Google Oogled

In May, Google announced that, for more than three years -- in more than 30 countries -- it had been "mistakenly collecting" personal data from open WiFi networks as its vehicles roamed the streets taking photos for its Street View mapping service. That data could include people's email messages, their passwords and even the logs of their Web site visits.

This week, more than 30 state attorneys general announced they will begin examining the lawfulness of Google's actions, though it still isn't clear whether Google committed any legal wrongdoing. "At the very least, Google acknowledges that intercepting and gathering people's data was wrong," Connecticut AG Richard Blumenthal told WIRED. "But there may be a need to strengthen and enhance federal and state laws." Meanwhile, the chief of the Consumer and Governmental Affairs Bureau of the Federal Communications Commission has issued a warning to consumers that Google's "behavior" raises important privacy concerns, adding that the collection of WiFi data, "whether intentional or not ... clearly infringes on consumer privacy."

The Google disclosures have triggered one of the biggest public probes of online privacy so far in the digital era. Google, in response to government inquiries and lawsuits, has claimed that it is lawful to use packet-sniffing tools readily available on the Internet to spy on and download payload data from others using the same open Wi-Fi access points. But two months ago, in May, shortly after the FCC and U.S. Justice Department began looking into the Street Maps issue, Google co-founder Sergey Brin told a Google developer conference his company "screwed up" by improperly collecting the WiFi data. "We screwed up, and I'm not making excuses about it," Brin said. "Trust is very important to us and we're going to do everything we can to preserve it." Brin said the company is "putting more internal controls into place and bringing in third parties to work on this issue, as well." Google also has begun destroying some of the Wi-Fi data it collected for Street View -- in some cases, at the request of governments, including Britain's. But privacy advocates now say Google should preserve the data and turn it over to governments.

"The problem here is that there are criminal laws at issue, and there is a real question as to whether Google violated these laws," says Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC), a nonprofit privacy rights group in Washington. "If it did, the evidence is in the information Google collected. Google has tried to minimize the data it collected, calling it snippets or fragments. But that's a determination that needs to be made by a third party, possibly a prosecutor."

For one of the most comprehensive overviews of the Street Map issue -- including a timeline of the Street View program from its launch in 2007 to Germany's announcement last month that Street View vehicles have been collecting data from WiFi networks -- see EPIC's Web page on the brouhaha.

Street View isn't the only Google product that has been drawing recent privacy concerns. In February, EPIC filed a complaint against the company with the FTC, seeking constraints on Google Buzz, the company's new social networking service. The complaint describes an attempt by Google "to convert the private, personal information of Gmail subscribers into public information" for the Buzz service. "This change in business practices and service terms violated user privacy expectations, diminished user privacy, contradicted Google's own privacy policy, and may have also violated federal wiretap laws." [Facebook also has come under fire from privacy advocates for ongoing problems with its privacy settings, chiefly the lack of control users have over personal information that others have made public about them, including photographs. Another sore spot: Facebook's decision to push users into using its "instant personalization" feature, the company's link to third-party Web sites such as Yelp and Pandora that share users' opinons on shops and tunes.]

What do you think? As the Web becomes more "social," should consumers have more of a say in how their personal data is distributed across social networks? [See Radical Shock, a Q&A by Cause Global with privacy scholar Helen Nissenbaum about the need for new privacy protections that don't care so much about whether data is shared "but whether it's being shared appropriately."] Let us hear from you.

-- Marcia Stepanek

(Photo: istock.com)

Networkers' Bill of Rights

An influential group of Silicon Valley tech activists are circulating a petition across the Web that calls for a Social Network Users Bill of Rights. As reported here earlier, the group met last week at the 2010 Computers, Freedom and Privacy conference in San Jose to hammer out the document, a response to the ongoing Facebook privacy uproar and concern over Goggle Buzz's recent release of users' top email contacts.

Here's what emerged:

We, the users, expect social network sites to provide us the following rights in their Terms of Service, Privacy Policies and implementations of their system:

1. Honesty: Honor your privacy policy and terms of service

2. Clarity: Make sure that policies, terms of service, and settings are easy to find and understand

3. Freedom of speech: Do not delete or modify my data without a clear policy and justification

4. Empowerment: Support assistive technologies and universal accessibility

5. Self-protection: Support privacy-enhancing technologies

6. Data minimization: Minimize the information I am required to provide and share with others.

7. Control: Let me control my data, and don't facilitate sharing it unless I agree first.

8. Predictability: Obtain my prior consent before significantly changing who can see my data.

9. Data portability: Make it easy for me to obtain a copy of my data.

10. Protection: Treat my data as securely as your own confidential data unless I choose to share it, and notify me if it is compromised.

11. Right to know: Show me how you are using my data and allow me to see who and what has access to it.

12. Right to self-define: Let me create more than one identity and use pseudonyms. Do not link them without my permission.

13. Right to appeal: Allow me to appeal punitive actions.

14. Right to withdraw: Allow me to delete my account, and remove my data.

What do you think? Google and Twitter have, so far, declined to comment; a Google spokesperson said the company already has its own set of posted privacy standards. Facebook, when asked to comment on the principles by the San Jose Mercury News, issued a prepared statement, which said that while Facebook shares the goal of ensuring "a safe and trusted environment" for its users, "we don't agree with all of the proposed elements" of the Bill of Rights, including any provision that would let people use pseudonyms.

Petition organizers are hoping to get widespread support for the document, regardless. "A networking Bill of Rights is a tool that users can use for education and empowerment," said Jack Lerner, director of the USC Intellectual Property and Technology Law Clinic and one of the drafters. Jon Pincus, a co-chairman of the conference, added that "Facebook, with its 400 million users, likes to describe itself as equivalent to the third-largest country in the world. But what rights do the citizens of that country have? Users of social networks need to know about how some of their rights are being subverted and need to know how to protect themselves."

What do you think? Noble pipe dream, or the start of something big? Go here to vote in favor of the petition; go here to vote against it.

-- Marcia Stepanek

(Illustration: istock.com)