Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update risk-mitigation.mdx #643

Merged
merged 1 commit into from
Oct 21, 2024
Merged

Update risk-mitigation.mdx #643

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion docs/workflow/implementing/risk-mitigation/risk-mitigation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,6 @@ Experiments and Rollouts are making remote changes to the experience of live use
- **Brand**: If the public, users, or press were to discover this experiment and description, could it negatively impact their perception of our brand? This includes when that perceptions is unfounded. Example: We offered recommendations in a client-side, privacy respecting way, but the method of recommending could have been misconstued. Instead of an incident, when the question came up (reddit, hackernews, etc) it was good press because we quickly pointed people to the well-written SUMO description of how we were respecting user privacy when making recommendations.
- **Revenue**: Impact from changes related to Search, New Tab, Ads, Pocket, etc should follow the VP Sign-off guidance.
- **Partnerships**: If a partner is involved in any way, it raises risk and you should follow the Legal sign-off guidance. A partner could also be affected indirectly, for example if search functionality or presentation is altered. Considerations can include: revenue, licensing, partner privacy policy, contractual obligations, trademark usage, etc.
- **Encryption**: Encryption in your technoology is subject to export control laws and you need Legal Sign-off. Releasing to other countries could put our users at risk of criminal punishment and result in the country sanctioning our browser use. Even code shipped preffed off, could manually be activated. It is critical to NOT deliver encryption into these countries.
- **Sensitive Data**: If you are using [Category 3 or 4 data](https://wiki.mozilla.org/Firefox/Data_Collection#Data_Collection_Categories) you need to work with legal and data. Follow the Legal Sign-off guidance.
- **AI data use**: If your change relies on AI (e.g. ML, chatbot) in any way, it will need a legal product review.
- **Encryption**: Encryption in your technoology is subject to export control laws and you need Legal Sign-off. Releasing to other countries could put our users at risk of criminal punishment and result in the country sanctioning our browser use. Even code shipped preffed off, could manually be activated. It is critical to NOT deliver encryption into these countries.
Loading