Hacker News Reader

Comment by Meph504 | Hacker News Reader

I'm confused how they keep saying this is in compliance with Grpd when auto opt in is not allowed.

And the idea that they force everyone in, and will add an opt out button later seems like they are gaming the system.

If they don't opt everyone out they didn't ask to opt in as a default, their actions to me seem hollow.

Most likely because as an American company they have no clue what the GDPR really does. Many European companies are still struggling to be fully compliant.

Furthermore, if they transmit crash logs, and those contain partial memory contents (core dumps), chances are actual content from network packets are transmitted to UBNT as well, and those contents may contain PII (IP addresses, MAC addresses, usernames, passwords, real names, addresses, credit card information, etc.), meaning they’re most certainly violating the GDPR by making it opt out.

With a significant fraction of Internet traffic (and all eCommerce traffic) end-to-end encrypted, is it really realistic that they would have sensitive data (usernames, passwords, real names, addresses, credit card information, etc.) in memory of an AP? This is the point of Let's Encrypt, after all, to close the exposure that we give to our ISPs and our ISPs ISPs.

AFAIK ubiquity also does routers, those can hold quite some sensitive data in memory.

Don't think sensitive data, think personal data. An IP is personal data.

Macs tend to use your name as their network name from what I've seen, and corporate logins usually are some variation of your first and last names. The APs absolutely know those.

But APs are not limited to internet traffic.

Maybe some company somewhere runs an internal server, and because it's internal they might think that encryption is not needed. Hell, it might even use GET arguments for username/passwords in the URL.

The crash dumps would contain these data as well.

I wouldn't assume "crash logs" means "core dumps". I'd assume they mean stack traces, and perhaps register contents.

And they never hold IP addresses in registers?

Oh come on. It's extremely unlikely, and there'd be no reliable, automated way to extract them anyway.

You can absolutely automate retrieving information from a core file. I'm not saying that UI is going to purposefully extract sensitive information, but of course they'll setup automated processing of the core dumps in order to categorize the types of crashes into buckets so that engineers can examine them more closely.

Next time you come across a core file, use strings on it - you'll be surprised what it will find!

We were talking about registers+stack trace, not a core dump.

Anonymous data is not subject to the the GDPR. See recital 26. [0]

IANAL, but as far as I know, companies can collect anonymous data ("what versions are our customers running?") without involving the GDPR.

> This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

[0] https://gdpr-info.eu/recitals/no-26/

the thing is, it's pretty difficult to guarantee the data is indeed anonymous. In this specific case, as they are not willing to explain what data is actually processed and say it's somewhere in the Tos, privacy policy[1] etc... we'll take that as the gospel.

----------------

The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser.[1]

----------------

This data is certainly not anonymous by GDPR standards. Identifiers that uniquely identify a device will in some cases(ex, single-user devices) also be unique identifiers to a single person. That is enough for the data to be considered Personal Data in the context of GDPR.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person[2]

[1] - https://www.ui.com/legal/privacypolicy/

[2] - https://gdpr-info.eu/art-4-gdpr/

I bet they will not actually be GDPR compliant. They will likely get away with it because enforcement is lacking, but anonymization is hard to get right and I would be surprised if they did get it right.

Is there a way to file GDPR complaints? Enforcement might be lacking but with enough data and support surely it would be possible or be sufficient to make Ubiquiti move to opt in.

contact your local DPA[1] and file a complaint. There's plenty of info on the original thread[2] on what they're doing wrong.

[1] - https://ec.europa.eu/info/law/law-topic/data-protection/refo...

[2] - https://community.ui.com/questions/UI-official-urgent-please...

There is no such thing as completely anonymous data. If the data is of interest is has some uniquely identifying feature. Even anonymized data always contain some bits of information that can be correlated to de-anonymize a user.

Opt in is only one way to justify data collection and be in compliance with GDPR.

They may be basing their collection on ‘legitimate interest’ for instance.

I don’t think anyone is in a position to predict these things but I’d bet they have a pretty good justification there for IP collection given the product they provide.

given that there are very little references to GDPR in their ToS and privacy policy I'd say they haven't even thought of it properly.

Also in the original thread someone quoted this cool tidbit from their ToS .[1]

> Special Note to International Users. If You are accessing the Services from the European Union, Asia or any other region with laws or regulations governing personal data collection and disclosure that differ from United States laws, please be advised that Your continued use of the Services will be governed by United States law

this makes it seem even more likely.

[1] - https://www.ui.com/legal/termsofservice/

I hope Ubiquiti (or one of their lawyers) reads your comment.

Reply on news.ycombinator.com