How Far Should Google Go To Protect User Privacy In Lawsuits?

from the questions-questions dept

We've already discussed the ridiculous circumstances under which a model, Liskula Cohen, ended up getting a judge to order Google to reveal an anonymous blogger who Cohen felt defamed her by calling her a "skank," among other things. That no longer anonymous blogger, Rosemary Port, is now planning to sue Google, though it seems her chances of winning are slim to none. Still, the whole thing did raise questions about the level to which Google should go to protect the anonymity of people who use its services.

This issue is getting more attention, as Google has apparently alerted some anonymous Caribbean journalists that it may hand over their information due to a defamation lawsuit filed against the journalists, concerning their investigations into corruption in the famed vacation resort Turks & Caicos Islands. One of the people accused of being involved in the corruption filed the lawsuit, and Google sent the site a letter, saying:

To comply with the law, unless you provide us with a copy of a motion to quash the subpoena (or other formal objection filed in court) via email at legal-support@google.com by 5pm Pacific Time on September 16, 2009, Google will assume you do not have an objection to production of the requested information and may provide responsive documents on this date.

Some are making a big "First Amendment" deal out of this, but it's not clear that's such a huge deal. Google, as a private company, can choose to reveal that information, and appears to be properly notifying the people in question of the legal situation and allowing them to respond. But, of course, some insist that Google should stand up for the privacy rights of its users, and there's an argument to be made there. How far should Google be expected to go to defend the privacy of its users in the face of a court order or subpoena? Given Google's reputation as being user friendly, many would expect it to go quite far, but is that reasonable? Is there a balance between obeying court orders and subpoenas and fighting for its users' rights? Or should Google always default to defending its users' rights as far as possible?

39 Comments | Leave a Comment..

Court Says IP Addresses Aren't Personally Identifiable Information

from the ok... dept

We've noted that in Europe, IP addresses are considered private info, and I've pointed out that I don't think IP addresses, by themselves, should be considered private. I agree that combined with other identifying information an IP address can reveal info about you, but just the numbers alone are not private. And it appears a judge agrees, noting that IP addresses are not "personally identifiable" information (sent in by Dave Barnes). I'm actually surprised about this, because most people seem to disagree with me on IP addresses. However, this does raise a separate question: if courts say IP addresses are not personally identifiable, then does that shoot a large hole in most of the RIAA cases which rely on IP addresses? After all, the judge in this ruling said:

"In order for 'personally identifiable information' to be personally identifiable, it must identify a person. But an IP address identifies a computer."

37 Comments | Leave a Comment..

Italy Is The Latest Country To Realize IP Address Alone Does Not ID File Sharers

from the took-'em-long-enough dept

For many years, people who understand these things have pointed out that an IP address alone does not accurately identify who was doing any sort of file sharing. In many cases, it doesn't even accurately identify who was paying for the connection being used. Yet, the industry has often relied on IP addresses as definitive proof of file sharing. Only recently have courts begun to recognize how that's a problem. So it's nice to see that an Italian court is now recognizing that IP addresses alone are not enough to identify a file sharer, and even throwing out cases that don't have much more in the way of evidence. Still, in most of the various cases, it's never really about getting people to court. The industry prefers to scare people with a letter implying it has the evidence, and then getting people to pay up a "settlement fee" before they can defend themselves, because that's a lot cheaper than going to court.

26 Comments | Leave a Comment..

The Pirate Bay IP Addresses Point To Prosecution Lawyers

from the funny-stuff dept

In a somewhat amusing joke, it looks like the folks behind The Pirate Bay have had their latest IPs listed as being controlled by the law firms involved in the prosecution against them. Some thought that somehow the law firms had taken control over the IP addresses, but it appears to be much more of a joke by The Pirate Bay folks, showing the prosecutors how IP info isn't universal truth. However, the timing of this little prank may have been a bit off, as The Pirate Bay site has been experiencing some downtime due to ISP issues totally unrelated to the IP addresses or to the trial (though, it didn't stop someone from emailing me that The Pirate Bay had been down for all of three minutes and something must be wrong!!!).

17 Comments | Leave a Comment..

Judge's Order For Google To Hand Over YouTube Usage Morphs Into Google Backlash On Storing IPs

from the backlash-everywhere dept

There was plenty of attention given to the judge's order that Google hand over log files to Viacom's lawyers in the Viacom/YouTube lawsuit, with much of it focused on what an awful ruling this was. Now it appears that some are trying to use this bad ruling to actually focus negative attention on Google instead. A lawyer who is also suing YouTube over copyright issues mistakenly claims that Google has tricked the press into making Viacom the enemy here. That's not quite true, though. Most of the anger was focused on the judge's decision, not on Viacom. However, he does make another, related point that is getting picked up by others as well: "How else do you explain why they have been collecting and using IP addresses to monetize their site (for a while now), yet only now, with great self righteousness, claim to be concerned about producing IP addresses?"

Of course, that's not quite an accurate portrayal of the situation either. It's one thing to store your own log files -- it's quite another to be asked to hand them over to a random third party. Louis Solomon's statement above is like saying "how can a doctor store your medical info and then, with great self righteousness, claim to be concerned about protecting your medical info." It's rather easy: the doctor has a right to the medical info, while a third party does not.

However, that hasn't stopped some privacy advocates from asking why Google has kept the log files in the first place. This doesn't strike me as being that big a deal, to be honest. There are plenty of reasons why Google should be able to control its own log files. I can understand questions concerning what it does with the log files should those actions violate user privacy -- but merely tracking how people use their websites hardly seems like a privacy violation.

34 Comments | Leave a Comment..

Phorm Did Track IP Addresses, Replaced Charity Ads With Behavioral Ads

from the how-nice-of-them dept

Phorm, the extremely controversial former adware company that reinvented itself as a behavioral advertising firm that would work with ISPs to look at your clickstream data and serve you special ads instead of the ones you were supposed to see, has been working overtime to defend its program as being perfectly legitimate and no risk to anyone's privacy. Of course, that's not satisfying many, as it later came out that, despite claims of openness, BT and Phorm had secretly tested the service without letting anyone know their clickstream data was being used this way. Even worse, after this news came out, BT and Phorm downplayed the test, only to later have it come out that it was quite extensive.

And, now, it gets even worse. More information has been leaked out about that test. As for it being super duper secret without your IP address ever being compromised? Well, not so much. It turns out that an internal BT analysis found that IP addresses were likely used as the identifier, which is the exact opposite from what Phorm has insisted. And, as for how well the system works? Well, it was successful in covering up ads for various charities and replacing them with "targeted" behavioral ads instead. Wouldn't want those darn charities to have anyone see their ads.

Update: A representative of Phorm has gotten in touch to note that there were some incorrect statements in the original report on this. Specifically, it appears that Phorm purchased the original charity ads that were replaced -- so it's not as though the charity lost anything here. It's easy to understand why the original interpretation of the BT report would make one think this was not the case, as it stated: "The advertisements were used to replaced [sic] a 'default' charity advertisement (one of Oxfam, Make Trade Fair or SOS Children's Villages) when a suitable contextual or behavioural match could be made by the PageSense system." It does not appear to say that the ads were purchased by Phorm -- at least not in that same section. At this time, there is still no indication whether or not the charities knew their ads were going to be "covered up" in this manner. None of this, of course, answers the questions about whether or not this test was legal.

Update 2: And now BT has also gotten in touch with us to complain -- though they falsely accuse us of making false statements, saying that the headline still says they "hijacked" charity ads. It does not and has not. It has always said "replaced" which, I'll remind BT, is the exact word used in their own report. Unless BT was falsifying its own report, the word "replace" is correct. The mistake was in suggesting that Phorm had not purchased that ad space -- and that has already been corrected quite clearly. BT also is upset that we accused them of "misleading ICO." The only problem: we made no such statement. Finally, BT complains that no personal information was used in the trials -- which is a point that is still disputed. The original researcher who researched the report claims that IP addresses were passed to Phorm's proxy server and that personal info was requested on a web form. BT notes that the IP addresses were not stored -- but that doesn't mean they weren't used, which was what was in question. Also, to both Phorm and BT, the comments on this post are open, and you are free to make your case here where anyone else can see it. Contacting me personally, with vague, slightly threatening and sometimes incorrect statements is certainly less effective that making your case to the public. Part of the reason you're in this PR situation is because of your secrecy. Being a bit more open might help.

20 Comments | Leave a Comment..

Is Your IP Address Your Personal Information?

from the seems-like-a-stretch dept

Some European politicians in charge of "privacy" issues have decided that your IP address should be considered personal info, along the lines of your name or address. This has various implications for how sites like Google store IP addresses -- but also should raise some questions about what sorts of information should be considered private. We've already talked about why you should just assume that any information you put online is already public info, but an IP address isn't exactly something that you "put" online. It's something that automatically identifies where you're coming from and is a necessary part of internet communications. While it is true that an IP address can often be used to trace back the identity of an individual, it seems a little odd to think that a bit of information that your computer announces to every site you visit should somehow be considered private. By it's very nature your IP address is rather public -- and if you want to "hide" that information there are various anonymity tools and proxy servers to do so. It seems like a rather artificial construct to suddenly claim that an IP address, which is used to announce where you're coming from, now needs to be considered private information.

In fact, this whole discussion raises an important (and all-too-often-ignored) issue: personal information and privacy isn't exactly a binary situation, where information either is, or is not, private. There's a whole spectrum -- and it depends very much on the circumstance. Your name is personal info, but most people are public enough with it. Your credit card information clearly is "private," but you share it with plenty of merchants as part of the transaction that you're making. Your phone number is personal information that you may keep private in some cases, but are willing to make public in others. So, the privacy of personal information varies a great deal based on the context and use -- and it seems a bit forced to suddenly declare that a particular piece of information is personal, and therefore must be kept private.

39 Comments | Leave a Comment..

TorrentSpy Cuts Off US Users, Rather Than Tracking Them

from the and-the-music-played-on dept

BitTorrent search engine TorrentSpy has been involved in a legal battle with the MPAA for some time now. The lawsuit took a slightly bizarre twist a few months back when a judge demanded that TorrentSpy start logging details about its users -- something the company had never done and had no plans to do. TorrentSpy claims that doing so will violate its users privacy and violate its own terms of service. Apparently, however, that hasn't convinced the judge to change the ruling -- meaning that TorrentSpy has now cut off access to visitors coming from the US as a way of protecting their privacy. Of course, it'll probably take all of about 10 minutes for most people to figure out other ways to get to TorrentSpy (or they'll just move on to another BitTorrent search engine). Congratulations to the MPAA for driving a bunch of movie fans further underground...

26 Comments | Leave a Comment..