Electronic Telemetry: The Sheep in Wolf's Clothing

Two workhorses dominate the electronic world: advertising and analytics. Both go hand-in-hand, as advertising companies heavily use analytics to target products at a perceived demographic. And because of this, analytics and user-tracking have gotten a bad rep over the past few years. Turn off statistics. Install a tracking-script blocker. While there is some truth to this advice, there is a blurred separation between "good" and "bad" tracking, and some analytics, especially anonymous telemetry, can be extremely useful. Sometimes even mission-critical.

Application developers use usage statistics to observe use patterns, detect unexpected errors, collect crash reports, construct runtime metrics, determine content quality, and much more. These statistics are fed back to determine what bugs developers need to fix and what new features are most wanted. Have you ever reported an error message? Or requested a new feature? Or complained about a glitch? Most people actually do...but not to the developer that made the application. Users usually complain to other users in online communities. And it is left to the developers to find these communities and track the feedback accurately. This is a daunting task that does not scale as the user-base grows in size and diversity. As an alternative to manual data collection, automatic telemetry is an attractive feature for an application. When done correctly, it can provide developers with valuable information about their product without breaching users' privacy, when done correctly, that is.

By Ofol (Own work) [CC BY-SA 4.0], via Wikimedia Commons

One of the reasons users have been backlashing telemetry is companies collecting more data than users think they need, or even lying about the data they collect and how to disable such collection. Microsoft set a great example. They added one or two placebo settings for turning off telemetry, and afterward went through great efforts to implement mandatory telemetry that bypasses common power-user blocking techniques. Users like the illusion of choice with privacy, but not so much when that illusion is shattered. And there is always somebody willing to monitor all the network traffic coming from their computer to see exactly what information it is sending back to the mothership.

Lying is not the only way to deceive your users, though. Moving from one big corporation to the next, Facebook is very straightforward about its Messenger app, and what data it collects and why. But telling the truth is not enough. The Messenger app collects so much usage data that a digital forensics expert claimed, "I've worked for companies writing corporate spyware for iOS that didn't know you could get some of this information." It might be nice if every burglar in the nation made sure to list what things they stole and why they stole them, but the homeowners would still be quite a bit angry, and probably want their stuff back.

Bad examples aside, there is an acceptable way to collect telemetry data from your users. Collect a reasonable amount of data, allow for turning data collection off, and be transparent about what data you collect and why. It also helps to show users the steps you are taking to protect their privacy. Users understand—well, they think they understand—the job of the people developing the applications they use. And most users are willing to make a small privacy sacrifice, if it can even be called a sacrifice, to help improve the software they use daily.

Electronic Telemetry: The Sheep in Wolf's Clothing by Tyler Romeo is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

New Technologies and Information Security

The life insurance industry is considering a system of basing insurance rates off of data collected by the iPhone. With new technologies, information like heart rate, time spent asleep, and blood pressure can be monitored right through your smartphone. The auto insurance industry is doing something similar. Using the same technologies, insurance companies can already measure speed, location, and miles driven in your car in real time. While this new technology is exciting, it also brings up a whole new wave of questions about information privacy and the risks associated with disclosing this kind of information.

Life insurance companies already use information like age, occupation, and whether or not you’re a smoker to make decisions on insurance costs, so it comes as no surprise that this potential new stream of information would be extremely valuable. However, just like all valuable information, if it ends up in the wrong hands it can be detrimental. With recent hacks of large companies like Home Depot and Target leading to massive financial information loss, it’s extremely hard for me to believe that insurance companies are immune from hackers.

It’s one thing to lose your credit card information and have to get a card reissued, but a completely different story to lose information like your most frequented location, roads most traveled, and sleep schedule. Imagine a robber getting ahold of your exact daily schedule and location at all times of the day, or a foreign government getting access to this information about an important person. It would be simple to go to someone’s house and rob it or for a foreign government to plan an assassination. Not to mention the NSA’s greediness for information that would most likely lead to them taking this information for whatever purpose they felt necessary regardless of the legality.

What this all really boils down to is the question of where do we draw the line on collecting information and are we ready for this kind of innovation. With recent occurrences like the fappening, financial hacks, as well as the recently discovered bash exploit mentioned in Allan Zimmer’s blog post, I believe the answer to both those question are no. It is true that we are in a new era of computing and information collection, but the key word is ‘new’. Technology is evolving at such a rapid rate that we need to give it a chance to settle down before pushing forward with so much innovation. Encryption and the internet are too young to handle this information with the sensitivity required for it to be commonly collected and stored.

Furthermore, I believe the answer to this problem is some kind of information security standard. Our current method for information transfer has been working great, but the problem comes from the systems that keep this information not storing it well enough. Perhaps once the new wave of Computer Science and Cyber Security majors enter the workforce we’ll have enough brainpower to conquer this immense challenge. Until then, we should keep basing  our insurance rates on the information we have.

Sources:

How iPhone apps could impact your insurance, By: James O'Toole