How much do we really care about protecting our personal information?

Over on Techdirt, Mike Masnick discusses an interesting new survey that highlights the sharp disconnect between how much we claim privacy matters to us and how far we’re willing to go to safeguard it. America Online polled 1,000 users in the United Kingdom, and the results further reinforce what other recent studies have suggested:

The study found 84% of users say they carefully guard their info online — but when tested, 89% of people actually did give away info in the same exact survey.

The AOL survey brings to mind security guru Bruce Schneier’s insightful quip on privacy from back in 2001:

If McDonald’s in the United States would give away a free hamburger for a DNA sample they would be handing out free lunches around the clock. So people care about their privacy, but they don’t care to pay for it.

When presented with the option of sacrificing a bit of privacy for something of value, like a chocolate bar or a free gift certificate, many users are surprisingly willing to dole out data to third parties for commercial use. And the value of personal details to marketers is massive. As social networking sites and ad-serving networks amass ever greater knowledge of our hobbies, political views, and even our favorite music, these sites are getting better at mining data to tailor ads with pinpoint precision, commanding high click rates while sustaining server farms and original content publishers.

Continue reading this post »

Posted by Ryan Radia on Aug. 17, 2008 | Link | Comments |

Under-Appreciated Existing Legal Remedies for Trolling, Defamation and Other “Malwebolent” Invasions of Privacy

Anyone interested in the long-running debate over how to balance online privacy with anonymity and free speech, whether Section 230’s broad immunity for Internet intermediaries should be revised, and whether we need new privacy legislation must read the important and enthralling NYT Magazine piece  “The Trolls Among Us” by Mattathias Schwartz about the very real problem of Internet “trolls“–a term dating to the 1980s and defined as “someone who intentionally disrupts online communities.”

While all trolls “do it for the lulz” (”for kicks” in Web-speak) they range from the merely puckish to the truly “malwebolent.”  For some, trolling is essentially senseless web-harassment or “violence” (e.g., griefers), while for others it is intended to make a narrow point or even as part of a broader movement.  These purposeful trolls might be thought of as the Yippies of the Internet, whose generally harmless anti-war counter-cutural antics in the late 1960s were the subject of the star-crossed Vice President Spiro T. Agnew’s witticism:

And if the hippies and the yippies and the disrupters of the systems that Washington and Lincoln as presidents brought forth in this country will shut up and work within our free system of government, I will lower my voice.

But the more extreme of these “disrupters of systems” might also be compared to the plainly terroristic Weathermen or even the more familiar Al-Qaeda.  While Schwartz himself does not explicitly draw such comparisons, the scenario he paints of human cruelty is truly nightmarish:  After reading his article before heading to bed last night, I myself had Kafka-esque dreams about complete strangers invading my own privacy for no intelligible reason.  So I can certainly appreciate how terrifying Schwartz’s story will be to many readers, especially those less familiar with the Internet or simply less comfortable with the increasing readiness of so many younger Internet users to broadcast their lives online.

But Schwartz leaves unanswered two important questions.  The first question he does not ask:  Just how widespread is trolling? However real and tragic for its victims, without having some sense of the scale of the problem, it is difficult to answer the second question Schwartz raises but, wisely, does not presume to answer:  What should be done about it? The policy implications of Schwartz’s article might be summed up as follows:  Do we need new laws or should we focus on some combination of enforcing existing laws, user education and technological solutions?  While Schwartz focuses on trolling, the same questions can be asked about other forms of malwebolence–best exemplified by the high-profile online defamation Autoadmit.com case, which demonstrates the effectiveness of existing legal tools to deal with such problems.

Continue reading this post »

Posted by Berin Szoka on Aug. 3, 2008 | Link | Comments |

Cuil’s Incredible Privacy Policy

First, an excerpt:

[W]hen you search with Cuil, we do not collect any personally identifiable information, period. We have no idea who sends queries: not by name, not by IP address, and not by cookies (more on this later). Your search history is your business, not ours.

Next, the obligatory read the whole thing.

Because you can. It’s just a little over 500 words.

Posted by Jim Harper on Jul. 29, 2008 | Link | Comments |

Judge Orders Google to Turn Over YouTube Viewer Records

In case you’ve been in a pre-holiday daze this week, the blogosphere has been atwitter (not to mention a-twittering) with the news that the Hon. Louis L. Stanton, the Federal district judge presiding over Viacom’s massive copyright infringement suit against YouTube has ordered Google, which owns YouTube, to turn over its viewership records (12 terabytes).  Most notably, TechCrunch’s Michael Arrington has called Judge Stanton a “moron” for failing to appreciate that “handing over user names and a list of videos they’ve watched to a highly litigious copyright holder is extremely likely to result in lawsuits against those users that have watched copyrighted content on YouTube.”  Whatever one thinks of the Viacom v. YouTube/Google case, Arrington’s concern is misplaced (if not hysterical) and his logic betrays his ignorance of how litigation actually works.  Continue reading this post »

Posted by Berin Szoka on Jul. 4, 2008 | Link | Comments |

Senate Housing Bill to Require Collecting of Online Payment Information

While the Wall Street Journal has noted one disturbing aspect of Sen. Chris Dodd (D-CN)’s sprawling mortgage industry bailout bill (HR 3221) –the required fingerprinting of mortgage loan “originators”–Sen. Dodd and his Republican colleague Richard Shelby (R-AL) last week introduced an even more disturbing amendment (Subtitle B of S.AMDT.4983) that would require the nation’s payment systems to track, aggregate, and report information on nearly every electronic transaction to the federal government,” as reported by FreedomWorks (and noted briefly by the WSJ).

Specifically, online payment systems such as eBay’s Paypal, Amazon, and Google Checkout (along with banks and credit card networks such as Visa, MasterCard and Discover) would be required to report,

(1) the name, address, and [Taxpayer Identification Number] of each participating payee to whom one or more payments in settlement of reportable transactions are made, and
(2) the gross amount of the reportable transactions with respect to each such participating payee.

This requirement would produce, starting in 2011, a detailed record of information about every “participating payee”–i.e., anyone receiving at least 200 online payments in a year worth at least $10,000 in total.  This record would include entries for not only most online merchants but also the “long tail” of small sellers through sites like eBay who eke out more than $10,000 in revenue (not profit) as well as those who collect donations online, as many non-profits, blogs and other user-supported sites do.  Such granular data collection becomes particularly troubling when one considers that, individual payees would be identified by social security number, as would sole proprietors of small businesses who use their own social security number instead of obtaining a separate Employer Identification Number.  Continue reading this post »

Posted by Berin Szoka on Jun. 23, 2008 | Link | Comments |

Rigid federal mandates hinder privacy technologies

Privacy laws threaten e-commerce innovation, as Wayne Crews and I argue in an op-ed in yesterday’s San Jose Mercury News:

Politicians have long used corporations as convenient whipping boys, and the technology industry is no exception. Today, tech companies face political attacks over their online privacy policies. Rep. Joe Barton, R-Texas, for instance, recently demanded that Google provide a detailed explanation of how it stores user search queries.

The federal government, so eager to safeguard privacy, is itself the worst offender, unwilling to abide by the same stringent opt-in standards that regulations would impose on private firms. The post-Sept. 11 push for compulsory national ID cards, warrantless wiretapping and escalating data retention mandates reveal a government inclined toward violating privacy, not protecting it.

Continue reading this post »

Posted by Ryan Radia on Jun. 16, 2008 | Link | Comments |

Google, California’s Privacy Policy Law & Our Sci-Fi Future

As Jim has mentioned, Google stands accused of violating a California law that requires a website operator to “conspicuously post” a link to its privacy policy on its “home page or first significant page after entering the Web site” with the word “Privacy” in a larger font than the rest of the page’s text.

Are we not fortunate to have state laws that make it possible for customers to actually find website privacy policies? With all the billions of documents floating out there in the dark and mysterious pipes and tubes of the so-called “Internet,” how on earth would any simple user ever find the Google privacy policy if Google were not required by law to include an obvious link to that policy on its homepage? Some modern-day da Vinci would have to invent a technology that could magically index every single webpage in existence and let users find—or “search,” to use a classic science-fiction term—for that particular webpage by typing the words “Google privacy policy” and clicking a button.

Until such fantastic Jules Verne-style technologies are developed in some distant century, it is obviously vital that each and every state government develop its own requirement as to how website operators—especially those that purport to offer fantastic-but-as-yet-clearly-impossible “search” services—must clutter their websites’ homepages with links to information that no user could ever possibly find on his or her own with today’s crude technology. Continue reading this post »

Posted by Berin Szoka on Jun. 4, 2008 | Link | Comments |

  •  
  •