The Kings of Creepy

Microsoft and Google are neck-in-neck in the creepy contest. I know that's a strange thing to say, given recent revelations about Microsoft giving up its search data to the Department of Justice's antiporn brigade. But do you really think Google decided to fight the government's subpoena for its own search data because it has our privacy interests at heart?

There are some extremely cool lawyers and engineers at Google who actually do give a shit about your privacy, but I'm not sure Google execs were persuaded by these freedom fighters' moral arguments. I think the top brass at Google wanted to protect the company's search index trade secrets. I think it also wanted something non-evil to report about its corporate ethics before announcing it would be working with China to censor search results behind the Great Firewall.

I'm also not persuaded that the information Microsoft gave up to the government was privacy-invasive. I recently spent some time at Microsoft talking with its lawyers and search engine geeks about what data, exactly, was handed over to the DOJ. According to Ken Moss, Microsoft's general manager of development and testing for MSN Search, his company handed over a random list of one million pages from its search index. It also gave the DOJ a list of terms people searched for over a period of a couple of weeks. "This data was literally two columns, with search terms in one and number of times the term was searched in the other," Moss said. No personal data like IP addresses or cookies were included. I'm a fairly rabid privacy advocate, and it's hard for me to see how this data invaded user privacy -- unless you're talking about the privacy of searchers as a collective entity.

I'm not saying Google should have handed over its data the way Microsoft did. I'm glad it's fighting the subpoena, no matter how Machiavellian its reasons. But that's because of the reasons the DOJ has given for subpoenaing this data. It's gathering evidence to fight the American Civil Liberties Union's suit over the constitutionality of the Child Online Protection Act, a law that imposes harsh penalties (including jail time) on the operators of commercial websites containing sexual materials that could be accessed by minors. By gathering "snapshots of the web" from search engines, the DOJ hopes to prove that the web is bursting with porn, and therefore that kids are constantly in danger of stumbling upon it. Specifically, the government wants to demonstrate that filtering software doesn't actually prevent minors from seeing porn, and that laws are therefore needed to rectify the situation.

How the hell will random information about searches and indexed web pages prove the government's point? This data will tell it nothing about how well filters work. More important, the DOJ will have no idea which search terms and web pages are being accessed by minors. And that's what really worries me. When I was hanging out with the Microsofties, we discussed what they would do if the feds came back and asked for age information about the people who were searching.

Moss and some of his search cohorts said it might happen -- and given what the DOJ hopes to prove, I'd be shocked if it didn't. And make no mistake: Microsoft has this information, just as Google and Yahoo! do. So does Amazon, which owns the search engine A9. "If they subpoena us, we have to comply," Moss said. But that's not true, as Google has demonstrated. They can move to quash the subpoenas for any number of reasons.

So it's a little disingenuous for Microsoft or any other company to say it "has" to respond to subpoenas with data. It's also disingenuous for the media and privacy advocates who know better to claim that Microsoft has handed privacy-invasive data over to the government already. Instead, we should be worrying about what the feds will ask for next. More than that, we should be pushing search portals like Microsoft, Google and Yahoo! to stop keeping personally identifying data about our searches. They could discard personal information after a month, keeping only search terms and number of searches for statistical analysis of user behavior. If they purged personal data, they wouldn't have any information to hand over to pushy governments.