Would this breach T&C

Question

Hello, not sure if this is the right place to post this.

I am working on a university project part of which involves testing the accuracy of IP geolocation databases. For this I am looking to collect grounded data. So Ips and lat/long.

I have created a simple web site to collect the data. If I was to share the link in my personal blog on e14, would it break any t&c so long as I explained what will be collected?

colporteur · Answer

I don't hold any position at Element14 other than being an active member. As a former IT Security Specialist, I caution you on gathering data without a proper security risk assessment. The rules governing privacy are varied across countries. The individuals on this site will give your a very broad geographic representation. Depending on what you are collecting you can find yourself in hot water pretty easily. I include a recent news story from Canada. https://www.cbc.ca/news/business/privacy-commissioner-loblaws-id-request-25-gift-card-1.5323043 I personally would be reluctant to participate but then again, I'm paranoid. Sean

colporteur · Answer

Please correct me if I am wrong in my understanding.

The project is going to pull the geolocation information that is contained in the browser, along with the IP address assigned to the host. I'm going to speculate this is the same geolocation information retail companies use to identify the nearest store to your location when you purchase products online. Canadian Tire and Home Depot are two companies for Canada that come to mind.

Is the geolocation information a subset of a larger data set or does it stand on its own? I'm not familiar with the browser protocols or architecture so forgive me if my questions are inane. My question is are you collecting a larger data set but extracting only what you need. If this is the case then the privacy concern covers the whole data set, not just the part you are using.

What happens to the data? You indicated it will be made public. Can you describe what the data will be used for and who would have access to the data?

Feel free to tell me to **** off and I won't be offended. You leave the job but the job never seems to leave you. I'm conditioned to think like the black hats. Your data set geolocation/IP address by itself is not an issue. It does provide a data collection , when combined with other publicly available data sets that can be used for nefarious purposes.

I have a bias when it comes to data collection. Being a victim of identity theft some 20 years ago still occasionally comes back to remind me, the value of data. I pass up many "free" offerings simple because I am unwilling to give you data in return for the free stuff.

Sean

djfraz · Answer

Only the IP and the location is collected. No other data is stored or collected other than what is normally send along with any web request. With regards to the availability of the data, I will most likely post it here and with the possibility of using hit hub along with the source code of the app. I am unsure how the browser determines the location. However it is available using commonly available code, which is vanalia JavaScript. The latitude and longitude are extracted from this function and placed into two hidden inputs (form inputs which are not displayed on the webpage) which are POSTed to the server. The IP is collected from the request header to the server. Search "w3schools geolocation" and it will show you the same code I used for determining the location. I would suspect that this is similar to how Google shows you results relative to your location. The browser will also give you a pop up to allow the page access to your location which you have to accept before the app will allow you to submit. They probably have a much more sufisticated method though. I can't blame you for being suspicious. even some of my close friends where dubious when I had then testing the prototype for the app. Hence why I wanted to get some feedback from the fourm. Ultimately, I want this to be as transparent as to why you are submitting.