After reading his analysis, I'm not sure how much I can trust Wacom's behavior when it comes to data collection. My concerns don't then jump to sharp edges and electrical shocks. I think about data retention. How well do they protect that data? I think about what Wacom might do with that detail of personal behavioral information if approached by a data broker with cash in hand and ready to make a purchase.
So why are you plugging their device into your USB port, logging in to your computer, and letting it operate your computer for you?
Still, since you invited, I'll talk more about my own concerns. Do I trust Wacom as a company, as a whole? I think it depends on how they respond to this, right? Do I still trust them to make a tablet that doesn't have the problems you raised with "electric shock hazards, sharp edges"? Yes. At this moment, do I trust Wacom in the area of data collection? No, that seems to me like a questionable decision. I want to know more. I don't think I want an accessory manufacturer to compile a dossier of what programs I use at what time and from what (partially masked) IP address. More so when they're not being up-front about it (certainly from a layperson's perspective). I'm also not very confident right now that the behavioral data will stay within Wacom's walls and go no further.
In fact, I'm forwarding this to my CISO's office for further evaluation. Is that bad in some way?
So they are being up front about it, right? I mean, maybe not in layperson-friendly language, but in compliance with regulations and under the guidance, presumably of their legal team.
In the box alongside the tablet, there was also probably a little booklet full of safety notices, warranty indemnifications, compliance statements, and arbitration assertions about the fitness for purpose of the hardware itself - also not written in layperson-friendly language. But the reaction on seeing that was... well, probably to toss it aside and go ahead and plug in the device, not to immediately assume that because the company presented a bunch of dense legalese, they might be trying to get away with something.
You said yourself: you don't trust Wacom not to sell the data to a data broker when presented with enough cash. But all sorts of Wacom business processes had to comply with regulations, be carried out diligently and ethically, and be generally trustworthy for Wacom to have produced an electronic device that you can safely plug into your computer. So I'm just trying to get you to consider:
What is it about their data processing that leads you to all of a sudden question their corporate ethics, diligence, compliance and trustworthiness?
Actually, I'm interested in exploring more of your own view here. You seemed to take exception that he limited his findings to his apparent area of expertise and interest (software engineering, security/privacy). Is that still the case, or have your views evolved on this issue?
> What is it about their data processing that leads you to all of a sudden question their corporate ethics, diligence, compliance and trustworthiness?
Your questions for me are really best answered by the author:
1. Apparently, it defied a reasonable expectation that the purchase of such a minor peripheral of this type would lead to the manufacturer's attempt to obtain a regular stream of what applications he launched on his PC (and at what time, and from what partially masked IP address). He was a smart cookie. His tip-off was that it somehow needed a privacy policy. And he had the smarts to launch his own technical investigation.
2. When he finally saw what they were pulling from his PC, once again, he was shocked, because that seemed to conflict with his own understanding of what Wacom said they were doing. He hadn't just casually scrolled through the privacy notice. It looks like he read it quite carefully.
I suspect this might be what he took issue with:
> Information Automatically Collected – Google Analytics When You use the Tablet Driver, certain information as described below may be automatically collected for purposes such as improvement of the Tablet Driver, troubleshooting bugs, providing the functions of the Tablet Driver, managing the services and improving overall performance of the Tablet Driver. Such information includes aggregate usage data, technical session information and information about Your hardware device.
No, I'm not interested in pulling in more sections of text and going back-and-forth in a game of Internet Lawyer. Someone else here might be a more willing partner.
> So they are being up front about it, right?
That's the issue. Was Wacom clear and transparent? Or did Wacom manage to generate a body of text which obfuscates what they are actually doing while still maintaining legal compliance? Or did they overreach? As it turns out, the FTC has a special page to submit complaints regarding privacy policies. I imagine that corporate privacy policies are turning into a hot topic for the FTC right now. I guess there's enough interest here, so I'll go ahead and submit this issue to the FTC (Federal Trade Commission) and see if they want to help Wacom figure out the answer to your question.
Beyond that, you have some interesting questions about trust. Not my area of expertise, but I'll take a crack at it. Your boss might say that you're someone he trusts. He might give you authority over an application which processes millions or billions in yearly revenue. But he wouldn't trust you to take care of his kids for a week. Trust is not binary (yes/no), and it is not universal (trust in area X must equal overall trust or trust in area Y). That's as much as I've got. If you've got followup questions about trust, they might be better directed towards an online resource which focuses on that issue.
Hope this helps.
Like the whole 'internet-connected-cars' panic that occasionally grips developers. You know what's more dangerous than putting a car on the internet? putting a car on the road. There are other drivers out there who could kill you. Thousands of people actually die in accidents. And you want to worry about the infotainment system containing a remote execution vulnerability?
Also, wouldn't your argument equally imply that mechanical engineers should drop their parochial belief that hardware issues are terrible while ignoring software problems? (Presuming they do that, which seems not unlikely)
And you’re worried about their data handling policy?
A short and very incomplete list of the things a purchaser of a Wacom tablet is trusting to be true:
- That the tablet is safe to use - it will not fail in a way that exposes the user to electric shock hazards, sharp edges, dangerous chemicals, etc. - that the EM emissions used to communicate between the pen and tablet don’t interfere with other systems in ways that could compromise safety - that the device complies with usb standards and won’t damage electronics you interface it to - that there are no hidden surveillance devices in the tablet or pen - that, as an input device with access to your usb bus it doesn’t have the ability to be remotely induced to control your computer
Then you’re installing a piece of driver software, giving it sufficient permissions that it can read what application is currently running, and you are worried about it exfiltrating that information, rather than - say - the fact that as an input driver, again, it has complete control over your computer; it can record input - what if you use your Wacom to sign a pdf? Now it knows your signature. Or you tap out your banking password using an on screen keyboard. Who knows what else it can do - acting at the user input level presumably it can do anything you the user can do.
So sure, be concerned about what happens to the data it sends to Wacom, but if you don’t trust Wacom, your problems started much sooner than when you accepted the data sharing agreement.