Telemetry

Telemetry or Cyber Espionage?

Imagine for a minute that you are a developer who has created a device or program. Naturally, you would want to know which of its features users are utilizing, how often, and what problems and errors they encounter. Such information would allow you to improve your solution and thereby increase sales. There are several ways to obtain this information.

The first way is to conduct surveys, where you ask users questions, and they provide their answers. In this case, users provide data only if they want to, and only the information they are willing to share.

However, this method has obvious downsides: firstly, users are reluctant to share information; secondly, users often cannot accurately assess even the information about the features they are using; thirdly, many errors are not visible or understandable to users at all, and they can only be discovered through the functionality of the software.

Pros: no unauthorized collection of user data and the ability to determine user satisfaction, which telemetry can only ascertain through indirect data.

The second way is automated collection of telemetry data. It has undeniable advantages over surveys: all necessary information about the user is collected, including the version of their system, parameters and version of the program, location, resource usage such as CPU load, and much more. You can obtain an accurate list of all used options, usage time, technical data about all errors and application crashes.

This information is then transmitted to a server and processed automatically. Here arises the key question: where is the fine line between telemetry collection and cyber espionage, should the information be tied to a specific user or simply anonymized?

For example, if an application collects information about all your active sessions and sends it without linking it specifically to you - this is telemetry. If the data is in any way tied to you - this is cyber espionage. The application may know your email, but it is absolutely unnecessary for collecting data aimed at improving the application; however, it is necessary for targeted information collection about you.