In a blog post in response to the Amazon privacy controversy, Mark Shuttleworth wrote:


  Don’t trust us? Erm, we have root. You do trust us with your data
  already. You trust us not to screw up on your machine with every
  update. You trust Debian, and you trust a large swathe of the open
  source community. And most importantly, you trust us to address it
  when, being human, we err.


What does he mean by "we have root"? Surely Canonical doesn't have root access to every machine running Ubuntu?

The wording of that sentence may seem a bit worrying because in a way it implies that they have root access as a backdoor that is already installed and in use. The truth is that it was just bad wording from Mark and what he tried to explain is that, yes, they have potential root access to your machine because every package update runs as root and at that point they can do and install anything they want or anything that could potentially sneak in from some open source project. 

If you also go through the comments on that blog post you will find Mark giving the answer to your question(his username in comments is 'mark')

Someone asked him:


  Sebastian says: 
  (http://www.markshuttleworth.com/archives/1182#comment-396204)
  September 23rd, 2012 at 11:42 am
  Ermm. You have root? Details please.


and then Mark replied:


  mark says:
  (http://www.markshuttleworth.com/archives/1182#comment-396225)
  September 23rd, 2012 at 1:00 pm
  @Sebastian – Every package update installs as root.

