974031 - Privacy-Technical Review: Firefox Telemetry Experiments (rev 1)

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Benjamin Smedberg]

Initial Questions:

Project/Feature Name: Firefox Telemetry Experiments (rev 1)
Tracking  ID:973990
Description:
This is the first form of variation testing that we're going to deploy to our Firefox audience by default that doesn't require explicit opt-in.
Additional Information:
PRD: https://docs.google.com/document/d/1GPpkIcWFNkZmXONjqBCc05U3uocOD-1jpZHdAsR0v1k/edit?usp=sharing
Key Initiative: Firefox Desktop
Release Date: 2014-03-17
Project Status: development
Mozilla Data: Yes
Mozilla Related: Firefox desktop, Firefox Health Report, Telemetry
Separate Party: No

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

wiki set for input of data
https://wiki.mozilla.org/Privacy/Reviews/Firefox_Telemetry_Experiments_%28rev_1%29

Comment 2

[Benjamin Smedberg]

Curtis, I don't understand what comment 1 means.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

So the process[1] for technical privacy reviews (TPR) is done to a large degree on the privacy wiki so we can garner public comments from the gathered data. The first major step is for the development team to provide information on the data flows. Where information comes from, what it is, where it is at rest, who has access to it during this and where it ultimately ends up. A good example of what this looks like is shown in the review done for F1[2]. This means filling out the architecture and components sections of the wiki. Once that is done I'll fill in the user data risk minimization and alignment with privacy principles sections and file any bugs that might be necessary. With those in hand the wiki link is sent to dev-planning & dev-privacy for a 7 day comment period to ensure that we've not missed anything and that it's been scoped appropriately. If no further issues arise after public comment then the review is closed and we all move on.




[1] https://wiki.mozilla.org/Security/Process/Technical_Privacy_Review
[2] https://wiki.mozilla.org/Privacy/Reviews/F1A

Comment 4

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

covered during the security review, determined no further review was needed beyond that meeting https://wiki.mozilla.org/Security/Reviews/Telemetry_Experiments_r1