"Reality: Google doesn't know who you are as an individual. Its use of cookies, hardly unique, doesn't give it a magical ability to see your face and know your name through your monitor."

Sure, OK, but let's go down that rabbit hole:

Server logs have emerged as one of the favorite features of technology for lawyers and prosecutors. I've been subpoenaed and forced to make a deposition because of information that a screwy law firm found on one of my former employers' servers. It was a colossal waste of time: I lost a whole day, much of it spent waiting for the lawyer who had subpoenaed me. But it could have been worse.

In the wake of 9/11, this country has chosen to remove many of the normal safeguards of our democracy. It is entirely possible for an innocent person to be arrested and held without reason or due process, if someone in a position of authority decides there's cause.

Increasingly, email and other information about a person's activities on the Internet are being used by investigators and others - everyone from the FBI to the RIAA - to pursue people they suspect of everything from terrorism to (gasp) downloading MP3 files.

The FBI has its own snitch boxes sitting at major ISPs, but, in theory, they can only make use of the data gathered in this way when they have a court order. The FBI can subpoena Google's search records any time (and so could lawyers for just about anyone else). As Danny mentions, it's trivial to associate a given cookie with its source IP address.

And once they have the IP address from Google, a quick visit, subpoena in hand, to the ISP should result in who was using that IP address at the date and time that the search was performed - regardless of whether the IP is fixed or dynamically assigned. Danny says this info is hard to come by, but that's just not true. When a hacker commandeered one of my Linux machines a couple years ago, the FBI was on the phone with me in very short order, even though the connection was, apparently, bounced through a number of ISPs.

So, assume that the search string "how to make terrorist bomb" came from an IP address that you were using at the appointed date and time: does that constitute cause for somebody to come and cart you away? Will the FBI really believe that someone other than yourself was sitting in your den or office cube searching on suspicious terms?

Maybe, maybe not. In a normally functioning democracy, if you were picked up, you'd quickly have your day in court, and likely the judge would laugh this sort of thing out of his courtroom, without some serious corroborating evidence. But in today's scarier climate, you might spend a very long time sitting in some federal facility, without access to friends, family or defense lawyers.

If you don't think so, ask Mike Hawash's wife: he is the Intel engineer, a U.S. citizen and a Muslim of Arab descent, who was arrested March 20th, at gunpoint, and is still being held incommunicado. It's not very clear what information the Feds have, or where they got it, but I'll bet a dollar that investigators were monitoring Mr. Hawash's email and Web surfing habits.

If you think that this activity is marginal or rare, think again. I believe it's true that there are already on the order of 10 million requests for telephone and Internet records in the U.S. annually by law enforcement agencies, lawyers for corporations etc.

The point is that by keeping logs that point back to individual computers, Google is building a gigantic Pandora's box. People's lives are quite literally at risk: mistakes happen (remember the security guard at the Atlanta Olympics?). I note that Danny's column happens to be sponsored by Google...
Comments 10:49:30 AM    

Chris Gulker's view from Silicon Valley - in words and pictures