August 30, 2002

2:36 PM

Is Google's use of cookies unnecessarily invasive?Daniel Brandt, described by Salon yesterday as Mr. Anti-Google, says Google "has inadequate justification for planting a cookie that expires in 2038 on every user, and also recording that user's search terms, IP number, and time-date." Brandt is the man behind the NameBase conspiracy database (previously discussed here), and also uncovered the CIA's illegal use of cookies last March. He insists that Google's use of cookies, combined with the Patriot Act, allows U.S. authorities to "do a 'sneak and peek' search of a Google user's hard drive when he isn't home, retrieve a Google cookie id, and then get a keyword search history" specific to the user's computer. Oh yeah, he also thinks PageRank is undemocratic.
posted by mediareport (39 comments total)

Am I the only one who thinks Salon's article is a bit over-the-top with the "this guy's a loon" stuff? At the very least, I think Google's responses to Salon's questions about its privacy policy are ridiculously off the point; they deserve follow up. Even Brandt's PageRank point strikes me as valid. So what if Brandt is upset at how Namebase gets ranked? Calling out Google for touting the system as "democratic" sure makes sense to me. Hopefully, more tech-savvy MeFi'ers will help me sort this one out.
posted by mediareport at 2:41 PM on August 30, 2002

when he isn't home??

Well, that right there disqualifies him about knowing anything about how cookies work.
posted by crunchland at 3:00 PM on August 30, 2002

No, the guy is a loon. A huge portion of the web servers out there record exactly the same data in access_log. That it gets tied to a particular browser installation -- via the Google cookie -- is simply not all that scary compared to what a great many other, less above-board organizations, are trying to do in terms of privacy invasion. Logging accesses to a web server is standard procedure and nearly all do it.

Does Google have "adwquate justification" to individually identify a browser installation with a cookie? Yes, to customize itself to your preferences it needs a way to differentiate your browser state from anyone else at the same IP address (such as behind a proxy, on a multiuser system, or on a network with dynamic addressing).

Is there a good reason to expire the cookie in 2038? Yes. That's the customary value for "don't expire at all."

The guy's a coconut almond nutbar and needs to understand somewhat more about the subject before hurling accusations and bleating paranoia.

Do take all this with a grain of salt; I've drunk the Google kool-aid and believe firmly that the current management and technical direction of the company is a wonderful thing, and that Google is at the present time attempting -- with success -- to do good things in the world.
posted by majick at 3:06 PM on August 30, 2002

I think on the cookie issue Brandt is right. On the page rank, his sour grapes about his own page detracts seriously from his credibility.

I have no problem with Google using a cookie to save my preferences. Metafilter uses a cookie for that. However, why does Google keep individual stats on my searches that can be linked to my cookie? You can always delete your cookie periodically, but why should you have to? Google should not keep this information; there is no excuse for it. Does Metafilter keep a running log of everything that I look at? I doubt it. There is a difference. Matt runs this for love not profit, although he deserves one. Google is a business, pure and simple. They have the best technology, but take big hits for keeping individual search logs.

My comments are based upon believing Brandt that this is true. Here's hoping that he is full of it and that Google doesn't actually keep user identifiable logs. Aggregate logs are completely different.
posted by caddis at 3:10 PM on August 30, 2002

Call me crazy, but if I do a search for "United Airlines," I want the corporate site to come up first with various and sundry related sites ranked after it. Same with the Donald Rumsfeld search--if Google brought up the NameBase sites before the Defense Department, then I'd call it faulty. My own experience with getting my sites ranked in Google have been flawless. Of all the catalogues and search engines, Google was the first to list my sites and immediately gave me a higher rank than other engines, which insisted on listing sites that didn't even exist anymore above mine. I'm sure Google's not perfect, or even necessarily all good, but I definitely think they're the best choice out there.
posted by dreadmuffin at 3:19 PM on August 30, 2002

caddis: AFAIK, Metafilter has a log of everything you look at. It's just not being saved in your cookie.

The funny thing here is that people should be happy that your recent searches are being saved on your computer (where you can delete them) rather than, as Amazon does, save them in a database on their server. Go do a search for "Vibrators" on Amazon, and then watch how it starts trying to sell you more vibrators for days after. There's nothing you can do about that.

Google permits you to visit their site with cookies turned off--and IE 6 allows you to block cookies at the site level.
posted by perplexed at 3:40 PM on August 30, 2002

I admit, I haven't read the Salon story yet, but I read the guy's PageRank rant and agree if Salon implies this guy is a loon.. I think he is!

"Votes cast by pages that are themselves 'important' weigh more heavily and help to make other pages 'important.'" In other words, the rich get richer, and the poor hardly count at all. This is not "uniquely democratic," but rather it's uniquely tyrannical.

I mean, that just demonstrates his 'loonyness'. He's comparing national elections to ranking Web pages. Web pages are not citizens, and are not 'ruled' by anyone. It's just that a search engine uses the importance of a page to clarify the importance of others. And do remember that while you get a benefit if a high PR site links to yours.. it doesn't -have- to. Your PR can increase from even small sites linking to yours.

And what of his 'solution' to this problem? He suggests Google keep using PageRank but simply sweep the name under the carpet and to get people to forget about it. Oh, well that's smart. At least Google is a little open about their policies.

And his point is invalid anyway. America is not entirely democratic (note: last Presidential election). The votes of the electoral college have far more importance than those of ordinary citizens.. is that democratic?
posted by wackybrit at 3:43 PM on August 30, 2002

crunchland, what do you mean? If the government can enter homes and search computers while you're gone, and Google cookies are stored on your computer, I don't understand what you're trying to say.
posted by mediareport at 3:55 PM on August 30, 2002

perplexed: Google, as far as I know, does not save my searches on my computer. Rather, it saves the search requests on its computers and links them to a cookie on my computer. By deleting the cookie occasionally I effectively erase that record, unless my ISP gives me a persistent address, in which case I am screwed and Google saves in an identifiable, retrievable way every search that I have ever made. This makes me a little uncomfortable, and it should make anyone uncomfortable.
posted by caddis at 4:01 PM on August 30, 2002

why does Google keep individual stats on my searches that can be linked to my cookie? You can always delete your cookie periodically, but why should you have to? Google should not keep this information; there is no excuse for it.

My thinking exactly. For comparison, note that after the Patriot Act, the American Library Association recommended (pdf) that its member libraries "review and address its policies on retention of and access to all types of information," which many in the field took to mean that libraries shouldn't keep personally identifiable information about patrons' choices for *any* length of time. Why is the supposedly good-hearted and democratic Google not doing likewise?

majick and perplexed, there's a big difference between cookies that set simple preferences like seeing 100 results at a time instead of 10 and cookies that store everything my computer has searched for at Google until the year 2038. And note how the Google rep, Nathan Tyler, fudges on the 2nd page of the Salon article by presenting an either/or situation: Either you let us store all your search terms until 2038, or don't use cookies at Google. Like those are really the only two choices.

The Salon author not only lets Google off the hook on that one, but then goes on to say, "It's hard to get too upset about search privacy at Google" because other companies do worse. Huh? I don't give a fuck what ABC or Fox News have worked out with Doubleclick. But I use Google every day, and it'd be nice to hear a specific reason why they've set their cookies to keep a record of all my search terms for the equivalent of forever. I call bullshit on that.
posted by mediareport at 4:17 PM on August 30, 2002

Oh, I see. I didn't factor in the paranoid aspect. I thought they guy was saying that Google could somehow connect to your PC without your knowledge. So the guy isn't ignorant, just schizoid.
posted by crunchland at 4:25 PM on August 30, 2002

Not that anyone will care, but I'm really getting tired of snide dismissals of people who raise obviously good points. crunchland, you were wrong in your first comment, and you're wrong in the second. Google is collecting information it has no apparent reason to collect -- the kind of information that other public services committed to freedom of public information don't collect on their users. Asking pointed questions about why Google is keeping this information, and raising civil liberties concerns the ACLU and Libertarian Party have also raised, is hardly "schizoid."

IF there's anyone who can argue these things without insults, please feel free to jump in here. Geez, crunchland. What's the point to doing what you're doing in this thread?
posted by mediareport at 4:45 PM on August 30, 2002

I'm just curious, what kinds of stuff is this guy searching for in Google that has him so paranoid? It has to be more exciting than my last search, i810 drivers for XFree86...
posted by samsara at 4:46 PM on August 30, 2002

caddis! My mistake. I misread the article.
posted by perplexed at 4:57 PM on August 30, 2002

Pr0n?
Islamic Info sites?
A good lawyer?

Who cares. It's a privacy issue.
posted by dash_slot- at 5:04 PM on August 30, 2002

I'm really getting tired...

I suggest you take a nap.

If he honestly believes the FBI is going into his house when he's not home and looking at his hard disk drive for cookies from Google... well, I count that as being paranoid.

And I'm not doing anything but participating. What are you doing?
posted by crunchland at 5:14 PM on August 30, 2002

The browser makers are way ahead of the schizoids here. Both IE and Mozilla let you block a particular site's cookies, and Mozilla lets you limit cookie lifetime to as short as you wish (right down to timing out after each session). If you've got a problem with how a site handles your privacy, it's quite easy for you to block it. It's kinda weird to hear people make a big stink over something that 10 seconds in their preferences would fix.
posted by boaz at 5:20 PM on August 30, 2002

I'm not jumping on the "he's a schizoid" bandwagon, I'm just curious. If I were to search for something that would devistate me if seen in public, then I would take measures to ensure that my tracks are covered. Although, from what I've seen, I wouldn't worry about Google's cookie since the rest of the information (just searches from what I've read) is on their servers. I would just clear the cache and history in most cases. (unless, well...if I was doing something blantantly illegal...er...using Google that is...)

Now on the other hand, privacy is an issue for those not knowledgable with how web browsers work in the first place. However I really don't believe this becomes a privacy issue until there's a reason to physically connect a person's name, address, cookie and the computer it is stored on. If it's the FBI that has to do the leg work to request this information, then there is probably a valid reason.
posted by samsara at 5:23 PM on August 30, 2002

Right on, boaz. I have Mozilla ask me whether to store a cookie every time a web page tries to set one, and it's quite incredible how many cookies it's possible to pick up. Personally, I can't see why anyone would ever browse with "accept all cookies" turned on.
posted by salmacis at 5:25 PM on August 30, 2002

Google is collecting information it has no apparent reason to collect

Can someone tell me where Google's privacy policy says this? Granted, it doesn't say specifically that they aren't collecting search keywords in an individually identifiable manner, but I don't see where it says they are. It seems to me that this issue can be summarized as "Conspiracy theorist offers pessimistic between-the-lines reading of Google policy." The Google mouthpiece quoted in the Salon article doesn't seem to address Brandt's complaints, but her statements seem to be taken pretty far out of context as well.
posted by hilker at 7:11 PM on August 30, 2002

Google is collecting information it has no apparent reason to collect

I'd think it would be very useful to be able to see what kinds of searches a specific user performs over a long period of time. In theory, it should be possible to bias the results toward things you have been interested in in the past. That seems like a quite legitimate reason, to me.
posted by kindall at 8:02 PM on August 30, 2002

How much spamming of the google page rank system is happening? I know many of the other search engines were made unusable by abusive tactics (cramming keywords, invisible text, etc) of early irresponsible webmasters.

Look at this page for the London Knights, a Junior A hockey team. The bottom of the page is full of invisible text linking to all the web design company's other sites (You have to look at the source - it's all covered with a big div so that the links aren't selectable and don't trigger the cursor pointer). A nasty trick that I haven't seen elsewhere yet, but could undermine google's effectiveness if it becomes common or isn't countered.

Oh, and I see no reason for google to be warehousing individuals' search terms. They might be the most well-meaning company to ever take out a business licence, but it's still a practice potentially dangerous to civil liberties and they should be made to answer for it.
posted by TimTypeZed at 8:25 PM on August 30, 2002

Ok, just a quick question: how much have you paid recently to use Google?

Really? Nothing? Free? Exactly, so get used to the fact that you are going to pay with information.

Google is a great service, thus it is popular and thus and it costs a lot to run. Google is not a public company yet, so it's revenues are not entirely transparent, but a significant source of revenue is almost certainly advertising and advertisers are convinced by data, data that we can all help provide by leaving our cookies alone.

Support free Google. Provide Data. Keep your cookies.


And no, I don't work for Google.
posted by i blame your mother at 9:47 PM on August 30, 2002

Perhaps I am reading into their responses, but I detect in the Google defenders on this issue an inherent bias. I feel it too. Google is the ultimate search engine. Everything that came before pales by comparison. Google did not sell out on a corporate basis like so many other search engines. I could go on, and on, and on singing Google's praises. They are just so great. I love Google. That is why this sort of creepy aspect of saving every search request in an individually identifiable fashion bothers me so much. What if, on the other hand, Microsoft owned Google? What if, unbeknownst to us, the FBI was really in control of Google? Would that change our opinions of whether it is OK for Google to save personally identifiable search results? Yes, most individual searches are innocent enough, but if you wanted to create a dossier on someone logging their search requests would be a pretty potent place to start You could probably discern, albeit without certainty, their health history, drug history, sexual preferences, political preferences, etc., all of which most people, would rather keep private whether they have something specific to hide or not.
posted by caddis at 11:06 PM on August 30, 2002

Perhaps I am reading into their responses, but I detect in the Google defenders on this issue an inherent bias

Its not just you. There is definitely a touch of 'cult of Google' out there in which it is somehow believed that they can do no wrong. Frankly, I think its frightening.

I have a simple rule: I don't "love" corporations, especially for-profit ones.
posted by vacapinta at 11:23 PM on August 30, 2002

from google's privacy policy:

Google does not collect any unique information about you (such as your name, email address, etc.) except when you specifically and knowingly provide such information. Google notes and saves information such as time of day, browser type, browser language, and IP address with each query. That information is used to verify our records and to provide more relevant services to users. For example, Google may use your IP address or browser language to determine which language to use when showing search results or advertisements.

this sounds a lot like keeping server logs, which nearly every site does. what's to be outraged about?
posted by chrisege at 12:12 AM on August 31, 2002

Google notes and saves information such as time of day, browser type, browser language, and IP address with each query.

But is the query itself saved? If so, I see it as a problem, whether it's just google, or google and everyone else.
posted by bingo at 4:17 AM on August 31, 2002

Heck, if someone hits my site using google, I can see the query in my referrer logs. I can see their IP address, the time of day, the browser type, and the language.

I really don't see what the big deal is.

Look, ALL web servers log your activity. They show what pages you visit, and what files you download. They show how long you're on a site. They show your IP information, and they show the time and the date. Google's log files must be HUGE, and if they didn't put the cookies on your PC, they'd still have it via that log file.

Might as well just turn off your modem now if that bothers you.
posted by crunchland at 6:01 AM on August 31, 2002

I was pretty disappointed by Salon's article - Google is the search engine for many people, and coming up with this goofball's complaints about how his site isn't popular and how Google dares to use cookies is pretty poor journalism.

What I thought the article was about at first glance is Google's policies with AdWords, those nifty "Sponsored Links" ads to the side of the search results. Basically, Google refuses to take any ads for "sites that advocate against groups or individuals. So after the whole Xenu.Net Scientology
DMCA demand, numerous people took out AdWords critical of Scientology until Google started rejecting any such ads.
Interestingly enough, Google's guide lines fail to mention this limitation. Similarly, Anita Roddick's blog got its AdWords pulled because she called John Malkovich a "vomitous worm". It's not like she did it in the ad, it was just on the front page when a Google employee checked her site, so they pulled it. As Roddick pointed out to the Google ad staff, larger media sites like the NY Times and TownHall.com seem to be able to criticize people and groups without having their ads pulled. Only if you're small and controversial does Google pull your ads - hey, even the site featured Aug 23 on the MeFi sideblog got its ads pulled due to "anti oil sentiment". Not that this is a new thing for advertising - PETA's been trying to put ads on network TV for years, and money or not, they still can't get access.

They also refuse to do business with any company that sell firearms or firearm parts. Again, this isn't just refusing ads for guns but any ads from these companies. Bowman's Bridage had his ads for night vision goggles and dehydrated food pulled because he also sells firearms and knives on his site. I realize that some may think this is a good thing, but I'm sure you can think of some good or service that you'd be annoyed about if it was unadvertisable.

While this is censorship, Google's a private company and they can do this (public agencies that advertise, otoh, can't chose ads based on content like this). I'm just disappointed that Google would - if someone's got the cash, and it's not something illegal, I think they should run the ad. Google's an important source, and when they start acting in a less than colorblind I start getting suspicious about their honesty. Part of my mistrust about conventional media is their refusal to provide equal advertising access even when the money exists, and I'm sad to see Google going down the same path. I also think they should be upfront in the AdWords guidelines about it - it's somewhat dishonest to later come to people and say "Oh, by the way, we don't allow that."

On a less serious note, Google also dislikes bad poets - Christophe Bruno got his fairly nonsensical ads pulled due to poor response. If you don't get the clicks, Google'd rather not have you cluttering up their results. Not that I blame them - they're a business - but hopefully the Cult of Google can realize that.
posted by dragoon at 7:33 AM on August 31, 2002

Google notes and saves information such as time of day, browser type, browser language, and IP address with each query.

bingo, I'm with you. The above sentence doesn't make it clear how, or even *if*, the information listed is associated with your specific query record. Again, the Salon article let the Google rep off the hook.

kindall: I'd think it would be very useful to be able to see what kinds of searches a specific user performs over a long period of time.

Yeah, useful to a business like Google but also, as caddis pointed out, incredibly invasive to visitors. Should Google be storing detailed information about my (ok, my computer's) medical history, location, purchases, drug history, sexual preferences, political preferences, etc? Without making it clear to me it's doing so? I don't think so.

We have every right to ask Google why it's collecting this information (if indeed it is) and how it intends to use it, especially since the company enjoys almost unprecedented good will in the 'Net community. Since most users aren't very smart about cookies, Google is apparently getting a ton of information about people without their permission or knowledge. That seems clearly wrong to me, just like for-profit data-mining in meatspace (without permission) seems clearly wrong to me.

At the very least, there should be more transparency and a middle-ground option that allows us to set a few basic preferences but doesn't allow Google to associate search terms with user cookies for decades to come. And Brandt's point that Google should be a public service, like libraries, is well-taken.

crunchland: I really don't see what the big deal is.

Is the American Library Association being "schizoid" in suggesting its members may not want to retain information about patrons' reading choices? If we're being paranoid, crunchland, you're being pollyannish -- especially given the obvious history of FBI domestic spying abuses. Casually dismissing folks concerned about how the government might use Google's cookie/database combo to spy on and harass U.S. citizens is ignoring reality. (And to be honest, your first two posts surprised me. I guess I expected more when I saw your nick. If my expectations were out of line, let me know and I'll revise downward ;)
posted by mediareport at 12:09 PM on August 31, 2002

Tell you what. I'll give you the benefit of the doubt. Being worried about the FBI snooping is something to be concerned about... and if you have the FBI snooping around in your house while you're away at work, you have more troubles than having to deal with my inane messages here on Metafilter.
posted by crunchland at 4:04 PM on August 31, 2002

Just wondering; has anyone here alerted Google to this thread? It would be interesting if they chose to respond.
posted by taz at 10:49 PM on August 31, 2002

By the way, we'd all better delete our cache and cookies every morning before we leave. And our browser history. And make sure we don't have autocomplete on our browser, or else right clicking on the address box, or even a form field will pull up what we typed before... And we better also wipe our drives to DOD standards... or at least overwrite our empty and erased disk space a couple dozen times with hash characters... oh, and don't forget your caller-id, don't want those pesky law enforcement dudes seeing who called us. Oh, and the notepad on our desks, we should tear off the top 10 pages or so, cuz a little graphite will show what you wrote even if the page is missing (I saw that on CSI last season)... in fact, why don't we all just call in sick to work, because all of this stuff is gonna take so long to do every morning anyway, and then the FBI won't come around snooping because they only do that when we're away from the house, right?

Now, if you'll excuse me, I have some aluminum foil helmets to make, to block out the mind control rays.
posted by crunchland at 12:05 AM on September 1, 2002

I think we're going to see a lot more of the kind of thing crunchland posted above as the debate over a right to privacy in the 21st century heats up. It's a bullshit debate tactic, of course, but it's not designed to debate; it's designed to inflame emotions and encourage folks to ignore 1) the massive profits that can be made sharing information without consumers' permission and 2) yet another powerful government surveillance push.

*shrugs* What can you do? Some folks honestly don't care -- or feel their personal financial interest trumps citizens' right to be left alone. Why they feel the need to insult those who do care is another question entirely (best guess is it probably relates to lingering doubts about their own position).

Meanwhile, fellow crazy tin-foil hat wearers concerned about the way the debate has tilted dramatically in favor of profit and centralized government control might want to spend some time reading a few thoughtful explanations of why it's important to keep an eye on private and police surveillance powers in a democracy. Here's an excellent resource page and bibliography. And if you can find it, Erik Larson's 1992 book "The Naked Consumer: How Our Private Lives Became Public Commodities" is a quick, sharp read that might turn your head around.
posted by mediareport at 11:12 AM on September 1, 2002

Have you considered that you are being equally dismissive?

You've expanded a small aspect of how Google operates, and turned it into a part of a huge and vast conspiricy against personal privacy. It's kind of hard to take it seriously.
posted by crunchland at 12:32 PM on September 1, 2002

Oh please, crunchland. Read my fifth comment again. Not only have I tried to be careful and skeptical, I've also modified my position to acknowledge the possibility raised by some posters that Google isn't really collecting search term data. Meanwhile, your insults and dismissals have only gotten more goofy and outrageous.

Someone's in Tin Hat country here, but it sure isn't me.
posted by mediareport at 1:30 PM on September 1, 2002

Let me try to summarize the problems with this particular bit of fear-mongering, mediareport:

• In order for the FBI, NSA, CIA, Black Helicopters, etc. to get Google's data, they first have to look at your hard drive for the cookie. That's the most ludicrous thing, that we're supposed to believe that they'll get some information out of Google that they couldn't already get out of looking at your hard drive (or looking through the rest of your house for that matter). I don't buy it: if you were googling for mp3's, you'd have mp3's on your hard drive; same with porn; same with atomic bomb schematics. They're far more likely to find any of the examples you gave (medical records, location (I suppose they'd already know that), drug history) looking through your house than on Google's servers.
• It literally takes 10 seconds to disable Google's 'tracking' ability in any modern browser. Seriously, in the time it took this guy to write his rant, he could've written a tutorial on how to disable Google's cookies on every major up-to-date browser. Even if you hadn't posted about his extreme case of sour grapes, I could've guessed. He's cursing the darkness standing right next to the light switch.
• It's a free service. As such, this strikes me like asking whether all those commercials are really necessary on network TV. I'd find these claims less laughable if either you or Anti-Google Guy were offering to pay Google to respect your privacy.

And Brandt's point that Google should be a public service, like libraries, is well-taken.

So, making Google government-funded is the answer? Do you really believe that Google would have a greater concern for your privacy if it were a 'public service'? If you believe that, you're not just ignoring what we've been saying; you're ignoring what you've been saying.
posted by boaz at 4:16 PM on September 1, 2002

We seem to all be agreed that google uses access logs. This is the information that they collect, which, it has been pointed out, is common practice, not just among search engines, but all web sites. Google also uses cookies that are set to the standard "never expire" date, which is also common practice. The problem seems to be that they are associating the two. They can already associate search requests with ip addresses with their server logs, but using the cookie lets them associate requests with specific computers more accurately. This might be a problem. How long do they keep their logs? Do they retain logs indefinitely, or just keep aggregate statistics after a point? We are talking about an incredible amount of data. I don't know the answer, but it is very possible that google does not keep raw logs indefinitely. The cookie expiration date is irrelevant to the discussion; only the longevity of the logs is relevant.
posted by Nothing at 10:39 PM on September 6, 2002

Also, google does not directly make money using their access logs--they make their service better using their access logs (which might end up attracting more users and thus more advertising money). Google makes money with advertising, using each individual search as self-selecting demographic information.
posted by Nothing at 10:45 PM on September 6, 2002