U.S. Web-Tracking Plan Stirs Privacy Fears

U.S. Web-Tracking Plan Stirs Privacy Fears

http://www.washingtonpost.com/wp-dyn...002743_pf.html

By Spencer S. Hsu and Cecilia Kang
Washington Post Staff Writers
Tuesday, August 11, 2009

The Obama administration is proposing to scale back a long-standing ban on tracking how people use government Internet sites with "cookies" and other technologies, raising alarms among privacy groups.

A two-week public comment period ended Monday on a proposal by the White House Office of Management and Budget to end a ban on federal Internet sites using such technologies and replace it with other privacy safeguards. The current prohibition, in place since 2000, can be waived if an agency head cites a "compelling need."

Supporters of a change say social networking and similar services, which often take advantage of the tracking technologies, have transformed how people communicate over the Internet, and Obama's aides say those services can make government more transparent and increase public involvement.

Some privacy groups say the proposal amounts to a "massive" and unexplained shift in government policy. In a statement Monday, American Civil Liberties Union spokesman Michael Macleod-Ball said the move could "allow the mass collection of personal information of every user of a federal government website."

Even groups that support updating the policy question whether the administration is seeking changes at the request of private companies, such as online search giant Google, as the industry's economic clout and influence in Washington have grown rapidly.

Two prominent technology policy advocacy groups, the Electronic Privacy Information Center and Electronic Frontier Foundation, cited the terms of a Feb. 19 contract with Google, in which a unnamed federal agency explicitly carved out an exemption from the ban so that the agency could use Google's YouTube video player.

Contract Terms
The terms of the contract, negotiated through the General Services Administration, "expressly waives those rules or guidelines as they may apply to Google." The contract was obtained by EPIC through a Freedom of Information Act request.

"Our primary concern is that the GSA has failed to protect the privacy rights of U.S. citizens," EPIC Executive Director Marc Rotenberg said. "The expectation is they should be complying with the government regulations, not that the government should change its regulations to accommodate these companies."

Cindy Cohn, legal director for Electronic Frontier Foundation, called the contract "troubling."

"It appears that these companies are forcing the government to lower the privacy protections that the government had promised the American people," Cohn said. "The government should be requiring companies to raise the level of privacy protection if they want government contracts."

The episode recalls a dispute in January when critics complained that a redesigned White House Web site featured embedded Google YouTube videos -- depicting events such as the president's weekly address -- that used tracking cookies. The White House and Google later reassured users that they had stopped collecting data.

But the current ban on cookies, according to senior OMB officials, applies only to federal agencies and not third parties. That means that a visitor to http://www.whitehouse.gov, for example, isn't tracked by the government, but information about a user who clicks on a YouTube video on the site could be tracked by Google, according to a source at the company with knowledge of the partnership with the Obama administration.

Google spokeswoman Christine Chen directed broader questions to the government, but said in a statement that the White House use of YouTube "is just one example of how government and citizens communicate more effectively online, and we are proud of having worked closely with the White House to provide privacy protections for users."

GSA and White House officials would not answer questions, releasing only a statement by OMB spokesman Kenneth Baer that said the administration is committed to protecting users' privacy. "That is why when we asked for public comment on a new cookie policy, we specifically identified privacy considerations as a main area of focus," Baer wrote.

In a May 28 letter responding to EPIC's public records request, Zachariah I. Miller, a GSA presidential management fellow, said "...GSA and the rest of the Government do take personal privacy seriously and apply all existing privacy statutes and regulations in this area."

Similar to Online Stores
Vivek Kundra, the government's chief information officer, and OMB official Michael Fitzpatrick, wrote in a July 24 blog posting that the policy review is intended to improve customer service by allowing agencies to analyze how people use their sites and to remember individual visitors' "data, settings or preferences." Such use is similar to online stores' creation of personalized "shopping cart" services that have won wide public acceptance.

The pair proposed that if the change is made, visitors be clearly notified that tracking technologies are being used and allow them to opt out without penalty. For technologies that track users over more than a single Internet session, known as "persistent identifiers," there would be higher levels of privacy safeguards, they said.

EFF and another group, the Center for Democracy and Technology, have said that the time has come to expand privacy safeguards to new tracking technologies. At the same time, they say that the cookie ban might be too broad, keeping the government from improving its services for the public.