THE on-going saga of Google sweeping up people’s Wi-Fi transmissions—as its Street View vehicles trundled around the world, snapping panoramic pictures of their surroundings—has focused attention yet again on just how much privacy people can expect when using online services for e-mail, search, social networking, navigation and shopping. The rule seems to be: if the service is free, then not much. Get used to it.
It has been said many times, but the fact remains that anything users share over the internet will inevitably be bought and sold and, sooner or later, used against them in some way. That is the price people tacitly accept for the convenience of using popular web services free of charge.
The corollary, of course, is that if individuals are not paying for some online product, they are the product. And collecting information about the product (users) enhances its value for the service’s actual customers (advertisers, corporate clients and government agencies) who pay the bills. That is how the business model works. Those who do not like it can choose not to use such free services and find paid alternatives instead that promise greater privacy. Though limited, they do exist.
In Google’s latest run-in with the law, the Ninth US Circuit Court of Appeals refused to exempt the firm from liability under the federal Wiretap Act for intercepting people’s e-mail messages along with their network identification, signal strength, username, password and other data. Back in 2010, Google admitted it had collected some 600 gigabytes of “payload data” from unsecured wireless networks in more than 30 countries. Several putative class-action lawsuits filed at the time were subsequently consolidated into a single case.
In its defence, Google claimed it was perfectly legal to intercept data transmitted over unencrypted Wi-Fi networks—just as it is lawful to intercept “electronic communications [that are] readily accessible to the general public”. Therefore, like listening to the radio or watching television, the company reasoned that intercepting data on unsecured Wi-Fi networks was also exempt from wiretapping laws.
Not so, said the district court hearing the case. Data transmitted over an unencrypted Wi-Fi link, it concluded, is not “readily accessible to the general public”, as the terminology is ordinarily understood. Anyone seeking to intercept such signals and extract data from them would need to park outside the front door with a “packet sniffer” and specialist knowledge. No way could that be compared with listening to the nine o’clock news.
Rebuffed, Google appealed. And now that the appeals court has refused to dismiss the privacy lawsuit—confirming that the interception (inadvertent or otherwise) of unsecured data from people’s Wi-Fi connections is not exempt from wiretapping laws—the class-action against Google can proceed.
By mistake or intention, intercepting e-mails between private individuals was not one of the search giant’s smarter moves. When normal people send an e-mail, they rather expect it to be treated like posting a letter. The post office's job is simply to deliver it to the address on the envelope—and not to open it and read the contents. However, Google has made it clear that its own Gmail users can have no “reasonable expectation” that their communications are confidential. “All users must necessarily expect that their e-mails will be subject to automated processing,” the company said in a court filing. Its servers scan Gmail contents at the very least for viruses and other malware. While at it, they also look for key words that help advertisers display their most appropriate advert adjacently.
Google’s privacy policy—amended last year so the company could meld personal data drawn from all the services it offers—explains what information is collected and why, how it is used, and ways for users to access and update their personal data. Google promises not to share the information with anyone outside the organisation, other than affiliates or other trusted businesses, or if required to do so by law, or for protecting against fraud, or for preventing Google itself from being harmed. This comprehensive document is more a "data-use primer" than a privacy policy.
Along with other internet companies, Google mines the data it collects from users for two purposes. One is to improve the user experience, making its various online services more personal, useful and rewarding for the individual—and thereby increasing their popularity. The other purpose is to provide better targeted information for advertisers.
Like other firms offering free services, Google makes its living out of matching the right kind of advertising to the specific interests of its individual users. To do so, it needs to know their likes and purchases as well as their identifiers and demographics, including name, sex, age, address, current location and income bracket.
If truth be told, no-one needs to eavesdrop to discover such things. People willingly volunteer all manner of facts about themselves when registering or subscribing to various online services. Scraping such information off social networks and combining it with data drawn from sites for searching, shopping, downloading, streaming or whatever lets social marketers infer all they need to know about most individuals.
That is fine for the vast majority of internet users, who are happy to trade a measure of privacy for the convenience of using popular sites like Google, Facebook, Twitter, Flickr and YouTube. That such convenience comes free of charge makes the trade an even better deal. But where to draw the line?
It is one thing to reveal personal preferences such as favourite films, TV shows, dishes, books or music tracks. However, most people (though not all) stop short of blurting out more intimate details about their private lives. Even so, all those innocuous bits of self-revelation can be pieced together, jig-saw fashion, by intelligent algorithms. Throw in the digital paper-trails stashed in Google searches and Amazon purchases, and things can begin to get a little scary.
Babbage’s teenage daughter, for instance, uses his Amazon account and credit card to buy everything from romantic novels to cosmetics and underwear. As a result, he gets bombarded by e-mails recommending other female items he might like to purchase. Anyone leaning over his shoulder could easily label him a pervert or worse.
That aside, Babbage considers himself a privacy pragmatist. Though easy to block, he accepts “third-party tracking cookies” from websites for the convenience of being able to log on easily and get quickly to his preferences. He even accepts “Flash cookies” because they help serve up more appropriate pages (and because they are difficult to block anyway). Above all, he accepts that, in wishing to take full advantage of all the useful services on the internet, he has to trust someone. So, best to trust reputable brands, as they have more to lose from any breach of privacy.
But with the convenience of using free online services, even those offered by major brands, comes the responsibility to be personally vigilant, to watch out for oneself—and to be willing to pay for services that offer higher levels of security, freedom from advertising, or simply a better quality of service all round. One of Babbage’s colleagues says he would happily pay for Twitter if it provided proper analytics. He would pay for Facebook, too, if it did not compress his photographs so much.
Ultimately, though, Babbage is more concerned about identity theft than with Google selling his likes and dislikes to advertisers. This is one of the fastest growing white-collar crimes around, with an identity being stolen somewhere at least once every four seconds (see “Your life in their hands”, March 23rd 2007). The average cost of restoring a stolen identity is reckoned to be $8,000, and victims spend typically 600 hours dealing with the nightmare—plus many years more restoring their good name and credit record.
For that reason, Babbage has long used a credit-protection service that keeps his credit record under lock and key. That stops anyone from opening a line of credit against his account. It also puts paid to all those tiresome, and potentially dangerous, offers of pre-approved credit cards. He also changes his passwords frequently, using combinations of letters and numbers amassed from memorable phrases. And he just wishes others had security policies as robust as his bank, insurance company and health-care service.
As Meghan Kelly wrote recently on VentureBeat, “Unfortunately, this free economy is distorting our expectations.” Would people be so tied to their favourite (addictive?) free services if they had to pay for them? “When we pay, we can start demanding more control over the ways companies share our data.” The time has come to pay up or shut up.
