So, our next speakers are Jerome Gawa, and I'm on the Injambar.
And it is about auditing web trackers.
So I hand over the microphone.
Welcome.
Thank you very much.
Thank you.
Thank you very much for adding us.
So I'm a model in Jomer.
I'm working at the EDPB secretariat at Technology Experts.
And we are giving this talk with Jerome, who is researcher in privacy at French University
that's called Unila Sen.
And so just for this, we don't know the EDPB is a European data protection board.
The idea is a European board who includes all the data protection, all national data protection
authority in Europe, plus the tree from the FTA country, which are nation-time, Norway, and Iceland.
And also the EDPBs.
So we are often confused with EDPBs.
So EDPBs is the supervisory authority for the EU institution, while the EDPB is the board
who helps all the data protection authority to agree on themselves to discuss, to move forward.
In practice, so I am working in the secretariat, so to help to not help to the confusion,
the secretariat is technically provided by the EDPBs.
But it just means that on my page clip it's written EDPBs.
But in practice, my boss is the chair of the EDPB, who he has for now the chair of the
Finnish SA, and Italian.
And so in practice at the EDPB, we have a lot of different tools to make all the data protection
authority thrive, and one of them is the support pool of experts.
The idea of this program is we have the call for expression of interest for experts in
legal, technical fields, and they can say, okay, we are interested to have a contract
with you.
Actually, we have a lot of people on the field.
Yes, we have 30% technical and 75% legal, but it just means that we are also people who are
both technical and legal.
And we have all those people who can pick for our project.
Since July 2022, we had 22 projects out of which 18 have been completed, and we try to
make them public, so we are publishing once they are ready, as the same says.
And most of these projects are report.
For example, we have the one stop shop, the idea is we will have one tematic, and we
will pick our layer or legal professor, and we will look at all the decisions that have
been taken on this subject by all authority, and we will do a report.
We also have technical reports, like the standardized messenger audit, where the professor
looked at what kind of requirement we call half to do an audit on the messenger half.
So we have all those reports, and we have the exception.
And the exception is the EDPB website of the team tool, which is a software, who has been
developed by agerum.
And so what was the idea of the what?
So internet is full of cookies everywhere.
We have cookies, for example, when you are authenticating your user, you want to be sure
that it's a same person in one page, and the next one, you need a cookie, but you also
have tracker cookies, so you have a lot of different kind of cookies.
And the thing is, whenever you are using a cookie to talk about one individual, then you
have, you have data, personal data, and so the GDPR apply to privacy apply.
You also have a certain piece of legislation that applies, that is the E-Privacy Directive,
and in fact, not all data protection is written, but some of them are also responsible
of the application of the E-Privacy.
In any case, at least for the first case, authority will need when they will audit a website
to check out whether the cookies are, you know, ligates or not well done or not.
And so what do they have to look at?
The third thing is, they have to understand what is this cookie, what is it used for, okay?
So that's what we call the purpose.
And it's very important because it has a legal impact.
If you have a technical cookie, and it's just here, so your website's function, then you
don't have to ask consent for it.
But if you are, for example, using a cookie for advertising purpose, then you need to ask,
you know, your user to consent to get this cookie.
And then we are talking about consensus.
So if we are talking about consensus, and the first thing is, I have a cookie there, okay?
I come to ask you to eat them before asking you if you want them, agree?
So the first thing is you have to check whether the cookie arrives on the website before or
after the consent, the first thing you have to check.
Second is, the user should be able to choose which kind of cookie they agree to eat.
If I have nice milk cookie like this one, maybe you will agree, maybe if I have mint,
chocolate one, you will, you know, disagree, I don't know.
The last one is, you know, any good consensus should be something that you can change, okay?
I can tell you, yes, I want to cookie now, and I test it, and I don't like it.
And I should be allowed to put it in the bin, okay?
It's the same with your cookie on your browser.
So you should be able to raise your content and it should not be hard, okay?
And so all of that are included in any audits that you are doing as, you know,
the top protection authority whenever you are looking at the website.
The same years, we wanted to do that in a tool, and our dream tool would be easy to use,
because in our 30 most officer are legal officer, okay?
The technical officer are very rare resource.
So we want the legal officer to be able to do most or even all of the assessment.
So we want some things that is easy to use, where they can interact with the websites,
because you have things that you don't like, dipping a new circumstances,
you may need to click on the website on buttons or this kind of things.
And then we want to simplify our lives, because we need to do the best with our resources
to be in the same software to do the audits, generate the reports, send the report,
do the evaluation, generate the report and so on.
And we want to reuse knowledge, because it's both for efficiency, but also for legal certainty.
I mean, if we have the technical decision at the time, we want to be sure that our colleague
or in the future will take the decision and for the act, we need to be able to reuse
knowledge to reuse it and also to work with the colleague.
And the last one, when we did it, the brainstorming about that, is that we need to create
an open software.
So at the EDPB level, we wanted to do software for transparency reason, but inside some
of the data protection authority, it was also requiring, for many two reasons, the first
one was, so they want public free and open software to be, to be precise, because they
want whenever they do an audits, for the auditi to be able to reduce the audits and check
what they are found and say, okay, you know.
And so as we said, we don't want just a browser, but we want to be able to do the evaluation
and the report and so on, we want to be able to prove that the entire software don't
mess up with the browser.
So that's what we say we have is that effectively what is it.
And so we look at what was existing and we had a few things that was, we say, could qualify
us very naughty and all things that are, you know, like not answering our beans, maybe
because they were using machine learning and so had false positive, what is counting
that you cannot have in the audits that we have legal consequences behind.
So you want to be sure that what your insight is true.
So we decided to develop the website of this thing too.
So with the CPSP program, using the romp, nicely as to subscribe to our call, as free and
open source software under the EU here and based on different other false projects.
And we just take one minute, says it's, we are, in particular, used as the EDPS quick.
So you see EDPS, this time, it's a complementary tool, the idea of the work is really
to have bulk code it.
So it's also website as a cookie auditing tool, but the thing is, they are the off script
and you can't bulk audit, but you cannot do a long website.
And so in a way, the work is more or less, you know, we could say that what is far, far
away from our work, the version was zero, it was very, very close of it.
So we are very thankful for the colleagues in the way that are working on this one.
Now I will give the floor to the romp who we will talk about website testing too on how
it works.
Thank you very much.
So let's talk about the technical side of this project.
So there is many requirements in it, so this slide will talk to developers in this room.
So one of the requirements was to have a browser that act the same way as the majority
of browser.
So we decide to use electron, because it has a chromium inside and chromium is now used
in the majority of browser in the market.
And the interesting thing we have electron is that you have a Node.js that is able to analyze
everything that is happening inside the browser and also going out and in from the browser.
So we do our analysis and then we display this analysis into a nice, angular interface.
So if you want to have a look to what the tool looks like, you can go on this URL and
you will have just a subset on the interface, a subset that doesn't include the browser itself.
So to summarize the tool is open source, it's only based on why the use frameworks.
It's cross-platform, you can use it on Linux, Windows, MacOS, and it's all written in TypeScript.
So here is what the tool looks like, so I designed the tool, I developed it and when I
started the project, what I want it to do is to take the user by the hand, because this
tool targets legal and technical editor, but it can also be used by data controllers,
data processors to inspect the own website, I mean it can be used by anybody, by everybody.
So that's it.
So when you start, you have like an extensive documentation about how the tool works just
to not be lost inside the tools and on the left, you have all the functionality which
are categorized into FreeSection.
So what the tool is mainly doing is producing analysis, so it will store analysis inside
the tool.
The first section is to manage your analysis, and we will get in-depth into it.
When you are doing analysis analysis, then you will see like session inside the running
sessions, the section categories, and then you have editors that will help you to create
your own knowledge base and to edit some to play to generate pretty print reports, and the
other sections for setting and documentation.
So if you click on browse, then you will get a number browser, I mean you will have all
the tool all the button from Chrome, but what is the specificity of this tool is that
it's provided as a stratum, many analysis, like this.
So the idea is to have something very modern, so you can add, easily, you can add, easily,
some analysis, so for instance, click on the first banner of the first stratum, which is
about cookies, so maybe you will be disappointed because I didn't with it like bad guys
and only goes on the European Data Production Board website, I click on Consent and
on the right, you will see that there is free cookies which are used by this website, when
you click on Consent, you have one technical cookie and two which are used for analytics
developers, and on each of this line you will get more in-depth information when you click
on it.
So there is the function, the goal of this panel is to dive a little bit on each of
this information.
So on the first one, there is several tab, you see, and the first one you get some details
about, for instance, the cookies, the name, the values, the values one, so this one is not
used for tracking, when you click on log, then you will get more information, more in-depth
information to do your investigation, because something which is hard when you are trying
to classify the purpose of a cookie is to really know who is entering this and for what,
so if you have an instance, so JavaScript cookie, then you will get the full costak of
every script, so everyone will get involved in the writing process inside the browser,
and if it's a JavaScript, it's a quick request cookie, sorry, I made by a set cookie,
and you will see the first request, we stored this cookie.
And the last tab is maybe the most important one, it's the dynamic matching functionality
for cookies.
So the idea is that the tool, when you get a cookie, we are always trying to find matching
characteristics in the database to see which purpose this cookie is usually stored.
You see, so you have several ways to do the matching.
If you have an exact match, it means that the domain who usually stored this cookie with
this name as this specific purpose, I mean regarding the knowledge place.
If you have a match domain, it's usually this domain is stored in cookie for this purpose,
so this purpose could be the objective of this cookie, and then the final one that you
come to see, it's the match name, because usually you have a lot of first-party cookie,
for instance, for analytics cookie, and so it will try to identify the name of the cookie,
regarding some SDK, you know.
So that's it, so all the analysis are, when you click on browse, it's just to have a preview
of a website, then if you want to store your analysis on the tool, then you have to create
a new analysis, that's why you have the this button, and all these analysis will be attached
to see now, you know that you have to interact with the website itself to see is
it be ever, when you consent to it, when you reject cookie, where you're just visiting it
without interacting with the cookie banner, so all of these are scenario attached to analysis.
So when you store analysis, then you will be able to mark every information to assess,
wherever they are compliant or not, with the current regulation, so that's why you have
all this tick and this button, and then you can explain why you, I mean, you can explain
your evaluation.
So that's it, once you have finished analysis, then you can share your analysis with
others, and you can export them as pretty print report using some templates, and you can
export it in many formats like PDF, tachyx, etc. So you remember that one of the requirements
of the mission was to foster the reuse of knowledge regarding cookies, so there is like
a full editing tool to edit your own database. So when you install this tool, this is maybe
the more complex thing when you are not like in the topotection authorities, you don't have
any knowledge base, mostly because most of the knowledge base which are used by that topotection
authorities are covered by a secret of instructions, you know, but the tool that you to create
your own database to reuse and the database, and I have made like some example of how to
translate some existing database to the format of the tool itself. So this is like a project
that I've put in some of my own repository, you will find the URL there, and that makes the
links to my research, which is, I mean, there is a lot of research perspective open by this tool,
I mean, one of one of one of something that could be done, I mean, by any researcher, if you
have work inside the cookie topic, see it's like there is many database which are existing,
there is no command methodology to build this database to find the purpose of this matter database,
some are using like machine learning, and over adjust reading like the cookie notice, you know,
so the idea is like if you have work on it, then I will be happy to discuss on you, see,
we can translate it, and if you can set like a confidence level to it,
over research perspective, like now browser, by default, enabling tracking protection,
so it seems, I mean, there is a lot of research paper that show that there is some alternative
to cookie that are used by website to try to track the user without joining cookie by itself,
or try to hide their own cookies by putting them as a first domain, so I'm thinking about
synemicroking for instance, just to hide, you know, a URL, or to take some fingerprint of your
terminal, so there is many research paper, there is many scripts, and I will be really interested
to speak with anyone who has work on this, and if we can integrate their algorithm into tools,
and last one is also regarding browser, is now there are trying to provide alternatives to cookies,
it's like the privacy initiatives, privacy sandbox for Google, privacy preserving
attribution for Firefox, so all these initiatives are, I mean, most of the DPA say that
they still require concerns, so I will be very curious to see how popular this initiative are,
and if they are really like compliant with all the expectations from the regulation,
and of course, if you have any other research ideas, if you have any initiative on this project,
I will be very happy to discuss with you after this presentation, and you can also find me later
in the audience, I will be there today and also tomorrow because I will also never, I'm speaking
on another track, so contact me, and now for the SP part, I'll give the floor again to another one.
So for more projects, what's in particular, so the first thing is the adpv is commenting to continue
to maintain the future, even to continue to develop it, for information, we have started the new
SP project, this year, to make a server version, we will pick them again, hoping it will do a
good job again, we will see, the idea is to make it a collaborative and we hope it will find a way
to allow to store knowledge that they send out its server sites, and of course, if you have
idea, you want to discuss, we are open to it, thank you very much.
Thank you.
Have you made any questions? One question? I think this one works first.
Hi, I'm Martin, I hope that you would like to work on cooking on this
compliance, like automated analysis of all those burners, so there's no work before you
don't know any work before to analyze for skookie's burners, there's pretty much good.
And the next question is, is there any work on vendors themselves, so called vendors,
the company is behind, because if you click on those links and you see, it's always bullshit.
So, Mike, they're pointing at each other and it's a disaster.
Because I'm sorry, I didn't get the question already.
Is it working? Okay, but so called vendors, the company is behind this tracking, is there any
like a data base, analyzing vapor uses, they have their own policies which are usually, you know,
Generic and stuff. Thank you.
It's sort of a confidence of the information, so could we trust that these kind of vendors
information that it, because you know that you have some technical cookies, also that, I mean,
one cookie can have new type of disease, and all the information about what needs the
preposterous phone cookies are not always available, you know, so the, the, yeah, that's it,
answer your question. And at the same time, if you looked in on like it's two, that the base that
Jerome at on this slide, you I choose first one was EDPB1, so that, you know, information that
shared, and you need to know by this, between SA, but the second one is built upon a
free software project that is completely not vated by EDPB, I'm not saying that you know, like,
we will do the same things, that was a legal part, but there are a bit based on that, I mean,
there are readings and also it is, and it's how people are contributing to it.
I'm sorry, I think that's all we have time for today, but thank you so much,
thank you for your time. I'll be outside in front. And I do have cookies for those who want.