It is important to realize that before Like.com was helping people find shoes and watches online, its technology was the core of Riya, a photo sharing and search site that allowed users to upload, tag and search images based on facial recognition technology. Users simply uploaded their photo library to Riya, tag faces in a handful of the photos, and then Riya’s facial recognition technology took over and attempt to automatically tag different faces it “recognizes” so that you don’t have to. Riya’s vision was to expand this facial recognition beyond an individual’s library, and eventually reach every digital photo scattered across the Web.

Over 4 years ago, I wrote about the privacy implications of Riya’s facial recognition technology here and here. I warned then:

Sure, it would be great if I could easily search for pictures of me on the web, but do I want others to be able to do that as well? Could this provide a useful tool for stalkers looking for a particular person? Abusive partners trying to track down their victim? (Note that Riya also uploads and indexes all the metadata related to your photos, including the date and time is was taken, when it was uploaded, etc. Users can also tag and search photos based on location). …there are externalities once all of the images of our daily lives (and their related metadata) are uploaded to the Internet, indexed, searchable, and accessible to all.

Google almost bought Riya back in 2006, but acquired Neven Vision instead, and soon integrated basic facial recognition into its image search results, and, later, into Picasa and Orkut.

With the purchase of Like.com, Google obtains the original Riya technology. Coupled with other recent social networking related acquisitions, Google appears poised to make a run at Facebook, with Riya providing the means to automate photo tagging at a scale Riya could only have dreamed of. What remains to be seen is how carefully Google will consider the privacy implications of unleashing powerful face recognition technology on throngs of users.

Related posts: (automatically generated)

1. Riya: Facial recognition for the masses
2. Photo Finder: Automated Facial Recognition on Facebook
3. Polar Rose: More Amateur Facial Recognition
4. Amateur Facial Recognition Creeps Closer
5. Gmail Pictures Used For Face Recognition?

Google’s explanation was that this privacy invasion was a mistake, and happened because some code inadvertently made its way into the Street View vehicles’ software. While I trust Google that this was a mistake, and that the data wasn’t used for anything, it reveals a significant lack of control over what its fleet of vehicles are doing — and what they are capable of doing without Google apparently knowing. It also reveals yet another example of how Google failed to recognize and address possible privacy issues related to the the fact they are deploying an army of vehicles to harvest information about the physical (and now wireless) terrain.

But not to be left out of the recent spate of dotcom executives making ignorant statements about online privacy, Eric Schmidt, Google’ CEO, had this response when asked about possible EU charges against Google for the WiFi privacy invasion:

“no harm, no foul”

and

“Who was harmed? Name the person.”

and

it was “highly unlikely” that any of the collected information was “useful” and that there appeared to “have been no use of that data.”

So, once again, we have the person in charge of a dominant Web company, a company in control of huge amounts of personal data about millions of users, defining privacy concerns solely in terms of the potential (or real) harm that could occur.

Schmidt’s harm-based conception of privacy supposes that so long as the data can be protected/prevented from being used to cause harm, the privacy of the subjects is maintained. Since no one was hurt, Schmidt appears to say, then what’s the big fuss?

Such a position ignores the broader dignity-based theory of privacy. This view recognizes that one does not need to have a tangible harm take place in order for there to be concerns over the privacy of one’s personal information. Rather, merely having one’s  information stripped from the intended sphere (personal WiFi network), and amassed by passing vehicles operated by the world’s largest search engine becomes an affront to the subjects’ human dignity and their ability to control the flow of their personal information.

But Schmidt doesn’t see things this way. Why? My theory is because he’s an engineer, not an ethicist. To an engineer, if the data has no obvious use-value, and no one was hurt, then all is good with the world. To an ethicist, harvesting personal information from the spheres of one’s personal WiFi network (whether the network was open or closed) is a privacy violation.

Until the computer scientists and engineers running the companies that possess so much of our personal information start to understand online privacy from contextual and dignity based frameworks, our privacy remains in peril.

[image source]

Related posts: (automatically generated)

1. Google Responds to SanFran Wi-Fi Privacy Concerns
2. Google Bows to German Data Privacy Demands, but Only Germany
3. I want my Google Data Privacy
4. Google’s Schmidt: “Google knows a lot about the person surfing”
5. Google’s “Street View” and Privacy in Public

In January of this this year, Google was the victim of a cyber-attack that originated from China. In its description of the attacks, Google noted that the ultimate target of these attacks included human rights activists, with the apparent intent to surveill their communications on various Google platforms. This, along with what Google described as “attempts over the past year to further limit free speech on the web”, prompted Google to announce that it was “no longer willing to continue censoring our results on Google.cn”.

This appeared to a major breakthrough, as numerous attempts to get Google to end their censorship of the Web and to fully embrace a commitment to protecting human rights had all previously failed.

Over three months have passed since this announcement, and today we finally learned Google’s “new approach” to China: pack up and move to Hong Kong.

Starting today, users visiting Google.cn will be redirected to Google.com.hk, Google’s Hong Kong search portal, where search results will be provided free from the filtering Google had previously been performing on Google.cn. Google is touting this as ending censorship in China, but, as Siva Vaidhyanathan has pointed out, that really isn’t the case. It’s an end-around. A slight-of-hand.

Google is simply routing customers to the Hong Kong site, where it — presumably — doesn’t have to abide by China’s laws regarding censorship (to get a .cn domain, you have to agree to comply with all applicable laws, regulations and policies of the China’s governmental agencies and the China Internet Network Information Center). So, while Chinese users will now be able to access unfiltered results at Google.com.hk, they could always do that simply by going to Google.com. The Chinese government can now simply block access to individual websites through its firewall like before. We’re back to square one.

There have been suggestions that China must now decide whether to censor a Hong Kong-based service, something it has been hesitant to do. I don’t see it this way. China doesn’t need to touch the Google.com.hk site; all it needs to do is continue to block access to the sites it doesn’t want people from Chinese IP addresses to view. It matters little whether the link was clicked from a search results page on Google.com or Google.com.hk or even Baidu.com. China won’t need to tread onto Hong Kong’s quasi-independence to continue its censorship.

A final point targeted at Google’s apparent skirting of its ethical responsibility. By refusing to stay and fight Chinese censorship directly (such as how Wikipedia has tried to stand firm), Google is waking away from any influence it might have towards ending oppressive censorship in China. When it first announced its cooperation with Chinese censors, Google defended its actions at a hearing before the Committee on International Relations of the U.S. House of Representatives by saying this:

If Google were to stay out of China, it would remove powerful pressure on the local players in the search engine market to create ever-more-powerful tools for accessing and organizing information. Google’s withdrawal from China would cede the terrain to the local Internet portals that may not have the same commitment, or feel the competitive pressure, to innovate in the interests of their users.

Apparently Google is now content with ceding the terrain, and leaving Chinese Internet users at the mercy of “local Internet portals” like Baidu, who has been described as being “the most proactive and restrictive online censor in the search arena.”

I know Google is trying to do the right thing here, and it hopes it can deliver unfiltered results to China from Google.com.hk (or force China to take some kind of action against the Hong Kong site). But I fear this move will instead result in further failure to serve the interests of Chinese Internet users, and another lost opportunity to fight oppressive online censorship.

UPDATE: As predicted, China is now blocking some access to the redirected Google.com.hk site, as well as some of the linked sites.

[image via hunxue-er]

Related posts: (automatically generated)

1. China vs. Germany: Comparing Google’s Censorship Practices
2. Google Now Officially Censoring In China
3. Brin says Google compromised principles in China
4. Google moving search records out of China
5. Google Censorship FAQ

Use information to provide our users with valuable products and services.

Develop products that reflect strong privacy standards and practices.

Make the collection of personal information transparent.

Give users meaningful choices to protect their privacy.

Be a responsible steward of the information we hold.

The principles are further explained in a video on the Google Blog (interestingly posted by an engineer, not one of Google’s legal/policy folks).

I like these principles; they are something every organization should commit to and strive for. The problem is, Google hasn’t adhered to them quite as closely as they’d want you to believe. Let’s consider each:

1. Use information to provide our users with valuable products and services. This isn’t so much a privacy principle as it is a disclaimer for what Google purports to do with all the data it collects about its millions of users. Google tracks what we do in order to know whether our search for “Paris Hilton” is about the blond or the hotel. This principle merely presents the value proposition for Google’s potential violation of user privacy.

2. Develop products that reflect strong privacy standards and practices. A very important goal, but the product featured in Google’s video, off-the-record chats in iChat, isn’t providing the kinds of privacy protections that most consumers or advocates clamor for. Certainly, being able to control (to an extent) whether my chats are logged is a way to protect my privacy, but what about IP logging or behavioral targeting? Perhaps Google doesn’t want to bring up its current data retention policies given Microsoft’s recent announcement. And perhaps it doesn’t want to actively promote one of its truly innovative privacy protecting product — the Google Advertising Cookie Opt-Out Plugin — since the more users who install the plugin, the less valuable its advertising platform becomes.

3. Make the collection of personal information transparent. Despite what Google claims about Dashboard, there remains an enormous lack of transparency regarding the collection of user information (Google Analytics comes immediately to mind). If Google was committed to transparency, it wouldn’t have resisted placing a link to its privacy policy on the homepage. If Google was committed to transparency, its behavioral targeting system would be opt-in and would provide a conspicuous link to “Ad Privacy Preferences”.

4. Give users meaningful choices to protect their privacy. Google touts the ability to report problems in Street View and the removal of one’s search history as examples of this principle. Of course, the Street View example has a horrid history, and removing your search history only removes it from that product’s interface, not from Google’s main server logs. That’s a limited choice, not a fully meaningful one.

5. Be a responsible steward of the information we hold. I have faith that Google is indeed being responsible with our information, and that it is keeping it secure. But while security is often necessary to ensure privacy, it certainly isn’t a sufficient condition, and the gaps in the preceding principles overshadow Google’s good stewardship.

In summary, I do give Google much credit for the steps they’ve taken in recent years to improve its privacy practices and communication. But too often its rhetoric is too self-congratulatory, and fails to recognize serious gaps in its approach to user privacy.

These principles are vital, and I hope Google continues to strive to meet them. There is much work still to be done.

Related posts: (automatically generated)

1. Brin says Google compromised principles in China
2. FTC Proposes Self-Regulatory Principles for Online Behavioral Advertising
3. Google’s Peter Fleischer is Dangerously Misleading on Privacy and Personalized Search
4. Google Launches Behavioral Advertising System, With Impressive (But Not Quite Perfect) Privacy Controls
5. Google Analytics and End User Privacy

Remember how hard we gad to fight to convince Google to include a link to its privacy policy on the Google.com homepage?

Remember how Google argued “we do believe that having very limited text on our home page is important” and that it was pitched as some great sacrifice to include the word “privacy” and disrupt the homepage’s aesthetics?

Remember how, just a month ago, Google argued that a “clean, minimalist approach” to their homepage gives users “just what they are looking for first and foremost” — thus only the search box appeared when you visit Google.com, with all the other content (including the privacy policy link) only fading in if you happen to move the mouse?

Apparently none of this is nearly as important as shilling promoting Google’s new phone, the Nexus One. If you visit Google.com today, you’ll notice everything faded out except a prominently placed Nexus One advertisement:

Move your mouse, and then everything else fades in (including yet another advertisement for Google Chrome, and an ugly one at that):

Yes, we’ve seen this kind of hypocrisy before…

UPDATE (1/7/2010): Google has now changed the way the homepage loads, with the Nexus One ad faded out and only appearing with the other content when the use moves the mouse. I’d be curious to see what kind of discussions led to the original design, and this revert.

[Minor update: crossed out "shilling", since it is Google's own phone]

Related posts: (automatically generated)

1. Google Shills for Droid on Homepage
2. On Google’s New Homepage, Privacy Fades Away
3. Disrupting Google’s homepage with a 14-charater string
4. Google (Quietly/Oddly) Adds Privacy Link to Homepage
5. Google Wants You to Search for their Privacy Policy (and they get to record that query!)

Sometimes, however, that trust can be misplaced.

Recently, a student in one of my classes gave a presentation on Google, and proceeded to explain how Google ranks search results using an algorithm called…..PigeonRank:

Why Google’s patented PigeonRank™ works so well

PigeonRank’s success relies primarily on the superior trainability of the domestic pigeon (Columba livia) and its unique capacity to recognize objects regardless of spatial orientation. The common gray pigeon can easily distinguish among items displaying only the minutest differences, an ability that enables it to select relevant web sites from among thousands of similar pages.

By collecting flocks of pigeons in dense clusters, Google is able to process search queries at speeds superior to traditional search engines, which typically rely on birds of prey, brooding hens or slow-moving waterfowl to do their relevance rankings.

When a search query is submitted to Google, it is routed to a data coop where monitors flash result pages at blazing speeds. When a relevant result is observed by one of the pigeons in the cluster, it strikes a rubber-coated steel bar with its beak, which assigns the page a PigeonRank value of one. For each peck, the PigeonRank increases. Those pages receiving the most pecks, are returned at the top of the user’s results page with the other results displayed in pecking order.

PigeonRank, of course, is a hoax, part of Google’s 2002 April Fool’s Day joke. But how did my student fall for it in 2009?

Simple. He trusted Google.

The first result when you search Google for “How does Google work?” is a link and a blurb purported to describe precisely that:

My student clicked on the link, read, and digested the information. He trusted Google.

Sure, a bit more information literacy might have tipped him off that this was a joke, but, like many folks, he had no real clue how Google works and simply trusted the result. (At the bottom of the page is a disclaimer that it is just a hoax, but he must not have seen it.)

So, making this a teaching moment, we learn from this experience that:

1. Many people still do not understand how Google works.
2. Many people trust Google search results and believe that what appears first is the correct information.
3. We need to teach information literacy as a core competency for all students.
4. We need to think about whether Google has any kind of responsibility to ensure hoaxes (especially of its own making) are marked as such within Google results. (I’m not necessarily suggesting this, but it makes for a good classroom discussion)

UPDATE: The minds at Crooked Timber have a nice discussion of this episode…

UPDATE: This item has been picked up over at MetaFilter.

Related posts: (automatically generated)

1. In Google We Trust
2. Google’s Chief Privacy Counsel: “Don’t trust fat businessmen”
3. Google and the Mission to Map Meaning and Make Money
4. Google on the Cover of Time Magazine
5. Google’s Schmidt: “Google knows a lot about the person surfing”

Aesthetically, this isn’t without its charm, and we all know how anal Google can be regarding the minimalist design of its homepage.

But it took so much effort to get Google to finally add a mere 7-letter hyperlink to its privacy policy on the homepage, it pains me to see it disappear again….

UPDATE: It has been suggested to me that having the privacy policy link “fade-in” might actually draw more attention to it than it simply being visible from the onset. That’s a testable hypothesis that I hope one of my quantitative-leaning colleagues might tackle.

Yet, the fact remains that in Google.com’s natural state, the link is invisible. A user can visit the site, simply start typing search terms, and click return to view the results. Thereby, preserving Google’s minimalist aesthetics, and keeping the links tucked out of view. That might be cool web design, but it is poor privacy compliance.

Speaking of, I wonder what the State of California will think about this, since it was California’s law requiring a privacy policy be “conspicuously” placed on a website’s homepage that finally compelled Google to add the link in the first place. If a user has to interact with a page in order to make the link visible, is that sufficiently conspicuous?

Related posts: (automatically generated)

1. Google (Quietly/Oddly) Adds Privacy Link to Homepage
2. Google’s Homepage Hypocrisy
3. Disrupting Google’s homepage with a 14-charater string
4. Google Shills for Droid on Homepage
5. Google Wants You to Search for their Privacy Policy (and they get to record that query!)

Last week, however, this all changed. Google announced two new “features” in Latitude: Location History and Location Alerts.

Location History allows users to opt-in to having Google keep a history of their locational data tracked by Latitude. Only you can see it, and you can remove items from your history, which is great. But for everyone who activates this service, there’s now a log in Mountain View of everywhere your cellphone has been, a log that could be shared with third parties in according with its privacy policy.

More people might activate Location History when they learn about Location Alerts, a service that notifies you if a friend happens to be nearby. The beauty of Location Alerts is that you won’t be altered when people are simply engaging in their routine activities (ie, you won’t be alerted every time your coworker sits down at their cubicle across from you) . Instead, it “learns” what users’ “normal” locations are, and only notifies friends if they are nearby in an unusual place or time. To make this work, you need to have Location History activated, and in the process, Google is able to create a type of “locational profile” for each user. It is unclear whether this profile might be used for other purposes (ie, targeted advertising).

Google, of course, realizes the privacy implications of all this, and again takes some steps to help mitigate these concerns. there are FAQs for each product detailing how they work and the privacy concerns; the services are op-in; users are reminded periodically when they have Location History activated (Google should do this for all products, btw).

But all this makes me wonder: did Google plan to provide these services from the start, just with a delay? Did Google learn the lessons of Facebook, who repeatedly bites off more than it can chew as it relates to users’ privacy, and decided to launch Latitude without these features, thereby winning the praises of privacy advocates (guilty), and then strategically add them 9 months later, claiming it is simply in response to user demand?

If my fears are true, it’s not quite what I had in mind when calling on Google to engage in value-conscious design in order to protect user privacy.

Related posts: (automatically generated)

1. With Latitude, Google Actually Got it (Mostly) Right
2. Google Web History: Not the Realm of Conspiracy Theorists
3. Google to Blur Personal Data on Street View Upon Request — But Requesting Remains Difficult
4. Google’s My Search History
5. Google adds a (dangerous) Firefox tune-up

Remember how Google argued “we do believe that having very limited text on our home page is important” and that it was pitched as some great sacrifice to include the word “privacy” and disrupt the homepage’s aesthetics?

Apparently providing users easy access to information about their privacy is much more burdensome for Google than providing a link to where people can buy Verizon’s Droid mobile phone.

Today, Google.com features an advertising message that the Droid is now for sale, and includes a link to this page touting its benefits, and prompting users to buy it from Verizon.

Makes me long for the days when Sergey Brin and Lawrence Page proclaimed that advertising has no place in search engines:

Currently, the predominant business model for commercial search engines is advertising. The goals of the advertising business model do not always correspond to providing quality search to users. …It is clear that a search engine which was taking money for showing cellular phone ads would have difficulty justifying the page that our system returned to its paying advertisers. For this type of reason and historical experience with other media, we expect that advertising funded search engines will be inherently biased towards the advertisers and away from the needs of the consumers. …we believe the issue of advertising causes enough mixed incentives that it is crucial to have a competitive search engine that is transparent and in the academic realm.

And I wonder if there’s any chance the presence of Bert & Ernie could be seen as a product endorsement….

Related posts: (automatically generated)

1. Google’s Homepage Hypocrisy
2. Disrupting Google’s homepage with a 14-charater string
3. On Google’s New Homepage, Privacy Fades Away
4. Google (Quietly/Oddly) Adds Privacy Link to Homepage
5. Google’s Schmidt: “Google knows a lot about the person surfing”

All this said, I was quite excited at the launch of Google Dashboard:

Google describes Dashboard as a simple way to view “the data associated with your account”, and that it will provide users “greater transparency and control over their own data.” Elsewhere, Dashboard has been described as a “big concession to users’ privacy rights“, as the answer to the question: “What does Google know about me?”, and as a place providing users “more control over the personal information stored in Google’s databases“.

Unfortunately, Google Dashboard is none of these things.

What Google Dashboard provides is a single place to browse the list of most of the Google services you’ve signed up for, quick links to their individual settings pages (including privacy settings & policies), summary statistics of your usage of these services, and indications of what details I’ve shared with others.

While this is a very convenient new interface, and a helpful reminder of some of the services and settings that I might have long forgotten were activated on my account, Dashboard isn’t providing any new transparency or new control over the data Google knows about me. I still only see that information Google wants to make available to me through its interfaces. I still only get to control the limited data Google allows me to control.

Sure, from the Dashboard I can go and look at my Web search history, for example (and this screenshot confirms that my TrackMeNot Firefox Extension is successfully sending ghost queries to Google!), and from there I can remove stored searches from the service. But remember, this is only removing the searches from the Web History service, not from Google’s primary search query logs (as Google acknowledges here). There is no new level of control over the personal information stored in Google’s databases. Simply convenience.

(And, FWIW, Dashboard could be made even more convenient if Google simply had a link to “Dashboard” in the upper right corner after you log in, rather than having to click Settings -> Google Account Settings -> View data stored with this account)

The convenience Dashboard provides is helpful. Users should be regularly reminded of what services they sign up for, what information is being collected, and what their current privacy settings are. And hopefully Facebook will follow Google’s lead and provide similar convenience. But, unfortunately, Google Dashboard is no concession to users’ privacy rights. A helpful step, but we still have a long road ahead of us.

UPDATE: Others agree with my assessment of Dashboard. ReadWriteWeb notes that “Google’s Privacy Dashboard Doesn’t Tell Us Anything We Didn’t Know Before”, while Mashable recognizes that “Dashboard is nothing more than a selected list of privacy-related settings”. And Fred Stutzman correctly observes in the comments below that “By creating this interface, Google gets to functionally define the “sense” of information collection/retention. That is, their sense of the boundaries of collection will be informed by the interface. But…this interface minimizes the true extent of data retention.” Indeed.

Related posts: (automatically generated)

1. Google on Transparency
2. Demanding Transparency in GoogleNews
3. Transparency in GoogleNews
4. Digital Footprints: Online identity management and search in the age of transparency
5. Google’s Privacy Principles Fall Short