[ No. 28 ]

The Cookie Monster

by Jeannie Thorp

Stranger Danger has taken on a whole new meaning for web users. 'Never take a cookie from a stranger' is the message from Web lobby groups who are concerned about the use of Internet software to collect information on users and invade their privacy. Unfortunately, given that the way the 'Cookie Monster' works, you may not even know that you have been offered one. Most likely it's simply been slipped into your 'pocket'. For the benefit of web virgins, a cookie is a tracer which can contain any information that a website wants to give you and can be used to automatically compile a dossier of your interests while you read their site. A cookie can also be placed on your system so that your email address is captured during future visits. If you've ever wondered how you ended up receiving spam or direct selling from a website you once visited, the 'Cookie Monster' may be the answer.

Many commercial sites, however, promote the advantages of cookies to their customers and defend their use. In a recent case, game developer Blizzard Entertainment was sued by a customer for allegedly capturing information from a hard drive. The company defended the practice saying it was necessary to check if their software was being pirated. Interestingly, cookies are sometimes used to block visitors. The Costco Wholesale website (formerly the Price Club), for example, won't even let you view their home page unless you are 'cookie-friendly'.

The reality is that, without special software, each time you visit a website, you will be leaving behind some information. Much of it will be benign, such as your country of origin, your IP address, what type of browser and computer you are using, the name of your computer, date, and time you logged on. That kind of information can be valuable to a website interested in tailoring their content to the interests of their regular readers. It is also useful to market researchers and advertisers in gauging the effectiveness of their promotions.

Potentially, however, information can be gathered and made available to people who have a very specific interest in you and your activities -- for example a private investigator, and even the police if the site is a 'dummy' set up to collect data on criminal activities such as child pornography. The value of seemingly innocuous information was brought home recently in the USA when a major national supermarket chain admitted that it had provided 'club card' purchase information, under subpoena, to investigators in a drug enforcement case. The investigators wanted to know if a suspect had bought large numbers of plastic garbage bags. (Garbage bag use is apparently an indicator of being involved in the illicit drug trade.)

Java and Javascript is also cited by lobbyists as being able to access sensitive information inside your web viewing program, including your email address and the history of the pages you've read. Java code also exists which can load into your browser under cover of some other application, and then report back to the originating site on any information you submit through web forms. Although junkbusters, cookie jar sealers, and other blocking programs are now freely available on the Internet, some versions of Windows and Internet Explorer remain vulnerable.

A major privacy issue is encryption security and the problems it presents not just for credit card transactions but for the transfer of massive quantities of confidential or commercially sensitive information over the Internet. The University of Victoria in Canada has recently participated in thirty empirical case studies of the international transfer of personal data from Europe to six jurisdictions (Canada, USA, Japan, Australia, New Zealand, Hong Kong). The cases represented five different transfer categories: 'sensitive information in airline reservations systems; human resources data; electronic commerce; medical data; and subcontracted outsourcing'. A detailed report on their experiment is available for downloading on the Web.

The Catch 22 with encryption regulation, however, is that while governments want to make data transfer secure, they don't want to make it so secure that identifying and tracking Internet criminals and terrorists becomes virtually impossible.

It isn't only websites that gather information about us. Chief Petty Officer Timothy McVeigh learned that the hard way when he inadvertently used one of his AOL screen names while organising a toy drive for navy children. One of his colleagues looked up his AOL profile and found he had listed his marital status as gay. The official investigation that followed resulted in a military trial and a major career dive. If you've ever posted a message to a newsgroup, there's a strong chance that it's still there in cyberspace. That could be a costly error if you've bad-mouthed your boss, made a confession about your private life, or just behaved inappropriately. Management headhunters and employment agencies are now webwise and regularly search the Internet looking for any references to applicants.

Email is not safe either, which is not surprising, given that every piece of email travels through between five and fifty gateways. There are plenty of opportunities for strangers to read the details of your business negotiations or most intimate of correspondence.

Never assume that the Internet affords anonymity -- you will be traced if it is worth someone's while to track you down. If you must email sensitive or inflammatory information, consider using a bland title or don't give it one at all. Never post anything on a website, or fill out Internet forms, without considering how that information could be used to your disadvantage now or in ten year's time. If you post to newsgroups, make sure you choose one like Dejanews which provides you with an option to delete the message at a future date. Being Stranger Danger wise will not only help preserve your privacy, it could save you a lot of personal discomfort at some later date.


[ s a v v y . p a s t ]