Slashdot Mirror
Salon Interview with TrustE CEO Bob Lewin
bmc wrote to us about an interview that is currently running over at Salon.com. Salon is talking with
Bob Lewin, the CEO of TrustE. Honestly, it's depressing. There's a real dearth of legislation that will protect privacy rights [?] and even groups like TrustE have loopholes the size of Mack trucks.
To the consumer that is. What difference does it make to me whether a site is TrustE certified or not? With all the loopholes and the fact that there is no standard for privacy, only internal policies for each company, it makes absolutely no difference at all to me. The certification is meaningless.
I don't want to have to read lengthy privacy statements on every site that I visit. Let alone having to reread the same info every time to make sure it hasn't changed. Who has time for that? TrustE is well aware of this and has covered its collective ass, but doesn't do anything to help me or anyone else besides the corporations who buy the certification.
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
"Well, we can't force consumers to read privacy statements,
And when a CEO of a company can't be forced to know something as important as this question:
"What percentage of sites get rejected?"
by giving:
"It's not a large percentage -- I'd guess 1 to 2 percent."
He's the CEO and guesses this important fact? Does he know what the hell is going on with his product? You can't trust a company who's leaders aren't involved enough to know basic operational facts.
> If they
/dev/null, letting these bozos know just how eager we are to share information. Unfortunately, that won't close all of the security holes.
> really cared about TrustE having some enforcement authority, they require that users re-authorize every time privacy changes.
They obviously don't. They have set the bar so low for awarding their ``Good Seal of Secret-keeping" that only one or two percent of all sites can't climb over it -- & the requirement is nothing more than to say ``We have no policy."
Sheesh. And even then, they have found themselves forced to talk to miscreants.
Mebbe we should just link cookies.txt to
Geoff
I think I see a trend here. Maybe for them it really would be easier to muzzle the entire internet than to produce p
A scant few of us at Ompages.com are trying to put together an internet for the rest of us, we're no dot com, we're a real community; we're very close to putting together a virtual private network that anyone can join with a php front end that spits out config files for your platform.
Privacy cannot be guaranteed by a policy site; it must be claimed like property, and on the internet it's first come first served...If you want control over your information you must be active in your efforts to control it... there's no substitute for aggressive activism...
I have high hopes for Ompages.com to use the encrypted IP infrastructure to bring real power to individuals...
Right now there's a news posting site, a la usenet, and it's that easy to post your links, works, projects etc...
We're not whining 'why me?' we're screaming 'mine now...!' We're not brown nosing industry or any single OS, technology or government; on the contrary, we're in their faces drawing lines in the sand... please believe it...
Outta the fryin pan in into the fire...
-nate
natepuri@office.ompages.com
Yes, it does. Or rather, it can.
This is taken from a comment I made on an earlier TRUSTe story on slashdot:
Jay (=
I never said they'd take the seal away, but they will hold off on giving it out the first time until the site modifies its practice, as the CEO mentioned in the article. I'd wager this happens /after/ payment, but I can't say for sure. Did you respond to the right post, btw?
In general, I trust no-one, but it is part of Truste's 'deal' that the privacy policy must be easily viewable. Says so on their website as well as in the Salon article.
There's a reason I have many random hotmail accounts that I use to receive activation passwords and nothing else.
Returned Peace Corps IT Volunteer
Q: What happens if my Web site fails a compliance review?
A: In the unlikely event that a site fails a compliance review or
TRUSTe has reason to believe that a site is in non-compliance with
its stated privacy practices, we will conduct an escalating
investigation. Depending on the severity of the breach, the
investigation could result in an on-site compliance review by a CPA
firm, or revocation of the site's trustmark license. After TRUSTe has
exhausted all escalation efforts, extreme violations are referred to
the appropriate law authority, which in the U.S. may include the
appropriate attorney general's office, the Federal Trade
Commission, or the Consumer Protection Agency. TRUSTe may
pursue breach of contract or trademark infringement litigation
against the site.
Returned Peace Corps IT Volunteer
You've made a crucial mistake: You've believed them.
Do you honestly think they'll take a seal away from a *PAYING* customer just because the customer plays fast and loose with the terms?
Remember, the customer is allowed to change the terms *AT ANY TIME WITH NO NOTIFICATION*. So, the people who said "opt-in only, we never share your address" can, every day at midnight, change the policy to "we will add all addresses we have to our master mailing list, and sell the result to a third party", ftp the list over, then change the policy back.
Tricky? Sure. But, as long as they "follow the posted policy" at any given time, TRUSTe will smile, nod, and keep taking their checks.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
"Well, we can't force consumers to read privacy statements, but in all our consumer outreach programs, we tell people: Even if you've visited this site before -- because things change -- the first thing to do is go to the privacy statement and review it to make sure there have been no changes. And we encourage licensees to put any changes up at the front. This is easier said than done -- none of us like to read pages and pages of text."
Are they kidding? Who on God's green earth would re-read the privacy policy of a web site every time they visit it??? If they really cared about TrustE having some enforcement authority, they require that users re-authorize every time privacy changes.
*sigh*
---
This sig has been temporarily disconnected or is no longer in service
Look, either people are really concerned about online privacy or they aren't. Let the market take care of it. People are either worried about this stuff or not, and if they are they won't buy from companies without good and well publicized privacy statements. If they aren't worried about it, well, the world will look like it does right now. Personally, I think most people just don't care... I know I don't.
Here is a little thought experiement for you. Imagine a product, a widget. Now this widget comes in 2 versions. The two versions are exactly the same with the exception that with one you have to give up some personal information to buy the widget, but get $X off. You give up all rights to this information, but other than that the two products are the same in all respects. What value of X will you buy that widget? This gives you a idea of what value people place on their privacy. I imagine for most people X is around $5 or so....
DrLunch.com The site that tells you what's for lunch!
This is truely sad. After reading the article it seems that TrustE has completely sold out. It seems to be created solely for the convience of the corporations that are it's clients.
/Duncan
Does anyone know of any other organizations such as TrustE? I checked at EPIC.ORG and didn't notice any comments or links to TrustE. I find that signifigant. TrustE seems to just be snake-oil.
I would recommend looking at EPIC and organizations that it links to for privacy guidlines:
EPIC, EFF, www.cspr.org, etc...
Duncan Watson -Rock climbing, Encryption, privacy
PGP Fingerprint -PGP Key on www.keyserver.net
Duncan Watson
My company went through ISO 9000 a few years ago, and the basic idea is the same as TrustE: Say what you do, do what you say.
In my mind, it doesn't mean that the company is any better organized than others, but it means that their business process is in a book somewhere and they follow what's in the book. Reviewers don't care what the actual processes are, as long as there's enough documentation to prove that those processes are followed.
Sounds like TrustE is doing the same thing: Does this company have a privacy policy for web-based information? Do they follow it?
Trying to lose some karma here, let me throw this out: I think TrustE is following their charter by not coming down on Real or MSFT. Why? Their charter doesn't include non-web based information gathering. If this means that TrustE should change their charter, or start a new group for non-web-based privacy certification.
But make no mistake: All TrustE is saying is that their "approved" company has a web-based privacy policy and that they follow it. Even if that policy says that they'll sell your name and phone number to anyone that asks.
-- Ever notice that fast-burning fuse looks exactly the same as slow-burning fuse? I didn't... (Edgar Montrose)
TRUSTe seems to have as a mission making sure that companies adhere to their own public policies, whatever they are. That's fine and well, but what we need is a company that provides you with an information policy and forces you to adhere to it. A standard for information dissemination is what's needed to stem the epidemic of information sharing.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
We need a powerful organization with a strong image that can enforce its privacy rules.
And here it is.
Make Space Ghost a part of your marketing program.
People should be aware that this kind of thing is not limited to the web. The same thing happens over the telephone, when business services, merchandise, etc. There, the problem is even worse. A sales rep will take your order, ask you questions about everything under the sun, then take your credit card info, etc. When it sounds like they're finally entering your order, they then ask for permission to release your info to third parties, which is necessary for your order to be completed; because the order will actually be carried out by a subisidiary. If you refuse, or even hesitate, they act as annoyed as possible, making it clear that if you want the service, this is the only way you're going to get it without a lot of hassle. The whole thing is set up to wear you down while they ask all their questions, so you'll get impatient and say "OK" when they ask for permission to release your info. I'm not paranoid enough to think companies purposely set up a system of subsidiaries, etc., just for the purpose of reaping data; but once they have such an arrangement, they milk it for all its worth. And obviously, some of the best (or most evil) minds in the telemarketing biz are behind this stuff. One of the worst examples of this is when buying internet access from the phone company. They go through all the aforementioned stuff, and it seems there's little chance you'll be able to buy their product without lending permission, etc. The worst thing is that they have all your personal info, including perhaps credit info, etc., and now your email address. Some even put email addresses in the phone book, which they then sell and rent to everyone under the sun. Want to find someone via their (telco) email address? Just look in a cdrom telephone directory!
Quite a few good points about TrustE, but I'm not sure I agree with the conclusion. I definatly would like to think that I have ethics enough (particularly computing ones) that I wouldn't be doing the same in their situation. But about their buisness problems, I'm not sure that those are inevitable. Right now, (espeically in light of Salon's article) the TrustE seal is less of a promise, and more of a vanity plate for web sites.
TrustE is a really well-entrenched brand name.
TrustE is in business to make money.
Hopefully not too much of a focus, since they are a non-profit organization. But realistically, yes, most likely true.
TrustE makes that money selling the essentially one-time process of certifying sites' privacy policy, for hundreds to thousands of dollars a pop.
Again, hopefully not. According to their web site, it costs somewhere between $300 and $5000 per year of certification, so review of a site probably [hopefully] takes place once a year.
TrustE relies on a QUANTITY of business to keep them afloat.
Since TrustE has an enormous amount of customers(sites) they've certified, to properly police all of them (protect the integrity of their seal) would cost far more than the revenue generated from the initial process.
Thus, the certification is symbolic at best.
The cost point is probably valid. It almost certainly costs more than $5000 to hire qualified people to ensure a web site as "privacy ok" for a year. This is mistake #1, and it was made on the part of TrustE. They should charge more for their services, which are valuble enough to the consumer that they would probably offset the cost of aquiring them. (Especially if they became widespread enough that the number of major sites that had them outnumbered the sites that didn't.)
However, a second mistake was made, which was probably more dangerous. And it wasn't made by TrustE, it was made by you and me, and others. We naively assumed what TrustE ensured, without actually going to the site and reading their license agreements and requirements. By their own rules, RealJukebox was outside their jurisdiction because it's not a web page. The same thing with the Intel Pentium III ID chip. And in these cases, we have no one to blame but ourselves, for not reading the fine print, and for taking TrustE at face value as "a certification of privacy". So yes, I blame TrustE for preying on the paranoia that most users have about privacy [and probably rightly so]. And yes, I blame them for selling out to some extent, by writing a set of requirements that enabled them to leave loopholes for large companies (their primary buisness target). But mostly I blame myself for not reading those rules beforehand. Trust no one indeed. Especially not people giving you the "brief" rundown on what a company/service "does".
I can't think of really anything regarding law or policy where there aren't loopholes. It seems the more precise we try and be with language, the more vunerable we are. If you're clever enough, you can stab someone to death on a street corner and not go to jail for more than two weeks. Not that two weeks of cellblock loving isn't punishment enough, mind you, but it's still getting off relatively easy. In some countries you have to perform the duties of the person you killed. Now, that's pretty damn nice if you happen to kill, say, the king or president or taco bell manager, but it rarely works that way. Usually you end up killing a prostitute or a mime, the latter for reasons which should be obvious. And should be legal I might add. I'd like you to point out FIVE people who aren't French who like mimes. I certainly haven't met them. I'm sure we'd all accept that if I haven't met someone, they don't exist.
But anyway, back to loopholes, specifically ones you could drive a Mack truck through. These can generally be dealt with fairly simply by putting a serrated metal tire-strip in front of the loophole to pop the tires of said truck. The truck then gets stuck in the entrance of the loophole, and nothing else can come through. Yeah, an awkward solution to the problem, but have you seen a kernel patch lately? Almost as much of a hack as any given service pack. Gets the job done, yeah, but it's NOT pretty.
As any other quick patch, this solution does not always work. Take for instance, when the Mack Truck gets eaten in advance by a Log Truck. I know what you're thinking, but Log Trucks are VERY cannibalistic. They feel no loyalty to other trucks. There is no evil like a Log Truck. If any foolhardy person doubts me, just take a quick stroll through the back woods of Central New York. And don't say I didn't warn you. You'll be lucky if you escape with your life. I grew up there, and even that wasn't enough. I was killed by a pack of ronin Log Trucks three years ago while hiking with a friend of mine. Now I am dead and sad.
thankyoutheend
"Trust Noone".
Seriously. When you think about it, there's nothing TrustE can do to prevent privacy policy violations from ALL the sites certified after the initial process. And yes, most of this is TrustE's fault, or better put, a serious ethical problem with TrustE's business model.
TrustE is a really well-entrenched brand name.
TrustE is in business to make money.
TrustE makes that money selling the essentially one-time process of certifying sites' privacy policy, for hundreds to thousands of dollars a pop.
TrustE relies on a QUANTITY of business to keep them afloat.
Since TrustE has an enormous amount of customers(sites) they've certified, to properly police all of them (protect the integrity of their seal) would cost far more than the revenue generated from the initial process.
Thus, the certification is symbolic at best.
So, what have we learned?
We didn't have this problem (as much) back in the BBS days, when everything was local. You knew your friendly (or not so friendly) sys0p, and his reputation preceded him. No silly seal necessary.
Of course, I realize this is a global network now, and this "everything is local" paradigm is dead.
But by the same token, nothing beats doing business with who you know and trust, symbolic declarations of good intentions be damned.
I don't begrudge TrustE - they have a hell of a racket, make a TON of cash, and I'm sure in the same position I'd do the same thing.
I don't understand how this is surprising ANYONE. The only thing truste 'does' for the end user is to say that the company follows the privacy policy it lays out and allows exits at required locations (you can't be forced to give your email address before reading the privacy policy, for example)
It does not, never has, never will, alleviate the need to read the actual policy at a website, word for word, before giving it a valid email address.
Truste is good for privacy policy building, its wizard is excellent for delineating exactly what you do and what you say. This is its true value add for businesses. Realize that Truste is for businesses, and not consumers, and a lot becomes clear. This is the only way this model can work--how many business would bay hundreds of dollars to get something on their site that reads {Truste Certified. This site sells email addresses}
Right. Just south of 1.
Something that would be interesting, tho, is an implementation of that web grafitti software (the controversail one that allows you to post messages connected to websites that other people with the same ware can see?) and have a real, consumer-advocacy-style group go through the big e-commerce sites and rate their privacy practices.
Returned Peace Corps IT Volunteer
It's not that TRUSTe's model is flawed. TRUSTe's model is perfect.
How many people naively share information with sites that have TRUSTe logos? How many people file complaints with TRUSTe instead of the FTC, or their local Attorney General?
TRUSTe works fine. You just have to remember what
they're there for: They exist to make consumers *FEEL* comfortable with privacy as it exists, and to keep people from complaining to their government.
It is not TRUSTe's policy to take action under any circumstances. These "loopholes" are not accidents; they are a *FEATURE* of the design of TRUSTe.
The purpose of TRUSTe is to waste your time so you don't complain to the FTC when a site violates its privacy.
And remember, TRUSTe has *NEVER* yanked a seal. Not once. Not even when company staff *FORMALLY AND OFFICIALLY STATED THAT VIOLATIONS OCCURRED*.
Look at eBay; they changed their policy, they started spamming, they kept spamming, they failed to delete accounts when people quit, they kept spamming... And they have a shiny TRUSTe logo.
Same goes for the BBBOnline.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
It's stories like this that make me beg for a real 3rd party privacy/security group to certify companies. You've got companies that are storing Customer Priviliged Information(credit card numbers and the like) on the same server as the web server with no protection. You've got a licensed TrustE members who lull you with this big pretty seal that your information is safe. I swear we need some legislative reform that holds a company liable for NOT protecting your information enough. If I found out a company had stored my credit card number (which I explicitly ask sites I shop with not to preserve) in an unsecure fashion and it became stolen, I want some form of legal recourse. I really think there needs to be more liablity and responsibility on internet based companies.
Of course i'm also a huge proponent of full disclosure for any companies that conduct transactions over the internet. I should be able to call up Company A and get information about thier security so as to feel comfortable in doing business with them. My bank does this on thier online banking site discussing topics that the average user wouldn't have any clue regarding.
Of course
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
Q. Once it has the TRUSTe seal, have you ever kicked out a site for doing something?
No, we've come very close, but we haven't had to do it.... [A] lot of these are just misunderstandings.... [T]he resolution... may result in a change in the privacy policy, the business model, or what have you.
And later:
As their Web sites evolve, we've got to ensure that the privacy statement evolves. It's an ongoing process.
This is wrong two ways.
First, it is a weak standard. All a web site has to do to keep their TRUSTe seal forever is to perform a mea culpa after each "violation" and then change their policy. They don't even need to return to any previous state of "protection."
However, a site only needs to sell my email address to a spammer ONCE for me to have lost my privacy completely. This is what "trust" means -- we as users are dependent on the site's good behavior; we must trust them.
TRUSTe's policy of closing the privacy-policy's barn doors after the user data have escaped is entirely inadequate to the task at hand.
What is needed is a civil liability for the damage that such betrayals of trust cause.
I. Intro and Perview
1. This document governs the privacy policies of the Internet System 197.234.74.257 (the SITE) with regard to its access by one person (the VISITOR) by electronic means and the data about the VISITOR (the INFORMATION) collected hereby, but none of its mirrors, load sharing sites or routers, neither other viewers.
2. By entering within sight of this site you have indicated your agreement to these terms.
II. General Rights
1. It is our pleasure to inform you that you have no privacy rights whatsoever. As you read, personal data is being collected.
III. Information Collected
1. The SITE will endeavour to collect as much INFORMATION as may be determined profitable by the SITE.
2. These INFORMATIONs will include but not be limited to: your home and work contact info, your family history, all such INFORMATION about your relatives including their schools or nursaries, principle caregivers, nannies and ages, your prom date, your IRS return form, any foreign tax return form (or lack thereof), your secret service file with each of the nations on the Security council and your IQ.
IV. Collection Means
1. The SITE will use whatever means neccessary, included but not restricted to cookies, IP fingerprinting, port mapping, indiscriminate hacking and paramilitary raids; In fact, as the VISITOR reads this a highly trained team of former SEALS and S.A.S. members is ransacking the VISITOR's (that's you) personal files and residences.
V. Use of Information
1. This site will under no circumstances refrain from selling this information to the highest bidder, including but not limited to security forces of any country or group.
VI. SECURITY
1. Due security measures will of course be taken. If they weren't, we couldn't sell the info because anyone could steal it.
VII. Accessing & Updating Information
1. The SITE sees no need to give access to the INFORMATION, as it is 100% accurate, comprehensive and personal, and the VISITOR therefore already knows it.
2. Every time the VISITOR moves his mouse, the information will be automatically updated. Therefore, the VISITOR will not need to manually modify the INFORMATION
VIII. Limitation of Liability
1. No-one's written any laws yet, so we're untouchable. We have no assets in Europe. The VISITOR is hereby sol.
He who fights and runs away,
Some tricks they use: they claim AOL.com is covered by the TRUSTe seal until you file a complaint. they then claim only www.aol.com is covered but members.aol.com is NOT covered. This means if you visit www.aol.com to get information you are covered ... but, if you actually join and give them your personal information you are not covered!
Any web site can set up 2 sites www.example.com that has the TRUSTe scam seal and then set up a second site www2.example.com that collects the personal info and avoids the requirements of the seal. What a joke!
Other complaints where sites do have the TRUSe seal simply go unanswered (Geocities, Real Networks, New York Times, etc). this is not surprising since TRUSTe is funded by fees paid from these companies. Pople who complain don't pay anything.
Russ Smith
http://privacy.net