Slashdot Mirror
Finding Fault With Google's Privacy Policy
orenh writes "Viacom has recently obtained a court order that requires Google to hand over a complete list of every video watched by YouTube users. These logs will include the login names and IP addresses of the users. Google are now asking Viacom if they can anonymize the logs before turning them over; Viacom hasn't responded yet. But this privacy nightmare could have been greatly reduced if Google had anonymized the data in advance. Google's privacy policy states that they keep personally identifiable information for 18 months. There is no real reason to do so; Google can achieve everything they need even if they anonymize their search logs after just one month, and it's time users told them to do so."
...why keep identifiable logs in the first place?
In soviet America, corporations tube you!
The problem is that we I.T. people are Data Hoarders. Even if the data isn't useful today, or at all useful into the foreseeable future, we still hang on to it. And we save every detail we can just to prove how clever we are to have been able to discover it in the first place. (Note: P2P program writers are the same, and that's how Media Sentry can tell you so much about filesharers they discover on the Internet right down to the full directory paths of files.) Now if storage wasn't so d@mn cheap we wouldn't have this habit, but Moore's Law applied to disc drives means we no longer have to store 2-digit years and have Y2K problems. We have these problems now instead.
This is why the RIAA is able to use IP addresses combined with timestamps to identify ISP account holders. It doesn't identify any actual copyright infringers, but they don't care as long as they have somebody to sue. If these logs were deleted after 3 days this whole RIAA mess would have been a non-starter.
We just have this compulsion to hang onto everything because we can, and perhaps with the faint hope that somewhere down the line we'll be able to show extreme cleverness to our PHB's when they ask some inane question like, "Duh, how many unique IP addresses have accessed our website since 1991?" and we'll be able to say, "Give me 10 minute and I'll let you know (wag tail)."
Chances are that Google themselves has never had to follow-up on an IP address to identify a user for anyone except the Chinese government and/or the NSA, neither of which are our friends. The first poster who asks why they keep this at all, let alone weren't anonymizing it long ago has it right. This is hardly the first time Google has had to turn over access records so they certainly know that it can and will happen.
Don't be evil at Google seems to mean don't destroy data you never needed in the first place in the event that some government we want to keep as our friend might want it. But now we find out that more than just governments can get to it with baseless suits and moronic judges.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Google clearly should have anticipated this. Governments have requested/required info on individual users before, as has been posted many times to /. For some countries, Google even moved user data off-shore, to protect it. Privacy advocates warned of this problem happening.
Google's rule is 'don't be evil', as long as it doesn't interfere with business.
But the problem isn't Google, it's us. We keep using Google, though we knew about the risks and problems. The day a company risks significant revenue over privacy, is the day they will pay attention to it.
We have met the enemy and he is us.
http://en.wikipedia.org/wiki/Pogo_(comics)#.22We_have_met_the_enemy.....22
That didn't mean much to one European BitTorrent tracker site who was ordered by U.S. judges to turn over all access logs where the site didn't even keep logs to start with. The judge said in his infinite wisdom that because the data existed in RAM at some instant that the logs were required to be created and then turned over.
While I respect the USA law within the USA, I despise when judges attempt, often with too much success, to enforce it outside of the USA. And not just data laws. We enforce US sex laws in other countries to criminalize behavior completely legal there. This Is Wrong!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
...if you don't have a Google login name. Google search works just fine without one. It even works fine without any Google cookies.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
just say they were 'lost' and that the backups were destroyed or lost due to shady backup practices. works for the White House.
There is an interesting tie in here to something I've promoted all along: If the last mile was owned by cooperative groups (meaning NOT ISPs) then they could pool the IP addresses assigned in a random, and meaningless way. That is to say that if 237 people in a housing association were sharing DHCP IP addresses through a server system with enough bandwidth that many ISPs could hook up and serve out email and other services by user, it would be possible to hide the end user IP. Then any stats by Google or others would apply to the group, not an individual. Share that cooperative environment out amongst all the people of your neighborhood or town where the number is now thousands or tens of thousands and the problem of privacy becomes less of a concern.
Only when there is centralized control of Internet usage is there a privacy issue. Imagine being part of a cooperative with 34 connections to various ISPs, and all of the 12000 users in the cooperative using something like TOR. Standard Internet browser usage would be anonymized completely. The idea that you should be identifiable comes from the fact that there is a way currently to identify you. If your packets arrived to the greater Internet backbone from more than one source and more than one IP, it would be anonymous, and the 'grid' would be truly that. If you and 14999 of your friends decide to make a mesh network using wireless and landline connections at each node, it would be impossible for anyone to identify your network habits. It would also be nearly impossible to cause a network-only outage. Power loss could still be catastrophic. My point is this, if you truly want anonymity, you have to work hard for it. Most people don't want to. Consequences of that are inevitable, unavoidable, costly.
I believe that this *IS* the answer to the problems of network neutrality. Force the powers that be to accept that they cannot regulate private networks by building our own outside of their useless understanding of how things work. When they finally discover that they cannot regulate, things will change a bit. I'm all for calling it a patriot network... might be over the top a bit, but we all need to start creating them.
Support NYCountryLawyer RIAA vs People
The world will find out about my Thomas the Tank engine fetish....
Viacom do not need this information. Any of it. At all.
Viacom, as I understand, want to show what percentage of YouTube content views are of Viacom content. In order to accomplish this all they need to do is provide Google with a list of content IDs, which they would need to have if they themselves were to perform the analysis anyway, and then to allow Google to provide a count of views for each of these pieces of content versus the total of all other content views for the same period.
Done. Mission accomplished. No private data changes hands.
I personally cannot comprehend how a judge ruled that privacy issues resulting from this are "speculative". You are essentially handing over information on millions of people on what content they watched, uploaded, commented on, rated, tagged, etc. to a media company, without need. This information is also the foundation for YouTube's business being handed over to a competitor.
The judge says it's speculative? I say remove the judge for willfully violating the privacy of millions of citizens and foreign nationals.
I would also like to know how the judge has completely ignored the Video Privacy Protection Act? If it's on the Internet suddenly all privacy concern automatically goes away, even if you're engaged as a customer of a company with a published privacy policy offering you many protections?
> Google has just been stupid here about privacy, and now it's coming home to roost in a very public way.
This is true, but it's not the worst of it.
Much, *MUCH* worse is that the judge has imposed on Google a legal ruling that the RIAA must be wetting themselves to obtain. And of course, these records will go straight to the MPAA, despite the contraints placed on their use.
This is either a case of extreme naivete on the part of the judge in ignoring the privacy ramifications in his incredible ruling, or quite possibly a simple case of corruption. Such naivete would be so incredible in a judge that isn't senile, that corruption has to be far more likely.
As for Google, their lawyers should have IMMEDIATELY said to the judge "Our client cannot do that, on privacy grounds. Google's duty to protect the privacy of millions cannot be dismissed by a legal ruling." Judges are not omnipotent, even when some of them think they are.
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra