|
[ No. 28 ]
The Cookie Monster
by Jeannie Thorp
Stranger Danger has taken on a whole new meaning for web users.
'Never take a cookie from a stranger' is the message from Web lobby
groups who are concerned about the use of Internet software to collect
information on users and invade their privacy. Unfortunately, given
that the way the 'Cookie Monster' works, you may not even know that
you have been offered one. Most likely it's simply been slipped
into your 'pocket'. For the benefit of web virgins, a cookie is
a tracer which can contain any information that a website wants
to give you and can be used to automatically compile a dossier of
your interests while you read their site. A cookie can also be placed
on your system so that your email address is captured during future
visits. If you've ever wondered how you ended up receiving spam
or direct selling from a website you once visited, the 'Cookie Monster'
may be the answer.
Many commercial sites, however, promote the advantages of cookies
to their customers and defend their use. In a recent case, game
developer Blizzard Entertainment was sued by a customer for allegedly
capturing information from a hard drive. The company defended the
practice saying it was necessary to check if their software was
being pirated. Interestingly, cookies are sometimes used to block
visitors. The Costco Wholesale website (formerly the Price Club),
for example, won't even let you view their home page unless you
are 'cookie-friendly'.
The reality is that, without special software, each time you visit
a website, you will be leaving behind some information. Much of
it will be benign, such as your country of origin, your IP address,
what type of browser and computer you are using, the name of your
computer, date, and time you logged on. That kind of information
can be valuable to a website interested in tailoring their content
to the interests of their regular readers. It is also useful to
market researchers and advertisers in gauging the effectiveness
of their promotions.
Potentially, however, information can be gathered and made available
to people who have a very specific interest in you and your activities
-- for example a private investigator, and even the police if the
site is a 'dummy' set up to collect data on criminal activities
such as child pornography. The value of seemingly innocuous information
was brought home recently in the USA when a major national supermarket
chain admitted that it had provided 'club card' purchase information,
under subpoena, to investigators in a drug enforcement case. The
investigators wanted to know if a suspect had bought large numbers
of plastic garbage bags. (Garbage bag use is apparently an indicator
of being involved in the illicit drug trade.)
Java and Javascript
is also cited by lobbyists as being able to access sensitive information
inside your web viewing program, including your email address and
the history of the pages you've read. Java code also exists which
can load into your browser under cover of some other application,
and then report back to the originating site on any information
you submit through web forms. Although junkbusters, cookie jar sealers,
and other blocking programs are now freely available on the Internet,
some versions of Windows and Internet Explorer remain vulnerable.
A major privacy issue is encryption security and the problems it
presents not just for credit card transactions but for the transfer
of massive quantities of confidential or commercially sensitive
information over the Internet. The University of Victoria in Canada
has recently participated in thirty empirical case studies of the
international transfer of personal data from Europe to six jurisdictions
(Canada, USA, Japan, Australia, New Zealand, Hong Kong). The cases
represented five different transfer categories: 'sensitive information
in airline reservations systems; human resources data; electronic
commerce; medical data; and subcontracted outsourcing'. A detailed
report
on their experiment is available for downloading on the Web.
The Catch 22 with encryption regulation, however, is that while
governments want to make data transfer secure, they don't want to
make it so secure that identifying and tracking Internet criminals
and terrorists becomes virtually impossible.
It isn't only websites that gather information about us. Chief Petty
Officer Timothy McVeigh learned that the hard way when he inadvertently
used one of his AOL screen names while organising a toy drive for
navy children. One of his colleagues looked up his AOL profile and
found he had listed his marital status as gay. The official investigation
that followed resulted in a military trial and a major career dive.
If you've ever posted a message to a newsgroup, there's a strong
chance that it's still there in cyberspace. That could be a costly
error if you've bad-mouthed your boss, made a confession about your
private life, or just behaved inappropriately. Management headhunters
and employment agencies are now webwise and regularly search the
Internet looking for any references to applicants.
Email is not safe either, which is not surprising, given that every
piece of email travels through between five and fifty gateways.
There are plenty of opportunities for strangers to read the details
of your business negotiations or most intimate of correspondence.
Never assume that the Internet affords anonymity -- you will be
traced if it is worth someone's while to track you down. If you
must email sensitive or inflammatory information, consider using
a bland title or don't give it one at all. Never post anything on
a website, or fill out Internet forms, without considering how that
information could be used to your disadvantage now or in ten year's
time. If you post to newsgroups, make sure you choose one like Dejanews
which provides you with an option to delete the message at a future
date. Being Stranger Danger wise will not only help preserve your
privacy, it could save you a lot of personal discomfort at some
later date.
|