957816 - Privacy-Technical Review: UP Engagement Test

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Ed Lee :Mardak]

Initial Questions:

Project/Feature Name: UP Engagement Test
Tracking  ID:
Description:
We're extending the existing UP study that was deployed to Test Pilot users to now modify the recommendation box on nytimes.com by indirectly calling NYTimes' API through a Mozilla "headliner" server. We replace the existing recommendations with other articles from nytimes and measure view counts and click rates.
Additional Information:

Key Initiative: Services: UP
Release Date: 2014-01-15
Project Status: ready
Mozilla Data: Yes
Mozilla Related: 
Separate Party: No

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

What's the status here? Is this far enough along that we can look at the technical parts of this?

Comment 2

[Ed Lee :Mardak]

The code has already been looked through by Mark Goodwin in bug 947367 for security with comment: "This is low risk; no user data, limited impact on other systems. I've had a look at the code and have no concerns." Is that enough to clear the Privacy-Technical review too?

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

If this really is not collecting any data on users then we're done.

Comment 4

[Ed Lee :Mardak]

The closest thing to collecting data is that there's a cache of articles by interest, but there's no cache by user (not even interests from the user as those get cached independently of a user request), correct?

Comment 5

[Olivier Yiptong [:oyiptong]]

There is no user data being collected for the content portion.
The request for content is stateless. The server does not store any personal information from the user.

Comment 6

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

OK, now I am thoroughly confused, so we're not storing any information server side, but are we storing preference, local, or other user data on the client side? Data we did not gather before? Or what is the decision making process for giving a user content they are interested in?

Comment 7

[Ed Lee :Mardak]

(In reply to Curtis Koenig [:curtisk] from comment #6)
> OK, now I am thoroughly confused, so we're not storing any information
> server side, but are we storing preference, local, or other user data on the
> client side? Data we did not gather before?
The data is pretty much the same as the first study that we've released where it calculated interests based on history. In this study 2, the add-on uses those interests to personalize content.

Also, is this privacy review for just the headliner server code? As that's what I was referring to in comment 2.

If it's also looking at the client code, the add-on is additionally deriving data from existing browser data (similar to how we processed history to generate interests). In particular, the add-on analyzes the history urls of nytimes to extract various query parameters, e.g., ?src=, &ref=; and the non-title portion of the path to get the section, e.g., technology, business.

Comment 8

[Ed Lee :Mardak]

curtisk, is there any other information you need for the privacy-technical review?

Here's the relevant changes from v2 to v3 (engagement study):

https://github.com/Mardak/profile/compare/fps-v2+...fps-v3

In particular these lines add a bool if we have user selected interests, a list of cleansed nytimes visit data, a cleansed nytimes subscriber/not user data:
https://github.com/Mardak/profile/compare/fps-v2+...fps-v3#diff-96b8a9e0a9317af4ccbaf692621001deR103

There's this line that records a bool if personalization is happening:
https://github.com/Mardak/profile/compare/fps-v2+...fps-v3#diff-4ae0a5fbcf2351097caa8e6c7d392df4R74

Comment 9

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I think we're good here, I don't see where we are gathing any specific data that can be tied back to a user. This is using history links to compare what a user has read in order to make a prediction about other articles the user might be interested in as well. It also appears that most of the work is happening client side (not server side) so the user should also have control of that data source.

If I am misinterpreting this please correct me.

Comment 10

[Ed Lee :Mardak]

Yup, sounds good. The analysis for personalization is done on the client side while the server is a relatively user-dumb endpoint that knows how to fetch articles from nytimes.