Google Privacy Practices Worse Than ISP Snooping, AT&T Charges

Still think security and privacy are no big deal for developers to worry about? Well then take a look at what AT&T testified to in front of the United States Congress early last week. AT&T write below...

"And if Google does combine its third-party cookie information, with user's search histories, with Gmail summaries, and with Google Analytics data, among other data sources, they would be a proper domestic intelligence agency."

//from www.blog.wired.com //

Online advertising networks -- particularly Google's -- are more dangerous than the fledgling plans and dreams of ISPs to install eavesdropping equipment inside their internet pipes to serve tailored ads to their customers, AT&T says.

At least that's what the company told Congress in a letter early this week, responding to four prominent House lawmakers who are bird-dogging ISPs about their online profiling practices. Those lawmakers asked 33 internet companies on Aug. 1 to explain some of their monitoring practices, Most have replied.

In its letter (.pdf), AT&T denies that it currently digs deep into the net habits of its users "for the purpose [of] developing a profile of a particular consumer's online behavior."* (AT&T is currently facing a class action lawsuit for allegedly helping the NSA spy on Americans' internet usage, but that's a different issue since the NSA does not run ads.)

However, it says it may bake this kind of surveillance into its tubes in  the future using so-called Deep Packet Inspection technology. The company rightly says could be also be used to detect copyright infringement, speed up packets of streaming video and detect child pornography.

But even if it did, that's nothing compared to Google, it says.

"If anything the largely invisible practices of ad-networks raise even greater privacy concerns than do the behavioral advertising techniques that ISPs could employ, such as deep-packet-inspection," AT&T wrote.

AT&T rightly points out that Google can know almost as much a snooping ISP could -- which, is the case for users who install Google's toolbar and don't know to opt out of Google's Web History program. And if Google does combine its third-party cookie information, with user's search histories, with Gmail summaries, and with Google Analytics data, among other data sources, they would be a proper domestic intelligence agency.

AT&T writes:

Advertising-network operators such as Google have evolved beyond merely tracking consumer web surfing activity on sites for which they have a direct ad-serving relationship. They now have the ability to observe a user's entire web browsing experience at a granular level, including all URLs visited, all searches, and actual page-views.

AT&T goes on to say then that because of Google's singular ability to gather online data that online advertising networks are substantially similar to ISPs monitoring their customers.

Google and Yahoo are perhaps the only two online empires that AT&T could realistically point towards to make that argument.

It's a clever argument, since online advertising cookies are nearly universally accepted and there are voluntary codes of conduct that most advertisers agree to in order to keep government regulators away.

And certainly any ISP thinking about looking at what its users are doing has got to be worried given that the House Energy and Commerce Committee is on a roll -- taking on ISPs that want to or have watched what their customers do online in order to serve them targeted ads. That roll is reportedly heading towards a long-fabled online privacy omnibus bill. Add to that, this month's unprecedented decision by the Federal Communications Commission to slap down Comcast for its secret and deceptive interference with file sharing traffic.

But the argument is also just wrong.

You pay your ISP to carry your traffic to and fro.

It can see everything you do online, unless you take extreme measures. It could know where you bank, the contents of your emails and chats, what sites you shop at, what you search about --regardless of search engine -- and everything you read or watch online.

Your ISP does not need to be peering into your traffic to decide whether to show you ads for hemorrhoid cream or sports bobble heads.

They just need to get that health information and that gallery of hockey's worst bobble heads to your browser quickly.

* Threat Level readers may enjoy this full sentence from the letter: "AT&T does not at this time engage in practices that allow it to track a consumer's search and browsing activities across multiple unrelated websites for the purpose [of] developing a profile of a particular consumer's online behavior."

//from www.blog.wired.com //