Privacy and Surveillance on the World Wide Web
By
Evangelos Markopoulos
September 2006
This dissertation is submitted in partial fulfilment of the requirements of the MSc in Information Technology, Management and Organisational Change degree of Lancaster University
Abstract
As we live more and more our lives on the internet, we create permanent record of unparalleled pervasiveness and depth. Everything we do, and everywhere we go on the internet, leaves a trail. These trails contain personal information that is being automatically captured and archived in electronic computer databases. In today’s era of information age, personal information has become a highly valued commodity that is bought and sold in ways never before imagined. Governments and businesses collect and process with the help of internet technologies our personal information on a massive scale threaten to make information privacy obsolete. New and old internet technologies have been created or expanded for one purpose: to monitor internet user’s actions, track, access and gather their personal information for commercial or non-commercial purposes. Although privacy has been a sensitive issue long before the advent of computers, the increased use of the Internet for everyday activities is bringing new threats to personal information privacy since the amount of personal info archived escalates.
This research paper discusses privacy and surveillance issues related to internet technologies. The first part of the paper introduces privacy and surveillance issues on the internet. The second part of the paper examines spyware and cookies technology as two very common ways that web sites use to gather and compile personal data. Emphasis is given on the way these technologies work and how can this threaten privacy. The final part, gives an overview
of
existing
privacy
protections
considering
three
general
approaches: the technology, the internet industry and legislation. The paper concludes that no single approach is able to solve the problem of personal information privacy. An integration of the three approaches may seems to be the best solution but not feasible yet.
Table Of Contents Chapter 1: Introduction ......................................................................1 1.1 Prologue ......................................................................................................... 1 1.2 The Purpose of this Research Paper ........................................................... 2 1.3 The Structure of this Research Paper ......................................................... 3
Chapter 2: Research Methodology ...................................................6 2.1 Rationale and Methodological Approach ................................................. 6 2.2 Limitations of this Research Paper ........................................................... 11 PART 1: Issues of Privacy and Surveillance .......................................................... 12
Chapter 3: Privacy and Surveillance on the World Wide Web 12 3.1 An Introduction to Privacy ........................................................................ 12 3.2 Privacy and Internet Technologies ........................................................... 15 3.3 Legislation .................................................................................................... 21 PART 2: Internet Technologies Invading Privacy ................................................ 23
Chapter 4: Spyware Technology .....................................................23 4.1 An Introduction to Spyware ...................................................................... 23 4.2 How a Spyware Can Infect Computers ................................................... 25 4.3 Spyware Business Model ........................................................................... 28 4.4 Legality of Spyware .................................................................................... 29 4.5 Protection Solutions .................................................................................... 31 4.6 The Reaction of Legislation ....................................................................... 34 4.7 Conclusions – Personal Critique ............................................................... 36
Chapter 5: Cookie Technology........................................................38 5.1 Introducing Internet Cookies .................................................................... 38 5.2 How They Work .......................................................................................... 39 5.3 The Functions and Benefits of Cookies .................................................... 41 5.4 Threats to Privacy ....................................................................................... 43 5.5 Solutions against Cookies .......................................................................... 45 5.6 Conclusions .................................................................................................. 47 PART 3: Privacy Protection ..................................................................................... 49
Chapter 6: General Approaches to Privacy Protection ...............49 6.1 The Technological Approach .................................................................... 51 6.2 The Organisational Approach ................................................................... 54 6.3 The Legal Approach ................................................................................... 58
Chapter 7: General Conclusions .....................................................61 References .......................................................................................................... 65 Additional References ...................................................................................... 75
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
Chapter 1: Introduction
1.1 Prologue The World Wide Web has seen exponential growth over the last years. More and more people have started to use the web for various electronic transactions from online payments and electronic commerce to personal entertainment and access to information. Since the internet is a highly interactive medium, there is a constant exchange of information between users to users and users to businesses. The growing internet access increased the exchange and the amount of personal information that becomes available on the web [10]. In addition, advances in internet technology have made it easier and cheaper to collect, store, retrieve, and organize personal information. Hence, the new capabilities for information retrieval and exchange created new commercial and economic prospects arisen from the collection and use of this information.
Nowadays, personal information has become one of the most valuable resources for online companies which continuously develop new, more sophisticated ways of capturing and using data about individuals. Customized and personalized services as well as targeted advertising are some of the services that online companies offer in return for the obtention of individuals’ personal information. However, whenever personal data is collected and stored, either with the awareness of individuals or nor, it may also be abused [4]. The new internet technologies and their potentials heave one of the most controversial and persistent debates related to the internet. This is the debate over privacy and surveillance as well as the treatment of personal data.
Msc ITMOC 2005/06
1
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
1.2 The Purpose of this Research Paper This paper attempts to identify not where the limits of privacy stand but the privacy issues that raise from the use of internet technologies. All privacy and surveillance issues are examined from individuals’ perspective. Therefore, the target audience is the individual internet users (known as Home Internet Users) who have moderate1 experience in internet use and internet technologies.
More specifically, the purpose of this paper is twofold. On the one hand, the first objective is to explore certain internet technologies that websites and online businesses use for the collection and compilation of personal data. The aim is to develop grounded knowledge about how these technologies work, how they are used and what are their consequences on personal privacy. However, this analysis creates issues for future research development on what are the prospects of these technologies and future threats on privacy.
On the other hand, the second objective is to analyse the existing privacy protection solutions offered to individuals. Hence, the paper focuses on the nature of online transactions that would facilitate privacy enhancement. It is examined whether it is better to build privacy enhancements into systems or leave the choice to individuals. For this reason, three general approaches are undertaken to provide comprehensive knowledge of the existing solutions: The technological, organisational and legal approach. Nevertheless, the paper creates the basis for future research to concentrate on one of these approaches for thorough and systemic examination of their full capabilities.
By moderate experience I mean they are familiar with internet terminology-technology and at least with basic operations such as websurfing and purchasing goods online as well as downloading and installing software 1
Msc ITMOC 2005/06
2
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
1.3 The Structure of this Research Paper To facilitate the reader, this section contains a brief description of the remaining chapters of the report. Along with the description, the main points of each chapter are summarised and presented.
Chapter 2 presents the rationale of the research, how the research questions have been shaped and what tools have been used to accomplish the research. In the end, the limitations of this research and possible areas for future research to concentrate on are presented.
The main body of my research starts with Part 1 which includes one chapter on privacy and surveillance and how these issues are connected with the internet. Consequently, Chapter 3 is concerned with issues of privacy and surveillance on the World Wide Web. In the prologue, it presents the notion of privacy and theoretical approaches of different academics. Then, it connects privacy with the internet and the challenges posed to it by the contemporary technological advances, examining the reaction of users and their “privacy myopia�. Finally, it examines the existing legislation with focus on the European Union Data Privacy Directive and how this works to ensure the privacy of society.
Afterwards, there are two chapters on Part 2 which examine certain internet technologies that websites use to gather and compile personal data and the privacy issues related to them. During the analysis of each chapter, various examples are used. Their use aims to communicate better the technical details and privacy issues of these technologies as well as to provide the reader with better understanding.
Msc ITMOC 2005/06
3
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ More specifically, chapter 4 comprises of spyware technology. It examines what spyware is, what its technical details are and how it can infect computers. This chapter also analyses the spyware business model which examines why spyware is used and what are its prime functions as well as how legal these functions are. It is also examined how personal information is treated by spyware and what is the reaction of legislation. Finally, there are drawn some conclusions and personal critique on what has already been discussed.
Chapter 5 examines the cookie technology: What are cookies and how they work; what are their functions and benefits for both users and websites as well as what implications they have on users’ privacy. Possible solutions against cookies are also examined in order to protect personal privacy; the chapter closes with personal conclusions on the discussion over cookie technology.
Following, the last part (Part 3) is driven by my second research question which examines the possible ways of protection against these technologies. Therefore, chapter 6 contains discussion derived from a more general question about the nature of online transactions that would facilitate privacy enhancement. If expressed in the form of a question: Is it better to build privacy enhancements into systems or leave the choice to individuals? The attempt to answer this question focuses not in one but three general approaches. Each one deals with the privacy and surveillance issues on the Web from a different perspective favouring different possible solutions. The technological approach examines the existing technology where privacy enhancements are built into machines. The organisational approach examines the internet self-regulatory schemes and initiatives on privacy taken by the
Msc ITMOC 2005/06
4
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ private sector1. In the end, the legal approach examines the solidity and usefulness of existing data protection legislation and regulatory frameworks based mainly upon the European Union Data Protection Directive.
Finally, chapter 7 concludes the discussion over privacy by making explicit some of the findings and stating the personal opinion of the author.
Private sector is the internet industry (businesses that use the spyware and cookies and take action in the area on electronic commerce) 1
Msc ITMOC 2005/06
5
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
Chapter 2: Research Methodology
2.1 Rationale and Methodological Approach This research paper was undertaken in the form of a dissertation which is a compulsory part of the Information Technology, Management and Organisational Change (ITMOC) Master’s Degree of Lancaster University. More specifically, the initial broader dissertation topic that was allocated to me was “Privacy and Online Surveillance”. However, at the outset of the research process, my preliminary reading helped me to develop my ideas and establish the scope of the research. Taking into account my personal interests, I further analysed the research subject and I decided, in conjunction with my supervisor, to narrow the scope of my research. Therefore, I decided to focus on the following topic which can be stated as question: What are the privacy and surveillance issues on the World Wide Web? The key concepts or the basic research questions that determine my research are the following two:
• First research question: How do websites gather and compile personal data? My initial thought was to focus, specifically, on electronic commerce. I intended to do some empirical work1 on two of the biggest and well known commercial sites in the word. My aim was to examine how these websites gather and collect the data of their customers or their visitors. Unfortunately, I did not succeeded in finding appropriate material to support my research. As a result, I changed the focus of my research on how websites (online businesses) gather and compile personal data. In other words what are the technologies they use? Once more, examining and analyzing the literature, I I would like very much to contact a case study research in order to add strength to what I have already known and maximize my confidence in the findings of the literature research. It could be considered as an explanatory, intrinsic but also instrumental research based on knowledge-driven theory 1
Msc ITMOC 2005/06
6
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ concluded that I should further narrow my research on one or two specific technologies. Having some knowledge and personal interest before, I considered I should focus on two technologies. They are not necessarily exhaustive or the most important ones but they are very common and well known to the 99% of the population that has access to the internet; technologies that both internet users and websites use to a great extend in their everyday practices. Hence, I concentrated on spyware and cookie technology trying to examine and be critical on how they work and what privacy issues they raise.
To continue, I established a second research question in order to supplement my first one. As in dualism, I assumed that it is better for my research to examine “both sides of the coin�; the cause and effect; or better, threats and solutions to privacy.
• Second research question: What are the existing privacy protections? Technology offers great variety of privacy protection tools. My initial though was to concentrate on one of them. However, my analysis would be much more technical and thus quite boring to the reader or simply the technology could be beyond the interests the reader. Therefore, I decided to undertake a more general approach derived from a more general question about the nature of online transactions that would facilitate privacy enhancement: Is it better to build privacy enhancements into systems or leave the choice to individuals? In my attempt to answer this question I used three general approaches: The technological, organisational and legal approach.
Msc ITMOC 2005/06
7
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ The Tools of my Research My research was library and internet based systemic analysis of literature review. The core sources of my material were the following:
• The library of Lancaster University which provided me with a huge variety of books and journals in a quiet, friendly environment. • Lancaster University also provided me with a powerful tool known as Metalib for searching and finding articles and journals available both online and offline. • I further used similar independent tools to Metalib that provided access to e-journal databases and electronic books: Google Scholar, Questia.com and a portal of Lancaster University available at: http://portal.acm.org/toc.cfm?id=J79&idx=J79&type=periodical&coll=ACM&d l=ACM&part=magazine&WantType=Magazines&title=Communications0of0t he0ACM . • A huge variety of websites provided also material from press articles and unofficial reports to government publications. I have listed most of these sites in my additional bibliography. • Discussion Forums (basically spyware forums, listed in bibliography) that helped me to understand better many technical details of spyware technology.
It is very important to mention that my research does not follow the conventional way of presenting the literature review and then continuing with the discussion-analysis in different chapters. Especially in Part 2, where I describe the technologies of spyware and cookies, I simultaneously present and analyse the literature giving my personal critique in the same chapter. In addition, I avoid many technical terms and descriptions by using various Msc ITMOC 2005/06
8
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ examples to make explicit how these technologies work. Finally and more specifically, in the chapter of spyware technology1, a lot of the description of the technology is based on my own conversance with the subject stemming from past readings and experience but mostly from my extended discussions in various spyware forums. Nevertheless, I tried to evaluate this source of information and compare it with the literature. Therefore, the reader should consider it as an oversimplified presentation of the existing literature.
In this point, I would like to give a small sample of the way I have participated in the forums and the kind of data I collected. First of all, I decided to participate in spyware forums hoping to gain a better understanding over spyware technology. The story-telling process (narration) of other users about how they see spyware, what problems did they have and how they reacted, helped me to transfer the information of various technical articles into my research paper in a more understandable and narrative way that any reader without technical background can follow. It was very difficult to find a forum with specific focus on spyware technology. Moreover, such forums would probably be very technical and susceptible to its new members.
As a consequence, I decided to focus on more general forums but more than one in number in order to avoid the weakness or intrinsic biases of a single technical-specific forum. My participation was peripheral, taking more information than giving. I had created a set of questions where I was trying to articulate them in different ways according to my chat mate. For instance, in one of my chats I asked about a certain anti-spyware program. The answer was: “SD is just brilliant; it does all the dirty work, but … cannot touch the reg2”. In another question I tried to connect cookies with spyware and other 1 2
Although there arefew points in chapter 5 of cookie technology as well Windows Registry
Msc ITMOC 2005/06
9
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ executable programs such as viruses getting the answer: “Don’t worry; none executable starts until you fire them”.
In general, I had lots of discussions, many of which were worthless or just made no sense to me. Discussions made more sense where there was a common perspective-understanding or common situation to refer to. For instance, users did like to discuss about articles on computer magazines and review their context1. However, at the end, I gained some knowledge of the viewpoints of amateur (non professional) internet users around spyware internet technology. Going back to literature and technical articles about spyware, I tried to evaluate, combine and transfer the data I gathered in a new ‘reader-friendly’ format for my target audience.
A favourite base for discussion was material from the following famous computer magazine: http://www.pcmag.co.uk/ 1
Msc ITMOC 2005/06
10
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
2.2 Limitations of this Research Paper Although this paper focuses on two certain internet technologies and their behaviour on privacy and surveillance, the discussion is quite general, thus not addressing all the possible issues. Moreover, the description is, maybe, over simplified in order to facilitate the reader and make more explicit the findings. As a result, a new future research would be better to focus on one only technology and examine in depth all the issues related to this technology.
To continue with, I considered more appropriate in my second research question, to examine general approaches to users’ privacy protection. Hence, I tried to connect it with my ITMOC MSc course at Lancaster University referring to the technological (IT), legal (‘managerial’) and organisational approach. However, this is once more, too general and therefore future research should focus on one of these approaches. The existing literature provides huge amount of information which is enough to support either the technological, organisational or legal approach to stand alone. In addition, future research could focus on the future development of technologies and their consequences on privacy as well as how the upcoming organisational and legal developments can contribute to the progress of the debate over privacy.
Msc ITMOC 2005/06
11
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
PART 1: Issues of Privacy and Surveillance This part starts the discussion over privacy and surveillance on the Web. The notion of privacy and the theoretical approaches of different academics are presented, in an attempt to be connected with the contemporary internet technological advances and the existing legislation.
Chapter 3: Privacy and Surveillance on the World Wide Web
3.1 An Introduction to Privacy The term “privacy” is a frequently used term, especially in philosophical debates, although there is no universally accepted definition of it. In the literature, the analysis or meaning of this term depends on the perception of the writer. On the one hand, academics treat privacy as “an interest with moral value” connecting it with freedom; on the other hand, they treat it as “a moral or legal right that should be protected by society and the law” [37]. However, there are few critical academics that pay little attention to privacy, since the constant changes in society and especially in technology make it impossible to give a single and stable definition of privacy. As Thompson (1975)1 argues, “any interest protected as private can be equally well explained and protected by other interests or rights”.
J. Thomson, 1975. The Right to Privacy, Philosophy and Public Affairs, Volume 4, Pages 295314, Cited in [37] 1
Msc ITMOC 2005/06
12
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ Nevertheless, the concept of privacy is considered as meaningful and valuable for the majority of academics. Warren and Brandeis1, deeply affected by the development of privacy protection in the law, draw the concept of privacy as “the right to be let alone”[61]. Parent (1983)2 extended further the concept of privacy to what is known as “control over information about oneself”. However, Parent gives the definition of the condition of privacy, not the right to privacy and this condition is “not having undocumented personal knowledge about one possessed by others”.
Fried (1968)3 also defines privacy as “control over knowledge about oneself” [32] and Alan Westin (1967)4 comes to describe it as “the claims of individuals, groups or institutions to determine for ourselves when, how, and to what extent information about us is communicated to others” [62]. Finally, James Rachels (1975) 5 echoed Westin’s definition of privacy as “our ability to control who has access to us.”
Considering the above views of academics, privacy is valuable due to its ability to let individuals control the extent to which their personal information is communicated to others, as well as when and how this is happening. Therefore, privacy is connected with human relationships and the way people behave and interact with each other in society. Edward J. Bloustein (1964)6 views the concept of privacy as a set of social values that exist to respect “inviolate personality”. These values include individual dignity and integrity, personal autonomy and independence [37].
Found in page 205 [61] W. Parent, 1983. Privacy, Morality and the Law, Philosophy and Public Affairs, Volume 12, Pages 269-88 3 C. Fried, 1968. Privacy, Yale Law Journal, Volume 77, Pages 475–493 4 [62]: Found in Pages 7 and 42 5 James Rachels, 1975. Why Privacy Is Important, 4 Phil. & Pub. Aff. 323 6 E. Bloustein, 1964. Privacy as an Aspect of Human Dignity: An Answer to Dean Prosser, New York University Law Review, Volume 39, Pages 962-1007 1 2
Msc ITMOC 2005/06
13
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ Most people prefer not to reveal personal information about themselves, such as facts about their health or sexual orientation and this can also be regarded as crucial to them. For instance, it would be a serious threat for the integrity and intimacy of a person to reveal the information that she is homosexually orientated or positive to HIV. As soon as someone obtains sensitive personal information about someone else, she gains power over that person [31].
Unfortunately, nowadays, such a threat is more than possible to be made because of the technological advances. Personal information from various data sources is synthesized and documented into electronic files stored in large computer databases. National governments (states) started to computerise and place personal information in public records online for greater efficiency. Such records may contain any kind of private information about individuals from birth date, current identity and location, property ownership and marital status to voter registration and psychological state. The new age of technological advances related to the use of the World Wide Web1 and the way that data is collected and added to databases, create further privacy concerns.
Next, my effort will focus on examining the challenges posed to privacy by the internet’s contemporary technological advance.
1
The World Wide Web ("WWW" or simply the "Web") is a global, read-write information space. Text documents, images, multimedia and many other items of information, referred to as resources, are identified by short, unique, global identifiers called Uniform Resource Identifiers (URIs) so that each can be found, accessed and cross-referenced in the simplest possible way. Web is actually something that is available via the Internet, such as e-mail and many other Internet services. [Source: http://en.wikipedia.org/wiki/World_Wide_Web ].
Msc ITMOC 2005/06
14
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
3.2 Privacy and Internet Technologies Privacy has been a sensitive issue long before the advent of computers [12]. Internet technology and the nature of the World Wide Web (WWW) as a distributed network of computers with linked information systems and many gatekeepers but no authority, shape a new contemporary privacy policy because of the new techniques and conditions that relate to the information collection [5]. Ubiquitous computing and electronic communication in general have resulted in information collection being invisible, automatic and remote, being built into routine activities [35]. Many simple everyday activities such as reading and writing an email or surfing on the cyberspace1 seeking information create electronic data trails, new information that can easily be captured and filed into databases. Ubiquitous computing formulates ubiquitous processes that become embedded in people’s practices. People might ask ‘why we use’ this or that technology, but since it seems to be so common for everybody else to use it, they do not enquire into ‘how’ it works and ‘what’ are the possible consequences. Mark Weiser said: “We believe that people live through their practices and tacit knowledge so that the most powerful things are those that are effectively invisible in use; this is a challenge that affects all of computer science” [5]. E-consumerism is the best example of how ubiquitous technology and human practices work.
In what follows, I am going to examine how the use of new internet technologies affects the privacy of Home Internet Users as consumers2. As I use the term “Cyberspace” to describe what the above term “Web” or “WWW” means. Furthermore, I mistakenly use the term “The Internet” as an alternative to the “Web” but meaning not the infrastructure-collection of interconnected computer networks but the information space that this infrastructure creates. 2 In my opinion, (home) individual internet users are considered to be consumers whether they purchase goods online, do a web search for academic articles or just read an online newspaper. In all cases they are looking for information and they are revealing information. 1
Msc ITMOC 2005/06
15
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ Paul Schwartz1 argues, internet technology has developed nearly limitless data storage possibilities as well as search possibilities that make it easy to compile the profile of an individual using many different data sources [12]. State agencies and private companies are able to track down, combine and analyse any kind of information about individuals. Private sector’s increasing competition in marketing and advertising is one of the most important factors for the use and further development of internet technologies related to information capturing. These technologies2 have created a whole new industry called the database industry, where companies make profits from gathering, compiling and exchanging data about existing and potential customers from various different data sources.
There are companies that depend on the data they have collected about existing or potential customers to make profits while other companies gather and compile data in order to sell it and that is their primary business [2]. The use of new Information and Communication Technologies (ICTs) used on the web makes monitoring of people and gathering of their data even easier and more effective. Cyber-surveillance is an insidious and effective form of surveillance. Cyberspace seems to be an ideal ‘place’ for the implementation of the metaphor of Panopticon3, offering excellent opportunities for even further-reaching forms of surveillance.
As Boyle argues, based on the analysis of Foucault of the Panopticon 4, the internet Panopticon “gives the opportunity private entities to create their own In the next chapters, whether I refer to internet users, consumers or just users I actually mean the same thing. I hope this does not confuse the reader. 1 Cited in [36], page 24 2 A couple of these technologies will be examined in Part 2. 3 For more information about Panopticon advise [30], [36], [8] and <http://en.wikipedia.org/wiki/Big_Brother_%281984%29> 4 Michel Foucault, 1975. Surveiller et Punir: Naissance de la Prison,
Msc ITMOC 2005/06
16
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ independent Panopticons”[63]. Therefore, not only is the state engaged in monitoring and surveillance of people’s actions or communications, in order to make them behave the way it wants, but businesses1 also do the same thing [30]. The nature of the Web has changed commerce and the way of doing traditional things. Nowadays, electronic commerce is a new channel of doing business in electronic ways providing more efficiency and “serviceability” [4]. Based on this fact, cyberspace became also the new frontier for marketing since it is the hub of the personal information data market thanks to its ability of collecting, aggregating and consolidating personal information effectively. Advertisers, seeing the new targeting capabilities of cyberspace 2, promote targeted marketing spending millions of money on internet advertising [36]. Unfortunately, this created more demand of personal information, because the more specific information is stored about a customer, the more valuable her profile will become to advertisers, in order to develop more targeted advertising to gain her attention. However, the information seeking is not only limited to existing customers but to prospective customers as well.
The valuable data that companies collect and combine, in order to transform it into specific information about customers can be divided into two different categories describing the two basic ways that companies collect personal information in cyberspace: The first one includes registration and transactional data collected directly from users, while the second one includes “Clickstream” data collected by tracking the way people navigate through the Web [36]. Visiting a website, consumers might have to register, in order to be Discipline and Punish: The Birth Of The Prison, Pages 197–229 1 Things have dramatically changed that instead of having one “Big Brother watching us” which used to be the state, there have been created many “Little Brothers” having a more mindless behaviour. 2 For example, the dynamic nature of web pages makes it possible for a web page to download different advertisements for different users. In general, due to interactive nature of the internet marketers can learn how customers respond to what they hear and learn.
Msc ITMOC 2005/06
17
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ able to log in and browse the rest of the site or use its services. Registration means that customers provide information about themselves ‘wittingly’, since they are able to decide that moment whether to do this or not. Transactional (or financial) data characterizes any personal transaction involving money, for example when purchasing goods or services, which often requires the disclosure of more information such as name and address.
“Clickstream” data derives from monitoring and tracking the online activities of users when they are websurfing and it is based on the trails users leave each time they visit a website or click on a link. This information about the habits and interests of users not only enables websites to better target advertising but to also measure their performance and attractiveness [7]. There have been developed numerous internet techniques that monitor and gather registration, transactional and “Clickstream” data. Two such covert but very common techniques are spyware and internet cookies, which are going to be examined in the following chapters.
Hence, the use of such data monitoring and data gathering techniques in cyberspace has created a new type of surveillance called “Dataveillance” [41]. “Dataveillance” is a new type of surveillance that does not focus on monitoring individuals themselves but on their data. Although it might seem to be an indirect form of surveillance, it is stronger and more dangerous. The tools of “Dataveillance” are data mining and data gathering techniques that in relation to data-exchanging techniques allow the massive collection, storage and analysis of enormous quantities of personal data. Most consumers, while possibly aware that they might be monitored and that their commercial activities may be digitally recorded and stored, have little knowledge of the methods used and how intrusive they can be to their personal privacy. They
Msc ITMOC 2005/06
18
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ have no idea how “Dataveillance” is used to track their digital trails, store them in databases and analyse them, so as to reveal potential information about them. But, in general, what is the behaviour of users concerning their privacy?
Surveys and statistics show that a big percentage of users are very concerned about their privacy [11]. While they are aware of possible threats and attacks to their privacy, they are unaware of the practices and techniques that are used in the web to monitor their actions and collect their data trails.
The absence of users’ education and knowledge on the emerging technologies is obvious. Most users are simply pleased to know the basics of how to operate their computers and use internet technologies such as search engines or make an electronic transaction; they pay no attention to the technical details. Many argue that “computers and the internet are like cars. So long as we know how to drive, why bother to learn how the engine works and what its components are”? Besides, people always like convenience and hardly abandon routines.
According to Boyle, “Customers are disciplined by consumption itself to obey the rules, to be ‘good’ otherwise they are put outside the reach of benefits” [63]. Coercion in this private Panopticon is replaced by consent, but the prevailing characteristics of panoptic logic remain [30]. Users often provide personal information voluntarily; in return they expect benefits such as discounts and special offers on favourite items. Personalization is a good example of how users are willing to provide personal information freely. In this case, users receive tailored products or services according to their preferences and personal characteristics [38]. However, it is required from them to regularly
Msc ITMOC 2005/06
19
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ update the information they provide in order to continue to receive the desirable benefits. Amazon.com's Book Recommendations is an interesting example of personalized service, whereby technology is used to monitor the preferences of users while they are buying or just looking for books, and deliver recommendations [64].
In addition, users are also willing to sacrifice some personal privacy when they come across a rich interactive environment. In this case, it is the sense of an active interoperable communication with another human, not software, which makes users less scrupulous in communicating. There are many other reasons that allure users to give up their privacy hesitation. Convenience, collaboration, security, trust and accountability are strong reasons for users to omit their activity or the release of data about themselves in favor of benefits they will gain [30] [44].
This “privacy myopia”1 hinders users from understanding the value and importance of their personal data. They sell their data too often and too cheaply at every opportunity they may find to benefit from. Given the right circumstances, users neglect their privacy concerns and communicate even the most personal details without any compelling reason to do so [3]. Consequently, coercion in this private Panopticon is replaced by consent, but the prevailing characteristics of panoptic logic remain [8].
1
See at [41], page1501: “The economics of privacy myopia”
Msc ITMOC 2005/06
20
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
3.3 Legislation This section examines the existing legislation and how it works to ensure the privacy of society.
Market regulation and contract laws have tried to apply to cyberspace in their traditional format. Unfortunately, the privacy issues, raised by the internet and its technologies, have been creating more specific needs for tailor-made legislation for the new technological era. In addition, political, religious and economic motives forced states all over the world to establish privacy legislation in order to regulate the use of internet technologies for personal data collection. One of the strongest initiatives to provide its citizens with comprehensive legislation, in order to protect personal data and privacy on the internet is the European Union Privacy Directive1 (hereafter EU Directive). “Everyone has the right to respect for his private and family life, his home and his correspondence”2. Regarding the huge technological advances and the nature of the Web as a hub of the personal information data market, EU Directive tried to establish good data management practices in order to guarantee a series of rights for individuals3.
Directive is technologically neutral: its provisions apply, irrespective of the technological means used to process personal data [46]. It defines who can be the data controller, what her role is and what rules she must comply with, as Or European Directive On Data Protection 95/46/EC European Convention for the Protection of Human Rights and Fundamental freedoms 3 The data protection Directive refers to the protection of informational privacy but neither applies to data processed for purely personal reasons or household activities (e.g. an electronic personal diary or a file with details of family and friends) nor to areas such as public security which is a national prerogative. In addition, there is a separate Directive, Directive 97/66/EC, which deals specifically with the protection of privacy in telecommunications and is referred as “Relational Privacy” [30] [46]. Available at: http://ec.europa.eu/justice_home/fsj/privacy/guide/index_en.htm 1 2
Msc ITMOC 2005/06
21
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ well as when personal data can be processed. The EU Directive also distinguishes between “sensitive” and “non-sensitive” personal data and regulates the way in which it can be transferred within and outside the EU. Therefore, the EU Directive allows personal data to be collected for reuse and resale only with the prior consent and permission of data subjects [41].
There are three basic rights of users that strengthen their position as predominant controllers of their personal information. First of all, they have the right to be informed of any data processing when they are the data subjects; who the data controller is and what her purpose is. Second, they have the right to access data related to them and to ask data collectors to correct or block inaccurate personal data. Finally, they have the right to access the logic on which automated decisions are based and the opportunity to discuss and understand the rationale behind the data collected [46].
In conclusion, the EU Directive has set some strict principles and processes in an attempt to create a uniform standard for internet operation regarding the collection of “sensitive” types of data. However, not few people accuse it of creating potential obstacles to the free flow of information and further burdens on economic operators and citizens. In addition, it is often found in opposition to other legal systems outside EU, in terms of culture and treatment of privacy [45]. Therefore, the most important consequence generated by this conflict, is connected with the global trade and, translated in economic terms and terms of competition, it creates obstacles to the growth of electronic commerce and the internet as the hub of the personal information data market.
Msc ITMOC 2005/06
22
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
PART 2: Internet Technologies Invading Privacy In this part, there are presented two very common internet technologies: spyware and internet cookies. I try to examine their technical details and the privacy issues they raise in a simple way drawing on examples in order to better communicate and provide the reader with global, comprehensive information about the privacy issues related to these technologies.
Chapter 4: Spyware Technology
4.1 An Introduction to Spyware There is not a strict definition about spyware. Spyware is a relatively new computing phenomenon. The name alone is not universal; spyware is sometime known as scumware, parasite-ware, stealware or theftware and occasionally mixed up with computer Trojans, viruses and worms [18]. Spyware is also known as a computer contaminant. People also use the terms malware1 or adware2 instead of spyware. This is not completely true since malware and adware are types of spyware although spyware can be component of malware3. However, most internet users, especially in the western European countries and the USA, prefer the name spyware.
There are various types of spyware. A quick search on the internet can provide many types of spyware and typical examples of common spyware programs. The most known types that both bibliography and internet discussion forums about spyware mention are: adware and adware cookies, For more information visit: http://en.wikipedia.org/wiki/Malware For more information visit: http://en.wikipedia.org/wiki/Adware 3 Information retrieved from Discussion Forums 1 2
Msc ITMOC 2005/06
23
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ tracks, browser hijackers, Trojan horses, spybots (they are the prototypes of spyware), system monitors, cookies and web bugs. Even commercial key loggers and parental control software that monitor users’ internet browsing habits are types of spyware [14]1.
Trying to give a definition of spyware and looking in the field of computing, the term spyware is “malicious software2 designed to intercept or take partial control of a computer’s operation without the informed consent of that machine’s owner or legitimate user” [20]. In simple terms, any software that secretly gathers users’ information and transmits it without their acknowledgement is considered as spyware. Therefore, spyware is a “data mining technique” and a form of Privacy Invasive Software (PIS) on the internet although as a term it is often misleadingly used in a much broader sense that includes various other forms of PIS [25].
“Data mining” can contain from simple logs of users activity during their browsing (for example what types of websites they visit) to personal sensitive data such as medical records, address, credit cards, insurance numbers and so on. More malicious versions are also able to intercept passwords or even record whatever users try to type on their keyboards or what applications run on their computers3. This collection of personal data is transmitted to the information gatherer (a third party) by the users’ own internet connection through the creation of a Globally Unique IDentifier (GUID)4. Spyware is directly connected with internet advertising and marketing of products and services. Today’s operating systems such as Microsoft Windows make
1
Information also retrieved from Discussion Forums For more information visit: http://en.wikipedia.org/wiki/Malware 3 Information retrieved from Discussion Forums 4 For more information visit: http://en.wikipedia.org/wiki/Globally_Unique_Identifier 2
Msc ITMOC 2005/06
24
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ spyware simple to build and install thus creating the conditions for their success.
Spyware components have further negative impact on systems and networks utilising
significant
amounts
of
system
resources.
Therefore,
their
implications are not only the privacy issues raised from users’ surveillance and gathering of their personal data. Spyware can affect as well the stability of the computing environment of users by consuming of system’s processing capacity (CPU and Ram usage) and internet bandwidth and creating issues about the general security or vulnerability of the system [16]. Such an example of security issue can be the case when disastrous malicious spyware takeover of system control making their programmers to control every aspect of the infected system1.
4.2 How a Spyware Can Infect Computers Spyware are not viruses although they now make use of computer virus selfpreservation techniques such as run-time encryption of the binary and viruslike strategies when attacking and gaining access to new systems but usually they cannot self-replicate [20]. They can change the Windows Registry in a manner that no obvious spyware entries are appeared in order the average user not be able to spot anything suspicious2. Once they have infected a system, they could be used as a gateway for more spyware to be installed but unlike viruses or worms spyware programs are unable to transmit this infection to other computers.
1 2
Information retrieved from Discussion Forums Information retrieved from Discussion Forums
Msc ITMOC 2005/06
25
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ Spyware result in a reduction of performance, stability, privacy and ultimately the security of an operating system and thus a computer [16]. Since most users are unaware that spyware has been installed onto their computers they do not know that they should uninstall this software immediately. However, if users are aware that any software installed included spyware they must act quickly removing not only the carrier program for instance the file-sharing tool but the spyware itself because it remains into the system and runs constantly even if the software which carried the spyware onto the computer is removed.
Spyware can be installed only by users. Therefore, there are various techniques used to deceive users. Occasionally, spyware can be presented as a useful utility and make users download them but before they realise its harmfulness it will be too late. Furthermore, they can be hidden behind desirable programs for internet users to download. For instance they can be hidden behind a music CD or an add-in for web browser’s toolbar without users to be aware of this fact because there are a few times that spyware might become visible to them and only when the software tries to communicate with the information gatherer1. Moreover, spyware can be installed even by a simple clicking on some option in a deceptive pop-up2 window.
Finally, spyware software can act as a web proxy or a Browser Helper Object and replace references to a site's own advertisements (which fund the site) with advertisements that instead fund the spyware operator [20]. However, spyware software is most commonly wrapped up in another piece of software
Information retrieved from Discussion Forums For a definition of Pop-ups visit: http://whatis.techtarget.com/definition/0,,sid9_gci212806,00.html 1 2
Msc ITMOC 2005/06
26
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ which, most of the times, is downloaded and installed with the consent of the users but without their knowledge [17]. How is this happening? Spyware manufacturers usually offer a free software or freeware1, which includes spyware clauses in the End User License Agreement (EULA). By the time users agree to the terms of the manufacturer (EULA), spyware is installed together with the freeware that users intentionally install. Spyware is not limited to free software or freeware. On the contrary, it also arrives bundled with shareware software such as games or P2P2 applications or through email. Video games are a favourite, attractive and easy target for spyware software.
An example will facilitate the reader to draw some knowledge about how spyware software works. Kazza Media Desktop (KMD) which used to be very popular peer-to-peer software was including software that was installed on user’s computers without their knowledge. Once this software was installed in a computer, it was manipulating its unused processing power to make it available to a secondary private network where the computer was already connected with. This was something very beneficial for Sharman Networks, the owner company of KMD, making it available to render video and 3D animated advertisements as well as processing the data gathered by the advertisers3. Moreover, the company could also process large amounts of user profiles.
Another spyware program called OfferCompanion, was also bundled with KMD. OfferCompanion was running in a stealth mode and launched every time users launched their web browser such as Internet Explorer. Then, each Freeware is copyrighted computer software which is made available for use free of charge, for an unlimited time. For ore information visit: http://en.wikipedia.org/wiki/Freeware. 2 P2P refers to a technology which enables two peers or more to collaborate in a network of equals. For more information visit: http://en.wikipedia.org/wiki/P2P 3 Information retrieved from Discussion Forums 1
Msc ITMOC 2005/06
27
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ time users were visiting certain websites, an affiliated marketing company called Gator Corporation was transmitting advertising pop-ups appeared on the desired page. Pop-ups and web banners1 are very often connected with spyware programs such as OfferCompanion. These are forms of online advertising on the World Wide Web constructed from an image, JavaScript program or multimedia object bundled with spyware programs or transmitted to the users through spyware.
A final useful example is about a spyware software used for monitoring home or/and work. It is called eBlaster2 and it is a quite stealthy program that monitors and records everything that happens to the computer it is installed, from web browser’s activity to keystrokes typed, sending the information gathered to the owner’s email address. In this case, surprisingly, spyware acquires the merits of viruses since a Trojan element on it, enables its authorised users to infect other machines remotely3.
4.3 Spyware Business Model Discussing about the business model of spyware vendors will facilitate the reader to understand the main functions of spyware software. Internet market and electronic commerce have different, special nature and rules from the traditional market. The nature of internet allows to the majority of internet users not to pay for information, software and online services they use but share or exchange this intellectual property. Peer-to-peer networks have been created for this reason. Copyright law is still unable to enforce and patrol the illegitimacy of infringing software copyright [15]. Therefore, it is very For more information visit: http://en.wikipedia.org/wiki/Banner_ad For more information visit: http://www.spectorsoft.com/products/eBlaster_Windows/index.html 3 Information retrieved from Discussion Forums 1 2
Msc ITMOC 2005/06
28
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ important for software manufacturers and vendors to ensure that even someone does not purchase their product (for example make an illegal copy or download it from a peer-to-peer network), they will still be able to make profit from it and not loose all their revenue.
The more popular their software is the more new channels of revenue can create. Therefore, software vendors try to find new sources of income driven from economic necessity [29]. This is possible through advertisements and marketing or by acting as hosts to other software bundling products with PIS. This allows software vendors to gain revenues from the PIS vendors (who get their income from advertisers) each time their product is installed by a user 1. Their new revenues are proportional to the times these file-sharing tools are downloaded and installed, something that might happen millions of times. Considering there is a charge of few cents each time the software is installed, this automatically means a significant income for involved parties is generated. Therefore, this kind of new software business model-approach seems to be very successful, speaking in economic terms, and the driving force to the development and domination of spyware software. Nevertheless, although these practices appear to be legitimate, they provoke the debate over privacy.
4.4 Legality of Spyware “Most users would prefer, had they known what was happening, not to have spyware on their computers� [18]. Spyware creates an ethical discussion whether is legal or not. On the one hand, spyware manufacturers argue that users have agreed to the spyware installed in their computers. On the other hand, as shown
1
Information retrieved from Discussion Forums
Msc ITMOC 2005/06
29
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ above, spyware software affects individual’s privacy since it is used as a means of surveillance without individual’s knowledge, making her behave in an open normal manner. Nevertheless, the legal position of spyware is not so clear yet, creating legal grounds for some people for passing over the laws and claiming that the software is legal [18]. The strongest argument is the following: Software is not spyware when it states exactly what it does in the EULA. A careful examination of the contract law and EULA will facilitate the reader to gain a better knowledge on this subject.
Some people argue that since EULA formulates a contract between the manufacturer of software and its user-customer, by the time users agree to the terms-rules of the manufacturer, legally enforceable obligations are created. “Clickwrap agreements”1 which are found on the internet as part of the installation process of many software packages, include “contracts d’ adhesion” [11] where enable the creators of software (sellers) to set their own terms but they do not enable the other contracting party (consumers) to affect the contract terms and the bargain equality.
For instance, I will examine users that download free software from a website. When they are ready to install the program, they come along with the license agreement (EULA) and many other options that have to decide whether to accept or not. Unfortunately, some options that are not listed on the initial license agreement are adhered to the software, most of the times as amendments and additions to the contract terms2. These amendments are compulsory and without them, the software cannot be installed onto user’s computer [42]. So, it has no difference whether users read all these terms
Agreements that allow users to read the terms of the agreement before accepting them. For more information visit: http://en.wikipedia.org/wiki/Clickwrap#Cases 2 Information retrieved from Discussion Forums 1
Msc ITMOC 2005/06
30
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ appeared on their screen and understand them or not. They have no other choice but to agree if they want to install the software.
Although many big software manufacturers that bundle spyware with their software clearly state that the use of their spyware is for marketing purposes, the majority of manufacturers deliberately omit to do this. This is because laws and courts seem to work for the favor of EULA [42]. They reinforce the power of EULA over the users giving the advantage to the writers of the contracts to create them according to their needs and giving little or no chance to the other part of the agreement (the users-consumers) to change it.
The needs of the market created this commercial necessity for the courts to favor the writers of the contracts enhancing thus the fact that most consumers are not legally trained to read carefully each agreement not to mention that although they read it they probably will not be able to see the disadvantages the contracts place them in [18].
4.5 Protection Solutions Most users are not only unaware about spyware software and how it works but also about the practices and behaviour they must have while they are online in order to keep their computers and privacy safe. Even experienced users, by the time some practices become embedded in their every day activities such as how to install software, omit to read the EULA and “Clickwrap agreements� that come before installation [42]. They also do the same for many other activities in their lives. For instance, when they buy a car, it is very rear to read the manual because they already know how to
Msc ITMOC 2005/06
31
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ drive. Therefore, it is the same about software; they want to use it and not read about it.
Consumers also like to make assumptions such as by the moment other people did something before without problems, the same will happen to them. Statistics from software distribution sites 1 show that even though people know that for example, P2P software such as KMD or Morpheus may or do contain spyware. However, they still download them because their friends already have them and seem to cause no troubles. But once a problem occurs, they panicky try to repair it or at least mitigate the spyware hazard. How? The market took good care of this creating a whole industry behind spyware.
A new group of software called anti-spyware or spyware removal tools. Antispyware programs such as Ad-Aware2and Spyware Doctor3 are able to detect and remove or block quite big percentage of spyware software but still are unable to exclusively detect a certain PIS behaviour which makes them useless in cases of severe or disastrous, malicious spyware4.
The list of anti-spyware programs is huge. Even major anti-virus firms such as McAfee5 and Symantec6 add anti-spyware features to their antivirus products. Norton Internet Security Pack 2006 is such an example. Anti-spyware programs once installed can play the role of the gatekeeper providing realtime protection or they can just detect and remove spyware software.
A leading software distribution site is: www.dowloads.com For more information visit: http://www.lavasoftusa.com/software/adaware/ 3 For more information visit: http://www.pctools.com/spyware-doctor/ 4 Information retrieved from Discussion Forums 5 For more information visit: http://www.mcafee.com/uk/ 6 For more information visit: http://www.symantec.com/index.htm 1 2
Msc ITMOC 2005/06
32
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ However, in order to be effective, they require a regular source of updates to keep updated their database of threats. Nevertheless, anti-spyware programs are one step behind spyware. Like most anti-virus software, its manufacturers have first to detect and determine new spyware and how this behaves in order to find the way to fight it. Not only the accuracy of anti-spyware programs is questionable but also their ability to safeguard user data and system components during the removal phase [25].
It is not unusual for anti-spyware programs to remove useful system components necessary for the normal operation of the computer in their effort to remove spyware. Are they able to keep and protect users’ legitimate files? Moreover, the fact that a lot of anti-spyware programs are not open about their methods in defining what spyware creates among others serious concerns about their political power. Their decision to remove or block programs may have impact on users’ sensitive data.
For instance, anti-spyware programs may block or disable other real-time encryption software that users use for their electronic transactions. They may also have impact on marketing companies legitimate business interests. Such an example is the claims of Comet Systems Inc1 that they have been unfairly targeted by Lavasoft (Ad-Aware spyware removal) and their business has suffered because of it [58]. Since marketing, through free software is legitimised the behaviour of anti-spyware software, affects the business and as a result the revenues of marketing companies and spyware vendors.
Comet Systems is an adware that periodically create desktop shortcuts linking to websites and product offerings. Besides, the program may automatically update itself to install new features without additional notification. 1
Msc ITMOC 2005/06
33
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
4.6 The Reaction of Legislation It is such the nature of World Wide Web that is impossible for legislation to apply worldwide. Therefore, it is not the purpose of this research paper to focus on legal reactions but to present some of the existing legislative arrangements that have been created to mitigate the risks and problems occurred by spyware. A good example is the first American legal initiative to control spyware: The ‘‘Spyware Control and Privacy Protection Act of 2001’’ [16] [18]. This Act has created some obligatory arrangements for spyware manufacturers to satisfy before they launch their product to the market. This includes explicitly reference: if the type of software comes to the category of spyware, how it works and how users can uninstall it, what kind of information is able to collect and for what purpose [15]. In any case, spyware software can operate its functions after users’ agreement to access certain information. In addition, manufacturers have to properly encrypt and protect users’ data from other sources, such as hackers [13].
However, this is not enough to control spyware in a proper manner. Even the initiative of the European Union Data Protection Directive1 to divide personal data into “sensitive”2 and “non-sensitive”3, is not effective as the division between those two types of data is not always clear. For instance, having a great amount of non-sensitive data of someone can lead to knowledge of sensitive data by a simple process of deduction. In addition, spyware
See Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. 2 Sensitive data concerns personal data surrounding the data subject’s finances, medical history, sexual orientation, lifestyle, political affiliation and race. This data cannot be collected or used without the data subjects consent. 3 Non-sensitive data includes any and all actions which spyware can record from the web and the conclusions which can be drawn from this data. This non-sensitive data can be collected, processed and sold without the data subjects consent. 1
Msc ITMOC 2005/06
34
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ manufacturers try to use any necessary means of technology and legislation to deceive not only internet users but also the legislation itself.
There is a gap between the time that a new technology is born and the time that legislative arrangements are made to control it. Thus, spyware manufacturers and marketing experts are taking advantage of this gap, in order to achieve their business purposes. Although, legal reactions such as the EU Directive have been created to set some rules and criminalise illegal actions of spyware software, they can not be applied even in the member states of European Union. The techniques required to monitor privacy invasions and enforce legislation are “beyond the power of single or groups of states� [18].
In my opinion, although legislation exists and may provide a strong level of privacy in many developed countries, it is accused that poses barriers to electronic commerce and electronic transactions in general. It is very difficult for any legislative approach to find the balance of the need and wants between different groups in society. As it has already been mentioned, since the global nature of internet vitiates the boundaries of nation states, it is very difficult to define the limits and the influence of laws of single states or group of states.
In addition, those companies dealing with personal data collection through spyware prefer to move to states with poor privacy legislation where it is very difficult to be located. Besides, the concept of spyware is so unclear especially when it is referring to the contract law and EULA. In addition, legislation often has little or minor effect.
Msc ITMOC 2005/06
35
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
4.7 Conclusions – Personal Critique The above discussion over spyware has left an open debate not only over privacy but also over which solutions should be applied to the problem. Since most internet users are unaware of this relatively new problem, they turn their attention into the market and the use of anti-spyware programs. However, technology is not a panacea by it self. Once a computer has been infected by a large number of spyware software, anti-spyware removal tools are usually ineffective and only cure is to completely remove and reinstall the operating system [20] that has been attacked. Users must have the ability to foresee such a possibility and the knowledge how to do this, for instance, having done a backup of their data before. Users must have at least a basic knowledge about how to find and install anti-spyware programs but also how they work, how to correct them if they fail to work and what consequences they might have.
Anti-spyware programs might be sometimes as dangerous as spyware and therefore there is a need of constant concern and alert by users. It is not rare the fact that users, trying to fight spyware, download inadequate antisoftware which makes them feel safe while they are not or download even more spyware. There are large numbers of fake anti-spyware programs released by malicious programmers in order to deceive users. Of course, there are some other techniques useful in addition to installing anti-spyware software. Some of these techniques are to use firewalls 1 and certain web proxies2 or install a large host’s file3 to block access to websites related with spyware. Yet, these utilities must be configured correctly in order to have a
For more information see http://en.wikipedia.org/wiki/Firewall_%28networking%29 For more information see http://computing-dictionary.thefreedictionary.com/Web+proxy 3 For more information see http://en.wikipedia.org/wiki/Host_file 1 2
Msc ITMOC 2005/06
36
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ positive result otherwise they can be more dangerous than if they had not existed.
However, the most important factor is the behaviour of users. It is of most importance for users to be informed and able to make decisions prior to the software installation process, or whether to install free software with the slight inconvenience of either pop-up ads or banners, or to pay for software free of advertising [25][19].
On the legislative side, contract law and EULA seem to be an inadequate help to users since it is usually used as a legitimising factor for unscrupulous business practices. Legislation may enforces software vendors to print in red ink and point the parts of EULA referring to the bundling of spyware software in order users not miss it. However, the power of national legislation is inadequate when has to do with internet based technology. Because of the nature of the World Wide Web, there is the need for an international legal consensus. Since this is very hard to be achieved, the best legitimate practices for users are their knowledge to read carefully each EULA prior to any software installation and being suspicious of any kind of software whether it is free or not.
The greater defensive mechanism is the end user education. Users are responsible themselves for achieving a balance between technology and society. A constant public debate over the demands of new technologies will keep users aware and informed about the use and consequences of new technological advances over the issue of privacy. Only then, technologies will have gradual effects on society.
Msc ITMOC 2005/06
37
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
Chapter 5: Cookie Technology In this section, there is a discussion on HTTP cookies or internet cookies (hereafter cookies) as an example of spyware which will facilitate the reader to understand how spyware are connected with and what implications may have on users’ electronic transactions. I chose cookies because it is a very familiar subject to the majority of internet users which also raises a lot of privacy concerns since they are commonly used in electronic commerce.
5.1 Introducing Internet Cookies HTTP cookies (also known as web cookies) are an addition to Hypertext Transfer Protocol (HTTP) which is the foundation for the web and the best up to the moment method to publish and receive HTML1 pages. All web pages and material are based on one or another version of the HTML standard. The cookie standardization process began in April 1995 [21]. In December of that year, the IETF undertook to write a cookie standard. The Internet Engineering Task Force (IETF)2 develops and promotes internet standards, cooperating closely with the W3C3 and ISO/ IEC standard bodies.
Cookies were originally called "magic cookies", named after the tokens with mystical powers that are a part of role-playing games [33]. Cookies are small files, simple pieces of data (text) created by the communication-interaction
HTML is a markup language designed for the creation of web pages with hypertext and other information to be displayed in a web browser Source: <http://en.wikipedia.org/wiki/HTML> 2 For more information visit: http://en.wikipedia.org/wiki/Internet_Engineering_Task_Force, and http://www.ietf.org/ 3 For more information visit: http://en.wikipedia.org/wiki/World_Wide_Web_Consortium 1
Msc ITMOC 2005/06
38
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ between a server and web browser and they are used for authenticating, tracking, and maintaining specific information about users [22].
Cookies cannot be of danger or pass on viruses since their file format is text based which is only readable and not executable. But even if they were executable they could not operate by their own unless users execute them1. They are placed on users’ computers hard-drives by websites servers containing information about users’ behaviour on the certain site and they can be read and used supposedly only by the websites that created them. This uniqueness has as a result hundreds of cookies to be stored on computer’s hard-drive. Cookie technology is the only data-gathering technique that actually stores the data it gathers about a user on the user's computer system [34].
5.2 How They Work A simple description of how they work might be better than many technical descriptions: Hypothetically, a user types the URL address of a commercial website such as the Amazon.com. The user accesses the web server of the company and selects categories of products that she is interested to buy sending as a result an information request. The server answers back, providing the desired information. At the same time the server creates a specific cookie for this customer characterized by a unique identification code and transmits it to the user’s computer. If the user has set browser setting to allow all cookies, then the cookie received from Amazon is stored without any notification. In another case, the browser could ask user’s permission to store the cookie. Once the cookie has been saved on the user’s computer, the
1
Information retrieved from Discussion Forums
Msc ITMOC 2005/06
39
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ personal information about product categories preferences that the certain cookie contains is available to the web server each time the user tries to connect with it. Therefore, next time the user visits the Amazon.com, the web server automatically access the cookie it had created giving the user the capability of continuing her search remembering her previous preferences.
Cookies are divided into two categories. “persistent” and “session” cookies. On the one hand, “persistent” cookies have an expiration date which may be in the long future, enabling them to be stored on computers until their expiration date. On the other hand “session” cookies are temporary and removed each time a session is closed. In my example, shopping on Amazon, the cookie related to user’s shopping cart will be removed after she finishes her purchase unless she decides to return another time to continue her shopping. However, another persistent cookie can be created after her transaction finishes which will contain information about what products she was looking for and what did she buy giving to her the opportunity to review previous transactions and the company to offer her special promotions according to her interests and preferences.
Furthermore, internet users usually refer to “good” or “bad” cookies1. “Good” cookies also used only by the websites that create them in order to customize their environment for consumers’ convenience. “Bad” cookies are used for marketing and commercial reasons such as selling, exchanging or sharing the information gathered with other third parties. The last years another name of cookies has appeared. It is called “ugly” cookies2 and describes those that function as bugs in programs giving experienced hackers the possibility to read thousands of cookies no matter their developer. 1 2
Information retrieved from Discussion Forums Information retrieved from Discussion Forums
Msc ITMOC 2005/06
40
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
5.3 The Functions and Benefits of Cookies The functions of cookie technology affect the electronic commerce transactions. Many people argue that the baseline level of user monitoring on the web is the use of cookies. Cookies are built into the web browsers and operate by default; web browsers are the most essential tools for computer users who want to access the web. Therefore, cookies are used as a type of “surveillance by design” aiming to record users’ internet behaviour, interests and preferences1 [34]. This tracking and gathering of user’s movements and information when they are surfing on the web is called “Clickstream” data. The vast majority of websites use cookies. Few companies invest in a website without anticipating some earning potential [6]. Especially in the case of electronic commerce and online marketing, cookies are the ‘gold’ for online companies.
Companies are based on cookies to provide them with the information they need to improve the features, content and generally the structure of their websites, no matter the content is static or dynamic. Cookies provide information about visitors of a web page such as how much time they spent and how they browsed the website, how often they visit it and what products/services they viewed or showed an interest in. Such information is very important since it allows websites to plan their updates accordingly, sitting improvements that will satisfy existing customers and attract new [24].
Creating a comprehensive, yet user-friendly interface is essential for online businesses to stay competitive in internet marketplace. As a consequence, after customer lists and profiles, this “Clickstream data” collection becomes a
Cookies can provide websites the ability to store and retrieve information about users that visit them, typically without their knowledge or consent. 1
Msc ITMOC 2005/06
41
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ valuable supplement on the assets of electronic commerce companies. Online marketing companies also use cookies to track users’ preferences and habits in order to build better marketing information and develop a “one-to-one” marketing approach providing thus personalized services according to users’ specific interests and desires [43]. In my opinion, these personalized services are the most important benefit for both online companies and users.
On users’ perspective, cookies can provide a tailored shopping experience according to their preferences thus facilitating their experience while providing, at the same time, a source of information for the suppliers. For instance, when users create an account on Amazon.com, cookies can provide the following personalized services: 1) Store names and passwords eliminating the need for users to memorize or retype passphrases and thus logging in automatically. 2) Remember the items added in users’ shopping cart making it available for them to finish shopping another time. 3) Furthermore, once users have made a purchase and given details such as credit card numbers and mailing address, the site does not need from them to re-enter the same information twice avoiding thus to repeatedly filling out order forms. 4) Remember also past purchases providing hence the website the ability to recommend and promote specific products and services that fit user’s interests1. 5) Store the last date and time that users logged in the website customizing it to show users what happened since their last visit. 6) In addition, cookies can provide greater network speed and efficiency allowing greater number of users to access the Amazon’s server at once2. In general, cookies make internet user-friendly and convenient, avoiding timeconsuming and sophisticated procedures [43]. Especially in the case where
1 2
Recommendations are very usual to books purchases Information retrieved from Discussion Forums
Msc ITMOC 2005/06
42
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ multiple individuals use a certain computer or an individual has multiple ID’s and numerous passwords, cookies seem to be extremely valuable1.
5.4 Threats to Privacy Along with the benefits of cookies come the downfalls. Most users are aware of the fact that Unique Identification Codes (UIC) assigned to each cookie that is installed into their computers. They visit, for instance, Amazon.com to search for a book. While browsing the site, they provide Amazon’s server with anonymized “Clickstream data” such as their preference for a specific category of books. A cookie, then, is installed into their computer by Amazon, with a specific UIC. However, users do not know that once they decide to register to the site, in order to have a discount on their purchases, this cookie can be linked to their real name and e-mail or home address. This can result in receiving junk-email according to the web choices. The most important consequence, though, is related to advertisers and webmasters.
Once it has been created a user’s profile on a website, cookies can be linked to this profile and create a form of identification enhancing the information that is available for the specific user. This might create serious dangers on user’s privacy. Not only her information is available to website’s database but also her profile can be sold and resold later to other commercial interests; advertising entities on not2 [1]. For instance, she might visit quite often web pages that sell or advertise cigarettes. By the time this information is sold to
Such a simple example is Microsoft’s MSN which allow multiple users to create different accounts in a single computer without the need to remember passwords, contacts and other details each time they log in. Cookies remember" who they are and set preferences accordingly when they return. For more information visit: www.msn.com 2 This sale of users’ personal data was driven by the new business model that the internet age has brought: “If you cannot make money selling things to your customers, just sell your customers”. 1
Msc ITMOC 2005/06
43
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ third parties, advertisers might bombard her with smoke advertisements and relative accessories; on the other side, non-advertising parties such as her insurance company will find it interesting to change her profile according to her internet habit [24]. Consequently, this is creating not only concerns about privacy but also serious concerns for potential abuse and harassment. The trail of cookies crumbs often provides more information about a person than that person might want to share [7]. Frequent visitors to racier or AIDS sites may have reasons to keep their interests or actions private.
The above problem of linking the anonymized “Clickstream data” with other identifiable information through the placement and sharing of cookies is one of the most serious problems concerning data privacy and has created the controversy over web-based advertising. A very well known example is that of Doubleclick Company which uses one of the most popular information sharing techniques1. In general, online marketing companies and advertisers use cookies to link users to particular advertisements through the use of adbanners2. This can lead to ad-servers trying to predict a user’s buying habits and send custom banners to them.
Finally, gaping security holes contained in cookie programming3 make easy for bugs to be plagued into web browsers and communicate to third parties any other information that is stored in users’ computer into files; from credit card numbers and bank accounts to passwords.
For more information about Doubleclick visit: http://www.doubleclick.com/us/about_doubleclick/privacy/ , http://www.privacychoices.org/. Alternatively, advise [1], [36]. 2 A web banner or banner ad is a form of advertising on the Web. This form of online advertising entails embedding an advertisement into a web page. It is intended to attract traffic to a website by linking them to the website of the advertiser. For more information visit: http://en.wikipedia.org/wiki/Banner_ad 3 For more information visit: http://www.cookiecentral.com/ccstory/index.html 1
Msc ITMOC 2005/06
44
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
5.5 Solutions against Cookies The market has created anti-cookie software which enables users to control or eliminate cookies. They can block all cookies apart from the required ones as soon as the user has configured them once. They can also avoid persistent cookies or authenticate them before storing them. There are many free or lowcost programs capable of doing this job in a user-friendly way.
Well known programs in the market are Cookie Master and ZDNET software, www.adsubtract.com which offers a cookie customizer that allows users to manage cookies and www.iewatch.com which is a plug-in to Internet Explorer browser to view cookies1. Many more anti-cookie programs are known for doing well the same job and therefore users have to choose carefully which suits best at them. However, they can also choose alternative techniques such as web anonymity tools or anonymizers2.
A very well-
known anonymizer is the homonym product.3
In my opinion, other solutions that individual users could adopt are restricted to simple everyday practices. For instance, they can set their browser preferences to decline cookies. However, this option does not make any discriminations and screens out the goods cookies as well as causing denial of access to some sites that require cookies to access them 4. A better option is to set browser to inform users and ask their permission whether to accept or not any cookies. Although this practice gives the control to the users, they are Information retrieved from Discussion Forums Anonymizer is a service that submits HTTP requests to Websites on behalf of its users. Because the request is submitted by the Anonymizer rather than the user, the only IP address revealed to the Website is that of the Anonymizer. However, users of this service are not anonymous to the Anonymizer itself, nor to their own ISPs, who may log their users’ Web activities. Source: [12] 3 For more information visit: www.anonymizer.com 4 To see such an example visit: www.hotmail.com 1 2
Msc ITMOC 2005/06
45
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ unable to know what information is actually stored and transmitted to the web server unless they know and trust the source of these cookies. Once more, this seems quite blurred because in many cases it s not always clear the source of the cookie. For instance, multiple cookies are offered to users when visit crowded websites making it difficult for them to distinguish what cookies come from advertisers or the websites and which are safe to store or not. Unfortunately, this practice becomes annoying and impractical to the users and they abandon it after a short period of time.
Moreover, there are few simpler tasks that users could do without having too much knowledge. Taking for example the well known browser Mozilla1 tasks such as clearing the private data are very easy to operate. What users have to do is simply go to options menu and tick the appropriate boxes. Cleaning the browsing and download history, cache, cookies and even the authenticated sessions and saved passwords are very simple but important tasks that can help to keep some personal privacy. Users have already created a movement against the malicious practices of cookies. This is known as the “toss your cookies” movement – a cookie controlling or "pro-choice" movement – with which users develop a great deal of momentum to industry to take initiatives to ensure their privacy [7].
The industry from its side developed some self-regulation initiatives such as the Open Profiling Standard which allows users to create their own profiles with the information they want to share with websites2. OPS designed to
For more information visit: www.mozilla.org OPS is a new proposed system of collecting user information on a strictly voluntary basis that has been agreed from over 60 companies (Microsoft is one of them). OPS "gives users control over their Personal Profile and the ability to manage which personal information gets disclosed or withheld from particular Internet sites. 1 2
Msc ITMOC 2005/06
46
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ allow the use of cookies for individualized internet advertising but protecting users’ privacy through strong encryption methods.
On the legislation side, there have been set specific rules and principles to regulate the use and protection of personal data. The EU Directive1 provides maybe the strongest data privacy protection giving individuals the opportunity to take control of their personal information. However, the best ever practice is based on users and their good judgement and awareness that everything they do in the internet leaves electronic trail [24]. It is users’ concern to safeguard their privacy and not fully depend on technology or legislation.
5.6 Conclusions Cookie programming has no limitations but the imagination of the programmers. Cookies are now ubiquitous on the Web but the debate over privacy threats still exists [26]. Internet was “considerably less than private before the widespread use of cookies” [27]. Websites, for example, can obtain information as well about users from alternative sources such as their IP address. Therefore, the basic privacy concern should focus not on what cookies can do to our computers but what information they can store and communicate to others beyond our knowledge and consent. In fact, the concept of privacy begun from the fact that as Victor Mayer-Schonberger said: “The cookie is stored in the user’s computer without her consent or knowledge” [28]. This is the rationale that cookies are concerned to be a type of spyware although they are not software or program.
The EU Directive has been examined in Chapter 3. For further details about this European framework of data protection see [27]. 1
Msc ITMOC 2005/06
47
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ Most users do not want to trust something as precious as their personal privacy to the goodwill of others [7]. They want to have matters under their own control. With the help of technology they can have a greater control over what cookies can accept and from where. For instance, the security and stability updates on all web browsers alert users when a cookie is to be set on their computers. This feature gives users the option to accept the cookie or not but still they can not know what kind of information is actually stored on it.
The existing regulation limits the use and application of cookies giving individuals the opportunity to protect their personal info but often this incurs extra costs for users. Furthermore, legal reactions take time; they are constantly challenged and seem to be ineffective because of the rapid development of technology and the various forms that it can take.
Laws, such as EU Directive, are usually neutral to technologies trying to minimize their consequences. The nature of technologies, especially internet technologies do not allow to regulate their operation since the uses of technologies are constraint only from the imagination of humans-creators. If humans cannot use a technology in a certain way, the will find another way to operate it or simply they will find a new technology.
Overall, education and knowledge are the most important practices from users’ perspective in order to protect their privacy. Since there are not yet strong privacy standards adopted in a global sphere, users should constantly question the use and purpose of cookies as well as any alternatives that they might have. An informed decision is the best option for people giving them power and control of their privacy [27].
Msc ITMOC 2005/06
48
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
PART 3: Privacy Protection This part, gives an overview of three general approaches dealing with the privacy and surveillance on the World Wide Web and the possible solutions they offer. The technological approach examines solutions built into systems, the organisational approach examines the initiatives of the internet industry and the legal approach examines the legal reaction for the protection of privacy.
Chapter 6: General Approaches to Privacy Protection The privacy debate seems to be an endless debate which is constantly encouraged by newer and newer challenges of technological advances. On this debate, the internet provides the best probably means for people's monitoring and surveillance in such a level that no one could have imagined. Internet technologies seem to become technologies of control where privacy becomes the price that internet users have to pay for their use of these technologies [39]. It does not matter if the threat to privacy comes from spyware software, internet cookies or any other kind of technology. The fact is that the privacy threat always exists and continues to exist since cyberspace becomes part of our everyday lives and many of its practices and uses become ubiquitous and embedded in our ordinary activities.
Consequently, the amount of our personal information that is gathered, stored and used on any way and by any means on the web will start more and more to escalate. The claim of Jerry Kang that “surveillance leads to selfcensorship� [65] is not totally correct anymore since the covert practices of new technologies, in relation to the awareness of users, create stealthier and
Msc ITMOC 2005/06
49
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ ubiquitous types of surveillance. This makes some people optimistic or careless about their privacy. There are famous quotes that show this optimism such as “privacy is an illusion” or what Scoot McNealy, Sun Microsystems stated: “You have zero privacy anyway". I reject them as very dogmatic and absolute views of privacy as an ‘all-or-nothing’ concept. I would better agree with the group of theorists1 such as Westin, Fried and Parent that I have already mentioned on chapter 3, that the privacy debate is a debate about the “control of personal information”.
Therefore, privacy is viewed as our ability to control who has access to information about us. This results in our ability to manage our social relationships the way we consider the most appropriate; only then we are able to produce the ‘image’ we want for ourselves and communicate it to the other people not to deceit them but to maintain a desirable relationship with them; to maintain dignity, respect and fair treatment but avoid any manipulation and coercion. Warren and Brandeis would define this as a “right” [61]. But even if privacy constitutes an institutional right or not, intrusions to it happen again and again.
Therefore, how well can privacy be protected and by what means? During my literature review, I concluded that there are three general approaches to privacy which examine solutions each one from a different perspective. Next, I am going to analyse these approaches using my personal critique.
Westin defines privacy as “being in a position to determine for [oneself], when, how, and to what extent information about [oneself] is communicated to others.” Parent and Fried define privacy as “the control we have over information about ourselves” Rachels defines privacy “our ability to control who has access to us.” 1
Msc ITMOC 2005/06
50
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
6.1 The Technological Approach Technology offers a variety of solutions to data protection. These solutions come within the general approach of the market to mitigate the negative consequences of Privacy Invasive Technologies1. Therefore, new technical initiatives called Privacy Enhancing Technologies (PETs) have been generated to enhance individual privacy by giving users more control over their personal information. Herbert Burkert has defined PETs as “technical devices organisationally embedded in order to protect personal identity by minimizing or eliminating the collection of data that would identify an individual or, if so desired, a legal person� [66].
The list of PETs is large and includes from anonymity tools and encryption software to proxies and firewalls. It is not the purpose of this paper to examine all the existing protection tools. My analysis will be based on a PET that is built into systems and which empowers users to decide about the collection, use and disclosure of their personal information every time they do online activities [59].
The Platform for Privacy Preferences or P3P is a standard which enables users to specify their own individualized web privacy preferences [34]. Actually, P3P is a set of internet privacy standards (software-writing guidelines) developed by the World Wide Web Consortium (W3C)2 that web-browsing software3 follows in order to give users more control over the information they release doing any online transactions. P3P is especially designed to 1
For instance spyware and cookies that have been examined in previous chapters
2
W3C is an international consortium where Member organizations, a full-time staff, and the public work together to develop Web standards. W3C's mission is to lead the World Wide Web to its full potential by developing protocols and guidelines that ensure long-term growth for the Web. For more information visit http://www.w3.org/Consortium/ 3 For instance browsers such as Internet Explorer or Mozilla
Msc ITMOC 2005/06
51
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ control electronic commerce activities which require identification of users and where covert data collection is taking place. Therefore, P3P seeks to “reduce the transaction cost of determining how much personal data should be surrendered in a given transaction” [41].
This new technical standard is built on the idea that privacy statements have little impact on most users’ behaviour. Hence, it allows users to create their own privacy profile and negotiate privacy practices with data collectors based on that profile [3]. For instance, a user can go to her P3P enabled web browser preferences and choose what information about her browsing habits should not be collected. Once she enters a website, the browser can give automatic warnings if the site’s privacy policy corresponds or not to her preferences and automatically reject any cookie that the website might want to use for this purpose. The user can set a greater variety of privacy options such as which information the server stores, for what purpose and use this information is collected, how long the information is stored and whether it is accessible or not by the user [53]. The P3P enabled web browser can inform her of site practices in both machine and human-readable formats and to automate decision-making based on these practices when appropriate [54]. Thus, the user does not need to read the privacy policies at every site she visits in order to examine if it complies with her preferences or not.
On the contrary, there are some weaknesses of P3P. First of all, it does not “learn by observation” but requires the user to store the settings [3]. It is also unable to issue warnings selectively to avoid ineffectiveness. Furthermore, it does not protect users once they have entered a website. However, the most important is that P3P is not scalable and therefore unable to meet the privacy needs of more intelligent infrastructures of the future [60]. Finally, while P3P
Msc ITMOC 2005/06
52
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ is an instrument of control over personal information, it can be also used as a means to control access to information1. Although this is not necessarily bad, it can raise privacy issues as well.
In conclusion, P3P is considered as the most prominent tool for privacy protection which is built into systems2. P3P, like PETS in general, gives individuals the power to control their personal information. However, the effectiveness of PETs and technology in general depends upon the circumstances and the nature of the threats to privacy [41]. The choice is on people to choose which technology is appropriate to protect their privacy interests. Nevertheless, any choice requires awareness of how technology works and what consequences its use might have. Legislation can encourage the development of PETs or discourage them3 [49]. However, laws must assure technological development in order to favour privacy protection initiatives.
Finally, although Privacy Enhancing Technologies (PETs) have already showed their importance, they still have to be examined and implemented on more serious scale and in comparison and compliance with the existing legislation.
For instance, P3P enables parents to establish set privacy rules that govern their children's activities online. Children are usually unaware of this practice which affects their privacy. 2 More specifically, P3P is a self-help PET build into identity management systems which is deployed to increase individuals’ privacy 3 Laws sometimes discourage unintentionally the development of PETs. For instance, when they discourage the spread of cryptography 1
Msc ITMOC 2005/06
53
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
6.2 The Organisational Approach The organisational approach examines the self-regulatory schemes and initiatives taken by the internet industry over the issue of privacy. Internet self-regulation1 emerges from business initiatives as an alternative to statutory regulation where individuals and organisations take responsibility for their own behaviour. As it has already been mentioned, the changing and shifting environment of the internet is a complex area where legislation is difficult to approach. General commercial and economic factors driven by the new prospects of the internet had as a consequence the internet marketplace to develop new initiatives to deal with the new challenges. Therefore, selfregulation can be considered as “market-based approaches to the management and control of controversial Internet content� [50].
Self-regulation was initially driven by the increasing competition and the need of online businesses to deliver quality and utility as well as consumer confidence and satisfaction. Nowadays, businesses2 have recognised the corresponding possibilities for brand enhancement engendered by privacy friendly practices [56]. Self-regulation can strengthen business and create the conditions for certainty and economic efficiency as well to establish trust relationships between the internet industry and internet users. By providing the right tools and mechanisms, self-regulation can contribute to empower users with the knowledge to control their own online environment and safeguard individual privacy [50]. Many self-regulatory schemes have been
Although there is no single definition about self-regulation, it is commonly agreed that selfregulation is one type of so-called 'soft law'. Soft law encompasses any form of regulation that is not introduced in a democratically elected legislature and is legally enforced. Source:[http://www.ncc.org.uk/regulation/index.htm ] 2 Especially companies which depend their future growth strategy on the internet. 1
Msc ITMOC 2005/06
54
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ emerged from the need to protect and respect privacy. But how actually such schemes work?
To begin with, any form of self-regulatory scheme needs to frame certain policy objectives; fundamentals principles1 that underpin privacy legislation [58]. It is very important to set clear objectives and standards that will apply to all users-members of the scheme. These objectives and standards shape the rules or “codes”2 of practice which are going to govern the behaviour of members. In addition, certain processes need to be established for monitoring and enforcement of those “codes”3 as well as providing members with adequate avenues for complaint [47]. Afterwards, it is equally important to create a user-friendly interface to encourage the communication with its users-members. Technology is essential to self-regulation. Most usually, there are used filtering technologies which allow users to control the context they are exposed to.
The following example will probably provide further understanding of the topic. Two private third-parties “privacy-assurance systems” which are the most visible and successful self-regulatory initiatives of the market, are Bbbonline.org4 and TRUSTe [41]5. They both set strict requirements regarding the way personal data is collected and used to ensure consumers that they are protected from unacceptable business practices. These requirements are in
Such principles can be data accuracy and data security Codes are sets of self-regulatory rules 3 These codes are connected with a set of values that comply with the respect to privacy. Some of these values are: end user autonomy; respect for freedom of expression; ideological diversity; transparency; interoperability and compatibility [48] 4 For more information visit: http://www.bbbonline.org/ 5 For more comprehensive information about Trust-e see [41], pp 65- 69 and www.TRUSTe.com 1 2
Msc ITMOC 2005/06
55
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ accordance with the terms of Privacy Policy that has been established as fundamental principle.
Any organizations participating in the scheme have been tested about their customer service practices and their confrontation with the general established Policy. This is easy noticeable because of the development of privacy seals and symbols (called “trustmarks”) for organisations to post on their websites1. These web seals certify also that their business comply with the self-regulatory guidelines established by independent reputable selfregulatory agencies that are able to judge its effectiveness, initiate amendments to codes and propose legislation when it is not meeting the objectives [47]. OECD2 and the Council of Better Business Bureau's3 are such self-regulatory agencies. Therefore, consumers can be assured before they decide to make a purchase that their information will be protected; it will be treated according to the general codes that these privacy-assurance systems have established. As a consequence, traders get more credibility which helps them to achieve public consumer confidence. But is self-regulation enough to develop and maintain consumer confidence as well the growth of online businesses?
These web seals offer a visible and effective way for organisations to communicate to consumers the privacy friendliness of their business. 2 The Organisation for Economic Co-operation and Development (OECD) is a unique forum where the governments of 30 market democracies work together to address the economic, social and governance challenges of globalisation as well as to exploit its opportunities. The Organisation provides a setting where governments can compare policy experiences, seek answers to common problems, identify good practice and co-ordinate domestic and international policies. It is a forum where peer pressure can act as a powerful incentive to improve policy and implement “soft law” – non-binding instruments such as the OECD Corporate Governance Principles – and can on occasion lead to formal agreements or treaties. For more information please visit www.oecd.org 3 Council of Better Business Bureau's : www.bbb.org 1
Msc ITMOC 2005/06
56
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ The history until now shows that the market did not correspond well to these self-regulation initiatives. For example, TRUSTe has, at the moment, around 1200 online merchants who pay for its services. The number is very small and shows the weaknesses that self-regulation has to overcome. Self-regulation faces the same problems with traditional regulation when it applies to crossborder consumer protection. Moreover, inadequate self-regulation can constrain the effect of legislation. Finally, its coverage of codes is not comprehensive enough to secure global agreement and often fails to meet even simple consumer needs [49].
What has to be done is to start cooperation between the internet industry and regulators. Self-regulation works better within cooperative structures underpinned by legal regulation1. Furthermore, no self-regulatory mechanism can work independently of an education and awareness campaign. [48]. The Internet industry should constantly need to evaluate and educate users about its practices thus providing general awareness of its mechanisms2 with the support of governments to reinforce education and consumer awareness. Effective self-regulation requires active and informed consumers.
To conclude, self-regulation is often more quick, flexible and cost-effective approach than legislation to target problems in the complex area of the internet. It is also more sensitive and responsive to changing user expectations providing them with greater choice [56]. Therefore, it can play an assertive role in building users’ trust to the new business practices and internet technologies since it can easier tackle with data privacy problems [49]. Everything seems to favour self-regulation to become the dominant For example, the legislation could provide the general principles with which all organisations must comply and these become the minimum standards for the drafting of industry codes [56] 2 For instance, awareness about the technology it uses such as filtering systems and hotlines 1
Msc ITMOC 2005/06
57
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ governing force in the future of the internet and electronic commerce. However, this should be possible only with the help and cooperation of legal regulation. Thus, it is very difficult for any self-regulation to stand alone for a long time.
6.3 The Legal Approach Legislation tries to balance the respect for privacy with justifiable uses of new technology. This section examines how solid and useful is data protection legislation focusing on the EU Data Privacy Directive.
On the one hand, the EU Directive1 of data protection is an excellent example of how legislation approaches the issue of privacy. There are strict laws that fend the right of control over personal information treating data as an independent intellectual property right. Laws are even stricter in the case of “sensitive�
personal
data
which
provides
individually-identifiable
information2. Control is given over individuals to decide when or how they want to share personal information with others. However, sporadic initiatives such as the EU Directive, even though they may provide a good regulatory framework for privacy, can not be applied in a global scale. In addition, they often create contradictions with other existing regulatory frameworks established in different countries3 [45].
Data privacy legislation is targeted against three different kinds of activities: collection, organization, dissemination. For more information please visit: <http://www.dataprotection.ie/viewdoc.asp?DocID=91> & <http://gsulaw.gsu.edu/lawand/papers/su98/panopticon/> 2 Such an example is personal health data 3 For instance, there is a strong debate over the differences between USA and EU legislation that affect their commercial and economic relationships 1
Msc ITMOC 2005/06
58
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ The digitalisation, convergence and continuing globalisation of computer networks make essential for a united global legal approach to be established [52]. However, in my opinion, one global legal framework with the consensus, participation and contribution of all countries would be unrealistic. On the contrary, a uniform legal framework among countries with strong commercial and economic relationships would be not only desirable but also feasible. The European Union and United States have recently started to test the convention for their practices and the legal protection they provide against cybercrime1. This great latitude tries to ensure a proper balance between the interests of law enforcement and respect for fundamental rights in a broader scale than this of European Union. Such a multinational initiative must be proceeded to regulate cyberspace, its related technologies and the consequences they have to personal privacy. The commercial and economic factors connected with the internet will heat up the process for a common, uniform and homogeneous legal approach to internet privacy.
On the other hand, it seems quite difficult to be established a general principle which will apply equally in all contexts and across all technologies. Attempting any regulatory approach takes time. What it needs to be done, but usually fails, is the fact that laws must be established after a public debate, consensus and concerted effort of the majority of the society after having examined in advance all the possible impacts. Laws are often created in opaque methods and they are ‘static’, usually representing a certain social group, the interests of an ‘elite’, and not the general public good. Commercial quest for profit and certain economic pressures are usually the driving forces of such laws to view privacy in terms of an “economic interest”, as Posner also suggested, and personal information as a transactional commercial product For more information please visit: http://conventions.coe.int/Treaty/en/Treaties/Html/185.htm 1
Msc ITMOC 2005/06
59
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ confronted to the laws of the market [55]. The European Union’s Data Protection Directive allows personal data to be collected for reuse and resale if the data subject agrees, consisting thus a legal financial transaction. Nevertheless, the parties in such a transaction are far from equal since most users are unaware of the value of their information and also unable to affect or stop the transaction if it results in creating negative results than they had expected1. As a result, Home Internet Users become the most weak and vulnerable part of the society.
Users should be encouraged to take initiatives to protect their privacy instead of searching for hope and depending on legislation to solve any possible privacy problems. Technology offers a number of solutions2 that any individual can adopt in order to enhance her privacy. However, the state should be patron to this effort providing the means for educating and informing its citizens about the effects of their actions and the potential threats of technology as well as the interpretation of legislation and the consequences that might have.
Good citizens are the informed citizens who question constantly the purpose and effectiveness of laws as well as their enduring capabilities for the future. They use technology but having first acquired the appropriate knowledge in order to use it effectively.
1 2
A case similar to this is what I have examined in Chapter 2 about EULA For instance PETs that have been examined in The technological approach
Msc ITMOC 2005/06
60
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
Chapter 7: General Conclusions This research paper has discussed the concept of privacy and surveillance on the internet pointing out the fact that the option of revealing or not personal information is not usually based on people’s free will but on the practices and the way that internet technologies are used. Fortunately, there are many possible solutions that can be applied to privacy problems that cyberspace creates. I have categorized these solutions into three approaches:
In legal approach, privacy legislation provides a basic legal framework and data-protection principles for internet users. In technological approach, there are Privacy Enhancing Technologies (PETs) as separate solutions for greater online privacy. Furthermore, the organisational approach incorporates selfregulation initiatives that online companies and organizations follow in order to provide better protection to their customers.
In my opinion, however, none of these approaches is sufficient enough to stand alone. On the one hand, legislation can not satisfy all different views of society and many times it is even against the interests of the greater public good serving the interests and goals of certain social groups. Besides, governments are consisted of politicians and each politician has personal values, visions and ambitions that might conflict with the general good. In addition, legislation takes time to examine, evaluate and decide about the effects of technology developments on people’s privacy.
The continuous technological advances make it impossible for legislation to predetermine the use of a new technology or its implications. Technology has no limits but the imagination of their creators. It can be used in as many
Msc ITMOC 2005/06
61
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ different ways as people can think. Therefore, legislation usually ensues to define the limits of new technologies and most of the times its usefulness is limited to soften the impact and implications of these technologies in society. David Brin argues: “No matter how many laws are passed, it will prove quite impossible to legislate away the new surveillance tools and databases and they are here to stay” and privacy laws can only “make the bugs smaller” [67].
There is no prefect legal rule since humans who create them are not perfect. Laws are easy to be violated at any time and in any excuse. However, fostering to make some things illegal, or regulating them, results in influencing outcomes; Even if the outcome is not what has been expected, the effort itself might be worthwhile. Any contemporary attempt of legislation to face the privacy problem affects the way the law will grapple with the problem in the future.
Online businesses1, on the other hand, are propelled and act-driven by their economic interests and their desire to make money. Although they want to keep their customers’ loyalty and trust active in order to continue to make money and dominate the market, they always try to exploit every opportunity coming from technology or legislation because ‘having one is good, but having two is even better’. Therefore, any self-regulatory initiatives they take are driven by deeper economic purposes and must be carefully examined.
Finally, PETs can provide a good protection for internet users. However, they are still challenged from new technological advances. Like antivirus programs, they come after an ‘infection’ has detected and try to give a solution and close the gaps that have been created. They need constant
1
The internet industry
Msc ITMOC 2005/06
62
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ updates but more significantly they need time to develop their practices to provide efficient protection. Once more, their use can not be blindly or unquestionably accepted because behind technology are humans and ‘you never know what a human being can think or how it can behave’.
Since the above individual solutions are imperfect to stand alone and provide strong privacy protection, a combination of them might be the best possible solution not only for the moment but also for the future. As Clarke proposes, a strong “co-regulatory” model is required to balance the competing privacy interests of individuals against the economic interests of online businesses [68].
Industry self-regulation must be accompanied and comply with PETs but both must keep up with the changes to legislation and comply with them. The creation of “privacy watch dog agencies” [68], independent organizations that will supervise and enforce the implementation of laws, could be also another assistant to the total effort of setting privacy policies.
To conclude, internet has created a milestone for personal privacy. The debate over privacy is going to be endless since new challenges of emerging technologies constantly feed this debate. Governments and businesses play a key role in setting privacy policies. However, the most important role is that of individuals. According to a famous quote: “one swallow does not make a summer”. This means that people have no power as individuals but altogether can achieve miracles. The development of privacy networks in accordance to consumer networks or any other social networks that people develop could be an example of how people can be united and develop same views and strategies in order to defend their privacy interests. Since people become
Msc ITMOC 2005/06
63
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ informed and aware of technology, its capabilities but also the threats it can raise, they can also become the driving force to set such privacy policies that will satisfy the society as a total.
At the end, privacy is not so much a technological, organisational or legal concept as a global social one that affects every human being in any place of the world.
Msc ITMOC 2005/06
64
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
References [1] Bennett C., 2001, ‘Cookies, Web Bugs, Webcams & Cue Cats: Patterns of Surveillance on the World’, Ethics & Information Technology, ABI/INFORM Global, vol. 3, issue 3, pp. 197-210.
[2] Westin A. & Maurici D., 1998, ‘Electronic commerce & Privacy: What Net Users Want’, Privacy & American Business, Survey Report
[3] Berendt B., Günther O. & Spiekermann S., 2005, ‘Privacy in Electronic commerce: Stated Preferences vs. Actual Behavior’, Communications of the ACM, Press New York, NY, USA, vol. 48, issue 4, pp. 101 – 106
[4] Ackerman M., Cranor L. & Reagle J., 1999, ‘Privacy in Electronic commerce: Examining User Scenarios & Privacy Preferences’, ACM Press, Proceedings of the 1st ACM conference on Electronic Commerce, Denver, Colorado, United States, pp. 1 – 8
[5] Weiser M., 1991, ‘The Computer for the 21st Century’, Scientific American, vol. 265, issue 3, pp. 66-75
[6] Crews C.W. & Thierer A., 2003, ‘Who Rules the Net? Internet Governance & Jurisdiction’, Cato Institute
[7] Schumann D. & Thorson E., 1999, ‘Advertising & the World Wide Web’, Lawrence Erlbaum Associates
Msc ITMOC 2005/06
65
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [8] Winokur M., 2003, ‘The Ambiguous Panopticon: Foucault & the Codes of Cyberspace’, Ctheory.net, Available at: <http://www.ctheory.net/articles.aspx?id=371> [2006, Sep. 05]
[9] Stephen LAU, 1998, ‘Electronic Commerce, Consumer Rights & Data Privacy’, Available at: <http://www.gilc.org/events/ottawa98/lau.html> [2006, Sep. 05]
[10] Liikanen E., 2000, ‘Europe & E-Business’, Presidents & Prime Ministers, vol. 9
[11] Hugh C., 1999, ‘Regulating Contracts’, Oxford University Press
[12] Cranor L., 1999, ‘Internet Privacy’, ACM Press, vol. 42, issue 2, pp. 28 – 38,
[13] McCardle M., 2003, ‘How Spyware Fits into Defence in Depth’, SANS Institute, Available at: <http://www.sans.org/rr/papers/index.php?id=905> [2006, Sep. 05]
[14] EarthLink.net, 2005, ‘Spyaudit’, EarthLink.net Press, Available at: <http://www.earthlink.net/spyaudit/press/> [2006, Sep. 05]
[15] Krebs B., 2000, ‘Sen. Edwards Intro’s “Spyware Control Act’, Daily News, Available at: <http://www.computeruser.com/news/00/10/11/news4.html> [2006, Sep. 05]
[16] Butler J. & Sparks S., 2004, ‘Spyware & Rootkits: The Future Convergence’, Login, vol. 29, issue 6, Available at: <https://db.usenix.org/publications/login/2004-12/pdfs/spyware.pdf> [2006, Sep. 05] Msc ITMOC 2005/06
66
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [17] Edelman B., 2004, ‘Methods & Effects of Spyware’, Available at: <http://www.benedelman.org/spyware/ftc-031904.pdf> [2006, Sep. 05]
[18] Klang M., 2004, ‘Spyware - The Ethics of Covert Software’, Ethics & Information Technology, vol. 6, issue 3, p. 193
[19] Boldt M., Carlsson B. & Jacobsson A., ‘Exploring Spyware Effects’, Available at: <http://www.bth.se/tek/aps/mbo.nsf/(WebFiles)/CAF6E79168D11036C125710 D00419F45/$FILE/NordSec2004-BoldtJacobssonCarlsson.pdf> [2006, Sep. 05]
[20] Wikipedia, 2006, ‘Spyware’, Available at: <http://en.wikipedia.org/wiki/Spyware> [2006, Sep. 05]
[21] Kristol D., 2001, ‘HTTP Cookies: Standards, Privacy, & Politics’, ACM Transactions on Internet Technology (TOIT), vol. 1, issue 2, pp. 151-198
[22] Wikipedia.org, 2006, ‘HTTP Cookies’, Available at: <http://en.wikipedia.org/wiki/Http_cookies> [2006, Sep. 05]
[23] Palmer D., 2005, ‘Pop-Ups, Cookies, & Spam: Toward a Deeper Analysis of the Ethical Significance of Internet Marketing Practices’, Journal of Business Ethics, vol. 58, pp. 271–280.
[24] Dyrli O., 2000, ‘The Continuing Cookies Controversy’ – author, Curriculum Administrator, vol. 36, issue 7, p. 26
Msc ITMOC 2005/06
67
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [25] Boldt M., Carlsson B., ‘Analysing Privacy-Invasive Software Using Computer Forensic Methods’, Available at: http://www.bth.se/tek/aps/mbo.nsf/(WebFiles)/D479A9073670E372C125710D0 041B265/$FILE/DIMVA06-BoldtCarlsson.pdf [2006, Sep. 05]
[26] Gowan M., 2000, ‘How It Works: Cookies’, Available at: <http://www.pcworld.com/hereshow/article/0,aid,15352,00.asp> [2006, Sep. 05]
[27] Eichelberger L., ‘The Cookie Controversy’, Cookie Central.com, Available at: <http://www.cookiecentral.com/ccstory/index.html> [2006, Sep. 05]
[28] Mayer-Schönberger V., 1997, ‘The Internet & Privacy Legislation: Cookies for a Treat?’, Va. J. L. & Tech. vol. 1, issue 1, Available at: <http://www.wvu.edu/~law/wvjolt/Arch/Mayer/Mayer.htm> [2006, Sep. 05]
[29] Leyden J., 2004, ‘Webroot: Spyware is Windows-only’, The Register, Available at: <http://www.securityfocus.com/news/9696> [2006, Sep. 05]
[30] Koops B.J. & Leenes R., 2005, ‘Code & the Slow Erosion of Privacy’, 12 Mich. Telecomm. Tech. L. Rev. 115, Available at: <http://www.mttlr.org/voltwelve/koops&leenes.pdf> [2006, Sep. 05]
[31] Marx G., 1998, ‘Ethics for the New Surveillance’, The Information Society, vol. 14, pp. 171-185
[32] Introna L.D. & Pouloudi A., 1999, ‘Privacy in the Information Age: Stakeholders, Interests & Values’, Journal of Business Ethics, vol. 22, pp. 27–38
Msc ITMOC 2005/06
68
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [33] Wildstrom S.H., 1996, ‘Privacy & the 'Cookie' Monster’, Business Week, issue 3506, p. 22.
[34] Tavani H., 1999, ‘Privacy Online’, ACM SIGCAS Computers & Society, vol. 29, issue 4, pp. 11 – 19
[35] Schmandt C. & Ackerman M., 2004, ‘Personal & Ubiquitous Computing: Issue on Privacy & Security’, Personal & Ubiquitous Computing, vol. 8, issue 6, pp. 389 – 390.
[36] Solove D., 2001, ‘Privacy & Power: Computer Databases & Metaphors for Information Privacy’, STANFORD LAW REVIEW, vol. 53, issue 1393, pp. 13931462
[37] Stanford Encyclopedia of Philosophy, 2002, ‘Privacy’, Available at: <http://plato.stanford.edu/entries/privacy/> [2006, Sep. 05]
[38] Rha J.Y., Widdows R., Hooker N. & Montalto C., ‘E-Consumerism as a Tool for Empowerment’, Forthcoming in Journal of Consumer Education, Available at: <http://www-agecon.ag.ohio-state.edu/programs/eagbiz/pagepapersandpres/papers_presentations/jce.pdf#search=%22EConsumerism%20as%20a%20Tool%20for%20Empowerment%22> [2006, Sep. 05]
[39] Rachels J., 1975, ‘Why Privacy is Important, Philosophy & Public Affairs’, vol. 4, issue 4, pp. 323-333
Msc ITMOC 2005/06
69
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [40] Frikken K., Atallah M., 2003, ‘Privacy Preserving Electronic Surveillance’, Proceedings of the 2003 ACM Workshop on Privacy in the Electronic Society: SESSION: Protocols, pp. 45 - 52
[41] Froomkin M., 2000, ‘The Death of Privacy?’ Stanford Law Review, vol. 52
[42] Newitz A., 2005, ‘Dangerous Terms: A User's Guide to EULAs’, Electronic Frontier Foundation White Pares, Available at: <http://www.eff.org/wp/eula.php> [2006, Sep. 06]
[43] Nielsen J., 1998, ‘Personalization is Over-Rated’, Available at: <http://www.useit.com/alertbox/981004.html> [2006, Sep. 05]
[44] Lester T., 2001, ‘Reinvention of Privacy: It Used to Be that Business & Technology Were Considered to Be the Enemies of Privacy. Not Anymore’, The Atlantic Monthly, vol. 287
[45] Vitale A., 2002, ‘The EU Privacy Directive & the Resulting Safe Harbor: The Negative Effects on U.S. Legislation Concerning Privacy on the Internet’, Vanderbilt Journal of Transnational Law, vol. 35
[46] Data Protection — European Commission, Data Protection Guide, Available at: <http://ec.europa.eu/justice_home/fsj/privacy/guide/index_en.htm> [2006, Sep. 05]
[47] National Consumer Council, UK, 2003, ‘Self-regulation, The National Consumer Council’s position’, Available at: <http://www.ncc.org.uk/regulation/index.htm> [2006, Sep. 05] Msc ITMOC 2005/06
70
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [48] The Bertelsmann Foundation Project, 1999, ‘Self-regulation of Internet Content’, Bertelsmann Foundation
[49] National Consumer Council, 2000, ‘Models of Self-Regulation: An Overview of Models in Business & the Professions’, Published by the National Consumer Council, Available at : <http://www.ncc.org.uk/regulation/models_self_regulation.pdf#search=%22M odels%20of%20self-regulation%3A%22> [2006, Sep. 05]
[50] Pierlot P., ‘Self-Regulation of Internet Content: A Canadian Perspective’, Available at: <http://www.isoc.org/inet2000/cdproceedings/8k/8k_2.htm> [2006, Sep. 05]
[51] Privacyrights.org, ‘Fact Sheet 18: Privacy in Cyberspace’, Privacy Rights Clearinghouse / UCAN, Available at: <http://www.privacyrights.org/fs/fs18cyb.htm#PART%20ONE> [2006, Sep. 07]
[52] Bergkamp L., 2002, ‘EU Data Protection Policy: The Privacy Fallacy: Adverse Effects of Europe’s Data Protection Policy in an Information-Driven Economy’, Computer Law & Security Report, vol. 18, issue 1, pp. 31-47
[53] Wikipedia.org, ‘P3P’, Available at: <http://en.wikipedia.org/wiki/P3P> [2006, Sep. 06]
[54] W3C, ‘Platform for Privacy Preferences (P3P) Project’, Available at: <http://www.w3.org/P3P/>, [2006, Sep. 06]
[55] Posner R.A., 1978, ‘An Economic Theory of Privacy’, Regulations, pp. 19-26
Msc ITMOC 2005/06
71
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [56] Curtis K., Privacy Commissioner 2005, ‘Address to the 27th International Conference of Data Protection and Privacy Commissioners’, Australian Government, Office of the Privacy Commissioner, Available at: <www.privacy.gov.au/news/speeches/spp09_05.doc> [2006, Sep. 05]
[57] Tellis W., 1997, ‘Introduction to Case Study: The Qualitative Report’, On-line serial, vol. 3, issue 2, Available at: <http://www.nova.edu/ssss/QR/QR32/tellis1.html> [2006, Sep. 05]
[58] Miles S., 2002, ‘Ad-Aware Maker LavaSoft Frustrates Internet Advertisers’, The Wall Street Journal Online, Available at: <http://users2.wsj.com/lmda/do/checkLogin?mg=wsjusers2&url=http%3A%2F%2Fonline.wsj.com%2Farticle%2F0> [2006, June 29]
[59] CDT’s Guide to Online Privacy, ‘Chapter Three: Existing Privacy Protections’, Available at: <http://www.cdt.org/privacy/guide/protect/> [2006, Sep. 05]
[60] The Center For Democracy & Technology, 2000, ‘A Briefing On Public Policy Issues Affecting Civil Liberties Online’, CDT POLICY POST, vol. 6, issue 10, Available at: <http://www.cdt.org/publications/pp_6.10.shtml#3> [2006, Sep. 05]
[61] Brandeis L. & Warren S. D., 1890, ‘The Right to Privacy’, The Harvard Law Review, vol. 4, issue 5, pp. 193–220
[62] Westin A., 1967, ‘Privacy and Freedom’, Atheneum, New York
Msc ITMOC 2005/06
72
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ [63] Boyle J., 1997, ‘Foucault in Cyberspace: Surveillance, Sovereignty, & Hardwired Censors’, 66 U. Cin. L. Rev, vol. 177
[64] Nielsen J, 1998, ‘Personalization is Over-Rated’, Available at: <http://www.useit.com/alertbox/981004.html> [2006, Sep. 06]
[65] Kang J., 1998, ‘Information Privacy in Cyberspace Transactions’, Stanford Law Review, vol. 50, issue 1193, p. 1261
[66] Burkert H., 1997, ‘Privacy Enhancing Technologies & Trust in the Information Society’, Available at: <http://www.gmd.de/People/Herbert.Burkert/Stresa.html> [2006, Sep. 06]
[67] Brin D., 1998, ‘The Transparent Society: Will Technology Force us to Choose Between Privacy & Freedom?’, Perseus Books, New York
[68] Clarke R., 1999, ‘Internet Privacy Concerns Confirm the Case for Intervention’, Communications of the ACM, vol. 42, issue 2, pp. 60-67
Msc ITMOC 2005/06
73
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ Discussion Forums Spyware forums • <http://www.castlecops.com/c35-Spyware.html> [2006, July 16] • <http://forums.spywareinfo.com/> [2006, July 16] • <http://forums.subratam.org/> [2006, July 25] • <http://www.spywarepoint.com/forums/> [2006, July 28] • <http://spyware-free.us/forums/> [2006, Aug. 19] • <http://www.asksomeone.net/forums/index.php?showforum=20> [2006, Aug. 22] Additional information about spyware can be found: • The Federal Trade Commission’s Information1 on Spyware, Available at <http://www.ftc.gov/spyware> [2006, Sep. 06] • OnGuardOnline.gov, Spyware2, Available at: <http://onguardonline.gov/spyware.html> [2006, Sep. 06] • Spyware quiz3: <http://onguardonline.gov/quiz/spyware_quiz.html> [2006, Sep. 05]
Use this site to learn how the FTC fights spyware through law enforcement and consumer education, and by encouraging industry to device technological solutions 2 Learn how to avoid spyware or remove it from your computer and learn practical tips that will help you be on guard against Internet fraud, secure your computer, and protect your personal information. 3 An online spyware quiz which tests users’ knowledge providing at the end the correct answers. 1
Msc ITMOC 2005/06
74
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________
Additional References • Gelbord B. & Roelofsen G., 2002, ‘New Surveillance Techniques Raise Privacy Concerns’, Communications of the ACM, vol. 45, issue 11, pp. 23 – 24. • Internet Education Foundation, 2003, ‘Privacy’, Available at: <http://privacy.getnetwise.org/> [2006, Sep. 05] • Thomson J., 1975, ‘The Right to Privacy’, Philosophy & Public Affairs, vol. 4, pp. 295-314 • Parent W., 1983, ‘Privacy, Morality & the Law’, Philosophy & Public Affairs, vol. 12, pp. 269-88 • Fried C., 1968, ‘Privacy’, Yale Law Journal, vol. 77, pp. 475–493 • Rachels J., 1975, ‘Why Privacy Is Important’, 4 Phil. & Pub. Aff. 323 • Bloustein E., 1964, ‘Privacy as an Aspect of Human Dignity: An Answer to Dean Prosser’, New York University Law Review, vol. 39, pp. 962-1007 • Foucault M., 1975, ‘Surveiller et Punir: Naissance de la Prison, Discipline and Punish: The Birth of the Prison’, pp. 197–229 • Porter M., 2001, ‘Strategy & the Internet, Harvard Business Review, vol. 79, issue 3, pp. 63-78. • Dennis C., Fenech T., Merrilees M., 2004, ‘E-Retailing’, Routledge • Turow J., 2003, ‘Americans & Online Privacy: The System is broken’, Annenburg Public Policy Center of the Univ. of Pennsylvania, (survey of popular privacy preferences), Available at: <http://www.asc.upenn.edu/usr/jturow/internet-privacy-report/36-pageturow-version-9.pdf> [2006, Sep. 06] • Franda M., 2001, ‘Governing the Internet: The Emergence of an International Regime’, Lynne Rienner
Msc ITMOC 2005/06
75
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ • Campbell J.E., Carlson M., 2002, ‘Panopticon.com: Online Surveillance & the Commodification of Privacy’, Journal of Broadcasting & Electronic Media, vol. 46 • Allen A.L., 1999, ‘Coercing Privacy’, William & Mary Law Review, vol. 40 • Jordan T., 1999, ‘Cyberpower: The Culture & Politics of Cyberspace & the Internet’, Routledge • Lyon D., 2002, ‘Surveillance as Social Sorting: Privacy, Risk,& Digital Discrimination’, Routledge, • Blotzer M.J., 2000, ‘Privacy in the Digital Age’, Occupational Hazards, vol. 62 • Fernback J. & Papacharissi Z., 2005, ‘Online Privacy & Consumer Protection: An Analysis of Portal Privacy Statements’, Journal of Broadcasting & Electronic Media, vol. 49 • Shapiro A., 1997, ‘Privacy for Sale: Peddling Data on the Internet’,The Nation, vol. 264 • Hoffman D.L., 1999, ‘Information Privacy in the Marketspace: Implications for the Commercial Uses of Anonymity on the Web’, Info Society vol. 15, issue 129 • Registratiekamer, 1995, ‘Two Privacy-Enhancing Technologies: The Path to Anonymity’, Available at: <http://www.ipc.on.ca/docs/anoni-v2.pdf> [2006, Sep. 06] • Shapiro B. & Baker R., 2001, ‘IT & Social Construction of Information Privacy’, Journal of Accounting & Public Policy, vol. 20, pp. 295-322. • Unknown, ‘Internet for Social Research Methods’, Available at: <http://www.vts.intute.ac.uk/tutorial/social-research-methods/> [2006, Sep. 06] • University of London Research Library Services, ‘Library Research Skills Tutorial’, Available at: <http://www.ulrls.lon.ac.uk/tutorial/> [2006, Sep. 06]
Msc ITMOC 2005/06
76
Privacy & Surveillance on the World Wide Web
_____________________________________________________________________ • Bartow A., ‘Learning Cyberlaw in Cyberspace’, University of Dayton School of Law, Available at: <http://www.cyberspacelaw.org/bartow/index.html> [2006, Sep. 06]
Msc ITMOC 2005/06
77