Searching with security


6 Apr 2006

Some 76pc of web users’ primary activity online is searching. This is done mainly through the four main search engine providers: Google, Yahoo!, Microsoft and AOL. When you search on the internet, how private an activity is this? Can your search engine provider be trusted to protect your privacy?

Since 11 September 2001, governments have had to increase security measures drastically around the world. These efforts, which are to protect our safety, seriously erode our personal privacy. Search engine companies are now handing over our personal information to governments around the world. The US Government has ordered America Online, Microsoft, Yahoo! and Google to hand over search data. AOL, Microsoft and Yahoo! have already handed over this data to the Bush administration. Google has vowed to fight, stating that the request is too broad and far reaching.

It won’t take long for the legal profession to grasp that a person’s entire search history is available and when they do, subpoenas will fly. This will happen mainly in the area of civil lawsuits and criminal prosecutions.

Google has always had the “don’t be evil” corporate attitude. This mantra is now eroding faster than our polar ice caps. The company has allowed the blocking of politically defined terms on its new China search website, in agreement with the Chinese Government. So now a tool that was supposed to empower freedom of speech is being used instead to suppress political expression and further authoritarian control.

Yahoo! has been accused by the Paris-based watchdog group Reporters Without Borders of helping Chinese authorities capture anti-corruption reformer Li Zhi, who is now serving an eight-year prison sentence. This is not the first time Yahoo! has been criticised for its actions in China. In 2002, it agreed to limit search results on search terms like ‘Taiwan Independence’ and a host of others at the request of Chinese regulators. Yahoo! has also admitted that it supplied the Chinese government with information that led to the arrest of journalist Shi Tao. She is now serving 10 years for criticising human rights abuses.

Congress in the US is not happy with this aiding of censorship and political repression. Christopher Smith (Republican) of New Jersey, chairman of the House Subcommittee on Africa, Global Human Rights and International Operations, said: “It’s like turning Anne Frank over to the Nazis.”

Tom Lantos, Democratic head of the Congressional Human Rights Caucus, said US-based companies “caved in to Beijing for the sake of profits”.

So now companies must make the choice on whether to comply with local law enforcement demands that can have dire consequences or whether to remain in that country. Profits will, as expected, determine this decision.

Bill Gates of Microsoft told the World Economic Forum that state censorship was no reason for technology companies not to do business in China. This is a complete turnaround coming from the man who said that the internet would be “one of the key cultural and economic forces of the early 21st century”.

It is easy for us to criticise the Chinese government for its censorship and monitoring practices but how free are we from government eavesdroppers?

One might think that searches are anonymous and cannot be traced back to an individual. Think again. They can be traced to any individual. Google can create a list of people that searched for a specific term, using their internet address (IP address) or a cookie. Google, Yahoo!, AOL and Microsoft all set cookies on your computer by default. Microsoft’s expire in 2016; Yahoo!’s in 2010; Google’s in 2038. AOL sets a third-party cookie that expires in 2011.

Google can also create a list of terms searched by a user of a given internet address. This is effectively an electronic dossier of an individual. If you have a Gmail account or use some other Google service that required registration then this further erodes your anonymity.

Microsoft and Yahoo! can do the same. AOL is the only search engine that cannot find out what users typed in specific search terms. AOL also deletes personally identifiable search data after 30 days. Google, Microsoft and Yahoo! keep this data as long as it’s necessary.

In the future it is likely that the police, lawyers in civil cases, divorce lawyers and employers in severance disputes will demand a user’s search history through subpoenas. Unless companies delete these records they are fair game. New data retention periods make this information available for years and in some countries, indefinitely.

So if you have typed “how to grow marijuana” or “how to cheat on income tax” into Google recently, this can be used against you. Typing in “how to have an affair” in the past will probably not help your case if you are about to get divorced.

Some believe that in order to be safer the general public must give up its privacy rights. Does the erosion of your privacy make you feel any safer? The old question “who watches the watchers?” is more relevant today than at any time during the Cold War.

By Kieran Glynn, CIPP, online privacy expert, Hewlett-Packard