Senate Scrutinizes Privacy Issues of ISP User Tracking

Hugh Pickens writes "As companies collect, use, and disseminate data regarding online users, there is concern that tracking individuals' Internet activity and gathering information from online users violates their expectations of privacy. The Senate Commerce Committee will hold a hearing Wednesday to look at the policy issues, and the hottest topic will be proposed systems by which ISPs can watch users and sell information about their surfing habits to advertising companies. The Center for Democracy and Technology has issued a report suggesting that these systems may violate federal law (PDF). 'Advertising per se is not the evil here,' says Leslie Harris from CDT. 'It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that.' On the other side NebuAd, the most active ad-targeting company, says its profiles are interest-based, and not personally identifiable. 'We have designed our entire company to make sure that we stay on the opt-out side of those laws and policies,' says NebuAd CEO Robert Dykes. Charter Communications announced last month that it would suspend a trial of NebuAd due to customer concerns about privacy."

Scrutiny should extend further.

[suck_burners_rice]

I'd say it's great that the Senate is scrutinizing what ISPs do to track people, but this shouldn't be limited solely to ISPs. There should be a lot of scrutiny about what the government does with your information, and I'm talking about all levels of government from the local level up to the federal level. Further, there are millions of businesses around the world, small and large, that gather all kinds of information. It is difficult to scrutinize so many companies, so I would say that the Senate should concentrate on the government first. Because the government collects the most.

Putting it simply

[CopaceticOpus]

What is needed is a clear separation between those companies that sling bits (ISPs) and those who provide content and advertising. Each ISP should be required to transfer data as fairly as possible with a minimum of interference and monitoring.

Most broadband providers have a monopoly or duopoly, and therefore need to be regulated strongly. Otherwise, customers who object to these invasions of privacy will have nowhere to turn.

Re:Yeah, and?

[Red Flayer]

Not only are there people who don't know anything about encryption

If they care about their privacy, that is their problem. If they don't care, no harm, no foul.

but why should I have to do something extra to ensure I have what is already supposed to be mine?

I have tons of problems with this question. Why do you assume that "it" is supposed to be yours? You're transmitting postcards, not sealed envelopes... assuming that by "it" you are referring to privacy, what makes you think that you have any expectation of privacy in a de facto public space if you don't make any efforts to safeguard it?

If I send a postcard to a friend, I assume anyone who handles it could read it. But that's not fair! Why should I have to take the extra step of sealing an envelope in order to maintain the privacy of my letter? And if it's really important info, you can bet your ass I'd encrypt it with a one-time pad. So even if they open my mail, they won't find anything useful without dedicating ridiculous resources to it.

Re:Scrutiny should extend further.

[pin0chet]

Agreed. When an ISP makes a bone-headed move, like using NebuAd, it gets a lot of bad press and has a strong competitive incentive to say sorry and fix its mistake.

I'm a lot more concerned about government invading my privacy than my ISP. You can always sue a company, but thanks to qualified immunity, government agents can break the law and get away scot-free.

Now there is a bill in the Senate, sponsored by Grassley, to force online retailers to inform the government of every online credit card transaction. You can't opt-out of govermment data collection, and you can't just "take your business someplace else."

The Senate's first priority should be taking a close look at the privacy implications of the REAL ID, the national fingerprint registry, the FBI's DNA database, and warrantless surveillance.

Re:Yeah, and?

[inhahe]

Collecting information about people's habits without their knowledge or explicit consent for the purpose of making money is reptilian. I say reptilian because I'm not sure that I can say it's unethical, because I don't believe that taking pictures of people in public is unethical. But then, what they do is more akin to paying someone you're likely to speak to to secretly record your conversation for them.

If we all believed that companies just wanted to serve our best interests, then there would be no backlash against this kind of profiling. But since we know on a deep level that corporations are fundamentally cold, evil and without conscience, it bothers us. You could say that by the devil's grace it just happens to work out so that serving their best interests serves ours, but that does not make it not reptilian.

And saying that, basically, if you don't want companies to profile you then surf anonymously is dangerously close to saying that if you don't want to be shot (and injured) by a criminal then wear a bullet-proof vest. Or if you don't want someone creating a voodoo doll in your likeness and dipping you in vaults of various acids in effigy, or perhaps collecting a DNA swipe off of a counter you touched to analyze it on their computer and determine the best pick-up line to give you the next day, then wear a hair net, a veil, gloves, a long-sleeved shirt and pants whenever you go out. Or maybe just a burqa to make it easier. We shouldn't _have_ to hide.. Oh, yeah, and the DNA analyst at his computer is just trying to figure out how to best serve you, right?

TBH though, there is no law against making a voodoo doll of someone and burning it (and I don't want the Inquisition all over again), so it's iffy whether companies should legally be allowed to do that. But I'm certainly not going to be apologetic for them..

Re:Boiling a frog

[easyTree]

Perhaps I'm using the wrong term - I'm ignorant of world affairs..

I'm talking about the situation that exists when profit is used as a means to determine what is moral.

Re:Yeah, and?

[Red Flayer]

As to encryption, it's a sad day when you cannot trust your service provider to provide a service, without eavesdropping for profit. What next, encryption for snailmail? We could always use invisible ink, but that might prove difficult for the mail service to deliver

If you're going to continue the snailmail metaphor, again I have to stress that without encryption, you are sending postcards, not sealed envelopes. And plenty of people have used, and still use, encryption with snailmail, as they deem it necessary to maintain their privacy. The question is, how much do they value their privacy, and how much effort do they have to put in for encryption? When encryption is so easy electronically, why not take advantage of it?

I think it's absolutely absurd to think that when you give a private for-profit organization your correspondence, you don't expect them to try to make money off their own information (after all, they have as much right of ownership to the information of what crosses their network, and from where, as you do).

Privacy cannot be protected by legal recourse. It can only truly be protected by technological recourse. Making something illegal does not prevent it from happening. Making something impossible does.