Electronic Telemetry: The Sheep in Wolf's Clothing

Two workhorses dominate the electronic world: advertising and analytics. Both go hand-in-hand, as advertising companies heavily use analytics to target products at a perceived demographic. And because of this, analytics and user-tracking have gotten a bad rep over the past few years. Turn off statistics. Install a tracking-script blocker. While there is some truth to this advice, there is a blurred separation between "good" and "bad" tracking, and some analytics, especially anonymous telemetry, can be extremely useful. Sometimes even mission-critical.

Application developers use usage statistics to observe use patterns, detect unexpected errors, collect crash reports, construct runtime metrics, determine content quality, and much more. These statistics are fed back to determine what bugs developers need to fix and what new features are most wanted. Have you ever reported an error message? Or requested a new feature? Or complained about a glitch? Most people actually do...but not to the developer that made the application. Users usually complain to other users in online communities. And it is left to the developers to find these communities and track the feedback accurately. This is a daunting task that does not scale as the user-base grows in size and diversity. As an alternative to manual data collection, automatic telemetry is an attractive feature for an application. When done correctly, it can provide developers with valuable information about their product without breaching users' privacy, when done correctly, that is.

By Ofol (Own work) [CC BY-SA 4.0], via Wikimedia Commons

One of the reasons users have been backlashing telemetry is companies collecting more data than users think they need, or even lying about the data they collect and how to disable such collection. Microsoft set a great example. They added one or two placebo settings for turning off telemetry, and afterward went through great efforts to implement mandatory telemetry that bypasses common power-user blocking techniques. Users like the illusion of choice with privacy, but not so much when that illusion is shattered. And there is always somebody willing to monitor all the network traffic coming from their computer to see exactly what information it is sending back to the mothership.

Lying is not the only way to deceive your users, though. Moving from one big corporation to the next, Facebook is very straightforward about its Messenger app, and what data it collects and why. But telling the truth is not enough. The Messenger app collects so much usage data that a digital forensics expert claimed, "I've worked for companies writing corporate spyware for iOS that didn't know you could get some of this information." It might be nice if every burglar in the nation made sure to list what things they stole and why they stole them, but the homeowners would still be quite a bit angry, and probably want their stuff back.

Bad examples aside, there is an acceptable way to collect telemetry data from your users. Collect a reasonable amount of data, allow for turning data collection off, and be transparent about what data you collect and why. It also helps to show users the steps you are taking to protect their privacy. Users understand—well, they think they understand—the job of the people developing the applications they use. And most users are willing to make a small privacy sacrifice, if it can even be called a sacrifice, to help improve the software they use daily.

Electronic Telemetry: The Sheep in Wolf's Clothing by Tyler Romeo is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

NOTOS

A Terms of Service, or TOS, is a legal agreement most services require a user must sign before they can use the service. It is standard procedure to list what the company will and will not provide, along with expected service usage by the customer. Expected usage is sometimes put into a separate Acceptable Use Policy, or AUP.

But the internet is an interesting service, in that, it is not an actual service. It is a connection of many networks, all provided through various internet service providers, or ISPs. These ISPs provide a buffer between a user and the “internet” and have their own TOS and/or AUP.

So how does the NSA get this data? The simplified explanation is they arrive at an internet service such as Google, Microsoft, Apple, Verizon, AT&T, etc. and provide a legal document stating they must comply with the document to provide access to their users, they cannot tell anyone about the document, and if they don’t comply, “bad things will happen”.

This places a service provider in a unique position. If they comply, they may effectively be violating their own TOS. But if they don’t comply, the government will do “bad things”. It has been recently revealed that this is accomplished by a contractor who, under federal government orders, is to install a splitter on the provider’s network that sends all traffic from their service to the NSA. All on the provider’s dollar and that they must keep it running.

The result is that if the provider complies, they can selectively send (meta)data, otherwise they send all data. Including irrelevant data such as a phone call ordering pizza from the office. As a result, most service providers opt to provide the data so they can filter it before sending it to the NSA.

If the United States had a federally mandated terms of service for accessing the internet, it would effectively remove any legal barrier that a service provider can stand behind by requiring any service provider to send data to the NSA without needing a legal subpoena. Effectively circumventing the 4^th and 5^th amendments without providing any legal floor for a plaintive to stand on if they try to argue against the unwarranted seizure of their data because the TOS grants the NSA, and the government as a whole, that ability.

By preventing institution of a country wide, federally mandated TOS, the NSA and government agencies must go through legal court orders to retrieve said data, and because companies are protective of their information and would want to mitigate potential customer lawsuit, they have a low chance of providing any more than the metadata that a company is willing to provide.

Of course, even with the FISA courts stating that US citizen privacy and the Constitution have been violated by the NSA many times, and the creator of the PATRIOT Act himself stating that the agencies have overstepped their legal obligations under said law. The NSA continues to request and retrieve the data under false pretense of what the PATRIOT Act allows. But, as there is no TOS stating that a US citizen may have their rights infringed at any period of time in the name of security, the law and NSA can be changed to remove the offending collection practices. Though there is always the risk that a new or incumbent politician or lawyer may infact decide to build upon the law and agency to increase what they are allowed to do, on which We the People are entitled and encouraged to remove said person of office and replace them with someone who’s ideology and stances are more in line with the people he or she represents.

It must also be noted that if you are not a US citizen, you may be out of luck. That is, without your own government stepping in to pressure the US Federal Government to reduce the mass data collection that occurs at an even greater rate from non-US citizens. But that is for another blog post.