Then:
“If we thought you concealed it, you would be gone.”
I had not.
Good.
Then Celia Novak estate.
Her daughter, Anna Novak, was furious.
“My mother painted a family partnership portrait.”
“Now some software company is turning it into wallpaper.”
Fair.
Foundation apologized.
Vendor removed derivatives.
Paid negotiated license fee for unauthorized promotional use.
Foundation paid part because our rights tagging contributed.
The money went to artist estate.
No confidentiality on facts.
Then Holy Cross.
Pastor laughed when we explained.
Then stopped laughing when he saw demo:
Madonna panel recolored in modern palette.
“That is not acceptable.”
No.
Removed.
Written apology.
Loan agreement amended:
no third-party derivative processing without owner approval.
Then the foundation public page.
The foundation announced the correction publicly.
Yes.
Short transparency notice:
A digital-rights review identified that a technology vendor used certain collection images in demonstration materials beyond the foundation’s licensed permissions. Uses were removed, rights holders notified, and data classifications corrected. No original artworks or title records were affected.
Good.
No:
cyberattack.
No:
stolen art.
Then internet:
MORETTI FOUNDATION AI SCANDAL.
Of course.
Close enough.
Then Luca called.
He was fifty-nine.
“Are you okay?”
“No.”
“Good.”
I laughed despite myself.
Then he said:
“I have no idea what any of these digital rights mean.”
“I know.”
“Does that make me innocent?”
“No.”
“Excellent.”
Then:
“Did you screw up?”
“Yes.”
“Are you fixing it?”
“Yes.”
“Then stop calling me unless you want lunch.”
He had learned.
No owner rescue.
Then Priya Lang.
The rights coordinator whose warning I had dismissed.
I called her in.
Not to thank her ceremonially.
To ask:
“Why didn’t you escalate after I replied?”
She looked uncomfortable.
“Because you were director.”
There.
Authority again.
I had said:
legal is addressing.
That closed the conversation.
So:
new escalation policy.
Any rights or title concern can bypass project lead to:
general counsel,
registrar,
or audit committee.
No retaliation.
But we did not create:
everyone copies board on every email.
Threshold:
material rights concern.
Then I apologized to Priya:
“I made my answer sound final before the issue was resolved.”
She nodded.
Then:
“I should have pushed.”
She could have escalated further.
But primary responsibility was mine.
There was no promotion after the incident.
None for three years.
Good.
I stayed.
Worked.
The rights system improved.
We created separate fields:
PUBLIC_DISPLAY.
EDUCATIONAL_REPRODUCTION.
PRESS_USE.
COMMERCIAL_REPRODUCTION.
DERIVATIVE_USE.
MACHINE_ANALYSIS.
OWNER_APPROVAL_REQUIRED.
Ugly.
Useful.
Then one curator complained:
“Metadata is becoming law school.”
We simplified interface.
Green:
allowed.
Yellow:
check.
Red:
not cleared.
Underlying records still detailed.
Systems must be usable or people bypass.
Then one year later, vendor asked:
The vendor later asked whether genuinely public-domain works could be used in demonstrations.
Yes, if:
photography rights ours.
loan terms permit.
no donor restriction.
no privacy issue.
Again:
not one field.
Then Mara’s portrait.
Celia Novak estate granted:
noncommercial educational rights.
No commercial derivative use.
Fine.
Foundation accepted.
The portrait did not need to become wallpaper.
Then Vanessa heard about the scandal.
She sent no comment.
Good.
Not every mistake needs old antagonist.
Then I received an email from a young collections assistant.
Subject:
Please don’t hate me.
She had discovered:
foundation gift shop sold postcards of a painting under a license that expired six months earlier.
Small.
I almost laughed.
Then remembered:
fear.
I replied:
“Thank you.”
“Stop new sales.”
“Preserve sales numbers.”
“Send contract.”
No anger.
Because she should not need courage to report a postcard.
The expired-license issue cost:
$1,870 in retroactive fees.
Tiny.
We fixed.
Then I thought about myself at twenty-nine.
Standing in foyer.
Bleeding.
Convinced fire was the only way to make a problem visible.
The best proof our system had improved was not that no one made mistakes.
It was that a junior employee could send:
Please don’t hate me
and receive:
Thank you.
No candle required.
That was the culture I wanted more than any perfect archive.
The digital-rights audit also found one positive fact.
Most staff had been more cautious than the system.
Editors had manually blocked hundreds of images from reuse because they were unsure.
Those informal stops never appeared in project dashboards.
So when leadership first asked:
“How many rights failures occurred?”
the answer could not be understood without also asking:
“How many failures did employees prevent despite bad metadata?”
That changed performance review.
We began tracking:
resolved flags,
prevented misuse,
rights questions escalated.
Not to reward paranoia.
To make invisible protective work visible.
The people who slow a project for a valid reason should not always look less productive than the people who move fastest.
After the digital-rights failure, we also changed how deadlines were discussed.
Project dashboards used to mark:
on time,
late,
blocked.
Blocked looked bad.
So staff learned to avoid blocking.
We added:
blocked for rights review,
blocked for ownership review,
blocked for safety review.
Those were not failures.
They were legitimate states.
Within six months, the number of “blocked” items increased sharply.
Executives panicked.
Then unauthorized-use incidents decreased.
The system had not become less efficient.
May you like
It had become more honest about where work actually stopped.
A red flag only helps if people are not punished for raising it.
