Senate Scrutinizes Privacy Issues of ISP User Tracking

Hugh Pickens writes "As companies collect, use, and disseminate data regarding online users, there is concern that tracking individuals' Internet activity and gathering information from online users violates their expectations of privacy. The Senate Commerce Committee will hold a hearing Wednesday to look at the policy issues, and the hottest topic will be proposed systems by which ISPs can watch users and sell information about their surfing habits to advertising companies. The Center for Democracy and Technology has issued a report suggesting that these systems may violate federal law (PDF). 'Advertising per se is not the evil here,' says Leslie Harris from CDT. 'It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that.' On the other side NebuAd, the most active ad-targeting company, says its profiles are interest-based, and not personally identifiable. 'We have designed our entire company to make sure that we stay on the opt-out side of those laws and policies,' says NebuAd CEO Robert Dykes. Charter Communications announced last month that it would suspend a trial of NebuAd due to customer concerns about privacy."

Scrutiny should extend further.

I'd say it's great that the Senate is scrutinizing what ISPs do to track people, but this shouldn't be limited solely to ISPs. There should be a lot of scrutiny about what the government does with your information, and I'm talking about all levels of government from the local level up to the federal level. Further, there are millions of businesses around the world, small and large, that gather all kinds of information. It is difficult to scrutinize so many companies, so I would say that the Senate should concentrate on the government first. Because the government collects the most.

Re:Scrutiny should extend further.

You can always sue a company.

Not so. After tomorrow, for example, Americans will no longer be able to sue AT&T for violating the law by letting the Bush Administration tap their phones without any judicial oversight.

The current president has taken the 60-year old notion of "state secrets" to an extent that absolutely shreds the Bill of Rights, but there was always the possibility that the truth would come out and the lawbreakers would have to pay. After tomorrow, not any more.

Re:Scrutiny should extend further.

Doesn't "state secrets" as currently used in court violate the first amendment?

Not the speech part, the ... to petition the Government for a redress of grievances. part.

Yeah, and?

'It's the collection of individuals' information, usually without their knowledge, always without their consent, creation of profiles and the complete inability of people to make choices about that.'

Hey, guess what... if a partner in a two-way correspondence chooses to share details of that correspondence, that's their choice (i.e., don't give private info to someone you don't trust). If you choose not to make safe your correspondence from third parties via encryption, that's your problem.

I'm willing to risk some troll or flamebait mods here to make a point:

No correspondence should ever be considered absolutley private. The same tools that allow data aggregation by companies like Google and ISPs give us better access to information and (arguably) a better quality of life. You have to take the bad with the good.

Creation of profiles allow vendors to serve us better. They allow better targeting of ads so we're not bombarded with ads for things we have no interest in (ok, in theory. In practice, this needs further work). They allow people and businesses to target our needs better, so it's easier for me to find what I'm looking for.

As long as we have the ability to anonymize and encrypt our traffic (which isn't a given), I have no problem with profiling. Those who want to opt out can do so easily... and if there is enough demand for it, there will be off-the-shelf tools for joe sixpack to do so.

So my point is this: Allow us to anonymize our traffic. Allow us to encrypt our traffic. Then you can go ahead and profile all you want.

Re:

Have you ever counted or even looked at the 1 pixel images embedded into web sites?
I encountered a recent ridiculous one from a Yahoo access - something like that:
us.bc.yahoo.com/b?P=FjLh6UWTUG8MnHdaSGkxXR + over 1000 characters more

To load 1 PIXEL!!!!!

There is tons of that stuff embedded in web sites. And that's got nothing to do with 2-way communication whatsoever.

Wo tracks it, who controls it, who sells and buys it?
Are the neurons in Sentat's heads interlinked enough to grok this?

Highly doubtful -

Re:

Wo tracks it, who controls it, who sells and buys it?

And why should you care, if your traffic is anonymized and your personal information, when needed, encrypted?

Re:

"if"

-yeah, encrypted web surfing/email for the masses is happening and Tor has lightning access speed.

It's just not reality at this point and will it ever be? So, your premise to arrive on your conclusion to "no need to care" is not a given, it's a cloud castle.

Re:

Not only are there people who don't know anything about encryption

If they care about their privacy, that is their problem. If they don't care, no harm, no foul.

but why should I have to do something extra to ensure I have what is already supposed to be mine?

I have tons of problems with this question. Why do you assume that "it" is supposed to be yours? You're transmitting postcards, not sealed envelopes... assuming that by "it" you are referring to privacy, what makes you think that you have any expecta

Re:

You're transmitting postcards, not sealed envelopes... assuming that by "it" you are referring to privacy, what makes you think that you have any expectation of privacy...

To complete your analogy, I guess it would be okay for the US government to read all postcards sent via the US mail, log the data, and use it for whatever purpose they want? After all, not sending it in a triple-sealed container means that we clearly wanted this information gathered and used. UPS can open and examine packages sent in paper envelopes or cardboard boxes, since if we cared about privacy we would have used a welded box.

You're confusing what could happen with what should happen. Just becau

Re:

There is no harm in a business wanting my data to serve me better.

Provide I, and only I, decide when they get what data.

Re:

the free market has killed democracy quite badly.

Reminds me of a quote (or sig) I saw once, wish I could remember the source:
"In the 80s, capitalism triumphed over communism. In the 90s, it triumphed over democracy."

Re:

As to encryption, it's a sad day when you cannot trust your service provider to provide a service, without eavesdropping for profit. What next, encryption for snailmail? We could always use invisible ink, but that might prove difficult for the mail service to deliver

If you're going to continue the snailmail metaphor, again I have to stress that without encryption, you are sending postcards, not sealed envelopes. And plenty of people have used, and still use, encryption with snailmail, as they deem it neces

Boiling a frog

How ironic that Congress is, in all likelihood, about to pass a telecoms immunity bill which allows them to spy on us... but are giving lip service to the issue of telecoms spying on us.

CongressCritters and Snoozators will soon be making a lot of noise about how they are protecting the public from being spied upon, while at the same time making it legal for us to be spied on.

Nothings changed, just another election year.

Re:

CongressCritters and Snoozators will soon be making a lot of noise about how they are protecting the public from being spied upon, while at the same time making it legal for us to be spied on.

Democracy in action :) - or rather that's what happens when the free market and democracy collide.

We had a similar situation in the UK recently with a company called Phorm. ISP's were entering into secret deals with them to collect our data so that they could modify the html streams returned from sites to inject target

Re:Boiling a frog

What free market? I hope you don't mean the mockery thereof that the current market of corporate cartels is.

Re:

Perhaps I'm using the wrong term - I'm ignorant of world affairs..

I'm talking about the situation that exists when profit is used as a means to determine what is moral.

Re:

It's not even profit anymore. Profit as a measurement of morality could be considered free market. What we have today is more control instead of profit. Everything is moral and fine as long as I get more control. More control of the market (in case I'm a corporation) or more control of the people (in case I'm a government).

I'd have less problem with this...

We have designed our entire company to make sure that we stay on the opt-out side of those laws and policies,' says NebuAd CEO Robert Dykes.

... If they'd stay on the "opt-in" side, but I'm sure user participation and company profits would be lower. Too bad, so sad...

Re:

Charter Communications announced last month that it would suspend a trial of NebuAd due to customer concerns about privacy. The sad thing was, their page specifically stated that their Cookie would opt you out of seeing the ads. They did not say that the cookie would keep you from being tracked. Even most non-tech people know to clean their cookies, and many programs will do it for you, like ccleaner on windows. Their privacy policy explicity states they will turn over all logs and information for a warra

Re:

Not necessarily - what if you could opt in for a little discount. You get 5 bucks off your monthly internet bill, and in exchange they have permission to keep a cookie on your machine to track what your doing. On the other hand, as a government backed monopoly I suspect that the ISP's are going to come out of this whistling the tune of the free market.

Re:

Why would they need a cookie to track what you are doing? They can just monitor your connection directly as it flows through their network.

Watch just one little word

To me, the money here is targeting the user to feed him/her ("them") ads based on what that user has already seen, queried, etc.

Yet, NebuAd says the data they collect is not "personally" identifiable. I'll bet a six-pack that the data is damn-sure "individually" identifiable by cookies, etc.

"Personally" just means they're not selling my name along with my surfing habits. But they are very much tracking my individual habits/interest and selling that; user by individual user. I say send them back to tele-marketing, the scum-bags.

Putting it simply

What is needed is a clear separation between those companies that sling bits (ISPs) and those who provide content and advertising. Each ISP should be required to transfer data as fairly as possible with a minimum of interference and monitoring.

Most broadband providers have a monopoly or duopoly, and therefore need to be regulated strongly. Otherwise, customers who object to these invasions of privacy will have nowhere to turn.

Re:Since When Do They Care About Our Privacy?

They're going to grant the telecoms immunity and the Bush Administration a free pass on breaking federal wiretap laws and violating the 4th Amendment, but *this* concerns them? Spare me.

1970s: Don't steal. The government hates competition.
2010s: Don't spy on your users. The government still hates competition.

Re:

Neubud purchases ad space on tons of websites.. when the web page is requested, they check the requesting IP. If its on a network they "service" then they call up the cookie and the profile from the monitoring hardware at the ISP, and instead of displaying a static ad, display one targeted to your surfing habits. Then they give the ISP a chunk of change (or a percentage of ad revenue, not sure), for allowing them to have their monitoring/profiling tools installed at their access points.. The ads don't go