Free Newsletters

  
Notes from the Field | Robert X. Cringely® » It may be Google's data, but it's you they're gonna arrest

February 25, 2008 | Comments: (0)

It may be Google's data, but it's you they're gonna arrest

Sergey Brin has weighed in on the whole MicroHoo fandango, and not surprisingly he's agin' it. At Google's Lunar X prize announcement last week, Brin told the Associated Press:

The Internet has evolved from open standards, having a diversity of companies. And when you start to have companies that control the operating system, control the browsers, they really tie up the top Web sites, and can be used to manipulate stuff in various ways. I think that's unnerving.

I'm right there with you, Serge. And when Google legal beagle Dave Drummond talks about "preserving the underlying principles of the Internet: openness and innovation" I just feel good all under.

After all, Google is one of the most open companies on the Net. Also: I'm the father of Jamie Lynn Spears' love child, and I give handsome lessons to George Clooney.

The problem with that last paragraph is that none of those statements are true. Google is one of those companies that seems completely open -- 'here, come in and have a oat bran muffin while we massage your feet' -- until you ask them a question about what they do or why they do it. Then they cinch up tighter than a frog's nether regions.

For example, try asking Google what it's planning to do with all the user information it collects after it has fully digested DoubleClick? Or why it needs to retain IP addresses for Google searches? Good luck getting any response at all.

In fact, Google's biggest privacy accomplishment in the last year has been deciding to hold onto users' IP addresses for only 18 months instead of 24. Gee, I feel more anonymous already. Don't you?

Last week, Google's Public Policy Blog posited the argument that IP addresses are not personal information, because they are often shared between machines and users. (Though, personally, my home office has a static IP.) This makes sense until you think about it for 15 seconds. Strangers have also occupied my home address in the past, and probably will do so in the future. But if you ring my doorbell today, I'm the one who answers.

And if you look at the server logs of any Web site I've visited, you'll find my IP address along with a time stamp. In most cases it's a trivial matter of proving that at the very least it was my computer, if not me personally, who was there. If I happen to have been logged into Google at the time, you'll find the whole ball of wax in my search history. If not, the site probably dropped a cookie on my system with a unique ID number in it.

Of course, Google won't share this information with anyone... unless they have a court order. Or a National Security Letter. Or maybe the spooks have already tapped into one of the Network Access Points outside the Googleplex.

But an IP address is pretty good all by its lonesome. It is after all what the RIAA has used in the 20,000+ lawsuits it's filed against terrorists evil doers file swappers. They take the IP address and demand the subscriber information associated with it from your ISP, who can either hand it over or fight a legal battle with the record companies. Guess which route most of them choose?

In the old days, I might have to do something suspicious or even vaguely illegal to warrant such attention. In these days of warrant-free searches and laptops impounded at the borders, who knows what it takes to get flagged by the feds? I'd rather not find out. And that in turn makes me a more cautious, even paranoid, Web surfer.

And Sergey? If you really believe in an innovative and open Internet, it's time to open up a little yourself. Tell me why you need my IP address information for 18 months. Better yet, give me the choice of whether you can really have it. Because right now, Google feels like a much bigger threat to my privacy than Microsoft and Yahoo combined.

Whose IP address is it, anyway? Weigh in below or email me here. Top commenters qualify for cool swag.

Think you've got the right stuff to pass our tech quizzes? They're not as easy as they look:
The InfoWorld News Quiz
Test Your Geek IQ
Test Your Network Security IQ

Posted by Robert X. Cringely on February 25, 2008 07:49 AM


RATE THIS ARTICLE:





 

  •  
  • COMMENTS




So what is the answer? Should every one start hiding behind proxi anomious servers? How would you know who or which proxi server to trust?

Thinking about this... When was the last time you had your picture taken? No not by your wife, but by a survaliance camera? I bet it was yesterday when you stopped at the bank, had a cup of coffee at the corner coffey shop, how about when you picked up the bagle, or at the grocery store last night.

No bid deal right??? What about when you are walking down the street and the camera in that little ball on the corner snapped your picture, the ATM you casually walke by snapped it.

Privacy does not exhist! It is an ilusion...

Posted by: Dalton Williams at February 25, 2008 10:49 AM

Just like the frog swimming in the pot on the stove with the water getting warmer, we have been lulled into the trap of "We're doing it to make you more secure". Were it only Google, and not any of the other search engines, I might be less concerned - I could just change which search engine I use to preserve what little is left of my privacy.

But I do not trust that my information will remain private unless subpoenaed by an "official" body, regardless of who has it. After 911 we gave up our right to privacy as we clamored for better homeland security - or as the U.S. government interpreted our "request" as equivalent to foregoing privacy for the promise of improved security.

So my attitude henceforth is to treat all info as if it were published on the front page of the local newspaper - including what websites I visit, what I am looking for, what I buy, where I buy it, and what my political preferences happen to be. I know I can be physically "traced" by carrying my cell phone with me.

Posted by: DocRobin at February 25, 2008 11:03 AM

Perhaps I have a different understanding of the issue than you do, but I don't believe the debate is about whether or not Google should be allowed to store an IP address for 18 months. In fact, I believe they anonymize this information. It's over whether or not Google should EVER be able to have your IP address.

The problem this presents is a technical one. When my machine needs to get information from Google's servers, it needs to know their server's IP address. So, DNS is used. Then a handshake occurs where my machine's IP address is given to their servers so that their servers know where to send the reply back to. To not give my IP address to Google's servers would essentially prevent this communication from taking place.

Sure, people can use a PROXY... but even to do THIS, you are giving the PROXY your IP address. In other words, if you use the Internet, you are ALWAYS giving your IP address to SOMEONE... whether it is to the destination site or to a proxy site. It is needed in order to allow the Internet to work.

So, Google (as well as any other website) NEEDS this information to be able to provide a response to you. Sure, they don't need to KEEP it forever... but they already have a process by which they anonymize this data.

People who are panicking with a knee-jerk reaction are trying to make IP addresses (by themselves) personal information, which is ridiculous. Every bit of information has some DEGREE of privacy... many pieces of information when taken together is dangerous... but often, by itself, is benign. For instance, I used to live on Plumas Avenue. This by itself isn't going to let anyone track me down, but it DOES allow someone to narrow me down from billions of people to, perhaps, millions or thousands.

An IP address, by itself, is not personal. An IP address AND a date/time, taken together, *IS* personal. However, we NEED to give up personal information if we want something in return. I can't get money out of an ATM without proving to the ATM who I am. I can't walk into a store without showing my face (I would imagine that if I were wearing a ski-mask, they'd get nervous and probably ask me to remove it.)

If you don't want Google to know who you are... then don't ask them for information. It's as simple as that. For some reason, people want to use the Internet, but they don't want the Internet to know they are using it. This is absurd. Either you are comfortable with the Internet, or you're not. You can't rely on it and use it and, at the same time, try to tear down the very fabric by which is has blossomed in the first place.

Google is just as open as they are expecting everyone else to be. Google has their IP address prominently displayed across the Internet's DNS servers. If you want to use the resources on their computers, why are you unwilling to give up your computer's address for the response to come back to you? You can't order products from a mail-order company and yet not give your address for the products to be shipped. Sure, your address as a whole is private information... but you want something from them and it requires that bit of private information.

Sometimes I just don't get non-techie people debating the tech world.

Posted by: StareClips.com at February 25, 2008 11:25 AM

Speaking as a techie who is both familar with the technology and technical security, I am concerned, but not by Google as much as by the government that would use Google to further it's own ends.

The common trend is for governments to use private organizations to do things that a government may be forbidden to do on its own. Governments can and do use guns and bombs and troops to enforce the desires of leaders. When governments can go to businesses and force them to provide information, the information provided by the business as the same value it would if the government did it themselves.

Added to this threat is the inability of most governments and businesses to securely host the large amount of data that they create. Witness the UK's major fiasco of last month.

When this information is agreggated and stored insecurely (missing laptops, horrible wi-fi security, etc.) that information is as unto gold for identity thieves.

Identity thieves are good. They are after money and lots of it. They utilize data mining techniques to find out as much as possible about people. They love governments for their willingness to do the bulk of the work and gather the information and provide easy access.

Don't fear the companies, fear the governments that use the data provided by those companies. If I could prevent the companies from gathering such data to begin with, democracy is enhanced and chances of somebody agregating enough information on me to steal my identity or take out credit in my name is lessoned.

Posted by: LOL at February 25, 2008 11:56 AM

Sorry Cringely, but your rant does nothing to address Brin's comment. He is talking about control of "standards", like what browsers can work with what sites and on what OS platforms. Nothing about who has the data behind these sites. Nothing about Google collecting your IP address stops you from using Opera, FF or IE to view their searches. You cannot say that about MS-Live and a potential MS-Yahoo-Live. Forget about trying to get your Safari browser to play well, or you Linux browser.

The discussion of collection and use of personal data is a whole other topic. One worthy of discussion, by not related to the breaking of web standards by certain companies.

Posted by: Dick at February 25, 2008 12:05 PM

"Those willing to giveup essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." -- Ben Franklin

Posted by: person at February 25, 2008 12:06 PM

Ok, so I concede that privacy is an illusion and probably has been a relative concept ever since we stepped out of the cave. The internet cellphone and other just made it a whole lot more 'relative'.

What I don't concede is that since it is orders of magnitude easier to obtain and correlate information about me that I've given an implied agreement that you can do with that information what you will.

I don't care if MicroVerizaYaHoogleCIA now has everything about me down to my underwear size and fingenail length and keeps it for eternity. I'll by stock in NAS storage companies.

Just so long as the Law of the Land states I must optionally decline or be compensated for every use of the information or the user is criminally liable. Including the US Government.

I don't hold out much hope for a quick resolution of this of course. After all, it only took 130 years of the telephone to come up with a 'do not call' list.

Posted by: Ozwaldster at February 25, 2008 12:56 PM

Don't forget that "Do Not Call List" conveniently excludes religious, charitable, and political groups so your politicians can call asking for money or whatever, all they want.

Posted by: Roger at February 25, 2008 01:59 PM

As Dick pointed out - what does Google storing IP information have to do with open access standards? At least Google doesn't care about what OS or browser you use or even require you to have Flash/Shockwave as a few do. As far as using it goes, Google is the Gold standard for open access to all.
TTFN!

Posted by: Richard Budd at February 26, 2008 02:21 AM

a few responses.

first, yes, brin was talking about open standards. my point was that this embrace of openness stops at google's door. they have developed a culture of secrecy that makes apple look chatty by comparison. and when questioned, their response is almost always "trust us, we're google." sorry, that trust has worn thin.

second, yes, you do need to hand over your IP address to get a search result. but handing over your IP address shouldn't turn into a permanent loan. many sites and ISPs do not keep this information for precisely this reason -- they don't want to be compelled to hand it over later. why does google need my IP address (or some portion of it) for 18 months? why is it so difficult to get an answer?

finally, to those who say 'we have no privacy' or that it's merely an illusion, I say this: drop your pants. and while you're at it, I'd like your social security number, date of birth, mother's maiden name and home address. post them here if you like.

everyone has information they want, need, and should keep private. the game isn't over yet.

peace out,

rxc

Posted by: cringe at February 26, 2008 05:19 AM

Check out Yahoo by Microsoft. YAHMIC! http://yahmic.com

Posted by: Billy Y. at February 26, 2008 10:23 AM

I agree I'd be nice if Google would divulge why they keep IP addresses and what they do with them, but that is an internal business practice. Banks keep scanned copies of every transaction you do as do credit card companies. Neither will freely say what they do with it but you can bet that is IS data mined by them.

Add to the list of Google's search open access - they don't even require Java...
TTFN!

Posted by: Richard Budd at February 26, 2008 04:38 PM

I thought the 18 months thing had to do with the EU. If it's a gov't authority that ultimately would obtain the info from Google, aren't they the boogieman forcing Google to hold onto it? Worse, it's not the Federal Gov't anymore, it's all those other gov'ts. Look how MS rolled over for the Chinese. In some ways, it's even worse than you say.

Posted by: s at February 27, 2008 10:51 AM

"Last week, Google's Public Policy Blog posited the argument that IP addresses are not personal information,"

Even though I may lose the Cringe's popularity contest, I must agree with Google: IP address are public. I compare them to your street address. They accompany you when you surf, post, and email.

As far as surveillance cameras go, are they not in public places? How do they differ from having a cop on the beat watching you?

Posted by: jjvors at March 2, 2008 03:00 PM

If you don't like the P in the Pool, don't go to the pool. Cover your tracks if you like, but someone, somewhere will know who you are and where you're from. Ya know, if I'm sorry worried about someone knowing my IP address, I'll just hack the Neighbors wi-fi...that way it's really THEM who are visiting all those questionable sites. :P guns don't kill people.

Posted by: Jason at March 5, 2008 12:38 PM

How to connect internet without providing ip information? Its not possible.

My home is private not My street address.
I need to secure my data. I can do it well.

Its search provider's job to collect more and information possible.

Posted by: Prabin Dahal at March 5, 2008 07:40 PM

At least Google isn't giving information to the authorities like Yahoo! did in China. Now a political dissident will sit in prison until they're all released, which is likely never. At least google is the lesser of two evils.

PS: Why the heck does the preview and post have different captchas? I already proved I'm a human. Sheesh.

276814
948596
279566
254300

Posted by: Justin Goldberg at March 7, 2008 11:25 AM

I suspect Google is using your ip address in their user and search research, not for nefarious purposes. It would seem the most logical reason.

I suppose Google could merely use a one-way encrypted hashed version of people's ip addresses. How else could they ensure privacy while also doing research? OTOH, this would preclude Google from doing geographical-linked research.


And yes, Google is still less evil than Yahoo! and MSN. Much like how Obama is less evil than McCainBot.


And if you're a privacy stud, you'll use TOR, the onion router.

http://tor.eff.org/

Posted by: Justin Goldberg at March 7, 2008 11:33 AM

Unless they do the geo-ip lookup before the hashing, but then they can never go back after the fact.

Posted by: Justin Goldberg at March 7, 2008 11:35 AM

The British government is using Google gathered informations exclusively.

Posted by: Thisisme at March 11, 2008 05:11 AM

Technology White Papers

 

InfoWorld Technology Marketplace

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert

Receive instant email notification when resources on this topic become available.
 
» BUY A LINK NOW

Sponsored Technology Links