New Concerns Over Online Privacy

MS. DIANE REHM

10:06:56
Thanks for joining us. I'm Diane Rehm. Last week, a student at Stanford University found bypassing security settings on Apple's Web browsing software. A Web developer discovered an app on his mobile phone collecting and storing information from his address book without his permission. And the FTC reported privacy problems with mobile apps for children.

MS. DIANE REHM

10:07:28
Joining me in the studio to examine privacy and transparency in our evolving computer age: Marc Rotenberg of the Electronic Privacy Information Center, Cecilia Kang of The Washington Post and Morgan Reed of the Association for Competitive Technology. I know many of you will want to join in this morning. Call us on 800-433-8850. Send us email to drshow@wamu.org. Feel free to join us on Facebook or Twitter. And good morning to all of you.

MS. CECILIA KANG

10:08:14
Good morning.

MR. MORGAN REED

10:08:14
Good morning, Diane.

REHM

10:08:15
Good to have you here. First, we have on the phone with us Jonathan Mayer. He's a graduate student in computer science and law at Stanford University. Good morning, Jonathan.

MR. JONATHAN MAYER

10:08:32
Good morning.

REHM

10:08:33
Tell us what you discovered Google and other ad companies were doing to bypass Apple's privacy settings.

MAYER

10:08:45
So there's an exception in Apple's privacy setting for forms the user submits. The idea is if the user fills out a form on a Web page or interacts with something on a Web page, for example, a Facebook application, then that application can submit -- can set cookies in response, so...

REHM

10:09:07
Tell me here. Define cookie very quickly.

MAYER

10:09:12
So a cookie is a little bit of text that can be saved in a Web browser. It's not dissimilar to slapping a bar code on your Web browser so you can track it.

REHM

10:09:22
OK. And then tell me how you made this discovery.

MAYER

10:09:31
So we ran some advertisements of our own, and, in those advertisements, we included some measurement code that allowed us to see which advertising companies had set these cookies in users' browsers. And we noticed Safari users had relatively few cookies from most advertising companies. But there were a few companies were they have a lot of cookies, and that clued us in.

REHM

10:09:58
So why do you think it's so important for consumers to be aware of this?

MAYER

10:10:09
Well, I think this, unfortunately, gives credence to the view that when it comes to online privacy, there's something of a cat-and-mouse game or arms race where consumers might do something to protect themselves, and then some companies will work around that protection. And then consumers are going to have to do something more. And I don't think we can reasonably expect ordinary consumers to understand how to participate in that arms race.

REHM

10:10:36
Marc Rotenberg, turning to you, how do you -- how concerned do you think consumers ought to be about what's going on here?

MR. MARC ROTENBERG

10:10:47
Well, Diane, I think they should be very concerned, and I think Jonathan makes the point well. A lot of the new techniques that are being developed by advertisers and the other big Internet firms have left consumers in a position where they really don't have the ability to protect their privacy online. And those efforts that they do make when they select privacy settings, for example, are oftentimes defeated. That's the reason that, to us, we increasingly think that this is an area that Washington will need to step in.

MR. MARC ROTENBERG

10:11:17
We need to update our privacy laws. We need the Federal Trade Commission to pursue enforcement, and we need to give support to consumers who are trying to protect their privacy online.

REHM

10:11:27
So, Cecilia, tell us about the difference between the kind of tracking that Jonathan is talking about and hacking.

KANG

10:11:41
Well, hacking is a little bit different in that -- well, actually, there's sort of a blurry line between privacy and some of these more criminal acts, which is getting into people's data without their -- your authority, and that's an illegal process. And that's what's sort of so alarming for a lot of people, what happened with this Google episode and tracking information through Safari when consumers had said expressly that they do not want to be tracked and that Safari, by default, does not track users.

KANG

10:12:11
So there is sort of this blurring of line in this episode, but there are -- and these are sort of the bigger problems and the bigger concerns and anxieties that consumers face when they're online because they see sort of a bleeding of what they -- the control they have over the data at large, how much information consumer -- that the companies have and what they do with that information, and then how outsiders maybe might be trying to get in.

KANG

10:12:38
From the consumer's point of view, all they see of all this is sort of out -- this feeling of being out of control, be it companies having the information and doing what they want or maybe even hackers doing what they want with information.

REHM

10:12:49
Jonathan, tell me what you have done now to protect yourself.

MAYER

10:12:57
So I use a number of features to protect myself. The first line of defense I rely on is an ad blocker. My lab did some research looking at the effectiveness of various consumer self-help tools, and, regrettably, it appears that blocking advertisements is, for the moment, the most effective things consumers can do. That's, of course, really bad for websites.

REHM

10:13:23
Now, to you, Morgan Reed, how effective are these so-called ad blockers?

REED

10:13:31
Well, as Jonathan points out, ad blockers are incredibly effective. But, unfortunately, it's kind of like spraying your entire house when all you want to do is get some ants that are in the corner. The Internet thrives on advertising, and it's able to provide a lot of free services and a lot of really cool applications for either low or no cost because of advertising. So the real problem that we're all facing in this is that we have a battle between transparency, which is me telling you, hey, this is what I want to do.

REED

10:13:59
And the problem of what's happened in this Google instance, where I've told you what I want to do, which is I don't want to see that or I don't want you to have that information -- and they've done it anyway. So I think it's really important that we don't try to, you know, fumigate the entire house to deal with some ants in the corner. And Jonathan's right. We need to develop better tools.

REHM

10:14:16
Is that a good analogy, Marc Rotenberg?

ROTENBERG

10:14:19
Well, it's certainly a provocative analogy. I do think that for most Internet users who take the time to limit advertising or to use, in the example of Safari, an Internet browser that was supposed to protect them from this type of third-party access, to subsequently learn that an Internet firm -- the largest Internet firm worked around that so they could place their own ads, must be enormously frustrating. I don't know what the user does in that situation.

REHM

10:14:48
Cecilia, do individual brands have a say in how data is collected and used?

KANG

10:14:58
Do you mean the websites themselves?

REHM

10:14:59
Yes.

KANG

10:15:00
They do. And, in fact, they're all supposed to, or they're charged with the responsibility of explaining to any users who are on their sites what they're doing with their data. And the problem is, is if you go and -- you know, I'd love to take a survey of people who actually read the disclosures, the privacy policies. They're very long. They're very confusing. You...

REHM

10:15:20
And very tiny print.

KANG

10:15:22
Very tiny print.

REHM

10:15:23
Yeah.

KANG

10:15:23
You need reading glasses for sure. And it's -- you almost need to be an attorney to understand some of the policies. And so one thing that the government wants to do, the Federal Trade Commission and others in the government want to do is make that easier and to mandate that of companies. But, really, it's upon the user to look closely. If you really care about what that company is doing with your data, to read as closely as you can, the problem is is there such a gap between the ability to understand the information that's out there and what consumers want.

REHM

10:15:56
Jonathan, I would have thought you would've read the data very carefully. But, nevertheless, your system was clearly invaded.

MAYER

10:16:12
That's right. So there are, I think, two issues I'd like to respond to here. The first one is, in this case, Google was somewhat transparent. It said, if you have this feature turned on, that's essentially the same as opting out of our ad tracking. We learned that wasn't true. But, at a higher level, I guess, I would resist this notion that transparency is the end-all solution to this problem. There's a great study on privacy policies by a team at Carnegie Mellon.

MAYER

10:16:40
And they looked at how, if the average user would've read all the privacy policies that affected them, it would take days and days out of every year. We can't reasonably expect that. And so, I think, beyond transparency at a policy level, we need to think about how we provide good consumer choice.

REED

10:17:00
Well, I'd...

REHM

10:17:00
Go ahead, Morgan.

REED

10:17:02
You know, it's -- he's talking about Lorrie Cranor and Aleecia McDonald's research on this. And they found two interesting things, one, that people don't read privacy policies, and if they did, it would take them forever. But, two, simplified policies are hard to make effective. And so, I think, it's important since, you know, my community is the mobile apps developers. We're actually trying to figure out better ways to do it. We've been around for 24 months.

REED

10:17:27
I mean, the entire ecosystem that we live in is roughly closing in on five years old. We're still working on ways to provide that transparency. So while Jonathan talks about, well, we need to -- we can't solve the problem with transparency, I think we can get pretty close. And I think it's what we should try to achieve first before we just shut down the whole operation.

REHM

10:17:46
Well, Jonathan, you talked about consumer choice. Say what you mean.

MAYER

10:17:54
Sure. So there's a specific mechanism I have in mind here. It's called Do Not Track. It's a proposal we've worked on at some links at Stanford. It's now been taken up by the World Wide Web Consortium -- that's a Web standards body. And the idea is a consumer shouldn't need to be getting a PhD in computer science to understand how to say no. They should have a simple choice built into their Web browser or smartphone that says, if I don't visit a website, I don't want them to track me.

MAYER

10:18:24
One simple checkbox and they're done, and there's already a number of users using this feature in existing Web browsers. It's not a hypothetical. Nearing 5 to 10 percent of Firefox users have already enabled this feature.

REHM

10:18:40
All right. Jonathan Mayer, graduate student at Stanford. Short break, we'll be right back.

REHM

10:20:04
And joining us now is Congressman Edward Markey of Massachusetts. He's co-chair of the Bipartisan Congressional Privacy Caucus. Good morning to you, sir.

REP. EDWARD MARKEY

10:20:18
Good morning. Thank you.

REHM

10:20:19
I know you've asked the FTC to investigate whether Google has violated its recent settlement. Tell me why and what's happened.

MARKEY

10:20:31
Well, my concern is that this is a continuing pattern of behavior by Google, and it's just an ongoing unfair and deceptive practice that is part of their business model. And so I've asked the Federal Trade Commission to investigate, to determine whether or not they are in violation of their recent settlement with the Federal Trade Commission, that they would not engage in that type of activity, and then to determine what the penalty should be.

MARKEY

10:21:08
Under the law, they are subject to very serious penalties. And my hope is that the FTC can act very quickly because we need to establish deterrence not only to Google but to every company from engaging in this kind of activity.

REHM

10:21:27
Marc Rotenberg, what's happened to Google and its privacy activities?

ROTENBERG

10:21:32
Well, the point that Congressman Markey makes, which is a very important one, is that Google is currently subject to a consent order from the Federal Trade Commission because of stuff they did last year with the launch of Google Buzz. And so the letter that Congressman Markey sent, along with Congressman Barton -- I should point out privacy in Washington is generally a bipartisan issue. It generally brings people together.

ROTENBERG

10:21:55
And I think it's important to note here, though, is both Congressman Mark and Congressman Barton who sent that letter, and specifically the Federal Trade Commission will need to act before March 1 because March 1 is the day that Google has proposed to make dramatic changes in its privacy practices.

REHM

10:22:11
I see.

ROTENBERG

10:22:12
It will combine all of the data of its users, which many people have objected to. So I hope that, with Congressman Markey's letter, there will be some effort to look at that more closely.

REHM

10:22:21
Cecilia.

KANG

10:22:22
Congressman Markey makes an interesting point about this being a pattern of behavior by Google. And you see this with not just Google, but with other companies, like Facebook, and concerns by users that, you know, I don't want to hear another apology from a CEO saying, whoops, I sort of violated your privacy. And you see that pattern with Facebook, for example, when they were sharing information on what was known as their Timeline, with the Beacon advertising mechanism that shared what users were buying online.

KANG

10:22:53
And over and over again, Mark Zuckerberg, and also Google, has -- and its executives have apologized and said to users, look, we're wrong. We're ahead of ourselves on technology. From the consumer's perspective, again, people right now are wondering, you know, I've become so accustomed and so dependent on some of these applications like Google Mail that were free -- and mind you, of course, I think everybody should pay -- be very mindful that a lot of these things are free. But is there potentially a cost to this, and is that cost privacy?

REHM

10:23:23
Congressman Markey, what steps is Congress taking to give consumers more control over their personal information?

MARKEY

10:23:34
Well, Marc is right when he said that, beginning in March, Google's new privacy policy will read, you have no privacy. They intend on sharing all of your information across all of their platforms. So what I have done with Congressman Joe Barton from Texas, a very conservative Republican from Texas -- I'm a very liberal Democrat from Massachusetts. So we've introduced the bill just focusing on kids 15 and under because all of this is happening to kids 15 and under who now have devices that they have convinced their parents to purchase for them.

MARKEY

10:24:16
And so they're in this very vulnerable situation as well. And so I don't think parents want the fact that a kid goes to YouTube to turn into You Track. And so, basically, what the legislation is, that I have, is it gives the parents and the kids a right to say, I don't -- that they don't want to be tracked and that the parents have a right to say, I want all of the information gathered about my child erased because you don't want a 12-, 13-, 14-, 15-year-old in a situation where they're haunting, then, the 19- to 20-year-old that they grow into, by which websites they went to, what they did online.

MARKEY

10:24:59
And what Google and Facebook and all of these companies all say to me is, oh, you don't know how complicated that would be. That would just be very technologically difficult to do. But, unfortunately, for kids 15 and under, much less adults because adults are in -- should have much higher levels of privacy protection as well. But if they're not willing to do it for kids 15 and under, who they're attracting to and marketing to in terms of purchasing of these devices, then it's really going to be a very dangerous, brave new world that everyone in America is living in. So...

REHM

10:25:35
And back to Jonathan Mayer, the graduate student at Stanford University, who simply says he's going to somehow include Do Not Track on his own computers. How successful, Jonathan, do you think that can be?

MAYER

10:26:00
Well, so Do Not Track is inherently both a technology and a policy proposal. So it's a technology proposal insofar as it provides a mechanism of signaling the consumer's preference. But then it becomes a policy problem in figuring out what that preference means and how we make sure companies enforce it. When we worked on Do Not Track here over a year ago, starting to flesh out the proposal, we realized that purely technological solutions could not work. And so this isn't just a Silicon Valley problem. It's also a Washington problem.

REHM

10:26:34
Hmm. Congressman Markey, how do you respond?

MARKEY

10:26:39
Well, I think Jonathan is right. It's not just saying, well, the technology is there. You've heard earlier about how very much more complicated it is than ordinary citizens have the time to dedicate to dealing with all of the various privacy policies, so there has to be, basically, a constitution, and especially for kids 15 and under. And that would be a right to the knowledge in information that's being gathered about them, notice that the information is going to be used for purposes other than that which the families intended for that information to be used by their kids, and, thirdly, the right to say no.

MARKEY

10:27:21
So knowledge, notice and then the right to say no. And we have to find a way of codifying it, and that's what Congressman Barton and I have done, actually working with Marc and many of the other experts that are in Washington, D.C. and across the country. Jonathan has been a great source of information for me and Congressman Barton as well. So we just have to make sure that it's not just Big Brother out there, the government, but Big Mother and Big Father who can protect the families from having all of this information gathered about young people.

MARKEY

10:27:58
And then having company after company around the world be able to market back into these kids, to be able to track them, is just not right. It should be unacceptable in a modern society.

REHM

10:28:09
Morgan Reed, knowledge, notice and no.

REED

10:28:13
Well, I think there are a couple of things here. First of all, we already have some of the enforcement mechanisms available through the Children's Online Privacy Protection Act. And this year, the FTC, which oversees COPPA, issued a new notice which adds a whole bunch of features, including, for my community, in mobile applications. And so a lot of the features that he wants to see in there are actually something that we already have some tools to deal with.

REHM

10:28:39
But why aren't they working?

REED

10:28:41
Well, in fact, a lot of them are, except for the fact that -- and this came out recently in an FTC study -- our community, my community, the mobile apps developers' community are failing to really do a good job on transparency. But I think I want to take it back to the real issue that we've got to get with with the FTC, and that is enforcement. You know, Marc Rotenberg just talked about the Google Buzz settlement.

REED

10:28:59
Well, that's not the only time that we've had this problem with Google. Remember, we had a conversation on Kojo and on other shows talking about the issue of Wi-Spy, where Google drove around the country, spying on people's houses, essentially. And then a few months later, they said, oops. Well, actually, worse than that. First they said, we didn't do it. Then they said, it was rogue engineers.

REED

10:29:20
And I think -- Marc, you can correct me if I'm wrong -- the final answer was, oops, we didn't mean to. So I think we have to separate out what we need to have, which is the ability to do advertising that supports these applications, from companies that keep saying, oops, and do it in a way that seems to be completely without worry about FTC enforcement.

REHM

10:29:38
Marc Rotenberg, I've got an email here from Pamela, who says, "What kind of a company is Google becoming? What about the credo of not being evil?"

ROTENBERG

10:29:53
Well, I mean, in fairness, Google is a very innovative, very successful company that provides an enormous number of Internet services that are...

REHM

10:30:00
Innovative and successful are one thing, but...

ROTENBERG

10:30:03
They're -- well, certainly, but I think the problem that has arisen, particularly in Washington, is the view that that, therefore, gives them a pass when they create problems. And our view is you can be an innovative and successful company and also respect the privacy rights of your users. And I think, in the last couple of years in particular, as Morgan has pointed out, it appears they have adopted a view, as long as we're successful, we don't have to worry about that issue. And that's a mistake. That just can't be right.

REHM

10:30:33
Cecilia.

KANG

10:30:35
Well, Google is an interesting company in that it is so large. And a lot of people have come to depend on their services for years, like Google Mail, for example. They have 350 million users. But, again, once you keep in mind that these are free services -- and they've actually been pretty upfront that they do behavioral advertising. They collect information about you, so they know you like certain things.

KANG

10:31:00
You might, like -- you surf for a Justin Bieber video on YouTube, and so I should maybe hawk a Doritos ad to you. That's -- those are the sorts of things that they're pretty upfront about what they do.

KANG

10:31:11
That said, the question is, if the company is giving you enough choice to say, you know, no, thank you. You're going to change everything on March 1. But I, actually, as a Google Mail user, for example, have decided that I don't want for my information on mail to be combined with YouTube and Blogger and Picasa and all their other 60 services, so that you have a portrait of me because maybe my kid was watching Justin Bieber, and I don't want you to think I like Justin Bieber. Or maybe I have professional emails in my Gmail account that I don't want anybody to have access to.

REHM

10:31:47
Congressman Markey, is there a gateway here that allows these companies to have access? Is there, in your view, a way to block this?

MARKEY

10:32:04
Yeah. First of all, let me just say that I am the author of the Child Online Privacy Protection Act of 1998, so I'm very familiar with that law that is already on the books. But, as the author of it, I also know that I put that law on the books in the BF era, in the before-Facebook era. So we might as well be talking about the Peloponnesian War as talking about 1998 and the Internet.

MARKEY

10:32:34
It's just grown so exponentially and insinuated itself into the lives of people all across the country, and children are the ones that -- and kids, teenagers, to them, being online is like having oxygen. I mean, they're waking around all day long just using these devices. And I do believe that an erase button should be made available for parents so that they can ensure that all this information being gathered about their children, about their kids 15 and under, cannot be turned into a product, cannot be turned into a profit-making center for these online companies.

MARKEY

10:33:20
The parents should have a right to say, no, you cannot be tracking my child. You cannot be marketing back to my 13-, my 14-year-old just because they happen to be using your device. And I believe that every parent, every child is entitled to this right. And so far, they spoke, and Google are saying, no, they will no do it. And I just think that it is wrong. It is technologically possible to create that right.

MARKEY

10:33:49
I believe that many people are under the misimpression that when they push the delete button that that information is gone because they can't see it anymore, but these companies continue to house...

REHM

10:34:00
All right.

MARKEY

10:34:01
...all of this information. For them, it's a very valuable product that creates a personal profile of the child, of the teenager that is then going to be used for the purposes of selling that information to other online companies.

REHM

10:34:16
All right.

MARKEY

10:34:16
There has to be a privacy bill of rights for kids 15 and under in this country.

REHM

10:34:22
Congressman Ed Markey of Massachusetts. And you're listening to "The Diane Rehm Show." Congressman Markey, we have an email from Kevin in Kensington, Md., who says, "Why aren't the privacy policies of our country requiring an individual to opt-out when companies want to collect information about them as opposed to the European model of opt-in, which requires the companies get your permission to collect information about you? Will Congress ever consider passing opt-in laws?"

MARKEY

10:35:15
Europe has a different history than we have because of World War II, because of the incredible impact which the Nazis had upon every country in Europe. And identity became a central part of who the Nazis oppressed and did not oppress, that within the living memory of every family in Europe is the real sense that their identity should be protected, which is why the Europeans in general have this sense that opt-in is the correct approach.

MARKEY

10:35:47
In the United States where we are, to a very large extent, the innovators in these new technologies, and a culture began to develop coming out of Silicon Valley that said, hey, privacy, you don't have any, get over it, there was a very successful political effort to block opt-in, which, ultimately, when people uphold, would be identical in terms of the interest level that American families have that European families have. But, politically, there was not the same intensity level.

MARKEY

10:36:22
But, I think, as more and more of these revelations made public about what Google, Facebook and, by the way, dozens and dozens of other companies are doing, that I think that there is going to be a public outrage. And I do believe it's going to start with the kids 15 and under.

REHM

10:36:40
Interesting. Morgan.

REED

10:36:42
Well, I think there are two things worth noting. I'd like your audience to think back in their memories and think about all the innovative free services coming from European-based companies. Oh, I haven't thought of any. In fact, it's really the United States that's really been leading in that space, in part, because of the ability to ramp up quickly, to get advertising in front of people and to make a go of it using advertising as your revenue.

REED

10:37:05
So all these free services -- and they aren't free. They're advertising-supported just like broadcast television has been -- those have been incredibly successful. I think, though, what Congressman Markey might be getting on to something where it is accurate is, do you start to achieve a certain size in which you aren't responsive to your customers anymore? So that, I think, is going to be the bigger question.

REHM

10:37:26
Morgan Reed, he is with the Association for Competitive Technology. Congressman Markey, thank you so much for joining us this morning.

MARKEY

10:37:39
You're welcome. Thank you.

REHM

10:37:40
And we'll take a short break here. When we come back, your calls, comments, questions. Stay with us.

REHM

10:40:04
And we're back. It's time to open the phones, 800-433-8850. First to Grand Rapids, Mich. Good morning, Anthony. You're on the air.

ANTHONY

10:40:20
Good morning, Diane. First of all, I've been a long-time listener, and it's a pleasure to speak with you.

REHM

10:40:24
Thank you so much. Good to have you.

ANTHONY

10:40:28
Google has become the wolf in sheep's clothing. You know, I was a big supporter of Google for many, many years. And then they came out with the Wi-Fi. Now, we hear that they are tracking Safari in violation of Safari's policies. But I want to talk about the new privacy policy that Google has rolled out. It's an adhesion policy. It's either take it or leave it.

REED

10:40:51
Diane...

ANTHONY

10:40:52
Those of us who have come to depend on Google services and have been using them for years, now, we are left with one choice: either adhere to the new privacy policy, which is going to allow them to track your Gmail -- they haven't said anything about if they're going to be tracking your Google Voice if you're using that. There's been nothing said, and I've read this policy about how they're going to track data coming off your Android phones.

ANTHONY

10:41:16
There are several million Android phones out there. They are always signed in to Google. They're going to be tracking people on Google Plus. The first thing I did after reading the policy was to go out there and delete my Google Plus account. But I'm very concerned about what's going to happen with the data that's coming across my Android phone. There's nothing out there that tells me are they tracking it, are they tracking everything that comes on, because you're always trying to...

REHM

10:41:38
OK. Marc Rotenberg.

ROTENBERG

10:41:41
Well, your caller is making a critical point. Google is going to make the problems that we're talking about today much worse after March 1 because, after that date, Google will be combining all of this data. And the interesting point that your caller also makes, it's not only the risk. It's also the fact that they have retained this information about you, which they now get to put together, and that users won't actually be able to assess what the consequences of future acts will be on their privacy.

ROTENBERG

10:42:10
An Android phone user won't know if what they've done on YouTube or search or Picasa or something else is going to have ramifications for the way their telephone operates. And that just can't be right.

REHM

10:42:21
Cecilia.

KANG

10:42:22
So the Android phone issue is interesting in that Android -- for the listeners who don't know that much about Android -- is based on Google's operating system called Android. And at the point of sale, when you buy an Android phone, typically the salesperson will ask you to sign on to a Google account to activate your phone, be that Gmail or something else. So, automatically, you're signed into what will be on March 1 a whole new system of sort of stitching together all your data across all of its services.

KANG

10:42:53
So that means that when your Android phone is on, you're being -- your data is being collected across these services. That said, in Google's defense, they would say, listen, you can still search -- use your search engine. You can still use YouTube, all these things, without signing on. You could be an anonymous user. But when it comes to Android phones, it's very difficult or impossible to do that for a lot of users.

REHM

10:43:15
How is that different from purchasing an iPhone?

KANG

10:43:21
Sure. So in iPhone, you don't have the Google Apps, the Google services that are so prominently displayed. And you don't have to sign on, frankly -- effectively, and you can't -- to use it, you can only download applications on an Android phone by using the Google Android marketplace. And you have to be an account holder. And that is the key to be an account holder, and to be signed on to any of these Google services to do it. And -- so it's difficult.

KANG

10:43:49
It's particularly difficult to make your phone really functional and interesting and really worthwhile, a smartphone, an Android phone, without being signed on to some of these services.

REHM

10:43:58
Jonathan Mayer, what's your reaction?

MAYER

10:44:02
So, I think, this issue of blurring the lines between different service offerings by Google is very closely related to what we discovered. I think, to the extent there's legitimacy to blurring the lines, I think it's incumbent upon Google to be very clear about how they're going to use a user's information, not just give a blanket statement of we're going to combine it all and use it as we see fit.

MAYER

10:44:26
The issue we discovered was in the context of a system that Google had not been very public about, whereby it was using Google account information, the account you have when you use Google's Gmail, for example, to personalize ads. So they've been blurring the line between what you do on Google's website and what shows up in Google advertising on other websites. And they hadn't really told users that.

REHM

10:44:50
Morgan.

REED

10:44:51
Well, I think we keep going around this issue. I mean, Google's whole mission is to collect the world's information and index it and then sell ads based on that information. They are an advertising company at their core that uses technology to collection information to provide you an ad you want to see.

REHM

10:45:06
And that's how they make their money?

REED

10:45:09
That's right. So -- and, you know, we need to remember that we're shocked that they're serving alcohol in this establishment. This is an advertising company with a goal of selling advertising. I think the problem that we're really getting to is the ubiquity of the Google services. And with Google now having government contracts, where Gmail is part of a government service -- the .gov email account is provided by Google -- we have to start asking real questions about what information are they collecting and how are they using it when it's a government agency.

REHM

10:45:39
Jonathan Mayer, what's your reaction?

MAYER

10:45:43
So, I think, that's quite right, that we need to start asking more difficult questions of Google in understanding what exactly it is that they're collecting and how they're using it. I think it also might make sense, given that Google is now a practical necessity for some phones, for some Web users, that it might start making sense to stop expecting Google on its own accord to put together the privacy choice that the consumers want, the kind of control over information-sharing among the services or with Google when you're not on a Google website, and start to look back to policy solutions there.

MAYER

10:46:24
Because, as a matter of business, it's quite right. Google's an advertising company, and their business has been to collect as much data as they can and then delivers that data to target ads.

REHM

10:46:34
All right, to Cambridge, Mass. Good morning, Steve.

STEVE

10:46:40
Good morning, Diane. I took particular issue with -- excuse me -- Congressman Markey when he said Google had insinuated itself, or these tech companies have insinuated themselves, into consumer's lives. It's quite the opposite. Consumers have demanded these products, have spent money on these products, and politicians like Congressman Markey have been very, very active in getting these products in the school. That's my first point.

STEVE

10:47:13
My second point is consumers feel that they're entitled to this tremendous of amount of free information of which provides them with power and convenience. And then, all of a sudden, when it comes to information on them, all of a sudden they feel like, oh, well, that's private property. No one can have the information on me. That's my private property. But they spend their lives on these devices.

STEVE

10:47:42
And they buy them for their children and go out and thinking the world is their oyster and they have the right to download movies and free music and information on every subject in the world. So those are my points.

REHM

10:47:56
Cecilia.

KANG

10:47:57
This is a really important point. Listen, consumers, you do have choice. That is for sure. And the question, though, is, are you being given enough information to make the right choices or the choices -- the most informed choices? That's sort of the concern today, those sort of lengthy, difficult disclosure policies, for example. But also, with the Google service and the changes in March, they're actually saying, if you want to remain a Google Mail user, for example, a Gmail user, you don't have the choice to opt-out of this particular policy.

KANG

10:48:28
So that is not a choice. But I think the caller does make an important point in that it is upon the consumer to educate -- if they're really concerned, there -- it's upon them to educate themselves as much as they can.

REHM

10:48:40
And here is an email from a medical professional, Carol, who says, "Is Google capturing data from our Android devices? Can that be considered a breach of contract?" She says, "What rights do we have? My goal," she says, "is to drop the Android phone, go back to a basic cell. My provider is Verizon. As a medical professional, I cannot absorb the legal consequences of Google capturing data for its use." Marc Rotenberg.

ROTENBERG

10:49:27
This is the critical point.

REHM

10:49:29
Yeah.

ROTENBERG

10:49:29
Consumer choice only works when businesses honor the terms of the bargain, when they respect the privacy settings of the user. And if a company enters into an agreement with the consumer and subsequently says, oh, now, we're going to change the rules, now, we want to use your data in new ways, that's completely on the company. And that's why you do need enforcement action. So without the enforcement of these terms, these policies become meaningless.

REHM

10:49:57
Morgan.

REED

10:49:58
Yeah, I think it's really important that we look at this action and Google's size because -- here's the problem: I need to be able to have small businesses to be able to compete and do new things. I need to actually be able to do advertising, possibly collect information, do deals, but, when Google goes ahead and breaks the law again and again and again, we know what's going to happen.

REED

10:50:21
Congressman Markey and Congressman Barton are going to put in legislation that will affect the entire industry and take us all down with the bad behavior by Google. So what we've got to have is the FTC or the administration has to step up and say to Google, no, you can't do this.

REHM

10:50:36
Cecilia, tell me about this social networking app called Path.

KANG

10:50:44
Oh, so Path is a social networking app that's sort of like an online diary, a journal. So you use this to just sort of log your thoughts of the day. It's -- and you have friends who can look into it and share information as well. And what happened with Path, a couple of weeks ago, is it was discovered that users of Path, their information from their iPhones, their contact lists, actually, the addresses and phone numbers of those in their iPhone contact list were scooped up by the Path application.

KANG

10:51:16
And that -- and not only just Path. I think Twitter was involved in this as well. And the concern was that, for Path users -- and there's about 1 million of them -- that they never expected that the information on their contact lists from their phone, the device itself, would be somehow assimilated into their Path experience, if you will. So that was another concern of -- sort of another betrayal of, you know, expectations.

REHM

10:51:43
Marc Rotenberg.

ROTENBERG

10:51:44
Well, what Cecilia is describing is the access to the address book that people have on their iPhones. And this is a very good example of sensitive personal information. So that when a third-party developer says, boy, it'd be really cool if I had this customer's address book 'cause I could add some other functionality and not actually say to the person, oh, by the way, I'm downloading your entire address book and all the notes that you might have associated with people...

REHM

10:52:07
Whoa.

ROTENBERG

10:52:07
...it's an enormous privacy issue.

REHM

10:52:09
All right. To Birmingham, Ala. Good morning, Brady.

BRADY

10:52:14
How are you doing this morning?

REHM

10:52:15
Good. Thanks.

BRADY

10:52:17
I, actually, am also in the medical field, so I was listening to what the emailer had written. And I also happen to be elite enough in the tech world to understand what's going on. I know that my information about myself is being taken up. When I purchased my Android phone, I looked to see what apps were on there. They -- eventually, a forced update was sent out. Eight company applications were put on my phone, and I was not allowed to delete them, still not able to.

BRADY

10:52:50
And they have access to my contact list and other current people's data, patients, other, you know, doctors and stuff, and that -- I sent a letter, and they said, too bad. If you don't want to use it, keep your phone off. And so I actually wrote a letter to the FTC, not anybody else 'cause it was a cellphone thing. And basically the company, Verizon, who I'm with, sent me a letter saying, well, too bad. We don't care. We're not going to fix it. If you don't want to use it, keep your phone off or buy a new one.

REHM

10:53:18
All right. And you're listening to "The Diane Rehm Show." Morgan.

REED

10:53:24
Well, two things. I want to step back to the Path issue really quickly. Here's the problem. My community, the geeks out there, we have a bad habit of asking not, should we do something, but can we do something first? And in the case of Path, they were out saying, we want to make this awesome, cool social networking app that ties you together with your friends in a new way. And they thought, like geeks, well, of course, you know that that means looking at your contacts to figure out who your friends are.

REED

10:53:48
So they made a really bad assumption. Now, the good news is is that this is the kind of thing where the FTC can come down hard on them if they weren't being straightforward with people about it. And I think that's something that we as industry have to solve. On the medical apps question and what's installed in your phone, I think the caller is right. And there's a huge high-tech medical conference coming up later this week in Vegas, and these are going to be some of the issues that the FDA and the FTC are going to be addressing, which is how do we do it.

REHM

10:54:15
Marc.

ROTENBERG

10:54:17
Well, it's very interesting that you're getting calls from people in the medical community who understand the importance of confidentiality. I mean, a lot of people may not even think about it. But if you do, you're in all sorts of relations, professional and personal, where privacy matters. And they think about what happens if, you know, services other than their telephone service has access to their personal data, their contacts, their comments. And they're rightly concerned.

REHM

10:54:39
All right. And to Traverse City, Mich. with another perspective. Good morning, Matt. Matt, are you there? I guess he's not. Let's go to Paul in Orlando, Fla.

PAUL

10:54:59
Hi, Diane.

REHM

10:55:00
Hi there.

PAUL

10:55:00
Thanks for having me on today.

REHM

10:55:02
Sure.

PAUL

10:55:03
I think this is a very important conversation, obviously, to have. I wanted to go back to something that -- I believe it was the graduate student who said, which is that these are companies, and their end goal is to make money, that they shouldn't be allowed to police themselves. You know, this is what the legislators and the laws are for. To think that these are just benevolent nerds out there, you know, just looking to make products that are sort of cool is just not the way it is. These are people trying to make money, and they shouldn't have free rein over our data with no legislature.

REHM

10:55:46
All right. So what do you see happening, Marc, in the months to come?

ROTENBERG

10:55:50
Well, I mean, I think -- look, these companies are innovative, successful, and I think that should be encouraged. But there has to be regulatory oversight 'cause that's the problem. And the truth is, if there isn't regulatory oversight, a lot of the success will come to an end. The FTC needs to act. That's what needs to happen right now. The Federal Trade Commission has to say to Google, no, you do not get to make those changes on March 1. Too many people have too many concerns about where the company is today.

REHM

10:56:19
Do you see that happening, Cecilia?

KANG

10:56:21
Well, one thing that I think that people do need to keep in mind is that their behavior is going to dictate what happens to them online. In other words, if you're giving a lot of information about yourself, then you should expect that you're going to have a lot of your data collected, and it's going to be used in some way. And Facebook, for example, in its initial public offering filing, had some very interesting information about what users were doing on Facebook. They're...

REHM

10:56:44
But if I fill out a mortgage application...

KANG

10:56:47
Sure.

REHM

10:56:48
...in writing, I don't expect that bank...

KANG

10:56:52
Yes.

REHM

10:56:52
...to use my information all over the place.

KANG

10:56:56
That's right. And I think that one should think of different tiers of privacy. There is, of course, mortgage, political information, medical information...

REHM

10:57:03
Exactly.

KANG

10:57:03
...financial information, for sure, that may be should be the most entrusted.

REHM

10:57:07
Cecilia Kang of The Washington Post, Marc Rotenberg of the Electronic Privacy Information Center, Morgan Reed of the Association for Competitive Technology, and thanks to Jonathan Mayer, a graduate student in computer science and law at Stanford University, and Congressman Ed Markey of Massachusetts. Thanks for listening. I'm Diane Rehm.
Transcripts of WAMU programs are available for personal use. Transcripts are provided "As Is" without warranties of any kind, either express or implied. WAMU does not warrant that the transcript is error-free. For all WAMU programs, the broadcast audio should be considered the authoritative version. Transcripts are owned by WAMU 88.5 FM American University Radio and are protected by laws in both the United States and international law. You may not sell or modify transcripts or reproduce, display, distribute, or otherwise use the transcript, in whole or in part, in any way for any public or commercial purpose without the express written permission of WAMU. All requests for uses beyond personal and noncommercial use should be referred to (202) 885-1200.

Our address has changed!

The Diane Rehm Show is produced by member-supported WAMU 88.5 in Washington DC.