Google's recent legal spat with the U.S. Department of Justice highlights not only what information search engines record about us but also the shortcomings in a federal law that's supposed to protect online privacy.
It's only a matter of time before other attorneys realize that a person's entire search history is available for the asking, and the subpoenas begin to fly. This could happen in civil lawsuits or criminal prosecutions.
That type of fishing expedition is not legally permitted for Web mail providers. But because search engines are not fully shielded by the 1986 Electronic Communications Privacy Act--concocted back in the era of CompuServe and bulletin board systems--their users don't enjoy the same level of privacy.
"Back then, providers were very different animals than they are now," says Paul Ohm, a former Justice Department attorney who teaches computer crime law at the University of Colorado at Boulder.
Two solutions are simple to describe, but not likely to happen. First, search engines could voluntarily--or be required by law to--delete search histories after a few months unless the customer objects. Second, federal law could be amended to make it clear that search engines, which serve as a window to the Internet, are fully protected.
CNET News.com has surveyed Google, Microsoft, Yahoo and AOL to find out their privacy practices, and assembled these answers to frequently asked questions.
Q: Does Google collect and record people's search terms whether they're
logged in or not?
Yes. Google confirmed this week that it keeps and
collates these results, which means the company can be forced to divulge them
under court order. Whether Google does anything else with them is another issue.
Given the Department of Justice's recent subpoena to Google, it's likely the police or even lawyers in civil cases--divorce attorneys, employers in severance disputes--eventually will demand that Google, Microsoft, Yahoo, AOL, and other search engines cough up users' search histories.
Q: Has this happened before?
Almost. A North Carolina man was found
guilty of murder in November in part because he Googled the words "neck," "snap," "break" and "hold" before
his wife was killed. But those search terms were found on Robert Petrick's
computer, not obtained from Google directly.
Also, attorneys have already begun introducing searches conducted on Google, Yahoo and AltaVista as evidence.
Q: When I use search engines, I type in a lot of search terms I consider
private. What does this mean?
We go into all the details below. But the
short answer is that when private companies collect reams of data all the time
on nearly every American, and the government and curious attorneys can get to that with few obstacles, this becomes a problem. Search
engines provide a look into people's personal lives, and privacy awareness has not kept pace.
Q: Aren't there any privacy laws that protect us?
Not really. There
is a federal law called the Electronic Communications Privacy Act. But it was enacted in
1986, long before politicians knew about the Internet, and the wording doesn't
prevent police and attorneys from targeting search engines.
Politicians wrote that law in a way that is technology-specific--one key part revolves around the meaning of the pre-Internet term "processing services"--instead of adopting a more flexible approach that would grow with technology. Some states may have laws that are more applicable.
Q: Why does Google store that information about me, anyway?
No law
requires Google to delete it, and there are some business justifications for keeping it.
For instance, keeping detailed records can help in identifying click fraud (faking clicks on Web ads to drive up a rival's cost), and in optimizing search results for different geographic areas. Compiling a user profile can aid in tailoring search results in products like Google Personalized Search. Also, disk storage is cheap, and engineers tend to prefer to keep data rather than delete it.
But it's hardly clear that a compelling reason exists for keeping older records--beyond a few months--unless a customer voluntarily chooses options like personalization.
Q: Does that mean Google has the technical ability to link a person's
searches together and divulge them when legally required?
Yes. Google says in its FAQ that it records Internet address, date, time,
browser type, operating system and a cookie ID.
Author and entrepreneur John Battelle received word from Google last week that the company can perform two important types of matches. (We confirmed this with Google and followed up with additional questions.)
First, given a number of search terms, Google can produce a list of people (identified by Internet address or cookie) who searched for a given term. Second, given a collection of Internet addresses, Google can produce a list of the terms searched by the user of a
Play video
There are currently no comments for this post.