Matt Cutts of Google answers Privacy International

Chris: Wake me up when SSL is fast enough to be the default. Look up Ockham's razor sometime. It will make you sleep better at night, because you won't have to worry about your silly theories anymore.

"I further expect the EFF and EPIC to voice their concerns."

I'd be shocked personally. The EFF is usually unbiased and careful. I also don't see this as being a result of Google doing something right.

It's not surprising that an organisation such as Privacy International is up in arms about Google. I further expect the EFF and EPIC to voice their concerns. As Robert notes in #2, If you do anything interesting in life you create enemies. This is merely a sign that Google is doing something right.

Since your last post about this subject I’ve become more and more interested in following it around the web.

It'll be really interesting to see how this all plays out.

Thanks for stirring my attention.

(I still don’t think it’s going to blow up like Microsoft did, but I do agree that if Google keeps up in this direction it won’t be good for them)

@11,

If Google really wasn't in cohorts with the NSA and other agencies, as is MS, Yahoo, AOL and all the others, they would simply stop the plain text web.

No more plain HTTP, no more plain IM message streams like MSNP 789-10,11,...., oscar AIM/TOC protocols or unencrypted Jabber. No more unencrypted email.

It would be at the very least SSL, and at the most a newer better encryption that pushes even super computer deciphering.
This would be at the network stack level and would not effect application code doing TCP socket routines.

Our own social networking used to be all in SSL but due to it not being in a datacenter anymore, we lost the IP for it. So I can't do it as a virtual site.

BUT Google has all the resources in the world to make a secure web experience. They KNOW BETTER. And they choose not to. They could totally replace the whole root CA system if they wanted to with their pull as a matter of fact. And develop something better and free. The only reason they SSL'd gmail and parts of the adsense/words is because everybody else does it with CC data and email.

They *WANT* your information to remain vulnerable. They are complicit to it. All the major companies are. They create this semblance of competition and real issues get clouded by the article mentioned, to avoid the real facts.

These companies are all from the same place and they all swap employees like an inbred family tree. Think about it one second. There is industry cohesion here on why the web is not secure.

Chris (#8) - You address some legitimate concerns that I think should get answers. I think questioning the methodology of the report is the next logical step.

The motto of the group I work in is 'Trust but verify' so I am all for validating the resulting claims.

I wrote a post - Privacy International and Google - What's Really Going On?, where I raise the issue of all the he said / she said arguments being raised by the two companies and question how much of this story we really know.

Matt talks about hitwise and ISPs selling data with router TCP filtering, but if Google really cared about privacy to the extreme that Matt makes it out to be, BTW, don't ripp off our new site, https://www.google.com would work and not redirect you to the HTTP. Google doesn't want you to SSL your queries so people can't snoop on the LAN level. Thanks to no SSL, it means that any agency can tap your searches, knowingly, or not as we saw with the NSA's no warrant tapping.

Why isn't SSL mandated on Google's jabber server?

Why not build encryption into GMail, and depart from pure RFC plain text mime? They have the pull that OE and Thunderbird would be forced to follow.

Why? Because they don't care any more than MSN or Yahoo, and they do the minimum, while making data completely as insecure as the other services.

That's criticism more in tune with reality than the article Matt responded to.

Thanks for the links Robert,

I read both. and I think Donna needs to be more explicit and compelling in her argument. On the surface it seems very circumstantial and almost hearsay. Matt makes a more convincing argument.

No doubt Google has their interests at heart, but to say standing up to the DOJ was purely based on money is to say greed is what rules Google, that may be debatable. Its also so vague its like watching someone driving really fast down the road and saying, "they're doing that to show off." When in reality since you are not in the car to ask the person you have no idea. Maybe they are a doctor or cop or something. Yeah sure maybe they need to make obvious the reason, but that does not make it any less valid (meaning defending user's privacy).

She also state the group based this on now and not past mistakes. Umm, those companies would never have corrected the mistakes unless it made them look bad (potentially money lost). Really, did the tobacco companies change their marketing and product even though they knew better, not until they got caught.

Objective discussion is hard and is not something that happens overnight. People have to have firm belief in the ability to be objective. In this case I think Matt was closer.

But I could be wrong...

"faction debate" should read "factual debate"

Thomas,

The thing that isn't right about this reporting is that you can use any tool like http live headers for Firefox and or Ethereal and you can see what you are sending to the Google, MSN, Yahoo website.
Had this report done a rundown in the way FPS is tested for Video cards in Hardware reports, it would have made more sense.
This article is full of opinion and very light on facts.
If Google has information it is because you willingly sent it to them. Same with the other engines.

Had the article focused on reality with ethereal dumps and HTTP header output data in the form of real statistics that prove a point, it would have made sense.

How *could* Matt Cutts defend this based on somebody's opinion? Aside from answering with his own opinion which he did. That's not a very geeky way to compare things and have a faction debate.

The fact remains that NONE of us have their server side code, and none of us knows what is really going on with msn, google, yahoo, aol or any other search engine. For that not to be the case, the engine code would have to be open source like media wiki for wikipedia. And there you would have to know that the site is running it unmodified.

This is just more opinion and blogger spew for rating.
Matt Cutts, Google better not take our new site idea. I spent a long time thinking this one up and I have to spend tons for the bandwidth. If you steal it you better compensate us big time.

Robert - good information, and thanks for the links to opposing views.

I appreciate that Matt is stepping forward and offering his side of the story. It is a necessary move for someone to start talking about this, and that person will take some heat. Good luck!

I also appreciate Donna's point of view. Statements need to be challenged to create a dialogue to get more of the truth.

It is nice, that Google didn't publish user queries and data. And maybe the PI report is only PR, but I have another problem related to Google and privacy.

I'm afraid that Google stores data that nobody knows and uses it inside to "optimize" the search results or the ads.

And Google did nothing to prevent this feeling up to now.

Oh, and Matt. If Google clones our new concept site shortly after it goes live, I am cloning Google in retaliation. All of it. Just so you know.

Hi Matt, if you know who it is, just email me. I don't mind telling you but I certainly won't post it on Scoble's blog. He just got out of the NSA a couple years ago, so I doubt he was doing anything but repeating what he heard there.

Hi Chris! I've written before about my experience working as a co-op student for the NSA in college. See here for example:
http://www.mattcutts.com/blog/debunking-google-...
I doubt anyone in the government even remembers me working there as a college student 15 years ago, let alone cares about what I say about Google and privacy now. Maybe someone there cares, but it would surprise me.

OK then. I am not going to post his name.

Chris: everyone gets jealous of someone who gets more than they do. More PR. More money. Etc.

If you do anything interesting in life you create enemies.

Unless they are willing to tell us why and sign their names to it (IE, put it on a blog) I totally discount this kind of commentary. It's worthless and not even worth discussing.

Scoble. I know somebody who recently got out of the NSA who now works in software in Seattle. He said that Matt Cutts is not well liked there anymore.

Matt Cutts would know about this from his work at the NSA better than anybody at the AP how to protect people's privacy. From what I heard some at the NSA consider that he sold out to Google for money.

Whether or not that's true I have no idea, but that is what I heard from his alumni.