[NYTr] Fears Mount over Internet Privacy: What's Google Up To Now? Date: Sun, 16 Dec 2007 10:26:23 -0600 (CST) Via NY Transfer News Collective * All the News that Doesn't Fit [Google wants its latest mega-acquisition to be the horrible ad service DoubleClick. There are many stories on the web regarding Congressman Joe Barton's "24 Questions" to Google which they have refused to answer, and the refusal of the FTC Chair to recuse herself because of conflict of interest from the FTC's review of this merger (her husband's law firm represents the Google Guys). Just a couple of these follow the story below on Scroogle. For more info, see Daniel Brandt's site at http://www.google-watch.org. Scroogle is to be found at http://www.scroogle.org/ The Times of London - Dec 16, 2007 http://business.timesonline.co.uk/tol/business/industry_sectors/technology/article3055825.ece Fears mount over internet privacy Google rival Ask.com is promising to wipe out people's search records within hours. But do the data really disappear? by Dominic Rushe, New York FOR the past three years Daniel Brandt has been running his own search engine. He called it, cheekily enough, Scroogle. Scroogle.org is the antiGoogle. It carries no advertisements and survives on donations from its users, usually less than $20 (9.90 pounds) apiece when and if they make them. It doesn't even have its own technology and relies instead on "scraping" search results from Google's site and offering them up, minus the ads. Traffic has doubled every year and now Scroogle has passed 100,000 visitors a day. Brandt said growth was down to one word: privacy. Unlike its well-funded rivals, Scroogle keeps no record of who is using its site or what they are looking for. Within an hour of using the site, the search terms are gone for good. The internet has become a depository for our most private thoughts and information. Details we would be reluctant to share with a doctor are routinely volunteered to Google, Yahoo and other search engines, and can easily be traced back to the computer it came from. "A lot of people don't realise search engines save everything you search for," said Brandt, a longtime Google critic. "The more these issues get into the press, the more people realise that when they sit down at their keyboard, they're being watched," he said. But after a series of scandals, that laissez-faire attitude seems to be coming to an end. All the big search groups have been tightening up privacy policies. Last week the search engine Ask.com went furthest by offering a new service, Ask Eraser, that will wipe out a searcher's queries within hours. Search information is valuable, allowing firms neatly to target ads to a person's interests to generate billions in advertising revenue. Search logs also improve the engine's performance, companies argue. Google uses search-log data to run its spellchecker B the system that asks: "Did you mean: Arnold Schwarzenegger?" when you type in his name spelt wrongly. Search data are also used to detect and fight spam and other attempts at internet fraud. Google, the industry leader, stores personal information for 18 months, as does Microsoft's search engine. Yahoo and Time Warner's AOL retain search requests for 13 months. But they are not the only people after the information. Search records have increasingly been targeted by the police. Last month in North Carolina a court denied Robert Petrick a retrial after he was convicted of murdering his wife. Google was one of the strongest witnesses against him. His wife, cellist Janine Sutphen, went missing in 2003. When police became suspicious they raided Petrick's home and found the computer consultant had Googled the words "neck", "snap", "break" and "hold" before his wife was killed. The prosecution argued Petrick had also viewed a document entitled 22 Ways to Kill a Man With Your Bare Hands and researched body decomposition and the topography of the lake where his wife's body was later found. Few people would complain about internet searches being used to catch criminals, but divorce lawyers regularly subpoena search-engine firms looking for dirt on warring spouses. Highly personal information can be used in a variety of ways that were never sanctioned by the person who entered the search terms. Then there are the risks of accidental breaches. Last year AOL inadvertently released detailed queries conducted by more than 650,000 Americans. Searches released by AOL included "depression and medical leave", "fear that spouse is contemplating cheating" and "how to kill oneself by natural gas". Searchers were quickly able to identify some of those behind the queries. While AOL is the only firm to have suffered a major leak so far, critics say that more are bound to come, and internet users should be wary of how firms can legitimately use their personal information. The London-based watchdog Privacy International ranked Google as "hostile to privacy" in its survey of internet firms, its lowest rating. Rivals Yahoo and Microsoft also fared poorly. In recent months, Ask.com has been trying to seize the high ground on search by casting itself as the alternative to Google's "monopoly" and by emphasising privacy. A spokesman said: "Some people are willing to lessen their concerns about privacy to get more services, but, for a certain set of people, privacy reigns supreme." It is difficult to erase digital footprints, however, and the information typed by users of Ask Eraser will not disappear completely. Ask.com relies on Google to deliver many of the ads that appear next to its search results, so Ask.com will continue to pass some query information to Google. "One less place for data to be breached is a good thing," said the Ask.com spokesman. Others are less impressed. Danny Sullivan, editor-in-chief of Search Engine Land, a blog that covers search engines and marketing, said more privacy moves were likely but that increasing privacy on the web was no simple matter. "All the major search engines have moved to toughen up their stance on privacy this year. I think it's useful, but the changes they are making gloss over the more detailed logging that goes on when people use these services," he said. Google will anonymise data after 18 months, so that any searches done, say, 19 months earlier, would not be traceable back to a person's computer. But when people log on to one of Google's services, Gmail, for example, and use the web history feature, which records and saves searches, Google is keeping track of all the websites they visit and all their searches "and they are going to keep that for ever", Sullivan said. Data are linked far more closely to you personally and you don't have any control over it. What happens next may well depend on investigations under way into Google's privacy policies. In Europe and the US it is under pressure from politicians over its purchase of online ad firm Double Click, the largest digital-ad server with a huge data-base of consumer searches. Between them, Double Click and Google know an awful lot about how people behave on the web. In the meantime, for those concerned about their privacy, there's always Scroogle. "Until we get too popular," said Brandt. "Then I'm expecting Google will pull our plug." END *** CNet News - Dec 12, 2007 http://www.news.com/8301-13578_3-9832985-38.html [See the original at URL above for chart, updates, and more embedded links.] House Republican targets Google on privacy grounds Posted by Declan McCullagh [Updated at 11:58 a.m. PST Wednesday: added response from Google and links to two more letters.] A top Republican in the House of Representatives is demanding that Google answer a barrage of questions about privacy, some of which are related to the company's proposed purchase of the DoubleClick advertising firm. Rep. Joe Barton, who has positioned himself as a privacy advocate and previously criticized the merger last month, complained in a letter to Google CEO Eric Schmidt that the company had initially agreed to let his aides visit the so-called Googleplex in Mountain View, Calif. but then didn't confirm a date. Barton is the senior Republican on the House Energy and Commerce Committee, which has Internet regulation as one of its responsibilities. The two men met in person on November 7 and the idea of a visit came up. But then, Barton said in his letter on Wednesday, "all efforts to reach a mutually agreeable time have been rebuffed, and it begins to seem that no date for a visit is sufficiently convenient to Google. Your warm initial invitation followed by Google's chilly response to a proposed visit by Committee counsels is disconcerting." Most of the rest of Barton's 24 questions deal with what Google does with search queries, how long information is kept, what data will be merged with DoubleClick's, and how the company performs its partial anonymization of search results. Barton asks for a response by December 18. (Unlike Ask.com, AOL, and Microsoft, Google does not delete search-related queries after 12 to 18 months. See the chart on this page for details from a survey we performed in August.) CHART: http://i.i.com.com/cnwk.1d/i/bto/20071212/search_priv_chart2_440x400.jpg The Federal Trade Commission is reviewing the Google-DoubleClick merger, which Microsoft and a band of pro-regulatory groups are hoping to derail. The FTC could allow the deal to proceed, attempt to block it, or attempt to impose conditions. In Europe, antitrust bureaucrats said last month that they were conducting their own investigation and would make a decision by April 2, 2008. Google spokesman Adam Kovacevich said Wednesday that Barton's aides are more than welcome to visit the 'plex. He said the dispute was essentially over dates: Barton suggested on November 20 that his aides visit on November 27 and November 28, precisely when their Google counterparts happened to be in Florida for the Republican YouTube debate. Barton didn't suggest any alternate dates, and, Kovacevich added, the House aides said they were unable to come during early December because Congress would be in session. Here's the November 20 letter (PDF) from Barton--much more polite than this week's-- http://politechbot.com/docs/google.barton.letter.112007.pdf and the November 30 reply (PDF) from Schmidt: http://politechbot.com/docs/google.schmidt.letter.113007.pdf Although Barton has talked about privacy before in terms of restricting the sale of Social Security numbers, he has not sought to assail other advertising-related mergers, some of which were larger than Google's proposed purchase. He never sent a barrage of questions to Yahoo (which bought ad firm Right Media), AOL (Adtech AG and Tacoda), or Microsoft (Aquantive and AdECN Inc.). By contrast, Barton, who counts telecommunications companies as major donors, has enthusiastically supported huge telecommunications mergers including Sprint and Nextel, AT&T and SBC, AT&T and BellSouth, and Verizon and MCI. Even though Barton says in his letter this week that he's concerned about the "privacy implications of the merger," he has a long history of voting for legislation that has been criticized by privacy groups such as the Electronic Privacy Information Center. Those bills include the Real ID Act, the Patriot Act, another bill to expand Internet surveillance performed without a court order, and a requirement to disclose federal agencies' data-mining programs to the U.S. Congress. (Barton opposed that last requirement.) Barton's letter to Google Here's the text of the letter, which Barton provided to CNET News.com. I'm including it below because it doesn't seem to be up on Barton's Web site: December 12, 2007 Eric Schmidt, Ph.D. Chairman of the Board and CEO Google Inc. 1600 Amphitheatre Parkway Mountain View, CA 94043 Dear Dr. Schmidt: On Tuesday, November 6, you visited my office and we discussed a number of topics relating to the online world and Google, in particular. One of these topics was the pending merger of Google and DoubleClick. As you will recall, I voiced concern regarding the potential consumer protection and privacy implications of the merger. You seemed to recognize those and similar concerns as legitimate, and graciously offered assistance to my staff to learn about your company's and the broader industry's current search and targeted advertising practices, as well as the potential ramifications of combining these two functions. This information will be vital as we begin to craft sound policy to appropriately protect consumer information and online behavior. Your assistance would be a valuable asset in crafting this policy and I attempted to accept your offer. On November 20, I wrote Google corporate officials to request that two counsels from the House Energy and Commerce Committee staff be permitted to visit your California headquarters offices, at Committee expense. The purpose of this trip was to learn first-hand about existing search and targeted advertising technology, what information may be garnered through the use of this technology, how that information is used, and, most importantly, how that information could be used. Google officials with whom we spoke deemed the dates inconvenient, and the request was denied. Since then, all efforts to reach a mutually agreeable time have been rebuffed, and it begins to seem that no date for a visit is sufficiently convenient to Google. Your warm initial invitation followed by Google's chilly response to a proposed visit by Committee counsels is disconcerting. To help us better understand the privacy and consumer protection implications of this transaction, please respond to the following questions: 1. Please describe Google's retention policy with respect to the following data. Include in your response a description of the type of data retained (for example, URL, Internet Protocol [IP] address, date, time of connectivity); the length of time the data is retained; where the data is retained; who has access to the retained data; and how the data is removed, deleted, or anonymized once the retention period lapses. a. Search queries on Google search; b. Search queries on Google maps; c. Search queries on Google news; d. Search queries on Google images; e. Email sent, received, or drafted on Gmail; f. Information or data collected or retained through a website's use of Google Analytics; g. Information or data collected or retained from an individual's use of Google Desktop Search, including the Google Desktop Search feature, Search Across Computers; h. Google Maps for Mobile; i. Google Web History Program for registered Google users/Google users with sign-in accounts; j. Information or data collected or retained from an individual's use of Picasa; k. Information or data collected or retained from an individual's use of Calendar; l. Cookies. 2. Please explain how Google uses the information or data described in Question 1(a) - (l), including, but not limited to, the following uses: perfecting Google's search algorithm; operating Google's advertising programs such as AdWords and AdSense; and research or analysis of user activity on www.google.com. 3. Please explain the need to retain collected information for the length of time described in your response to Question 1. 4. Please explain how Google uses the information or data described in Question 1(a) - (1), or any additional data, to drive or target advertisements to individual users' computers. 5. In particular, please explain whether Google Maps directs advertisements to IP addresses based on that user's Google Maps search query history. 6. Please explain how and why information is combined or shared across platforms when consumers opt-in for personalized services and whether Google first requires consent prior to such information-sharing. (For instance, whether search query data is shared with or linked to a user's Gmail account.) 7. Please identify the sections of Google's privacy policy that address the retention and use of the data described in Question 1(a) - (l). 8. Please explain the technology called "rich media" or "interactive multimedia," how this technology works, and what information may be collected by its use. 9. Please explain whether Google utilizes such technology. 10. Please explain whether Google posts a link to its privacy policy on the home page or search results page of www.google.com and, if not, explain why not. 11. In Google's privacy policy, "personal information" is defined as "information that you provide to us which personally identifies you, such as your name, email address, or billing information, or other data which can be reasonably linked to such information by Google." a. Please describe how Google interprets "reasonably linked." b. Please explain in what circumstances Google links information such that an individual can be identified. c. Please explain whether Google considers an IP address to be "personal information." d. Please explain whether technology exists to personally identify or determine the personal characteristics, including, but not limited to, name, email address, physical address or location, age, gender, or ethnicity of an Internet user based on that user's IP address. e. Please explain whether Google is capable of identifying or determining personal characteristics, including, but not limited to, name, email address, physical address or location, age, gender, or ethnicity of an Internet user based on that user's IP address. 12. Please define the term "anonymization" as related to the data collected as described in, but not limited to, Question 1(a) - (l). 13. Are Google's practices described in response to Question 12 consistent with industry-wide practices? If not, please describe any variance. 14. Please describe how Google anonymizes IP addresses. 15. Please describe how Google anonymizes cookie data. 16. Please explain whether Google has the capability or has attempted or plans to attempt to combine or merge the data described in Question 1(a) - (l). 17. Please define tracking cookies, which may track users across multiple websites, and how they function. 18. Please explain whether Google uses the tracking cookies described in response to Question 17. If the answer is no, please describe how Google's cookies are distinct from those described in Question 17. 19. Please explain whether Google's cookies reset and, if so, how and when the cookies reset. 20. If the merger of Google and DoubleClick is approved, please describe what use Google plans to make of the data retained and collected by DoubleClick (for example, data from DoubleClick's tracking cookies or DoubleClick click-stream data), and whether Google plans to combine or merge DoubleClick's data with data Google retains from individual search queries and other user activity on www.google.com. a. If Google does not intend to merge or combine the data Google retains with the information or data retained or collected by DoubleClick, please describe the efficiencies of the Google-DoubleClick merger. b. If Google does not intend to merge or combine the data Google retains with the information or data retained or collected by DoubleClick, please explain how the information will be segregated. 21. Please describe how Google defines "behavioral targeting." 22. Please describe your understanding of the broader industry's definition of "behavioral targeting." 23. Please describe Google's understanding of the Asia-Pacific Economic Cooperation (APEC) guidelines and how the guidelines would apply to Google's practices, including, but not limited to, those functions described in Question 1(a) - (l). 24. The House passed the Securely Protect Yourself Against Cyber Trespass (SPY ACT) in the current and prior two Congresses. The SPY ACT, H.R. 964, sponsored by Representatives Mary Bono and Adolphus Towns, mandates an opt-in privacy regime by prohibiting the collection of personal information from a computer without a user's notice and consent prior to the execution of any information collection program. H.R. 964 also demands that a user be able to easily remove or disable the information collection program. Please explain whether Google's applications are subject to H.R. 964's consent requirements. If the answer is no, please explain why these programs, which collect personal information, are not subject to the consent regime established by H.R. 964. As I mentioned above, I believe Google's participation in our research into and consideration of the consumer protection implications of a merger of any online search engine and any behavioral or targeted advertising firm is vital to crafting sound national policy. In furtherance of this goal, I hope that we may achieve your response to the above questions no later than Tuesday, December 18, 2007. Sincerely, Joe Barton Ranking Member cc: The Honorable John Dingell, Chairman The Honorable Bobby Rush, Chairman, Subcommittee on Commerce, Trade, and Consumer Protection The Honorable Cliff Stearns, Ranking Member, Subcommittee on Commerce, Trade, and Consumer Protection The Honorable Ed Markey, Chairman, Subcommittee on Telecommunications and the Internet The Honorable Ed Whitfield, Member The Honorable Deborah Platt Majoras, Chairman, Federal Trade Commission (Disclosure: Declan McCullagh is married to a Google employee.) *** Information Week - Dec 13, 2007 http://www.informationweek.com/news/showArticle.jhtml?articleID=204802847 Google-DoubleClick Deal Suffers Setbacks Privacy implications top a ranking congressman's concerns, while potential conflict of interest is on the minds of online rights groups. By Thomas Claburn Information Week Google's plan to acquire Internet advertising company DoubleClick suffered two setbacks on Wednesday. The Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy, two online rights advocacy groups, filed a motion with the secretary of the Federal Trade Commission asking that FTC chair Deborah Platt Majoras be recused from the ongoing Google-DoubleClick merger review because her husband's law firm, Jones Day, is representing DoubleClick before the European Commission. Majoras has not yet made a decision about her participation in the Google-DoubleClick review. "The chairman is reviewing the petition with our chief ethics officer," said an FTC spokeswoman. "We found out on Tuesday that Jones Day is representing DoubleClick before the European Commission. Jones Day has not appeared before the Federal Trade Commission in this matter." DoubleClick said in an e-mailed statement, "Simpson Thacher has been DoubleClick's outside counsel since July of 2005 and was retained to represent it in all aspects of its proposed acquisition by Google, including with respect to United States antitrust matters." The company confirmed that Jones Day represents it in Europe and other non-U.S. jurisdictions. Also on Wednesday, Rep. Joe Barton, ranking Republican on the House Energy and Commerce Committee, sent a letter to Google seeking answers to 24 questions about Google's privacy practices and policies as they relate to the company's proposed DoubleClick acquisition. Barton's letter to Google CEO Eric Schmidt describes how his efforts to arrange a visit from two staff members on the House Energy and Commerce Committee have been frustrated. Suggesting that Google could do more to win friends in Washington, the letter complains that, "Your warm initial invitation followed by Google's chilly response to a proposed visit by committee counsels is disconcerting." A Google spokesman paints a different picture, noting that the committee staffers proposed to visit on short notice, at a time when senior executives were attending the YouTube-hosted Republican debate in Florida. Barton isn't the only one questioning the privacy implications of the DoubleClick deal. Since Google announced its intention to buy DoubleClick in April, the proposed deal has drawn criticism from privacy groups and scrutiny from legislators in the United States, the European Union, and Australia. Despite the ongoing privacy questions, Google maintains that acquiring DoubleClick will promote innovation and competition, and that Google is deeply committed to privacy. "We make privacy a priority because our business depends on it," said David Drummond, Google's senior VP of corporate development and chief legal officer, at a congressional hearing in September. "If our users are uncomfortable with how we manage the information they provide to us, they are only one click away from switching to a competitor's services. If you don't believe me, recall that before Google, users clicked on an earlier generation of search engines like Excite, AltaVista, Lycos, and Infoseek -- each extremely popular in its time. User interests effectively regulate our behavior, and user trust is a critical component of our business model." *** Wired - Dec 14, 2007 http://blog.wired.com/business/2007/12/ftc-chair-refus.html FTC Chair Refuses to Recuse Herself on Google-DoubleClick Deal By Betsy Schiffman Federal Trade Commission chairwoman Deborah Platt Majoras is not going to be stopped by a couple of privacy-loving non-profits. Majoras says she will not recuse herself from the Google-DoubleClick review, despite a petition from the Electronic Privacy Information Center and the Center for Digital Democracy. The groups filed a petition earlier this week calling for her disqualification on the matter, citing a conflict of interest. (Majoras' husband works for law firm Jones Day, which represents DoubleClick in the antitrust case in Europe. Majoras also used to work at Jones Day.) Majoras We don't claim to be attorneys, but Majoras' defense seems lame. Her argument is this: a)Jones Day has never represented DoubleClick in front of the FTC, and b) her husband is a fixed participation partner, and not an equity partner at Jones Day, so he doesn't have a financial interest in the outcome of the case. This is what we don't get: Even if her husband's income is fixed, Jones Day still signs his paychecks. We're not really sure how he couldn't have a financial interest in the case. (Unless perhaps the Majorases are obscenely wealthy and paychecks are a trivial, silly matter?) Now, you could (and many do) argue that the investigation is a sham, but if the FTC is going to go through with it, why not do it right? * ================================================================= NY Transfer News Collective * A Service of Blythe Systems Since 1985 - Information for the Rest of Us Our main website: http://www.blythe.org List Archives: http://blythe-systems.com/pipermail/nytr/ Subscribe: http://blythe-systems.com/mailman/listinfo/nytr =================================================================