Risk
6/23/2011
03:15 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Privacy Surveys Breed Privacy Fear, Google Researchers Say

Survey bias is creating misunderstanding of our feelings on online privacy, Google says. One privacy advocate weighs in.

Top 15 Google Apps For Business
Slideshow: Top 15 Google Apps ForBusiness
(click image for larger view and for full slideshow)
At Google, many employees feel that the company has been unfairly characterized as disinterested or insincere in its efforts to protect user privacy. Google insiders, like insiders at any company, understand their own motivations and innovations better than outsiders, who often have their own agenda. They see missteps where others see malice.

There have been missteps, to be sure, from the company's short-lived stance in 2008 that it did not need to include a privacy policy link on its home page, despite California state law, to its mismanaged launch of Buzz and its inadvertent vacuuming of Wi-Fi packet data through Street View cars last year. But only the most hardened Google haters cite such incidents as the sort of evil that the company says it strives not to do.

The trouble for Google is that it has made many enemies in its meteoric rise--many have legitimate reasons to resent a competitor that plays harder than the public generally perceives. And now Google's surfeit of success has come back to haunt it, with the Federal Trade Commission reportedly on the verge of launching a formal antitrust investigation, with competitors backing a Do-Not-Track standard that would limit the data collection that drives Google's ad revenue, and with related privacy pressure, among other challenges.

Google has responded to privacy concerns by taking such steps as appointing a new privacy director for products last October and, more recently, rolling out a dashboard tool called Me on the Web to help users monitor what's said about them online. The company is also conducting research to help it reframe the privacy debate.

In a paper to be featured at the forthcoming Symposium on Usable Privacy and Security--held July 20-22, 2011 at Carnegie Mellon University--three Google researchers have found that privacy surveys tend to make people fear for their privacy. And they propose a way to conduct such surveys indirectly, so that questions related to privacy don't provoke an emotional response.

As an example, the study's authors found that the number of users willing to share most or all of their online purchase records with close friends or family declined 41% when survey questions included privacy and security language.

The paper, "Indirect Content Privacy Surveys: Measuring Privacy Without Asking About It," concludes that "privacy survey wording strongly impacts responses by increasing user reports of privacy concern both with respect to relatively innocuous content types (e.g. news articles) as well as content that contains personal information (e.g. purchase records)."

In short, asking people whether they're worried about privacy risks makes them worried about privacy risks.

Lauren Weinstein, co-founder of People For Internet Responsibility and founder of Privacy Forum, said in a phone interview that this isn't surprising. "Survey bias issues are fundamental and go back as far as surveys," he said.

While some may write off Google's research as self-serving--eliminating emotion from the privacy debate would likely diminish unease about Google's information gathering--Weinstein argues that such research is entirely legitimate, irrespective of what one might infer about the company's motives. He said what's important is to better understand what users really want. The absence of such understanding, he suggested, leads to ill-conceived initiatives like Do-Not-Track, which he considers to be too difficult to implement and too draconian.

"I think that we are only really starting to get a handle on the very basic aspects of [online privacy], beyond what has been primarily an emotional angle up to this point," he said.

Weinstein concedes that we may not be able to completely remove emotion from the privacy debate but insists there's still value in trying to find more scientific ways to gauge what people really want and to translate those desires into functional settings online.

A Google representative was not immediately available for comment.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.