NewsDude
09-12-2008, 10:00 PM
Earlier this week, Google announced it would cut in half the amount of time it keeps user logs before anonymizing them, from 18 to nine months. The decision appeared designed to mollify Google's European critics.
The move was partly successful, as Jacques Barrot, the EU's justice and home affairs commissioner, called it a "good step in the right direction." Barrot urged Google to cut the anonymization time even further, however, to six months, as recommended in a report by the EU's Article 29 Data Protection Working Party. "Awareness and compliance with fundamental human rights are of pivotal importance" for Internet companies, Barrot said.
But Internet security expert Chris Soghoian, writing on CNET, said Google's time reduction is almost completely illusory. Despite Google's assertion that "we're significantly shortening our previous 18-month retention policy to address regulatory concerns and to take another step to improve privacy for our users," Soghoian said that Google's new policy fails to provide meaningful anonymization.
Preserving Utility, Securing Privacy?
Google maintains that even anonymizing after 18 months entails "sacrifices in future innovations." The process for anonymizing after nine months will not "use precisely the same methods for anonymizing as we do after 18 months," Google's senior legal staff posted on the company's official blog. "After months of work our engineers developed methods for preserving more of the data's utility while also anonymizing IP addresses sooner."
Soghoian reported that he sought additional details from Google and was told, "After nine months, we will change some of the bits in the IP address in the logs; after 18 months we remove the last eight bits in the IP address and change the cookie information." The statement conceded that "it is difficult to guarantee complete anonymization, but we believe these changes will make it very unlikely users could be identified."
Soghoian explained that Google anonymizes...
More... (http://www.toptechnews.com/story.xhtml?story_id=61851)
The move was partly successful, as Jacques Barrot, the EU's justice and home affairs commissioner, called it a "good step in the right direction." Barrot urged Google to cut the anonymization time even further, however, to six months, as recommended in a report by the EU's Article 29 Data Protection Working Party. "Awareness and compliance with fundamental human rights are of pivotal importance" for Internet companies, Barrot said.
But Internet security expert Chris Soghoian, writing on CNET, said Google's time reduction is almost completely illusory. Despite Google's assertion that "we're significantly shortening our previous 18-month retention policy to address regulatory concerns and to take another step to improve privacy for our users," Soghoian said that Google's new policy fails to provide meaningful anonymization.
Preserving Utility, Securing Privacy?
Google maintains that even anonymizing after 18 months entails "sacrifices in future innovations." The process for anonymizing after nine months will not "use precisely the same methods for anonymizing as we do after 18 months," Google's senior legal staff posted on the company's official blog. "After months of work our engineers developed methods for preserving more of the data's utility while also anonymizing IP addresses sooner."
Soghoian reported that he sought additional details from Google and was told, "After nine months, we will change some of the bits in the IP address in the logs; after 18 months we remove the last eight bits in the IP address and change the cookie information." The statement conceded that "it is difficult to guarantee complete anonymization, but we believe these changes will make it very unlikely users could be identified."
Soghoian explained that Google anonymizes...
More... (http://www.toptechnews.com/story.xhtml?story_id=61851)