Fedora considers "privacy-preserving" telemetry [LWN.net]

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 5:04 UTC (Fri) by wjt (subscriber, #56250)
In reply to: Fedora considers "privacy-preserving" telemetry by geofft
Parent article: Fedora considers "privacy-preserving" telemetry

I'm happy you appreciated that blog post. FWIW I used the term “telemetry”, despite us using the term “metrics” throughout the codebase & in conversation about the stack, almost because it has those connotations and I wanted to address that head-on, rather than using other terms and potentially being accused of hiding behind euphemism.

to post comments

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 5:31 UTC (Fri) by oldtomas (guest, #72579) [Link] (13 responses)

FWIW I prefer calling a spade a spade. Everything else would come across as manipulative.

To the other examples you pose: they are all opt-in. The proposed telemetry is opt-out. To me, this is always a strong smell.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:18 UTC (Fri) by taladar (subscriber, #68407) [Link] (12 responses)

Opt-out is also more likely to be a problem legally depending on the information included.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:26 UTC (Fri) by eduperez (guest, #11232) [Link]

> Opt-out is also more likely to be a problem legally depending on the information included.

And that is a good thing, because it will force Fedora to ensure that the information included really preserves the privacy of their users.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 7:27 UTC (Fri) by tchernobog (subscriber, #73595) [Link] (10 responses)

Correct. In Europe, this also has quite a bit of repercussions on the way you implement GDPR requirements. Which requires opt-in and not opt-out as soon as data can be used even just for correlation purposes.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 15:13 UTC (Fri) by geofft (subscriber, #59789) [Link]

They address this in the proposal and say that this requires them to do things in a way that is compliant with European law, i.e., any proposals that would be in violation of European law are already off the table. This actually seems like a good constraint - if their devs insist (for good reasons that they set forth in the proposal) on opt-out metrics, their lawyers are going to insist that the data cannot be used for correlation. They can't be tempted to start collecting too much data and defend it with "it's fine because users are consenting."

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 16:59 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (8 responses)

That is not what GDPR says. GDPR says that you must have a "lawful basis" for collecting information. Consent is one such basis, and if you're using consent as your lawful basis, then opt-in is required, but there are other lawful bases as well, and for those, you don't even need to provide an opt-out. However, they all impose some kind of restriction on what data you collect and/or what you use it for. There is no "get out of jail free" card in the law.

Fedora considers "privacy-preserving" telemetry

Posted Jul 7, 2023 22:27 UTC (Fri) by fraetor (subscriber, #161147) [Link]

Specifically the relevant bit if GDPR is that the lawful basis can come via several things. Consent is one, but the most relevent would be legitimate interest.

“*The legitimate interests of a controller (..) may provide a legal basis for processing, (..) taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.*”

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 13:00 UTC (Sat) by eduperez (guest, #11232) [Link] (4 responses)

GDPR only caes about personal / sensitive information. As long as the information is (really) "privacy-preserving", it does not apply.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:42 UTC (Sat) by NYKevin (subscriber, #129325) [Link] (3 responses)

This is much broader than you think it is. According to GDPR Article 4(1):

> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

In other words: If it is *possible* to figure out which human a given piece of data relates to, then the data is "personal" data. So if I know that somebody has a mouse with three buttons, that's not personal data. But if I know that user #12345 has a mouse with three buttons, that is personal data (assuming that it is possible to look up user #12345 in some database somewhere).

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:53 UTC (Sat) by wjt (subscriber, #56250) [Link] (2 responses)

In the metrics system that is being proposed here, metrics are associated not with a user ID, but only with an identifier for the originally-installed OS image, which is the same across a large number of devices. (This OS image ID is an Endless OS-specific concept; I don't know if an equivalent channel ID would be used on Fedora but running the current implementation on Fedora would associate all events with the image ID "unknown".)

So, in your example, there would be no database in which to look up user #12345, and no "user #12345" identifier on the three-button-mouse data point.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 23:56 UTC (Sat) by NYKevin (subscriber, #129325) [Link] (1 responses)

That is probably fine, but you still have to be careful. It is very easy to accidentally store personal data without intending to do so.

As an example, let's say that you have some firewall that logs incoming requests for a short time, and captures the source IP address as well as the exact time of the user's submission. Your database stores a timestamp and whatever telemetry metrics are captured. The IP address is an "online identifier," and you can time-correlate the database with the firewall log, so the whole thing is "personal data." The fact that you separate the telemetry metrics from the IP address, and store them in independent systems, is called "pseudonymization":

> ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

Pseudonymous data is still considered personal data, at least until you delete the firewall log, or until you delete enough data that it is no longer possible to associate your telemetry metrics with an IP address (e.g. delete the timestamps from either the database or the firewall log). Pseudonymization is recommended as one possible practice to improve compliance with article 6, but it does not relieve you of any other obligations under GDPR, including the lawful basis requirement.

Fedora considers "privacy-preserving" telemetry

Posted Jul 9, 2023 9:21 UTC (Sun) by wjt (subscriber, #56250) [Link]

Each event is stored with a timestamp of when it occured, but not when it was submitted. They are buffered on the client and submitted in batches, and split apart before storing. So the events can't be correlated back to the load balancer logs to link them to an IP address. (I'm not sure what the load balancer logs – thanks for the idea to go and check this!)

It's actually quite annoying to not have the submission time together with each event because it makes it very hard to figure out the event submission latency. (After how many days in July can we expect the data on the server for June to be "mostly complete"?) It would be useful to store a truncated received-at timestamp on the events, but only if it is sufficiently vague to not allow associating events with one another, or with the logs of the upload.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:11 UTC (Sat) by iainn (guest, #64312) [Link] (1 responses)

Article 21 “Right to object” is a reason to provide opt opt, even when consent isn't the lawful basis.

Fedora considers "privacy-preserving" telemetry

Posted Jul 8, 2023 20:37 UTC (Sat) by NYKevin (subscriber, #129325) [Link]

That only applies to some situations. If, for example, Amazon.com asks you for your physical mailing address in order to ship a package to you, the law explicitly does not give you the right to object to that (because it would be absurd - how else are they supposed to get the package to you?).