Re: [R] Question about R software and output

[Richard O'Keefe]

R is open source software, available from CRAN servers, but also
packaged for various Linux distributions.  On this machine,
running Ubuntu, R was installed using the 'apt' package manager.

R is a complete programming language with built-in support for
reading and writing over the network.  Packages -- whether on CRAN
or elsewhere -- extend R with code written in a mixture of Fortran,
C, C++, and R.  Base R behaves itself, but a package loaded from
some random GitHub site could do anything.

Data processed by R need not have been anywhere near Excel or any
kind of spreadsheet.  I don't even *have* Excel on any of the machines
I run R on.  Most of the data I process is not in .csv or .xslx format.
R is able to read data in many formats as described in the
R Data Import/Export
manual, which is fairly brief.  If there is a data exchange format
with a significant community, chances are there's an R package that
can read and/or write it.  Indeed, it is even possible to extract
information from PDFs in R using the pdftools package.

It sounds as though your primary concern is data protection, and
there's good news and bad news.  The good news is that if you stick
with R and with packages from a trusted repository, you're safe.
The bad news is that a programming language that can do anything
can do ANYTHING, and you are not safe from a malicious programmer
in your own organisation sending data anywhere she wants to.
% R
> system("some possibly dangerous command goes here")
Of course, this doesn't let anyone do something they couldn't already
do *without* R.

And this gets us to the real bad news.  I think you are trying
to achieve security by a method that cannot work.  You're trying to
limit yourself to safe software.  But you ALSO need to plug ALL the
USB ports, ALL the Thunderbolt ports, snip the wires to the Wifi and
Bluetooth modules,If a system is capable enough to install
R (or anything else), it is insecure *without* R.  You have to limit
the internet connections that can possibly be established by ANY
program, and that means several levels of firewalls.  It also means
no "work from home".

On Wed, 4 Oct 2023 at 03:18, Ferguson Charity (CEMINFERGUSON) <
charity.eminfergu...@gstt.nhs.uk> wrote:

> To whom it may concern,
>
>
>
> My understanding is that the R software is downloaded from a CRAN network
> and data is imported into it using Microsoft Excel for example. Could I
> please just double check whether any data or results from the output is
> held on external servers or is it just held on local files on the computer?
>
>
>
> Many thanks,
>
>
>
> Charity
>
>
>
> *
>
> The information contained in this message and or attachments is intended
> only for the
> person or entity to which it is addressed and may contain confidential
> and/or
> privileged material. Unless otherwise specified, the opinions expressed
> herein do not
> necessarily represent those of Guy's and St Thomas' NHS Foundation Trust or
> any of its subsidiaries. The information contained in this e-mail may be
> subject to
> public disclosure under the Freedom of Information Act 2000. Unless the
> information
> is legally exempt from disclosure, the confidentiality of this e-mail and
> any replies
> cannot be guaranteed.
>
> Any review, retransmission,dissemination or other use of, or taking of any
> action in
> reliance upon, this information by persons or entities other than the
> intended
> recipient is prohibited. If you received this in error, please contact the
> sender
> and delete the material from any system and destroy any copies.
>
> We make every effort to keep our network free from viruses. However, it is
> your
> responsibility to ensure that this e-mail and any attachments are free of
> viruses as
> we can take no responsibility for any computer virus which might be
> transferred by
> way of this e-mail.
>
>
> *
>
> [[alternative HTML version deleted]]
>
> __
> R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
> https://stat.ethz.ch/mailman/listinfo/r-help
> PLEASE do read the posting guide
> http://www.R-project.org/posting-guide.html
> and provide commented, minimal, self-contained, reproducible code.
>

[[alternative HTML version deleted]]

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.

Re: [R] Question about R software and output

[CALUM POLWART]

Charity

There is OFTEN confusion what we mean when we say "R".

R is effectively a single bit of software with a ton of other bits of
software as optional extras.  You might think of some of those optional
extras like apps on a phone. You'd say you have a phone when you can open
the box and power it on. But you might add say "Spotify" app to it. That
will then be downloading the songs. And inevitably sending some data back
(I not do Spotify - no idea what - but it must have your identification and
what songs to play as a minimum).

R packages are like apps. They interact with the R core and do sometimes
amazing things. I think the majority do all that entirely on the machine
running R. BUT some may be using external services. There is for instance a
package that can interact with the Twitter API.  It would be impossible to
do that without sending as a minimum some login data and downloading data
back.  But you'd not normally send your entire research database to Twitter
during the login!

There will be SOME R packages that may be doing some odd stuff which might
need the dataset sent to the web. I can't think of any! Then there are
packages that could accidentally send data that you may or may not consider
sensitive. Say for instance you have a postcode list for every patient in
your research study. And you wanted to geocode that to get their location
as a long/lat... you can do that in an r package - which will have to send
the post code to get the answer. You haven't identified why you want the
postcode... but it is patient identifiable data...

That's R.

Add to that R Studio (or possibly other software solutions) - which is a
development environment which sits on top of R. It's often what people mean
by programming in R but it's effectively a glorified text editor. R Studio
desktop doesn't send data anywhere. Although it has database connectors
that could (but so can excel so if IG are flipping out feel free to remind
them of that!).

R Studio can work with git which is a version management system and can
upload code to a service like GitHub. You COULD upload data in that, or you
could chose not to.

And finally...

R Studio has a cloud version. It looks 98% the same as R Studio desktop.
Now called Posit.Cloud. That's a cloud service. While it may be secure etc
-- you are processing on their server not your PC.  And if this was your
question - it's a whole different set of answers!!


You may also want to Google NHSRcommunity where you might find help if
there are IG question to address as many of us will have wrestled with an
NHS IG team at some point.



On Tue, 3 Oct 2023, 17:26 Michael Dewey,  wrote:

> Dear Charity
>
> Since your organisation is a member of King's Health Partners you might
> like to ask colleagues in KCL for local support.
>
> Michael
>
> On 02/10/2023 08:48, Ferguson Charity (CEMINFERGUSON) wrote:
> > To whom it may concern,
> >
> >
> >
> > My understanding is that the R software is downloaded from a CRAN
> network and data is imported into it using Microsoft Excel for example.
> Could I please just double check whether any data or results from the
> output is held on external servers or is it just held on local files on the
> computer?
> >
> >
> >
> > Many thanks,
> >
> >
> >
> > Charity
> >
> >
> >
> *
> >
> > The information contained in this message and or attachments is intended
> only for the
> > person or entity to which it is addressed and may contain confidential
> and/or
> > privileged material. Unless otherwise specified, the opinions expressed
> herein do not
> > necessarily represent those of Guy's and St Thomas' NHS Foundation Trust
> or
> > any of its subsidiaries. The information contained in this e-mail may be
> subject to
> > public disclosure under the Freedom of Information Act 2000. Unless the
> information
> > is legally exempt from disclosure, the confidentiality of this e-mail
> and any replies
> > cannot be guaranteed.
> >
> > Any review, retransmission,dissemination or other use of, or taking of
> any action in
> > reliance upon, this information by persons or entities other than the
> intended
> > recipient is prohibited. If you received this in error, please contact
> the sender
> > and delete the material from any system and destroy any copies.
> >
> > We make every effort to keep our network free from viruses. However, it
> is your
> > responsibility to ensure that this e-mail and any attachments are free
> of viruses as
> > we can take no responsibility for any computer virus which might be
> transferred by
> > way of this e-mail.
> >
> >
> *
> >
> >   [[alternative HTML version deleted]]
> >
> > __
> > R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
> > https://stat.ethz.ch/mailman/listinfo/r-help
> > PLEASE do read 

Re: [R] Question about R software and output

[Michael Dewey]

Dear Charity

Since your organisation is a member of King's Health Partners you might 
like to ask colleagues in KCL for local support.


Michael

On 02/10/2023 08:48, Ferguson Charity (CEMINFERGUSON) wrote:

To whom it may concern,



My understanding is that the R software is downloaded from a CRAN network and 
data is imported into it using Microsoft Excel for example. Could I please just 
double check whether any data or results from the output is held on external 
servers or is it just held on local files on the computer?



Many thanks,



Charity


*

The information contained in this message and or attachments is intended only 
for the
person or entity to which it is addressed and may contain confidential and/or
privileged material. Unless otherwise specified, the opinions expressed herein 
do not
necessarily represent those of Guy's and St Thomas' NHS Foundation Trust or
any of its subsidiaries. The information contained in this e-mail may be 
subject to
public disclosure under the Freedom of Information Act 2000. Unless the 
information
is legally exempt from disclosure, the confidentiality of this e-mail and any 
replies
cannot be guaranteed.

Any review, retransmission,dissemination or other use of, or taking of any 
action in
reliance upon, this information by persons or entities other than the intended
recipient is prohibited. If you received this in error, please contact the 
sender
and delete the material from any system and destroy any copies.

We make every effort to keep our network free from viruses. However, it is your
responsibility to ensure that this e-mail and any attachments are free of 
viruses as
we can take no responsibility for any computer virus which might be transferred 
by
way of this e-mail.

*

[[alternative HTML version deleted]]

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.



--
Michael

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.

Re: [R] Question about R software and output

[avi.e.gross]

Charity,

As some of the answers I have seen show, your question is not clear.

You need to be clear on what you mean about R software and other concepts
before an answer makes sense.

The Base version of R may come on your computer already but likely has been
installed from some external source, or updated and the CRAN mirrors are one
such installation. As far as I know, it downloads the main R software as
well as packages considered important as part of that distribution and from
then on, you can disconnect your computer from any network and it will work
fine for any programs that operate only locally. 

Of course any program you run that wishes to access external resources can
do so. In particular, it is quite common for you at the prompt, or within an
R program, to ask for a package stored externally to be placed within your
computer but once done, it remains there until and unless you want to get a
newer version or something.

There are packages that include data within themselves and may well be some
that dynamically go out and get info from somewhere but I know of no simple
way to find out other than reading the source code or seeing what happens if
you disconnect from the internet.

Your mention of EXCEL also needs clarification. EXCEL has absolutely nothing
to do with R. It is an unrelated product and you do not need to have it
installed to run R and vice versa. That does not mean your program cannot
interact with EXCEL or the files it makes, just that it is not part of base
R. R does allow importing data (locally or not) in lots of formats including
some that EXCEL can save data in. But generally, internal to R there are
storage methods such as the data.frame that hold data and manipulate it and
a typical R program may read in some data from files like .CSV that can be
saved from EXCEL or many other sources or with the proper packages, you can
read directly from more native EXCEL formats such as XLSX files. And, you
can write out results in many ways using packages that include those
formats.

Once data has been received, I know of no way in R that tags it with the
source of the data as being internal or external. Often the fact that
something is external is well hidden as many R packages have ways to access
external data as if it were local.

Perhaps you can explain more clearly what your concerns are. But note R is
not atypical among computer languages and many others might share the same
issues that concern you. 

Avi

-Original Message-
From: R-help  On Behalf Of Ferguson Charity
(CEMINFERGUSON)
Sent: Monday, October 2, 2023 3:49 AM
To: r-help@r-project.org
Subject: [R] Question about R software and output

To whom it may concern,



My understanding is that the R software is downloaded from a CRAN network
and data is imported into it using Microsoft Excel for example. Could I
please just double check whether any data or results from the output is held
on external servers or is it just held on local files on the computer?



Many thanks,



Charity



*

The information contained in this message and or attachments is intended
only for the
person or entity to which it is addressed and may contain confidential
and/or 
privileged material. Unless otherwise specified, the opinions expressed
herein do not
necessarily represent those of Guy's and St Thomas' NHS Foundation Trust or
any of its subsidiaries. The information contained in this e-mail may be
subject to 
public disclosure under the Freedom of Information Act 2000. Unless the
information 
is legally exempt from disclosure, the confidentiality of this e-mail and
any replies
cannot be guaranteed.

Any review, retransmission,dissemination or other use of, or taking of any
action in 
reliance upon, this information by persons or entities other than the
intended
recipient is prohibited. If you received this in error, please contact the
sender
and delete the material from any system and destroy any copies.

We make every effort to keep our network free from viruses. However, it is
your
responsibility to ensure that this e-mail and any attachments are free of
viruses as
we can take no responsibility for any computer virus which might be
transferred by 
way of this e-mail.


*

[[alternative HTML version deleted]]

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, 

Re: [R] Question about R software and output

[Ebert,Timothy Aaron]

I would answer "local files only," but with sufficient motive it is possible 
for some people to abuse a system. Base R does not download any of your data. 
The packages that I know about do not download data. You can add a layer of 
protection by only downloading directly from the source rather than through 
some third party. If you are skilled, you should be able to read through the 
source code to check for statements that would write your data to an external 
source.

Another viewpoint: R is an approved software for the University of Florida. The 
University is very aware of regulations and risks associated with personally 
identifiable information. Downloading to an external location would be a 
security risk that the University would not allow. That said, the university 
provides students and employees  an approved link for downloading the software. 
It is designed to help people avoid third party sites and associated risks.

If this is an issue with personally identifiable information, then you should 
check with your employer if R is an approved software.


-Original Message-
From: R-help  On Behalf Of Ferguson Charity 
(CEMINFERGUSON)
Sent: Monday, October 2, 2023 3:49 AM
To: r-help@r-project.org
Subject: [R] Question about R software and output

[External Email]

To whom it may concern,



My understanding is that the R software is downloaded from a CRAN network and 
data is imported into it using Microsoft Excel for example. Could I please just 
double check whether any data or results from the output is held on external 
servers or is it just held on local files on the computer?



Many thanks,



Charity


*

The information contained in this message and or attachments is intended only 
for the person or entity to which it is addressed and may contain confidential 
and/or privileged material. Unless otherwise specified, the opinions expressed 
herein do not necessarily represent those of Guy's and St Thomas' NHS 
Foundation Trust or any of its subsidiaries. The information contained in this 
e-mail may be subject to public disclosure under the Freedom of Information Act 
2000. Unless the information is legally exempt from disclosure, the 
confidentiality of this e-mail and any replies cannot be guaranteed.

Any review, retransmission,dissemination or other use of, or taking of any 
action in reliance upon, this information by persons or entities other than the 
intended recipient is prohibited. If you received this in error, please contact 
the sender and delete the material from any system and destroy any copies.

We make every effort to keep our network free from viruses. However, it is your 
responsibility to ensure that this e-mail and any attachments are free of 
viruses as we can take no responsibility for any computer virus which might be 
transferred by way of this e-mail.

*

[[alternative HTML version deleted]]

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.r-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.

Re: [R] Question about R software and output

[Bert Gunter]

I am pretty sure you'll get more replies than mine, so just consider this
as part of the story.

Your understanding is confused/flawed.

1. R can be downloaded from hundreds/thousands of software repositories,
not just CRAN.

2. R can read/upload data in hundreds of different formats, not just
Excel's. R makes no use of Excel to read external files (I wasn't clear
what you meant here).

3. As Ben said, it is certainly possible that some R packages -- optional
add-ons extending R capabilities ---  communicate with and store data or
results on external servers. R,  itself, can run locally and can store
results either locally or externally. Like most software, it can also be
integrated as part of the infrastructure on a server for web applications.

If you have a specific question not addressed by these various replies, ask
it. You will most likely get a useful reply.

Cheers,
Bert

On Tue, Oct 3, 2023 at 7:17 AM Ferguson Charity (CEMINFERGUSON) <
charity.eminfergu...@gstt.nhs.uk> wrote:

> To whom it may concern,
>
>
>
> My understanding is that the R software is downloaded from a CRAN network
> and data is imported into it using Microsoft Excel for example. Could I
> please just double check whether any data or results from the output is
> held on external servers or is it just held on local files on the computer?
>
>
>
> Many thanks,
>
>
>
> Charity
>
>
>
> *
>
> The information contained in this message and or attachments is intended
> only for the
> person or entity to which it is addressed and may contain confidential
> and/or
> privileged material. Unless otherwise specified, the opinions expressed
> herein do not
> necessarily represent those of Guy's and St Thomas' NHS Foundation Trust or
> any of its subsidiaries. The information contained in this e-mail may be
> subject to
> public disclosure under the Freedom of Information Act 2000. Unless the
> information
> is legally exempt from disclosure, the confidentiality of this e-mail and
> any replies
> cannot be guaranteed.
>
> Any review, retransmission,dissemination or other use of, or taking of any
> action in
> reliance upon, this information by persons or entities other than the
> intended
> recipient is prohibited. If you received this in error, please contact the
> sender
> and delete the material from any system and destroy any copies.
>
> We make every effort to keep our network free from viruses. However, it is
> your
> responsibility to ensure that this e-mail and any attachments are free of
> viruses as
> we can take no responsibility for any computer virus which might be
> transferred by
> way of this e-mail.
>
>
> *
>
> [[alternative HTML version deleted]]
>
> __
> R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
> https://stat.ethz.ch/mailman/listinfo/r-help
> PLEASE do read the posting guide
> http://www.R-project.org/posting-guide.html
> and provide commented, minimal, self-contained, reproducible code.
>

[[alternative HTML version deleted]]

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.

Re: [R] Question about R software and output

[Ivan Krylov]

В Mon, 2 Oct 2023 07:48:36 +
"Ferguson Charity (CEMINFERGUSON)" 
пишет:

> My understanding is that the R software is downloaded from a CRAN
> network

This is mostly true. (There are other ways of installing R, but it is
most frequently downloaded from a CRAN mirror.)

> and data is imported into it using Microsoft Excel for example.

This is not exactly the case.

It is possible to prepare data using Microsoft Excel and store it in
the Microsoft Excel format, but the actual import process is performed
either using base R functions (e.g. read.csv(), which is built into R),
or using third-party packages running inside R (e.g. "openxlsx", which
is available on CRAN) that implement the functions necessary to
transform Excel format into R data structures.

It is also possible to prepare data using other software, or type it
manually into R, or store it only in R's native data format (using
the saveRDS() or save() functions).

> Could I please just double check whether any data or results from the
> output is held on external servers or is it just held on local files
> on the computer?

As long as you're running R on your own computer, it should keep the
data locally. The words of a J. Random Hacker from the Internet don't
carry much weight with government agencies (as they shouldn't), but the
source code of R is open to audits. Additionally, there are some
guidance documents at .

Note that this only covers R itself and not any third-party software
packages that you could be using together with R. (You could also be
connecting to an RStudio server or running an instance of webR in your
web browser, in which case your data is subject to the privacy policy
of the server administrators.) For example, the "googleCloudRunner"
package available on CRAN is designed for the purpose of running code
on Google infrastructure and will send the data there if asked to.

CRAN packages are required never to do anything that might be regarded
as antisocial ,
but a dedicated attacker may be able to slip something past the
reviewers anyway.

Since your e-mail address contains nhs.uk, the
 website could help you find the
information you need.

-- 
Best regards,
Ivan

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.

Re: [R] Question about R software and output

[Ben Bolker]

   It's conceivable that functions in a contributed package would 
communicate/transmit or receive data from a remote server, but base R 
does nothing like that (unless you explicitly ask it to).


  cheers
   Ben Bolker

On 2023-10-02 3:48 a.m., Ferguson Charity (CEMINFERGUSON) wrote:

To whom it may concern,



My understanding is that the R software is downloaded from a CRAN network and 
data is imported into it using Microsoft Excel for example. Could I please just 
double check whether any data or results from the output is held on external 
servers or is it just held on local files on the computer?



Many thanks,



Charity


*

The information contained in this message and or attachments is intended only 
for the
person or entity to which it is addressed and may contain confidential and/or
privileged material. Unless otherwise specified, the opinions expressed herein 
do not
necessarily represent those of Guy's and St Thomas' NHS Foundation Trust or
any of its subsidiaries. The information contained in this e-mail may be 
subject to
public disclosure under the Freedom of Information Act 2000. Unless the 
information
is legally exempt from disclosure, the confidentiality of this e-mail and any 
replies
cannot be guaranteed.

Any review, retransmission,dissemination or other use of, or taking of any 
action in
reliance upon, this information by persons or entities other than the intended
recipient is prohibited. If you received this in error, please contact the 
sender
and delete the material from any system and destroy any copies.

We make every effort to keep our network free from viruses. However, it is your
responsibility to ensure that this e-mail and any attachments are free of 
viruses as
we can take no responsibility for any computer virus which might be transferred 
by
way of this e-mail.

*

[[alternative HTML version deleted]]

__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.


__
R-help@r-project.org mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide http://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.