Is there a smart phone that doesn't track users?

Originally published 04/25/2011 at lubbockonline.com

Declan Mcullagh of CNET reports that Android also collects user data. This is similar to the complaint against Apple's iPhone and iPad last week. Google claims there is no user identifying data sent, but that isn't true, strictly speaking.

The article quotes Sammy Kamkar, a well known security researcher, as saying, ""It's not tied to a user, but it is a unique identifier to that phone that never changes unless you do a factory reset."

But it's worse than that. It may be impossible to truly anonymize data and have it retain it's usefulness for marketing purposes. AOL learned this. Netflix learned this. It's time we learned it. Police routinely request cell phone tracking data from providers, often without a warrant, and the Justice Department is pushing Congress to make it the law of the land that cell phone data can be searched without a warrant. Even if the data from cell providers is anonymized, current technology is more than adequate to allow clever people to attach a name, number and address to the anonymous data. According to Markus Ullman and Marco Gruteser all that may be necessary to identify a person is their location data:

Unfortunately, anonymous location samples do not fully solve the privacy problem. An adversary could link multiple samples (i.e., follow the footsteps) to accumulate path information and eventually identify a user.

No company should be able to just gather data on our whereabouts, our likes and dislikes, our political or any other preferences without our informed permission. But until we force them to stop, they won't. It's in their best interest to gather and use any information they can, either to sell or to use to tailor their offerings to us.

Mozilla announces "Do not track" feature in Firefox

Mozilla has announced that they will include a "do not track" feature in Firefox 4.1 in response to the FTC's call for the one. Google and Microsoft have also announced "do not track" features, but Firefox 4.1 will probably be released first.

It's a nice first step, or maybe a nice gesture. If the tracking companies don't agree to honor the do-not-follow requests of the browsers, nothing will change, and tracking will be business as usual. Right now no tracking company has agreed.

In reality, though, it may be too late for "do not track." We enjoy a mostly free web surfing experience. "Do not track" could be the end of that. A lot of the free sites that we enjoy are paid for by information gathered while we surf and used to help better target ads at us. Remove that source of revenue and the sites have a choice. Charge for service, or go away. How much would you pay a month for what is now free on ESPN.com. How about Youtube? ? Facebook?

We should control who gathers data on us, how data about us is gathered, and who is doing the gathering. But we have allowed things to get way out of hand. Tracking is central to doing business on the internet and cannot be removed without replacing the revenue it generates (directly and indirectly) unless you want to see a lot of online businesses go under.

FTC recommending privacy options for Internet users

Edward Wyatt and Tanzina Vega at the NY Times report that the FTC is recommending internet users be allowed to decide whether or not their surfing and buying habits tracked. Groups like the Electronic Privacy Information Center (EPIC) are encouraged, but don't see a "do not track" option as the perfect solution to online privacy concerns. Online advertising groups are not happy about the proposal, saying that if "Do not track" saw the same rate of adoption as "do not call" it would cause the industry "significant harm."

There is no doubt an opt-out of tracking option would require radical changes in the way online ads are targeted. But I should have the option not to be tracked. Just like I can choose whether or not to take part in CVS's data gathering ExtraCare reward card, I should be able to choose whether or not the sites I visit gather data on me. I should be able to see what type of data is being gathered and I should be able to have that data purged. Or I should be paid for the information. It is my information, after all.

There's a battle over how law enforcement can track us.

The EFF Deeplinks blog reports this week on three court cases regarding the feds use of cell phone and GPS tracking. Over all it looks promising, although the feds are predictably arguing that they should be able to track us using our cell phones and other geo-location technology without a warrant. But although it looks hopeful, we have to remain vigilant or have our right abridged, limited, and nullified.

It wasn't in the Deeplinks blog, but the News-Register.com reports that a federal appeals court in Washington D.C. ruled that D.C. police had violated Antoine Jones rights by placing a tracking device on his car without a warrant. The appeals court agreed with a lower courts opinion that a:

"reasonable person does not expect anyone to monitor and retain a record of every time he drives his car, including his origin, route, destination and each place he stops and how long he stays there."

A wise ruling on the part of both courts. If you can't get a judge to issue a warrant, you don't have enough reason to put a GPS on a car, any more than you have enough to tap a phone. There are reasons law enforcement is limited in it's ability to spy on us. We don't live in a police state. There has to be probable cause for police to search citizens, otherwise we could be pulled over and searched because the cop is having a bad day. Or because we post something critical of the President, or the mayor, or the police chief.

Big Brother - it's not who you think

George Orwell foresaw a future with no privacy and no security from government control. We aren't there yet. Not with the government. With corporations it's almost completely a done deal. But that can be changed.

It can be changed, but only if enough people are willing to take charge of their own information. Willing to be inconvenienced by denying cookies and turning off scripting. Willing to use private browsing all the time. Willing to leave Facebook until it the privacy policy is improved and enforced. In short, willing to force corporate America to change the way they gather marketing information.

Don't think it will be easy. The tracking information gathered when we search, buy, or just surf the web has become almost indispensable. Or at least corporations think it has. They won't willingly give it up.

I'm not sure most of us will be willing to give it up, either. A lot of the convenience of the web is a direct result of that data gathering. The nice personalized pages, the suggested items on eBay, Amazon, etc. are all a result of gathering and keeping data. Using your Facebook or Twitter sign-in to log-in to other sites requires gathering and sharing data.

Most of these things could probably be done with less tracking and data gathering. But they won't be unless we insist on it. And without insisting on simplified privacy policies written in plain English things will go back to the way they were. The sad truth is, even with privacy policies, the data gathered and held is still outside of our control.

The truth is, to enjoy any activity there has to be give and take. It only becomes a problem when one side either doesn't know what it's giving, or the exchange is far more beneficial to one side than the other. Most people do not realize just what they are giving up simply by participating in online life. If they did, they might not think they were getting their money's worth. They should be given the opportunity to make that choice.

If you would like to get a basic idea of just what can be figured out about you online you might try searching for your own name in Google, Bing and Yahoo. Depending on how active you are online, you might be surprised.

Web Tracking - Incredibly pervasive

There was an interesting piece on C-Span the other day about web tracking. It was an interview with Julia Angwin, Wall Street Journal (WSJ) Senior Technology Writer. She was being interviewed because of a report done by the WSJ on July 30th. The report is called, "The Web's New Gold Mine: Your Secrets," and even surprised me a little with some of what they learned. I was only able to listen to about 10 minutes of the 35 minute interview then, but even that had some interesting discoveries. I'll be going back to listen to the rest and I will be checking out the WSJ report. SomWall Street Journale of this I've talked about before, but here are some of the tidbits from the first 10 minutes (italics are my comments):

<blockquote>The top 50 websites in the U.S. were examined. After visiting all 50 over 3000 tracking devices had been installed on the computer. The average was 64 tracking devices per site, but the biggest offender was dictionary.com

The WSJ reporters were uprised by scope and invasiveness of the tracking, <i> which tells me they haven't been listening to groups like the EFF.</i>

Some of the trackers were programs that actually had the ability to log keystrokes. <i>This is something I wasn't aware of. It's disturbing.</i>

The file created by these trackes is supposedly anonymous. <i>Ms. Angwin later tells that someone sent them personal information gleaned from a supposedly anonymous file. It was all a little off - zip code one digit off, age a little off, etc. My experience tells me that was done on purpose, not because they couldn't get the right information.</i>

Beacons - Live software programs that launch invisibly while on page and monitor your activity - <i>these probably included the keylogger, but they didn't explicitly say that in the interview.</i>

Flash Cookies - cookies that live in Flash video player - harder to find and delete than standard cookies and almost universally condemned, even by the tracking industry's trade organization.<i>And yet they're still being used.</i></blockquote>

It looks like an interesting, informative report. Check it out.

Just a quick Google Buzz observation

A coworker of mine received a buzz on his cell phone, It was a comment by a guy he didn't know. Ok, that's what Google Buzz does. The neat (or scary if it was unintentional) thing is that along with his buzz was his location overlaying Google Maps. And it actually gave the name and address of his apartment complex! It's really neat, but if you read my old blog you may recall my concern about similar fun things in the past that used Twitter and Facebook to allow friends (and others) to track your whereabouts. Great stuff for stalkers. Enjoy your social internet, but be careful what you're letting people know.