隐私问题突显 Google逼近信任的十字路口

作者： CNET科技资讯网 翻译：李海

CNETNews.com.cn 2005-07-15 11:54 AM

CNET科技资讯网7月15日国际报道 Google首席执行官埃里克·史密特在自己的主页上并没有公开多少他本人的情况。

但是，花30分钟在Google的搜索引擎上，你会发现很多。50岁的史密特去年身价15个亿。今年年初，他出售Google股票，获益9千万美元，过去两月，当Google的股票价格超过3百美元时，他又出售了5千万的股票。

他与妻子温迪居住在加州富裕的阿瑟顿市，5年前之前，这个市的一个政治募捐者的席位价值1万美元，在艾尔顿强高唱“Bennie and the Jets”的伴奏下，总统竞选候选人阿尔戈尔与妻子Tipper曾在这次大会上翩翩起舞。

史密特曾漫步于内华达州的沙漠艺术节，他同时还是一名热心的业余飞行员。

如此详细的私人详细如此堂而皇之的在公共网站上出现会令绝大多数人感到不舒服。但是，与Google搜集到的，没有公开的信息相比，这些还不算什么。

假设史密特使用自己公司的服务，那么能够访问Google数据库的人就可能找到他写的电子邮件，发送的对象，他网上购物的站点，他个人电脑上保存的东西，甚至他通过网上地图查询的当地餐馆信息。和其它数量巨大的 Google用户一样，他的虚拟生活已被小心翼翼的记录下来了。

我们当然会担心，那些黑客，热心的政府调查人员，甚至是那些违背了公司道德规范的Google内部员工可能会滥用这些信息。有人担心，Google正在收集诱人的个人信息，Google对这些信息保密负有的责任，人们显得忧心忡忡。

隐私维护者们表示，雅虎，微软的MSN，Amazon.com的A-9等搜索与电子商务公司在信息收集方面也存在同样的危险。事实上，许多公司的商业计划都试图模仿Google的模式，其中一些公司对他们收集到的信息不够小心。但据WebSideStory最新的数据显示，Google，占据了美国搜索市场50%以上份额的公司，已经成为保护隐私雷电中的一枚避雷针，原因很简单，Google对互联网社区的影响太强大了。

“电子隐私信息中心”的Chris Hoofnagle说：“在可能侵犯隐私方面，Google超过了微软，许多用户很难相信这一点，因为Google的牌子太受信任了。但是，如果你仔细去看看Google的产品与它们的使用情况，你就会意识到，Google能够拥有很多关于用户上网习惯的个人信息－电子邮件，保存的搜索历史，图片，来自社会性网络站点 Orkut的私人信息－这些严重的危害到了隐私。”

“电子边疆基金会”的律师Kevin Bankston表示，Google收集到的数据可能勾勒出有史以来最为详细的用户轮廓。

Bankston表示：“你的搜索历史反映出你的社团，信仰，甚至是你的医疗问题。”

Google的记录

作为搜索引擎的惯例，Google会保存包含有搜索用到的词汇，访问过的网站，互联网协议地址，执行搜索的电脑，浏览器的种类等信息的日志文件。

另外，为了提供进一步的服务，搜索引擎正在收集用户的身份信息。比如，Gmail需要用户与电子邮件地址。通过比较发现，雅虎的注册还要求用户提供地址，电话号码，生日，性别，职业，一些金融服务还需要用户提供家庭住址，社会保险号码。

如果将搜索历史，电子邮件与注册信息相结合，一家公司即能清楚的了解一个人的健康，性生活，宗教，财务状况，购买偏好等详细情况。

Bankston表示：“这些数据几乎是你脑海中设想的一种打印输出：你想买的东西，你想交谈的对象，你交谈的内容等等。这些信息数量空前，象Google这样的第三方公司对信息拥有绝对的控制。”

Google公司的第一辩护律师Nicole Wong表示，Google使用日志信息来分析流量情况，以防止有人对搜索结果做手脚，应对拒绝服务攻击，以及改善搜索服务。

Google的隐私章程规定，除非获得用户同意，或外部公司值得信赖，否则用户的个人身份信息不会与外部公司分享，也不会用来进行市场营销。

去年8月，随着公司公开上市，人们对Google保存数据的方式越来越敏感。虽然Google“不作恶”的座右铭没有改变，但一些人开始怀疑Google用户隐私保卫与提炼数据用于广告之间的平衡能力。Hoofnagle说：“ 尽管Google在公众中是一个好的企业公民的形象，但过去的表现并不能保证未来的行为，尤其是在Google 已经上市，公司开始承担股东财富最大化的司法职责之后。”

尽管Google无法保证这些数据未来会怎么样，政府是否会使用这些信息，但Google的官员却相信，他们的隐私规范为用户提供了适当的保证。

Google清楚用户的担心

Google非常关心用户的隐私保护问题，Wong说：“从产品设计到发布，以及后面的使用，我们都非常关心隐私的保护问题。”虽然Google没有隐私官员，但公司有Wong这样由律师组成的专家队伍。

但Bankston担心，即使Google非常在意这些问题，数据最终还是会被滥用。

人们对Google隐私侵犯的最大担忧来自于Gmail。

Gmail用户能够删除邮件，但是删除的过程并不直接。需要花费数个步骤才能完成最终删除，Google 服务器完全可能复制这些邮件。

另外一个抱怨对象是Google使用cookies记录。

Google的桌面搜索也被人抱怨。隐私保护主义者们担心，能够进入用户电脑的人可以很轻易的利用这个程序来找到敏感数据。

一个企业版本的Google的桌面搜索已经允许用户设置密码，但个人用户版本的程序还没有这么做。 还有人对Google的网络加速器也表示了担忧。

信任是关键。正如软件行业分析师Stephen O’Grady去年底在他的网络日志上写的那样：“Google正在逼近一个十字路口，一个决定其未来方向的十字路口。他们可以从微软那里学习到很多的教训：信任这东西很难获得，却极易失去，并且几乎不可能重新赢回来。”(编辑：孙莹)

Google balances privacy, reach

Published: July 14, 2005, 4:00 AM PDT

By Elinor Mills
Staff Writer, CNET News.com

Google CEO Eric Schmidt doesn’t reveal much about himself on his home page.

But spending 30 minutes on the Google search engine lets one discover that Schmidt, 50, was worth an estimated $1.5 billion last year. Earlier this year, he pulled in almost $90 million from sales of Google stock and made at least another $50 million selling shares in the past two months as the stock leaped to more than $300 a share.

He and his wife Wendy live in the affluent town of Atherton, Calif., where, at a $10,000-a-plate political fund-raiser five years ago, presidential candidate Al Gore and his wife Tipper danced as Elton John belted out "Bennie and the Jets."

Schmidt has also roamed the desert at the Burning Man art festival in Nevada, and is an avid amateur pilot.

That such detailed personal information is so readily available on public Web sites makes most people uncomfortable. But it’s nothing compared with the information Google collects and doesn’t make public.

Assuming Schmidt uses his company’s services, someone with access to Google’s databases could find out what he writes in his e-mails and to whom he sends them, where he shops online or even what restaurants he’s located via online maps. Like so many other Google users, his virtual life has been meticulously recorded.

The fear, of course, is that hackers, zealous government investigators, or even a Google insider who falls short of the company’s ethics standards could abuse that information. Google, some worry, is amassing a tempting record of personal information, and the onus is on the Mountain View, Calif., company to keep that information under wraps.

Privacy advocates say information collected at Yahoo, Microsoft’s MSN, Amazon.com’s A-9 and other search and e-commerce companies poses similar risks. Indeed, many of those companies’ business plans tend to mimic what Google is trying to do, and some are less careful with the data they collect. But Google, which has more than a 50 percent share of the U.S. search engine market, according to the latest data from WebSideStory, has become a lightning rod for privacy concerns because of its high profile and its unmatched impact on the Internet community.

"Google is poised to trump Microsoft in its potential to invade privacy, and it’s very hard for many consumers to get it because the Google brand name has so much trust," said Chris Hoofnagle of the Electronic Privacy Information Center. "But if you step back and look at the suite of products and how they are used, you realize Google can have a lot of personal information about individuals’ Internet habits–e-mail, saving search history, images, personal information from (social network site) Orkut–it represents a significant threat to privacy."

Kevin Bankston, staff attorney at the Electronic Frontier Foundation, said Google is amassing data that could create some of the most detailed individual profiles ever devised.

"Your search history shows your associations, beliefs, perhaps your medical problems. The things you Google for define you," Bankston said.

The Google record
As is typical for search engines, Google retains log files that record search terms used, Web sites visited and the Internet Protocol address and browser type of the computer for every single search conducted through its Web site.

In addition, search engines are collecting personally identifiable information in order to offer certain services. For instance, Gmail asks for name and e-mail address. By comparison, Yahoo’s registration also asks for address, phone number, birth date, gender and occupation and may ask for home address and Social Security number for financial services.

If search history, e-mail and registration information were combined, a company could see intimate details about a person’s health, sex life, religion, financial status and buying preferences.

It’s "data that’s practically a printout of what’s going on in your brain: What you are thinking of buying, who you talk to, what you talk about," Bankston said. "It is an unprecedented amount of personal information, and these third parties (such as Google) have carte blanche control over that information."

Google uses the log information to analyze traffic in order to prevent people from rigging search results, for blocking denial-of-service attacks and to improve search services, said Nicole Wong, associate general counsel at Google.

Personally identifiable information that is required for consumers to register for and log in to Google services is not shared with any outside companies or used for marketing, according to Google’s privacy policy, except with the consent of the user, or if outside "trusted" parties need it to process the data on Google’s behalf.

Concern about Google’s data retention practices has become more acute since the company went public last August. The company’s motto of doing no evil remains, but some people question Google’s ability to adequately balance the heavy burden of safeguarding consumer privacy rights with the pull toward intermingling and mining data for ever more lucrative targeted advertising.

"Although Google is held in high esteem by the public as a good corporate citizen, past performance is no guarantee of future behavior, especially following Google’s IPO when the company will have a legal duty to maximize shareholder wealth," Hoofnagle said in testimony in March before the California Senate Judiciary Committee on the privacy risks of e-mail scanning.

Google can’t make promises about what it will or won’t do with the data in the future or state explicitly how it uses the information, but executives there do believe their privacy policy provides adequate assurances to calm consumers’ fears.

Google’s privacy policy says it may share information submitted under a Google account service "among all of our services in order to provide you with a seamless experience and to improve the quality of our services." Google representatives wouldn’t elaborate on what that means.

Yahoo’s privacy policy, by comparison, says it "may combine information about you that we have with information we obtain from business partners or other companies" and that it uses the data to customize the advertising and content that users see, contact users, conduct research and improve services.

Google, like virtually all companies, also complies with legal orders such as search warrants and subpoenas.

"The prospect of unlimited data retention creates a honey pot for law enforcement," Hoofnagle said in his testimony. In addition, e-mail stored for longer than 180 days has less protection from law enforcement than e-mail deleted before then, he said.

Google knows people are worried
Google is very much concerned with protecting the privacy of its users, Wong said. "We take privacy very seriously from the design of the products through launch and beyond," including by building in privacy-protection options in new products, she said. Google does not have a privacy officer, but it does have Wong and a team of lawyers who work with her to address privacy issues, among other matters.

Google executives would not say exactly how the company protects the data or whether it encrypts it. The privacy policy states that Google takes "appropriate security measures to protect against unauthorized access to or unauthorized alteration, disclosure or destruction of data" and restricts access to personally identifying information to employees "who need to know that information in order to operate, develop or improve our services."

Even if Google is well-intentioned, the data could eventually end up being misused, Bankston fears.

"I think the mantra of not being evil is not disingenuous, but it is a hard credo to stick to when you’re a public corporation with stockholders to please and economic incentives driving you to collect as much information as possible," Bankston said. "I’m not saying it’s evil to collect this information; I’m saying it’s dangerous for them to collect this."

The largest outcry against Google so far has been in response to Gmail. Launched in April 2004, Gmail now offers a whopping two gigabytes of storage for free and scans the content of messages to serve up context-related ads.

Gmail users can delete messages, but the process isn’t intuitive. Deletion takes multiple steps to accomplish and it takes an undetermined period of time to delete the messages from all the Google servers that may have a copy of it, Wong said.

Another complaint is that Google uses cookies–tiny tracking tags used by most Web sites to link a specific user with his or her activities–that expire in 2038. "Although Google said that it does not cross-reference the cookies, nothing is stopping them from doing so at any time," Hoofnagle said in his testimony. However, users can delete cookies or disable them.

People can use Google search without a cookie. If a cookie is used and is not deleted by the user, the searches may then be linked to the cookie, Wong said. However, Google can not correlate searches to a specific user unless that person voluntarily provides personally

identifiable information. For example, Google does not correlate Gmail accounts with users’ searches.

Google’s Desktop Search, an application that lets users search for personal files and Web history stored locally on their computer, also created a stir when it was launched last year. Privacy advocates worried that someone with access to a user’s computer could easily search for sensitive data.

A free version of Google’s Desktop Search for businesses has an option that allows users to require a password to access it. The free consumer version of it does not.

Other privacy concerns were raised with Google’s Web Accelerator, downloadable software for broadband users that was designed to speed access to Web pages by serving up cached or compressed copies of Web sites from Google’s servers. However, the service does not really retain any more data than a user’s Internet service provider can.

Underpinning many of the privacy concerns is the longevity of Google’s data retention.

The log files created during Web searches, and which don’t personally identify the user, are kept for as long as the data "is useful," Wong said. She did not give any time frame or elaborate.

Google is able to link log file data, cookies and Google accounts to help it identify attempts to manipulate Web site ranking on its search pages, help track down originators of denial-of-service attacks against Web sites, and provide improvements to services in general, Wong said.

Concerned Googlers can either choose not to register for Google services or use two browsers, one for their Web searches and another for Gmail and other Google services.

For the more paranoid there are anonymizing proxy networks, such as the EFF’s Tor, that bounce Internet communication through a series of routers that encrypt and decrypt it so that the origination and destination cannot be traced.

"Before you Google for something, think about whether you want that on your permanent record," Bankston advised. "If not, don’t Google, or take steps so the search can’t be tied back to you."

Google is no DoubleClick
In fairness, the level of anxiety hasn’t come close to what online ad network DoubleClick faced in the late 1990s. DoubleClick became the subject of a Federal Trade Communication lawsuit for its attempt to combine offline and online consumer data. It settled federal and state suits and eventually phased out its Internet ad profiling service.

In a question-and-answer session during Google’s media day in May Schmidt addressed the trade-off between privacy issues and offering better services.

"Our general philosophy on those things is very much to allow people to opt in," Schmidt said. "There are always options to not use that set of technology and remain anonymous with respect to the functionality that you’re using on Google."

Gartner analyst Allen Weiner opined: "Overall, I think the privacy concerns are probably overblown."

Search engines have reached a plateau in their ability to serve up the best results, Weiner said, adding that tracking users’ ongoing searches will lead to improvements.

"Have search engines gotten to the point where they have developed enough trust with consumers in order to get them to give up some of their privacy?" he asked rhetorically. "At some point there’s a leap of faith that needs to occur."

And it’s not as though Google is the only company asking Web surfers to make that leap, said Danny Sullivan editor of Search Engine Watch. "Overall, the issues with Google are not any different from the issues you have with Yahoo, Microsoft and others. They tend to get singled out, and unfairly, in my view," Sullivan said. "They’re the biggest, and they make a big target for someone to take a swing at. It’s not that the issues are not important. It’s that they are applicable to the search industry" as a whole.

Trust is the key. As software industry analyst Stephen O’Grady wrote in his Tecosystems blog late last year: "Google is nearing a crossroads in determining its future path. They can take the Microsoft fork–and face the same scrutiny Microsoft does, or they can learn what the folks from Redmond have: Trust is hard to earn, easy to lose and nearly impossible to win back."