Risk
6/23/2011
03:15 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Privacy Surveys Breed Privacy Fear, Google Researchers Say

Survey bias is creating misunderstanding of our feelings on online privacy, Google says. One privacy advocate weighs in.

Top 15 Google Apps For Business
Slideshow: Top 15 Google Apps ForBusiness
(click image for larger view and for full slideshow)
At Google, many employees feel that the company has been unfairly characterized as disinterested or insincere in its efforts to protect user privacy. Google insiders, like insiders at any company, understand their own motivations and innovations better than outsiders, who often have their own agenda. They see missteps where others see malice.

There have been missteps, to be sure, from the company's short-lived stance in 2008 that it did not need to include a privacy policy link on its home page, despite California state law, to its mismanaged launch of Buzz and its inadvertent vacuuming of Wi-Fi packet data through Street View cars last year. But only the most hardened Google haters cite such incidents as the sort of evil that the company says it strives not to do.

The trouble for Google is that it has made many enemies in its meteoric rise--many have legitimate reasons to resent a competitor that plays harder than the public generally perceives. And now Google's surfeit of success has come back to haunt it, with the Federal Trade Commission reportedly on the verge of launching a formal antitrust investigation, with competitors backing a Do-Not-Track standard that would limit the data collection that drives Google's ad revenue, and with related privacy pressure, among other challenges.

Google has responded to privacy concerns by taking such steps as appointing a new privacy director for products last October and, more recently, rolling out a dashboard tool called Me on the Web to help users monitor what's said about them online. The company is also conducting research to help it reframe the privacy debate.

In a paper to be featured at the forthcoming Symposium on Usable Privacy and Security--held July 20-22, 2011 at Carnegie Mellon University--three Google researchers have found that privacy surveys tend to make people fear for their privacy. And they propose a way to conduct such surveys indirectly, so that questions related to privacy don't provoke an emotional response.

As an example, the study's authors found that the number of users willing to share most or all of their online purchase records with close friends or family declined 41% when survey questions included privacy and security language.

The paper, "Indirect Content Privacy Surveys: Measuring Privacy Without Asking About It," concludes that "privacy survey wording strongly impacts responses by increasing user reports of privacy concern both with respect to relatively innocuous content types (e.g. news articles) as well as content that contains personal information (e.g. purchase records)."

In short, asking people whether they're worried about privacy risks makes them worried about privacy risks.

Lauren Weinstein, co-founder of People For Internet Responsibility and founder of Privacy Forum, said in a phone interview that this isn't surprising. "Survey bias issues are fundamental and go back as far as surveys," he said.

While some may write off Google's research as self-serving--eliminating emotion from the privacy debate would likely diminish unease about Google's information gathering--Weinstein argues that such research is entirely legitimate, irrespective of what one might infer about the company's motives. He said what's important is to better understand what users really want. The absence of such understanding, he suggested, leads to ill-conceived initiatives like Do-Not-Track, which he considers to be too difficult to implement and too draconian.

"I think that we are only really starting to get a handle on the very basic aspects of [online privacy], beyond what has been primarily an emotional angle up to this point," he said.

Weinstein concedes that we may not be able to completely remove emotion from the privacy debate but insists there's still value in trying to find more scientific ways to gauge what people really want and to translate those desires into functional settings online.

A Google representative was not immediately available for comment.

In the new, all-digital Dark Reading supplement: What industry can teach government about IT innovation and efficiency. Also in this issue: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.