GAO Recommends Cookie Policy For U.S. Govt.

Jim Madison writes: "The General Accounting Office (GAO) has issued a report today 'Internet Privacy: Implementation of Federal Guidance for Agency Use of "Cookies".' In it, they recommended that Federal agencies abide by a four point standard for the use of cookies: (1) clear notice (2)compelling need (3) public stated privacy safeguards for tracking info, and (4) approval by agency head. Only 8 of 65 agencies they checked in the study use persistent cookies, of which 4 did not even have privacy policies and none met the entire 4 point test. All agencies have agreed to comply; it sounds like a step in the right direction to me at least. What's the harm in the government collecting that info anyway, right?" Personally, I think the government should have to ask nicely before gathering any information via cookies, like Sen. Robert Torricelli has proposed for private firms. Other than that, these guidelines seem blandly sensible.

Comments

Privacy Complaints

[olegm]

IMHO If you do know what a cookie is and you don't want them, then you should know/learn enough to turn them off.

I do not think that anyone should have the right to complain about persistant cookies collecting info about them. Cookies are simple to turn off, and in the time it takes to complain you could have just as easily turned them off.

Just my 4 cents (adusted for enflation)

GAO

[Aaron Denney]

Every time I hear about the GAO, it is in such a way that it is demonstrating the incompetence of other agencies. They deserve many pats on the back.

Forget cookies -- you're munching on 1x1 GIF's

[teambpsi]

Those insiduous little 1 pixel by 1 pixel GIF's are more pervasuive than you might realize. Turning off cookies won't help you either -- the clever little laddies at the ad-tracking co's are using "non-caching" 1x1 pixels GIF's to track your return visits to a site

So you either turn off your cache (which you can't completely do in Exploder with its 1M minimum, but can thankfully in Netscrape) -- or you disable images....

Cha! Like ANYONE other than WAP users actually do that...

I guess what we could do is build a cookie-proxy system that would allow you to use cookies for the session -- but toast them automagically after logout.

Cookies are a fact of the net -- I simply cannot access my online bank account without them enabled -- sure i could switch banks because of this -- but i think in this case I would WANT the bank to have tracked access to my account.

The Government tracking my PR0N consumption is another matter all together ;)

Re:Forget cookies -- you're munching on 1x1 GIF's

[rpjs]

So you either turn off your cache (which you can't completely do in Exploder with its 1M minimum, but can thankfully in Netscrape)

You can't turn the cache in IE off but you can make it automatically empty every time IE closes. Just go to the "Advanced" tab of the Options dialogue and scroll down until you find the "security" section where you'll find an "Emoty Temporary Internet Files folder when browser is closed" option. Doesn't delete persistent cookies alas, but it does zap 1x1 bug images.

Another step backward

[Fat Casper]

The feds have been encroaching on our privacy forever, with our full knowledge. They do this "census" thingy every 10 years, all in an effort to collect demographic info on us, and people fill them out every time. What's going on here?

The way I see it, as long as they don't go sharing, or even worse, selling our info, it's not too bad. How many .gov websites do you actually go to in the course of a day? I go to a .mil periodically, but since I log in, I think they already know how often I go there.

We need to concentrate on companies doing this, not the feds. Only accept cookies you need, and we have to get the government to force companies to allow an opt-out for their info selling programs.

Re:Another step backward

[sconeu]

They do this "census" thingy every 10 years, all in an effort to collect demographic info on us, and people fill them out every time. What's going on here?

The Feds are REQUIRED to do a census every 10 years by the Constitution. Of course, all the demographic BS they collect isn't required.

IANAL, and so won't presume to tell you not to answer that BS, but constitutionally, they are required (and allowed) to ask how many people live in your house.

Why do cookies exist?

[cr0sh]

Because HTTP is a stateless protocol. When using CGI, there are only a few ways you can maintain state information about a user on a site, in order to allow login tracking, etc - cookies are one way (/. and k5 use this - many, many other sites do as well), URL decoration is another (though less "secure" - but both can be made more secure using HTTPS if needed). There is a third - can't think of it offhand.

Anyhow, the fact is that for interactive sites, we have to be able to preserve state information, if for nothing else the ability to know which user is which, when they last logged in (and to prompt them to relogin if needed), etc. This in and of itself isn't a problem, IMO - I don't mind if a site knows how often I visit them or when.

The problem is when those sites start sharing info about where the users are going (ie, sharing info you don't want shared without telling you, or allowing you a way to opt-in/out of that plan), or tracking via ad banner cookies (same thing, except it is one company doing it, via their ads). Another possible issue is cookie stealing - that is, one company looking into the contents of another company's cookie - without the company or the user's knowledge.

What we need is either a state-based HTTP type protocol (ie, move away from stateless), or another manner of handling cookies. The first idea probably isn't possible or realistic - there are probably too many reasons not to do it (performance and bandwidth usage being the primary ones). The second is possible, at least for new browsers.

Cookies could set by IP, or something, and only other servers with that same IP (or by a masked range, set by the user?) could access that cookie. It is almost like that now. Other mods could be made to allow easy user management of cookies, as well. Perhaps force the setting and reading of cookies via https, so that only the issuing source can read the cookies? There are probably a ton of other changes to the system, probably even a few legalistic ones (or apply current laws the way they should be, if they apply).

Web Bugs (1x1 GIFs) are harder to stop - but a browser could be made to identify "possible" web bugs, and allow the user to set the browser to eliminate, expand or highlight possible web bugs on the page - even allow the user to click on a possible bug to see the code or CGI query behind it. While this wouldn't eliminate the problem, it would go a long way toward helping...

Worldcom - Generation Duh!

Re:Why do cookies exist?

[raju1kabir]

Perhaps force the setting and reading of cookies via https, so that only the issuing source can read the cookies?

Um, only the issuing source (or, depending on how it was sent, another server in the same domain) CAN read the cookies.

The issue comes about when sites exchange data correlating cookies to other data behind the scenes.

Countermeasures, arms race

[Spamalamadingdong]

1x1 web bugs could be stopped easily with a caching proxy. The URL of every 1x1 transparent GIF could be cached, and on a repeat hit the proxy could just feed back a generic 1x1 transparent GIF. Shared lists of these URLs could make repeat hits on any GIF relatively rare.

Of course, the spies could escalate in any number of ways. Dynamically generated content could change the URL for every page load, eliminating the effective caching at some expense in server load. To counter that, a fix to the proxy might ignore "nocache" on images where the image is from a different site than the referrer. A patch to the browser might just ignore 1x1 images. And so it goes.
--