Google replies to lawmaker on privacy
687609
Google has responded to a U.S. congressman&#39;s series of questions about its privacy practices, with the company defending its use of consumer data.
39364
(InfoWorld) - What if there were a giant database that contained your hidden insecurities, embarrassing medical questions, and the fact that you still think from time to time about your high-school girlfriend? Well, such a data store does exist -- if you've ever plugged such private topics into a search engine. The fact is, search engines like Google, Yahoo, and Microsoft Live Search all record and retain in their vast data banks any term that you query in addition to the date and time your query was processed, the IP address of your computer, and a cookie-based unique ID that -- unless you delete it -- enables the search engine to continue to know if requests are coming from that particular computer, even if the connection changes. Microsoft Live Search also records the type of search you conducted (image, Web, local, etc.), while Google additionally stores your browser type and language. And when you click on a link displayed on Google, that may also be recorded and associated with your computer's IP address. While Google recently announced that it would make its search logs anonymous after 18 months' time by deleting part of the IP address and obfuscating cookies associated with search queries, Microsoft and Yahoo haven't yet made their retention policies public. AOL stores this data for just one month. The upshot: If someone were to ask one of these search engine companies to produce a list of IP addresses or cookie values that searched on a particular search term, they conceivably could. Or, conversely, given an IP address or cookie value, the search engine firm could produce a list of terms searched by the user of that address or cookie value. Don't worry; be happy Some people say there's not much to worry about because the server logs don't associate these search terms with personally identifiable information, such as your name or e-mail address. However, if you have an account with or have registered for any of the additional services on a search engine site -- e-mail, social networks, calendars, shopping lists -- it's feasible that that connection could be made, says Brad Templeton, chairman of the board at the Electronic Frontier Foundation, a group that protects liberties and privacy in cyberspace. In the case of Microsoft and Yahoo, that information can be extensive because of how much personal information these search engine firms ask for on their account registration forms, including your occupation, job title and marital status, and the number of children in your household. According to Whitney Burk, public relations manager at Microsoft, "There is no systematic way of identifying, isolating, or cross-referencing search data with personally identifiable information." Google also says it stores the two types of information separately. However, according to Templeton, "it would be very difficult to make it impossible for someone to make that correlation." Templeton emphasizes that he doesn't know exactly how any of the search engine systems are designed, but -- given typical designs -- there are many different ways that someone with the right access and knowledge could make a retroactive correlation between search terms and personally identifiable information. Considering that search terms can reveal personal information that ranges from medical prescriptions to religious beliefs and political preferences, that's not an association many of us would be happy to see. Even if you didn't provide any personal information, an IP address alone could be traced back through a reverse DNS lookup to the Internet service provider and city of the IP address, according to Danny Sullivan, editor in chief of Search Engine Land, a blog dedicated to search news. Contacting the ISP could result in a positive identification of the account holder by finding out which account accessed the search engine at the time recorded in the search log. Last year, reporters at The New York Times didn't even need an IP address to track down the identity of an AOL user when AOL published anonymous search logs of 500,000 users over a three-month period. The identification was made possible simply based on the specificity of the search terms the user queried, such as real estate searches in the small town where she lived. (If you have any question as to what collected search terms reveal about an individual -- accurate or not -- check out those AOL search logs.) Hello, George Orwell? If all this sounds Big Brother-ish to you, you're not alone. Individual users, consumer interest groups, government regulatory committees around the world, and privacy groups are growing increasingly worried about how much personal data search engine firms retain and what they could do -- or be forced to do -- with this information. In recent months, Google seemingly hasn't been able to make a move without drawing speculation and suspicion about its ability to construct personal portraits of user behavior. Several consumer interest groups have filed a complaint with the Federal Trade Commission regarding Google's acquisition of DoubleClick. The groups claim it would give Google unprecedented insight into consumer behavior because it could track both people's Internet searches and their Web site visits. And when Google released its History feature, which associates individuals' search and page visitation histories with their account information, some observers, such as veteran blogger Anil Dash, called it both "brilliant" and "scary." "With the release of Web History, especially in the context of its recent acquisitions and announcements, Google may have crossed the line where regular users start to react with skepticism and caution instead of unabashed enthusiasm," Dash says in his blog (see "Google hostile to privacy, group says"). The creepiness factor surrounding online search data was also upped by the revelation in early 2006 that the U.S. Justice Department had subpoenaed Google, Yahoo, Microsoft, and AOL to turn over a random list of Web queries conducted over the course of a week, divorced from the names of those submitting them. AOL, Microsoft, and Yahoo turned over some of the requested information, but Google resisted. Although Google set a good precedent by doing so, "Governments can and will do things that companies have to comply with," says Chris Sherman, executive editor of Search Engine Land, referring to the Chinese government pressuring Yahoo to turn over the name of a user who posted to an online forum. "The [U.S.] government is a growing concern because over the last several, years it's been expanding its power to ask for such information, especially as the political climate has changed," Templeton says. For instance, he points out, warrants have been easier to get since the USA Patriot Act was enacted. "It's something we should worry about more than in the past," he says. Of course, some in the government are trying for more, not less, protection for online data. Congressman Edward Markey (D-Mass.) introduced a bill in early 2006 (H.R. 4731) to require owners of Internet Web sites -- not just search engine firms --- to destroy obsolete data containing personal consumer information. Putting aside the government, there are other ways for private data to be revealed, Templeton says, in the form of internal employees. "Everyone knows the history of most large database [breaches] comes down to a story of corrupt employees who sell access to private records," he says. "In the private investigation world, they can use bribes to get people's tax returns." Brass tacks All of this raises the question: Why do search firms store all this data? Google offers three reasons: It can help the company improve its services, maintain security and prevent abuse by looking for patterns indicating fraudulent activity, and comply with legal obligations to retain data. The company asserts that it can use this information to determine how often users are satisfied with the first result of a query and how often they proceed to later results. Or it can determine how many times an advertisement is clicked in order to calculate how much the advertiser should be charged. In his blog, Sullivan is more direct. "Google is big on personalization," he writes. "Big, big, big. For Google, getting up close and personal with individuals is seen as a big leap forward on many fronts -- and 2007 is the year Google is going all out after it." The more Google can know about you, Sullivan explains, the more it believes it can deliver you a better experience, not to mention more targeted ads. "But in particular," he says, "personalization is seen as the next generational step in delivering better search results." But Templeton questions whether the search firms need to store as much information as they do and for as long as they do. "We regularly advise [Google] that they're keeping too much information," he says. While some people, such as Sullivan, applaud Google's move to limit the amount of time it retains search logs, saying that will make it nearly impossible to trace any query back to a particular computer, Templeton thinks total destruction of the data would be far better. "History is full of [incidents] where people thought they could anonymize or destroy data, but people find a way to recover it," he says. "You have to be more thorough in their destruction -- you have to eventually destroy the connection between the IP address and the searches." Plus, Google's move may or may not address backup data, which Sullivan notes is not as easily accessible or altered. And the 18-month window also doesn't address data stored via its Web History feature. That information, Sullivan says, is not being destroyed or anonymized over time. "If you want it wiped out," he says on his blog, "Google says you have to do that separately." On the positive side, Web History lets users know exactly what data pertaining to them is stored, and they can take it into their own hands to delete those histories at any time. The same is true of Yahoo's MyWeb feature, which stores user searches if it's been switched on. With all the focus on user privacy, the search engine firms say they are taking measures to increase the anonymity of users. Google has said it will build privacy protections into its nonsearch products, including Google Talk's "off the record" feature, as well as Google Desktop's "pause" and "lock search" controls. It has also said it will provide easy-to-understand privacy policies for users on its Web site. For its part, Microsoft says it's actively engaged with data protection authorities around the world on what user information is collected and for what purposes as well as policies around notice and consent. "There is no universal consensus on the 'right' policies," Burk says. "However, we will continue to be active with privacy advocates and authorities as these decisions are made." In the end, Sherman says, it's up to individual users to decide whether they trust search engine firms with their personal information. "It's something everyone has to decide -- at what level am I comfortable with the reality of improving my search results vs. my identity being connected with the types of queries I do?" he says. And he's careful to note that the question extends way beyond Google, which in his eyes takes strong measures to secure user data. "When you go to Google, you can't get anywhere near their data centers," he says. "There are levels of security in the company where few people are cleared to get into areas where people can see personally identifiable information." But to Templeton, that's not enough. "Even when people try to do a good job, things happen, and data still gets out," he says. "If it's collected and in a place that can be accessed, it can get out." Furthermore, Sherman points out, it's not just search engines that store personal data. "Your ISP knows more about you than any search engine -- not just what you're searching on but every Web site you've visited," he says. On his blog Sullivan adds, "Google may be anonymizing its records, but your ISP might not be."
478330
When it comes to protecting the privacy of its users, Google Inc. ranks worse than any other Internet company, according to an interim report by Privacy International. The international watchdog group also accused Google of engaging in a smear campaign in response to its findings, and demanded an apology.
654004
Google executives are taking a proactive stance when it comes to issues under consideration by U.S. lawmakers that could affect the Internet search engine.
737758
Google Inc., responding to concerns from a European Union privacy group, has decided to make the data it stores about end users anonymous in its server logs after 18 months.
190138
Europe&#39;s top data protection officials are working to clarify a grey area of Internet law: the legal status of an IP address.The question of whether an IP address should be considered private data occupied much time at a hearing earlier this week at the European Parliament regarding Google&#39;s planned acquisition of DoubleClick. If a person can be identified by an IP address, then the address is private, said Peter Schaar, the German data protection commissioner and chairman of the Europe-wide privacy group, the Article 29 Committee.This has been the rule in most countries in the European Union for more than 10 years. However, it is hard to set a clear-cut rule because some ISPs&#160;give out fresh IP addresses to subscribers each time they go online, and people also buy time online at Internet cafes.The Article 29 Committee has been examining the question of IP addresses as part of its analysis of how search engines respect European data protection rules. It is expected to reach some conclusions by mid-June, according to an official working for the committee who asked not to be named.The committee cannot fine transgressors of E.U. data protection rules, nor can it propose legislation, but it can prompt the European Commission to do so.Internet search companies, including Google, argue that an IP address merely locates a computer rather than identifying who is sitting at that computer. Treating IP addresses as personal information would have implications for how search engines record and use people&#39;s data.If the committee persuaded lawmakers to toughen IP address protection in Europe &quot;that would definitely change things [for search engines],&quot; said John Steinback, a spokesman on policy matters for Google.From Google&#39;s perspective, whether an IP address is personal depends on the context, Steinback said. An ISP can link an IP address to a subscriber, but a Web site visited by the person using a specific IP address cannot link the address to a person, he explained.The European Parliament hearing was convened by the assembly&#39;s civil liberties committee to assess whether citizens&#39; privacy would be harmed by Google&#39;s planned acquisition of Internet advertising company DoubleClick. The deal, which has already been given the green light by U.S. regulators, is under investigation by European Commission competition officials. However, like its U.S. equivalents, the Commission won&#39;t consider the privacy question.Nevertheless, if data being collected for one purpose by one of the companies is then handed over to the other company for use in a different way, European data protection officials would be obliged to intervene, said the official close to the Article 29 Committee.&quot;Google will have to respect all the obligations of DoubleClick, including its data protection obligations,&quot; the official said. If the two databases are to be used for the same purposes, then they would be deemed compatible and could merge. &quot;But if there was an incompatibility between the two databases, then they couldn&#39;t be merged,&quot; he said.The European Parliament&#39;s civil liberties committee said it would be holding more seminars to examine the issues surrounding data protection in the months and years to come.
273137
Privacy to be central to lawmaker hearings in Europe on Google's proposed $3.1 billion acquisition of DoubleClick.
581365
EU-Google negotiations going swimmingly The head of Europe's privacy watchdogs said that he is still in negotiations with Google about a major data retention dispute and is confident that the search giant will change its policies.â¦Learn &amp; Contribute, Live &amp; Online - The Register Debates Green Computing
186725
Imagine being able to check instantly whether or not statements made by politicians were correct. That is the sort of service Google Inc. boss Eric Schmidt believes the Internet will offer within five years.
414095
(InfoWorld) - U.S. lawmakers promised to push ahead legislation aimed at cracking down on pretexting despite some objections from telecom carriers and the U.S. Department of Justice. Nearly all the members of the House of Representatives Energy and Commerce Committee pledged to push the Prevention of Fraudulent Access to Phone Records Act, which would give the U.S. Federal Trade Commission (FTC) authority to file lawsuits against pretexters and the people who hire them. The bill would also require the Federal Communications Commission (FCC) to draw up new rules for telecom carriers to protect private phone records, and it would prevent carriers from sharing customer information with third parties without permission. Despite some concerns about the bill, lawmakers said consumers need protection against pretexting, the practice of posing as a telecom customer to obtain phone records and other private information. "Someone with bad intentions and a few bucks can get a hold of almost anybody's cell phone records," said Representative Fred Upton, a Michigan Republican. President George Bush signed a bill creating criminal penalties for pretexting in January. But proponents of the Prevention of Fraudulent Access to Phone Records Act say the extra protections in the bill are also needed. The Energy and Commerce Committee approved the same bill during the last session of Congress, but the legislation apparently was held up on the House floor because of concerns from federal law enforcement agencies that the bill could slow efforts to get information on terrorism suspects. Lawmakers from both parties complained that they received little explanation about why the bill died last year. Thomas Navin, chief of the FCC's Wireline Bureau, said the Department of Justice was concerned that the FCC would set up rules that consumers are notified too soon after their phone records were accessed by someone else. The DOJ wanted a delay of seven days before consumers were notified, he said. But Representative Ed Markey, a Massachusetts Democrat, said consumers should be notified immediately. "I don't think the Department of Justice should be listened to on that issue," he said. "I think [victims] should be listened to on that issue." Markey pointed to news reports this week saying the FBI may have violated the law and its internal rules while collecting telephone, data, and other personal records through the Patriot Act. "There is still a lack of respect for the law of our country," he said. Beyond the law enforcement concerns, representatives of trade groups the United States Telecom Association and CTIA-The Wireless Association said the bill could prevent them from sharing customer information with third parties that market complementary products. CTIA members don't share customers' personal information with unrelated groups, but the carriers do use third-party vendors to market wireless-related products, said Steve Largent, CTIA's president and CEO. But Representative Joe Barton, a Texas Republican, questioned industry concerns about language in the bill that could require carriers to get opt-in permission from customers to share their personal data. "It seems if we want to protect privacy, we should change this from opt out to opt in," he said.
662753
Anonymous messages posted on a Web site raise questions about the handling of data on a Merck &amp; Co Inc  and Schering-Plough Corp  cholesterol drug, two House of Representatives Democrats said on Monday.
363471
By MICHAEL LIEDTKE  SAN FRANCISCO -- Google Inc.'s privacy practices are the worst among the Internet's top destinations, according to a watchdog group seeking to intensify the recent focus on how the online search leader handles personal information about its users.
459683
Though communications protections exist, the law is fuzzy regarding internet and e-mail activity. Watch out for the legalization of digital mind readers tracing internet users' thoughts and interests, and trampling privacy rights in the process.
113737
Google's privacy and content policies for Google Applications give Google full rights to use your content however the company wants.  Are you nervous?
345343
Data privacy is likely to be among the hottest technology issues to face Congress this year, thanks in part to interest from the new chairman of the powerful House Financial Services Committee.
286257
A congressional inquiry into online data brokers has raised concerns that federal and local law enforcement may be skirting privacy laws to obtain calling records
182232
Google Inc , the world's  largest Internet company, will propose at a meeting of European  policymakers in France on Friday that national regulators agree  on a basic set of global privacy protections.