YouTube, Viacom, And Why You Should Fear Google More Than The Government
Reading Wired this morning (and a bunch of other blogs), I learned that a judge ordered Google/YouTube to turn over ALL records of who watched what on YouTube. To Viacom of all organizations, as part of their lawsuit against Google for hosting copyrighted content. The data transfered over includes IP address and what was watched.
Gee, think that might leak at some point? Ever watch YouTube porn from an IP address that can be tied to you? No porn? How about singing cats? Yeah, I thought so you sick bastard.
But wait, what are the odds of tracing an IP address back to an individual? Really damn high if you use any other Google service that requires a login, since they basically never delete data. Even old emails can tie you back to an IP, never mind a plethora of other services. Ever comment on a blog?
The government has a plethora of mechanisms to track our activity, but even with recent degradations in their limits for online monitoring, we still have a heck of a lot of rights and laws protecting us. Even the recent warrantless wiretapping issue doesn't let a government agency monitor totally domestic conversations without court approval.
But Google? (And other services). There's no restriction on what they can track (short of reading emails, or listening in on VoIP calls). They keep more damn information on you than the government has the infrastructure to support. Searches, videos you've watched, emails, sites you visit, calendar entries, and more. Per their privacy policies some of this is deleted over time, but even if you put in a request to purge your data it doesn't extend to tape archives. It's all there, waiting to be mined. Feedburner, Google Analytics. You name it.
Essentially none of this information is protected by law. Google can change their privacy policies at any time, or sell the content to anyone else.
Think it's secure? Not really- I heard of multiple XSS 0days on Google services this week. I've seen some of their email responses to security researchers; needless to say, they really need a CSO.
I'm picking on Google here, but most online services collect all sorts of information, including Securosis. In some cases, it's hard not to collect it. For example, all comments on this blog come with an IP address. The problem isn't just that we collect all sorts of information, but that we have a capacity to correlate it that's never been seen before.
Our laws aren't even close to addressing these privacy issues.
On that note, I'm disabling Google Analytics for the site (I still have server logs, but at least I have more control over those). I'd drop Feedburner, but that's a much more invasive process right now that would screw up the site badly.
Glad I have fairly tame online habits, although I highly suspect my niece has watched more than a few singing cat videos on my laptop. It was her, I swear!
—Rich
