Google’s explanation was that this privacy invasion was a mistake, and happened because some code inadvertently made its way into the Street View vehicles’ software. While I trust Google that this was a mistake, and that the data wasn’t used for anything, it reveals a significant lack of control over what its fleet of vehicles are doing — and what they are capable of doing without Google apparently knowing. It also reveals yet another example of how Google failed to recognize and address possible privacy issues related to the the fact they are deploying an army of vehicles to harvest information about the physical (and now wireless) terrain.

But not to be left out of the recent spate of dotcom executives making ignorant statements about online privacy, Eric Schmidt, Google’ CEO, had this response when asked about possible EU charges against Google for the WiFi privacy invasion:

“no harm, no foul”

and

“Who was harmed? Name the person.”

and

it was “highly unlikely” that any of the collected information was “useful” and that there appeared to “have been no use of that data.”

So, once again, we have the person in charge of a dominant Web company, a company in control of huge amounts of personal data about millions of users, defining privacy concerns solely in terms of the potential (or real) harm that could occur.

Schmidt’s harm-based conception of privacy supposes that so long as the data can be protected/prevented from being used to cause harm, the privacy of the subjects is maintained. Since no one was hurt, Schmidt appears to say, then what’s the big fuss?

Such a position ignores the broader dignity-based theory of privacy. This view recognizes that one does not need to have a tangible harm take place in order for there to be concerns over the privacy of one’s personal information. Rather, merely having one’s  information stripped from the intended sphere (personal WiFi network), and amassed by passing vehicles operated by the world’s largest search engine becomes an affront to the subjects’ human dignity and their ability to control the flow of their personal information.

But Schmidt doesn’t see things this way. Why? My theory is because he’s an engineer, not an ethicist. To an engineer, if the data has no obvious use-value, and no one was hurt, then all is good with the world. To an ethicist, harvesting personal information from the spheres of one’s personal WiFi network (whether the network was open or closed) is a privacy violation.

Until the computer scientists and engineers running the companies that possess so much of our personal information start to understand online privacy from contextual and dignity based frameworks, our privacy remains in peril.

[image source]

Below are some of the Street View images he has found, along with his closing remarks. I urge everyone to read and feel the entire essay.

The collections of Street Views both celebrate and critique the current world. To deny Google’s power over framing our perceptions would be delusional, but the curator, in seeking out frames within these frames, reminds us of our humanity. The artist/curator, in reasserting the significance of the human gaze within Street View, recognizes the pain and disempowerment in being declared insignificant. The artist/curator challenges Google’s imperial claims and questions the company’s right to be the only one framing our cognitions and perceptions.

Google has conceded, and will now erase identifiable raw data depicting people, property, or cars upon request.

This is a first, and it is significant, but it is an exception only for Germany.

Rather than taking a broader value-centered approach to designing its systems, Google continues to base their decisions based (primarily) on local laws. The U.S. lacks laws guaranteeing individuals “privacy in public,” so Google launches street view with minimal (and poorly-executed) ability to protect one’s privacy. Canada, however, does have such laws, so Google decided to blur faces there (but only applies that engineering solution to Canada). Now, Germany wants the source data purged, so Google will only provide this privacy-protecting measure to that local authority.

A broader values-centered approach would (learning from the Canadian and EU legal environment) recognize that protecting one’s privacy in public might indeed be a fundamental right, and perhaps is something that must be designed into such a potentially privacy-invasive tool as Street View.

I’ve informally chatted with Google folks about these issues, and I applaud that they do have law/policy folks on every product team. But too often, when asked about something like “why didn’t you blur the faces in the U.S. version”, the answer is “the law doesn’t require it”. Such a strict legal approach to designing (or not) ethics into products is extremely shortsighted.

Do we need to start calling for Chief Ethical Officers in our corporations?

Most recently, Germany has noted that Google’s (reluctant) blurring of faces and license plates is not enough, demanding that the original images themselves be permanently removed from their databases. Google argues that the original images are necessary to help the system “learn” how to automatically blur better in the future. This sounds like a valid need from an engineering perspective, but the key dilemma here is how to manage the balance between engineering and ethics. Just because the engineers want to have access to the original images doesn’t mean they should remain.

These are difficult decisions to make, but we’re here to help…

Meanwhile, I’ll take this opportunity to reiterate what I’ve previously suggested Google do to alleviate some of the privacy concerns with Street View:

1. Make use of their own facial recognition technology to automatically scan the Street View image database to identify and blur all faces, thereby protecting privacy and differentiating themselves from Microsoft’s offering. This should be done in all Street View products, not just the Canadian version.
2. Make reporting inappropriate images easier by placing a specific  “report this image” link on each image screen, not just a generic “help” link.
3. Think harder about privacy in public, and recognize that just because a random person can take another random person’s picture in public doesn’t mean there’s no difference in having a similar image available on Google.

Novel pragmatic frameworks have recently emerged to ensure that particular attention to values becomes an integral part of the conception, design, and development of technological artifacts and systems. These value-conscious design frameworks — known variously as Design for Values (as conceived by L. Jean Camp), Values at Play (Helen Nissenbaum & Mary Flanagan), and Value Sensitive Design (Batya Friedman) — seek to broaden the criteria for judging the quality of technological systems to include the advancement of ethical and human values, and to proactively influence the design of technologies to account for such values during the conception and design process.

I strive to contribute to these attempts to bring value considerations systematically to bear on the design and development of new media and communication technologies. Examples include my dissertation research on the value implications of the quest for the perfect search engine, my work on the privacy and surveillance aspects of vehicle safety communication systems, and more recent explorations into Web 2.0 information infrastructures.

Clearly, there is no shortage of potential applications of value-conscious design, as there continues to be a glaring need among major ICT providers to consider the value and ethical implications of their products before rolling them out to the masses. Consider recent examples from two of the current darling companies — Facebook and Google:

(more after the fold)

Facebook:

In September of 2006, Facebook launched the mini-feed, ignoring how the new “feature” impacted the norms of personal information flows — that the contextual integrity of the flow of information within Facebook was disrupted. When they tried to address the concern, the expanded privacy settings were defaulted to the maximum sharing of personal information — hardly a stance revealing a commitment to protecting user privacy. We also must not forget that the mini-feed was automatically activated for every user. This revealed an obvious case where user values should have been considered in the initial design stages of the feature; a value-conscious design approach would have recognized how such a feature would have been seen as a privacy violation by many, and its default settings and other design features would have been tweaked accordingly.

Now, a year later, Facebook has repeated the same mistakes, again failing to engage in the value-conscious design of new “features” to their popular service. In pursuit of advertising revenue, Facebook released Facebook Ads, a complex system whereby Facebook cookies are retrieved at third-party e-commerce sites, users are given 20-seconds to opt out (the default is to participate, and the screen disappears with the option still checked if no action is taken), and users’ likenesses are appropriated to shill for products. With all this, Facebook has again disrupted the contextual integrity of personal information flows, and made it difficult for users to opt-out of the potentially privacy-threatening situation. Only after significant complaints, including a campaign by MoveOn and threats of an FTC investigation, Facebook modified how Beacon works in order to better protect user privacy. Again, a value-conscious design approach would have likely prompted the release of this more privacy respecting variation in the first place. Instead, Facebook is left to try to protect values on the back end.

Google:

About 6 months after Microsoft launched their Windows Live Local Virtual Earth service, providing street level images of San Francisco and Seattle, Google jumped into the foray, offering their own “Street View” enhancement for Google Maps. You can drive or walk around a map and view the streets and storefronts…and the people. This detailed level of mapping carries significant concerns about one’s privacy in public, given the prevalence of visible and identifiable faces and license plates captured by their fleet of camera-toting cars trolling our streets, which I pointed out at the time.

To remove yourself from the database of images, Google first required submission of your legal name, e-mail address, a copy of your driver’s license or other government ID, and proof of your association with that address (letterhead, utility bill, etc). This, of course, created even more privacy concerns, and Google eventually backed down on this set of requirements, instead asking for only your name and the image location. Later, Google loosened the requirements further, allowing anyone to request the blurring of a face or license place, even if the identifiable image isn’t you/yours. They later announced certain versions of Street View will automatically have all faces and license plates automatically blurred (when local laws require it, such as in Canada). Now, 6 months later, reports indicate that Google might be considering taking the same steps with the U.S. version of the Street View software.

These are all positive moves by Google, but they are all reactionary. They reveal Google’s adeptness of responding to criticism over user privacy, and little initiative in proactively protecting that privacy with these kinds of products. The very fact that they are only “considering” blurring identifiable information with the U.S. version reveals a lack of consciousness to the value-laden implications of their design decisions.

Plea:

Dear Facebook, dear Google:

Please engage in value-conscious design. Please recognize that you can make value-based decisions during the design phase of products, rather than relying on your legal, PR, and engineering teams to clean up the mess after they are deployed. We (in academia) can help you, we want to help you. We’ll guide you through the theory of privacy as contextual integrity, about pragmatically designing for values, and help reveal the links between design and corporate social responsibility and action ethics.

We like your products; we use your products; we want your products to succeed. We also want them to respect and protect human values. Together, we can accomplish this.

~michael

Google released Street View to much criticism, given the prevalence of visible and identifiable faces and license plates captured by their fleet of camera-toting cars trolling our streets. To remove yourself from the service, Google first required submission of your legal name, e-mail address, a copy of your driver’s license or other government ID, and proof of your association with that address (letterhead, utility bill, etc). This, of course, created even more privacy concerns, and Google eventually backed down on this set of requirements, instead asking for only your name and the image location.

Later, Google loosened the requirements further, allowing anyone to request the blurring of a face or license place, even if the identifiable image isn’t you/yours. And now it seems certain version of Street View will automatically have all faces and license plates automatically blurred.

These are all positive moves by Google, but they are all reactionary. They reveal Google’s adeptness of responding to criticism over user privacy, and little initiative in proactively protecting that privacy with these kinds of products.

This isn’t much of a surprise given Google’s apparent position that since people are in public, they have no right to privacy. Consider the comments by Philipp Schindler, head of Google Northern Europe, that appeared in the German Spiegel Online (as translated by Philipp Lenssen):

The Street View feature includes only those photos taken from public grounds. The imagery is not different from anything each of us can photograph themselves – the kinds of things you’d see when you walk the streets.

Such a sentiment has no understanding of the “contextual integrity” of one’s privacy in public. Yes, someone might happen to be standing on the same street corner at the exact date and time that I am walking by and take my picture. But that is one person who was lucky enough to have good timing, and one photo in that person’s camera. Most people expect a handful of strangers to be able to view, and perhaps take note, of one’s public actions. But it is a difference in kind when those actions are digitally recorded, indexed, and viewable by millions through the world’s leading provider of information.

Further, consider the justification provided by Peter Fleischer, Google’s Senior Privacy Counsel, from this article:

The United States has “a long tradition of saying that it is legal and appropriate to take pictures from public spaces and publish them,” Mr. Fleischer said.

I am uncertain as to his claim that the U.S. (courts, presumably) have a “long tradition” supporting the “appropriateness” of publishing images from public places. Any discussion of appropriateness would certainly be contextually bound, and shouldn’t be considered a blank check to publish any and all public images online. Even so, the fact that U.S. courts say its OK doesn’t mean Google should do it. (“Don’t be…”)

Google really missed the boat on this one. Remember, Microsoft had already released a similar product with the same privacy concerns (although few noted it at the time), and to really take a leadership role in protecting user privacy, Google could have done the following:

1. Make use of their own facial recognition technology to automatically scan the Street View image database to identify and blur all faces, thereby protecting privacy and differentiating themselves from Microsoft’s offering. This should be done in all Street View products, not just the Canadian version.
2. Make reporting inappropriate images easier by placing a specific  “report this image” link on each image screen, not just a generic “help” link.
3. Think harder about privacy in public, and recognize that just because a random person can take another random person’s picture in public doesn’t mean there’s no difference in having a similar image available on Google.

Of course, its not too late to make these changes…

• Siva Vaidhyanathan has launched a new blog for his forthcoming book, “The Googlization of Everything“…
• …while Cory Doctorow provides his fictional vision of Google at its most evil extreme, working with Homeland Security to monitor and track citizens. My favorite passage: “In the grand scheme of things, it hadn’t cost Google much to wire the city with webcams. Especially when measured against the ability to serve ads to people based on where they were sitting.”
• Speaking of books, Dan Solove’s latest, “The Future of Reputation: Gossip, Rumor, and Privacy on the Internet,” just hit the shelves. Should be amazing.
• David Fraser reports that Google is going to blur faces in the Canadian version of its Street View product after a privacy commissioner raised concerns about the service. (More on this later)
• Google has posted a 2nd video in its series attempting to explain their privacy policies. This one is about personalization, and the money line is “knowing about you, in particular, can be our most valuable tool.”
• Google also seems poised to taken on Facebook by (reportedly) planning to release new APIs to leverage its social platforms.
• Netherlands-based Bits of Freedom, and my friend and colleague Joris van Hoboken, announced the winner of the 2007 Big Brother award: you.
• In a similar vein, Michael Arntfield blogs at the Identity Trail about wikisurveillance, “the manner in which the community at large has been seduced by, or at the very least summarily acceded to, the idea of watching, recording, reporting, and even the expectation, or exhibitionism, of being watched, as the new de facto social contract for the post-industrial age.” (This concept has similarities to my probe on “netaveillance“)

Ok, back to work.

In a positive move, Google has changed their policy to make it easier to have sensitive information removed. Now anyone can notify Google and have an image of a license plate or a recognizable face blurred, even if it isn’t yours/you. The problem, as Nicole Ozer at the ACLU of Northern California recognizes, is that Google hasn’t changed the interface for initiating the process to make it more intuitive for people:

…there is no direct link from a Street View image to request take-down of a photo for privacy or security concerns. Individuals must know to click on the “Street View Help” link at the top of any image and then scroll down to the bottom of that box and click on “Report Inappropriate Image.” See here.

If Google is really serious about ensuring that people can protect their privacy and security by requesting take-down of images, they should add a direct link entitled “Request Take Down” or “Flag for Removal” to the top of each Google Street View image.

Like I’ve said before, privacy-enhancing changes won’t enhance anyone’s privacy if they don’t know about it or can’t figure out how to take advantage of it. Google: if user privacy is a priority, foreground it on your product interfaces.

UPDATE: I woke up this morning and remembered that Google already has employed simple facial recognition algorithms in their Image search.  If Google wanted to be serious — and proactive — about user privacy they could simply  scrub the entire Street View image database and automatically blur every face they come across. The tools are there — all it needs is the will.

:::

I don’t want to be picky, but given all the (necessary) attention given to the privacy aspects of Street View, I still wonder where everyone was when Microsoft launched basically the same service last year. As I pointed out then, the same privacy and surveillance concerns emerge. Is Microsoft truly that irrelevant now that we’re no longer concerned about their ability to surveil and collect personal information?

:::

Business Week has a short profile of the company who has an exclusive agreement with Google to provide the imaging. The story includes some details of the 11-lens camera, called a Dodeca 2360, used to provide the Street View images. They note: “What makes it unique is its dodecahedron (12-sided) shape, which captures images consistently in every direction. Anyone can buy one for around $100,000, but only a handful have been sold—mostly to government agencies.” So, Google and government agencies are the only one’s who have access to this imaging technology…lovely…

:::

It has been reported that in order to have your image removed from Street View, you must provide Google your legal name, e-mail address, URL of the Street View image, a copy of your driver’s license or other government ID, and proof of your association with that address (letterhead, utility bill, etc). Of course, many consider providing this level of detailed information to Google just as harmful as the Street View image itself, especially since there doesn’t seem to be a privacy policy in place regarding their handling of this extraneous personal data.

Google eventually backed down on this set of requirements, instead asking for only your name and the image location. While some herald this as Google taking action about privacy concerns, it seems more like a poorly-thought-out knee-jerk reaction to an original poorly-thought-out policy. Given this thin requirement, little prevents me from requesting to have images removed of anyone I feel like (competitors, friends, etc). If Google really wanted to take action to help protect people’s privacy in public, they would add a link to “remove your image” on the Street View main interface, rather than hiding it 2 clicks away on a help page.

:::

Philipp Lenssen provides a translation of an interview with Head of Google Northern Europe Philipp Schindler that appeared in the German Spiegel Online, where Schnidler responds to some of the privacy concerns:

The Street View feature includes only those photos taken from public grounds. The imagery is not different from anything each of us can photograph themselves – the kinds of things you’d see when you walk the streets. Added to that, we spoke to a variety of US organizations to get a feeling if there’s potential concerns, and if so, which these are. In the cases where we found out it’s necessary to introduce special privacy protections, we reacted prior to launch. For instance, you won’t find images of accommodations for the homeless, or abortion clinics.

Those familiar with my research can predict my objections with the implicit claim that images taken in public places are unproblematic. But what bugs me about Schindler’s comment is the odd assumption that removing images of homeless shelters somehow protects the privacy of those individuals, along with his claim that abortion clinics have been scrubbed as well. I found this image of a Planned Parenthood clinic in lower Manhattan the first day this was launched!

:::

Finally, odd scenarios continue to be found within Street View, including this sequence of a violent street fight captured for posterity as the van passed by.

Google has now jumped into the foray, offering their own “Street View” enhancement for Google Maps. Pretty slick, but the same concerns persist. If you click on the image to the right, you’ll find the “street view”for a Planned Parenthood clinic in lower Manhattan. Do you think those people hanging out in front expected their image to be taken and mapped by Google for millions to see? Luckily for them, they’re not identifiable in this particular case, but I’m sure other examples could be found that might show people in places they’d rather not have recorded and distributed by Google.

But wait! Perhaps Google was listening, for they provide instructions for flagging a “Street View” image as “inappropriate” which takes users to a feedback page where particular images can be flagged with these concerns:

• This image contains inappropriate content
• This image infringes on my privacy
• This image presents personal security concerns
• Other

What Google does with these requests I don’t know, but its a helpful step for them to acknowledge that these concerns persist with the expanded use of images from everyday life in such applications.

One suggestion, though: the “report inappropriate image” prompt should be on the main image display, not tucked away at the bottom of the related “help” page.

UPDATE: BoingBoing readers have been sending in various “inappropriate” images viewable thanks to Google’s new toy, including this one of someone’s neighbor taking out their trash (are they recycling??), and another of a car in a driveway with its license plate in clear view (I hope its supposed to be there).

UPDATE 2: Wired News is amassing a nice collection of images as well.

UPDATE 3: More amazing “best of photo galleries” [via Google Blogoscoped]