Risk
6/23/2011
03:15 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Privacy Surveys Breed Privacy Fear, Google Researchers Say

Survey bias is creating misunderstanding of our feelings on online privacy, Google says. One privacy advocate weighs in.

Top 15 Google Apps For Business
Slideshow: Top 15 Google Apps ForBusiness
(click image for larger view and for full slideshow)
At Google, many employees feel that the company has been unfairly characterized as disinterested or insincere in its efforts to protect user privacy. Google insiders, like insiders at any company, understand their own motivations and innovations better than outsiders, who often have their own agenda. They see missteps where others see malice.

There have been missteps, to be sure, from the company's short-lived stance in 2008 that it did not need to include a privacy policy link on its home page, despite California state law, to its mismanaged launch of Buzz and its inadvertent vacuuming of Wi-Fi packet data through Street View cars last year. But only the most hardened Google haters cite such incidents as the sort of evil that the company says it strives not to do.

The trouble for Google is that it has made many enemies in its meteoric rise--many have legitimate reasons to resent a competitor that plays harder than the public generally perceives. And now Google's surfeit of success has come back to haunt it, with the Federal Trade Commission reportedly on the verge of launching a formal antitrust investigation, with competitors backing a Do-Not-Track standard that would limit the data collection that drives Google's ad revenue, and with related privacy pressure, among other challenges.

Google has responded to privacy concerns by taking such steps as appointing a new privacy director for products last October and, more recently, rolling out a dashboard tool called Me on the Web to help users monitor what's said about them online. The company is also conducting research to help it reframe the privacy debate.

In a paper to be featured at the forthcoming Symposium on Usable Privacy and Security--held July 20-22, 2011 at Carnegie Mellon University--three Google researchers have found that privacy surveys tend to make people fear for their privacy. And they propose a way to conduct such surveys indirectly, so that questions related to privacy don't provoke an emotional response.

As an example, the study's authors found that the number of users willing to share most or all of their online purchase records with close friends or family declined 41% when survey questions included privacy and security language.

The paper, "Indirect Content Privacy Surveys: Measuring Privacy Without Asking About It," concludes that "privacy survey wording strongly impacts responses by increasing user reports of privacy concern both with respect to relatively innocuous content types (e.g. news articles) as well as content that contains personal information (e.g. purchase records)."

In short, asking people whether they're worried about privacy risks makes them worried about privacy risks.

Lauren Weinstein, co-founder of People For Internet Responsibility and founder of Privacy Forum, said in a phone interview that this isn't surprising. "Survey bias issues are fundamental and go back as far as surveys," he said.

While some may write off Google's research as self-serving--eliminating emotion from the privacy debate would likely diminish unease about Google's information gathering--Weinstein argues that such research is entirely legitimate, irrespective of what one might infer about the company's motives. He said what's important is to better understand what users really want. The absence of such understanding, he suggested, leads to ill-conceived initiatives like Do-Not-Track, which he considers to be too difficult to implement and too draconian.

"I think that we are only really starting to get a handle on the very basic aspects of [online privacy], beyond what has been primarily an emotional angle up to this point," he said.

Weinstein concedes that we may not be able to completely remove emotion from the privacy debate but insists there's still value in trying to find more scientific ways to gauge what people really want and to translate those desires into functional settings online.

A Google representative was not immediately available for comment.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?