• Siva Vaidhyanathan has launched a new blog for his forthcoming book, “The Googlization of Everything“…
• …while Cory Doctorow provides his fictional vision of Google at its most evil extreme, working with Homeland Security to monitor and track citizens. My favorite passage: “In the grand scheme of things, it hadn’t cost Google much to wire the city with webcams. Especially when measured against the ability to serve ads to people based on where they were sitting.”
• Speaking of books, Dan Solove’s latest, “The Future of Reputation: Gossip, Rumor, and Privacy on the Internet,” just hit the shelves. Should be amazing.
• David Fraser reports that Google is going to blur faces in the Canadian version of its Street View product after a privacy commissioner raised concerns about the service. (More on this later)
• Google has posted a 2nd video in its series attempting to explain their privacy policies. This one is about personalization, and the money line is “knowing about you, in particular, can be our most valuable tool.”
• Google also seems poised to taken on Facebook by (reportedly) planning to release new APIs to leverage its social platforms.
• Netherlands-based Bits of Freedom, and my friend and colleague Joris van Hoboken, announced the winner of the 2007 Big Brother award: you.
• In a similar vein, Michael Arntfield blogs at the Identity Trail about wikisurveillance, “the manner in which the community at large has been seduced by, or at the very least summarily acceded to, the idea of watching, recording, reporting, and even the expectation, or exhibitionism, of being watched, as the new de facto social contract for the post-industrial age.” (This concept has similarities to my probe on “netaveillance“)

Ok, back to work.

The advertising software, which could be part of the operating system, a standalone app, or an application feature, would use information gleaned from documents, music, computer status messages, and e-mails as context for ads. However, the software could conceivably gather information on every file on a user’s hard drive and send it to advertisers, and the application does little to assuage security and privacy concerns.

The patent makes no mention of any method by which users might be able to control or even turn off the service, nor does it mention the multiple privacy and security concerns. Ars Technica, however, notes the cheerful propaganda MSFT deploys in support of the idea:

That’s okay. It’s still a good thing. It says so right in the application: “The ability to derive and process context data from local sources rather than monitor interactions with a remote entity, such as a server, benefits both consumers and advertisers by delivering more tightly targeted advertisements. The benefit to the user is the perception that the ads are more relevant, and therefore, less of an interruption. The benefit to the advertiser is better focus and a higher chance of conversion to a sale.”

As with the justifications given for personalized advertising in Web search engines, we’re confronted here with the claim consumers automatically benefit from having more targeted advertisements, without any consideration of what might be sacrificed by such a Faustian bargain. (Interrogating this belief is on my long-term research agenda.)

I also wonder how the research & development behind this patent application fits within Microsoft’s broader Privacy Guidelines for Developing Software Products and Services…

There has been increased attention lately about Google’s data retention policies and the impact its drive towards personalization might have on user privacy. In response, one of Google’s chief privacy lawyers, Peter Fleisher, whose opinion I normally have high regard for, has penned an op-ed piece (also found here and here) that recently appeared in the Financial Times.

The title of Fleisher’s piece is “Google’s search policy puts the user in charge” — a claim that is dangerously misleading.

In the op-ed, Fleisher touts the benefits of Google’s efforts to provide personalized search results (an important part of attaining the “perfect search engine“). With personalization, Google can provide the most relevant results (and advertisements, lest we forget) for ambiguous searches, such as “Paris Hilton.” He states:

…if an algorithm is built to take into account an individual’s preferences it has much more chance of guessing what that person is looking for. Personalised search uses previous queries to give more weight to what each user finds relevant to them in its rankings. If you have searched for information about handicaps or clubs before, a search for “golf” is more likely to return results about the game than the car. If you have been checking out the Louvre, you are less likely to have to wade through all the details of a particular heiress’s personal life.

Most anyone would agree that there are benefits to having search results tailored to the individual who performed the search. The concern, of course, is the trade-off for achieving this kind of efficiency. In the case of personalized search, that trade-off is user privacy, as Fleischer recognizes:

As the Financial Times has pointed out this week, personalised search does raise privacy issues. In order for it to work, search engines must have access to your web search history. And there are some people who may not want to share that information because they believe it is too personal. For them, the improved results that personalised search brings are not matched by the “cost” of revealing their web history.

(This concern, of course, is the basis of much of my research.)

Fleischer tries to resolve this crisis himself with a simple (but as we will see below, dangerously misleading) claim: that Google puts users in charge of whether to reveal their web search history. He explains:

We believe that the responsible way to handle this privacy issue is to ask users if they want to opt in to the service. That is why Google requires people to open an account and turn on their personalised search functionality. They do not have to give a real name to open a Google account, but even if they cannot be identified, we think they should have to give explicit consent before their web history is used. Unless they do, they will simply have the standard Google search service.Our policy puts the user in charge. It is not something Google seeks to control. At any time they can turn off personal search, pause it, remove specific web history items or remove the whole lot.

While it is true that users can opt into Google’s Web History product – effectively deciding whether they want their search results to be tweaked based on their search history – as well as remove items from the Web History service, this form of “user control” does not eliminate concerns over user privacy nor absolve Google of any responsibility in that regard.

It is vital for every user of Goolge (indeed, neary all search engines) to understand that their searches, results clicked, and other actions on Google’s platform are routinely monitored, logged, aggregated, and stored by Google. It says so right in Web History product’s own privacy FAQ (emphasis added):

4. What happens when I pause the service, remove items, or delete the Web History service?

You can choose to stop storing your web activity in Web History either temporarily or permanently, or remove items, as described in Web History Help. If you remove items, they will be removed from the service and will not be used to improve your search experience. As is common practice in the industry, Google also maintains a separate logs system for auditing purposes and to help us improve the quality of our services for users.

These logs are explained in Google’s main privacy policy, which acknowledges the collection of “information such as your web request, Internet Protocol address, browser type, browser language, the date and time of your request and one or more cookies that may uniquely identify your browser” as well as links that are clicked and other clickstream data.

Let me repeat this: Whether users opt in or out of Google’s Web History in order to personalize their searches, their activity on Google is still being tracked. Whether users delete some or all of the data in the Web History product interface, their activity on Google is still being tracked. Any privacy concerns that a user has about Google watching, tracking, and logging their search activity remains regardless of their actions related to the Web History product.

It is this kind of misleading rhetoric that lures users into thinking that Google is going out of their way to protect user privacy. It minimizes the threats of privacy online, lessens user’s expectations of privacy, and results in an atmostphere where the widespread monitoring and collection of user activity becomes normalized and unproblematic.

For Fleischer to suggest — in capacity of Google’s global privacy counsel — that users are in control of the privacy of their web search activities simply by allowing them to remove data from the Web Search history interface is dangerously misleading, and borderline negligent. I call on him — and Google — to correct this rhetoric and fully acknowledge how user privacy is impacted by Google’s techncial design and business practices, regardless of any kind of “control” users have with the Web History product.

UPDATE: Like I said above, I usually find Peter Fleischer’s comments and perspective on Google & privacy useful. Case in point: he has recently come out to say that Google’s privacy policy is “vague” and that the company “could do better” in crafting and communicating their position on user privacy. I hope he also addresses my concerns above.

According to the survey, the number of consumers willing to provide demographic information in exchange for a personalized online experience has grown over the past year, increasing 24% to a total of 57% of all respondents. The Survey also finds an increase in the number of consumers willing to allow websites to track their clicks and purchases, increasing 34% from the previous year. However, the results show no significant decline in the number of consumers concerned about the security of their personal data online, with 62% expressing concern in 2006 vs. 63% in 2005.

I can’t find a link to the report (here is the 2005 version [PDF]), but this is an interesting trend. My first reaction is to wonder how informed general Internet users are about the potential to aggregate and transfer personal information they decide to provide to gain some level of personalization. Do users think their information remains generally anonymous? Do they presume it is only used for personalization, and not aggregated for other purposes, or made available to other organizations (marketers, law enforcement, etc). Much more work needs to be done to fully understand people’s preferences and expectations regarding the use of their personal data for personalization services.

[via Pogo Was Right]

The mechanisms are already in place for search engines to track your online behavior. Tool bars, mini apps, personal search history. All of these can and do track where you’ve been. Everybody is being tracked to some degree.

But as Seana pointed out in her column, most of us are blissfully unaware of it. That’s because it’s been relatively benign to this point. In return for a handy tool bar that offers increased convenience, the ability to index your desktop and other added functionality, we just click the accept button without really reading what we’re accepting. Up to now, there hasn’t seemed to be any consequences. But in the background, the engines are quietly collecting terabytes of click-stream data.

Unfortunately, he casts this concern aside much too quickly:

More and more consumer groups will launch protests. Politicians will sense opportunity and jump on their soapboxes. There will be a very vocal minority that will rail against this “Big Brotherism.” There will also be a group of advertisers that will continue to step way beyond the acceptable, using targeting to subvert the user experience, rather than enhance it, hijacking the user and taking them to places they never intended. This will add fuel to the fire. And because they’re the most visible target, the search engines will bear the brunt of the attack.

In the end, we’ll realize there’s much more pro than con here. Effective targeting will generally add to our experience, not take away from it. We’ll toy with trying to use a third-party privacy filter, but in the end, most of us won’t be willing to give up the additional functionality in return for maintaining an illusion of anonymity online. Much of the usefulness of Web 2.0 (I know, I hate the term too, but at least it’s commonly understood) will be dependent on capturing personal and click-stream data. We’ll give in, and the storm will gradually fade away on the horizon.

Our goal must be to make consumers aware of the trade-offs between providing enormous amounts of personal information in exchange for a “convenient” toolbar or a contextually-relevant ad. We must not allow people to give in so easily.

[via Pogo Was Right]

Regarding the diss, I’ve been writing on how web search engine providers have relied upon what I refers to as infrastructures of dataveillance to collect and aggregate data about users across services:

These infrastructures rely on the interconnections between various search engine products and services, including general web searches, e-mail, personalized news delivery, special interest groups, and shopping services. Increasingly, search engine providers are also providing interfaces between the searchable web and our social lives through the integration of calendars, social networks, and blogging and publishing platforms. All these systems, through the use of persistent web cookies and universal logins, provide the ability for search engine providers to collect and aggregate a much wider array of personal information about their users than just their web search queries.

Obviously, much more to say about this when I have more time. For now, see these two related posts over at Google Operating System: Are You Logged In? and Google Persistent Memory

One tidbit I found curious in the Google Bigtable paper was this hint about the internals of Google Personalized Search:

“Personalized Search generates user profiles using a MapReduce over Bigtable. These user profiles are used to personalize live search results.”

This appears to confirm that Google Personalized Search works by building high-level profiles of user interests from their past behavior.

Recent patents by Google confirm the growing reliance on personalized search profiles for delivering advertising and other services. The existence of such profiles, of course, also presents significant privacy concerns.

Battelle asks, “what rights do you, I, or anyone else have to edit, delete, or own these profiles?” Right now, the answer is none.

Surveillance in Spheres of Mobility: Privacy, Technical Design and the Flow of Personal Information on the Transportation and Information Superhighways

A recent Nassau County Supreme Court ruling held that data retrieved from a vehicle’s black box – a computer module that records a vehicle’s speed and telemetry data in the last five seconds before airbags deploy in a collision – could be admitted as evidence even though law enforcement officials did not have a search warrant. The court ruled that by driving the vehicle on a public highway, “the defendant knowingly exposed to the public the manner in which he operated his vehicle on public highways. …What a person knowingly exposes to the public is not subject to Fourth Amendment protection.” A federal judge in upstate New York made a similar ruling, stating that police officers did not need a warrant to secretly attach a Global Positioning System device to a suspect’s vehicle. The judge said that a suspect traveling on a highway has no reasonable expectation of privacy.

In January 2006, the web search engine Google resisted requests from the U.S. Department of Justice to turn over a large amount of data, including records of all Google searches from any one-week period, partially on the grounds that it would violate their users’ privacy. This event generated widespread concern over the privacy of web search histories, and prompted many users to question the extent to which this component of their online intellectual activities might be shared with law enforcement agencies. (Indeed, it was later revealed that three other search engine providers – America Online, Yahoo and Microsoft – had previously complied with government subpoenas in the case, without public notice.) Similar concerns have arisen over commercial access to search engine histories as the vast databases of search histories held by these providers are increasingly matched up with individual searchers and demographic information from other search-related services in order to provide individually targeted search results and advertising.

The two technological systems described above – networked vehicle information systems and web search engines – represent important tools for the successful navigation of two vital spheres of mobility: physical space and cyberspace. However, they also share a reliance on the capturing and processing of personal information flows, and provide the platforms for surveillance of the person on the move. Networked vehicle information systems, which include GPS-based navigational tools, automated toll collection systems, automobile black boxes, and vehicle safety communication systems, rely on the transmission, collection and aggregation of a person’s location and vehicle telemetry data as she travels along the public highways. Similarly, web search engines, striving to provide personalized results and deliver contextually relevant advertising, depend on the monitoring and aggregation of a user’s online activities as she surfs the World Wide Web. Taken together, these two technical systems are compelling examples of the increased “everyday surveillance” (Staples, 2000) of individuals within their various spheres of mobility: networked vehicle systems constitute large-scale infrastructures enabling the widespread surveillance of drivers traveling on the public highways, while web search engines are part of a larger online information infrastructure which facilitates the monitoring and aggregation of one’s intellectual activities on the information superhighway.

I go on to conclude that:

At a moment when concern over government surveillance of its citizens is high, the prospect of the creation of a nationwide networked vehicle system infrastructure capable of monitoring vehicle location and activity causes pause. Similarly, general concerns over the privacy of web search histories is further aggravated by the possibility of the information being shared with government authorities. Broadening the conceptualizations of privacy to include approaches such as contextual integrity can help raise awareness of the political and value implications of these emerging information technologies. Further, embracing the pragmatic tools of “value-sensitive design” and “critical technical practice,” will ensure attention to political and ethical values becomes integral to the conception, design, and development of technologies, not merely considered after completion and deployment.

Please read the full essay here, and join the conversation.

Google. knows. a lot. about. you.

BTW, the original scholarly paper by Google founders Sergey Brin and Larry Page warned of the dangers of advertising-based web search systems:

Currently, the predominant business model for commercial search engines is advertising. The goals of the advertising business model do not always correspond to providing quality search to users. … [Given] historical experience with other media … we expect that advertising funded search engines will be inherently biased towards the advertisers and away from the needs of the consumers … [W]e believe the issue of advertising causes enough mixed incentives that it is crucial to have a competitive search engine that is transparent and in the academic realm. [emphasis added]

Apparently, this is no longer a concern…

Theme 2: Store 100% of User Data
With infinite storage, we can house all user files, including: emails, web history, pictures, bookmarks, etc and make it accessible from anywhere (any device, any platform, etc).
We already have efforts in this direction in terms of GDrive, GDS, Lighthouse, but all of them face bandwidth and storage constraints today. For example: Firefox team is working on server side stored state but they want to store only URLs rather than complete web pages for storage reasons. This theme will help us make the client less important (thin client, thick server model) which suits our strength vis-a-vis Microsoft and is also of great value to the user.
As we move toward the “Store 100%” reality, the online copy of your data will become your Golden Copy and your local-machine copy serves more like a cache. An important implication of this theme is that we can make your online copy more secure than it would be on your own machine.
Another important implication of this theme is that storing 100% of a user’s data makes each piece of data more valuable because it can be access across applications. For example: a user’s Orkut profile has more value when it’s accessible from Gmail (as addressbook), Lighthouse (as access list), etc.

I agree with John Battelle that the notion of Google storing 100% of my data on their servers is quite unsettling.

[via Google Blogoscoped]