SCN: Privacy

[Steve]

x-no-archive: yes

==========================

(Jeri Clausing, NY Times)---Major Internet companies and the Web's 
standard-setting body on Wednesday unveiled some long-awaited 
technology that would alert computer users before they visited Web 
sites that collect more personal information than they are willing to 
share.  

Although the new standard, called the Platform for Privacy 
Preferences, or P3P, was billed as just one step in improving the 
state of privacy on the Internet, it was immediately denounced by 
some privacy advocates as a way for companies to avoid increased 
regulation and a tool that would give consumers a false sense of 
security.  

Still, if the technology proves to be widely accepted by Internet 
companies and Web sites, it would give consumers a way to more 
easily control whether and how companies track their Web 
movements and gather information about them.  

"The goal is to give users on the Web more control," said Daniel J. 
Weitzner, an official with the World Wide Web Consortium, or W3C, 
which develops open standards to promote universal Web access 
and interoperability between Web sites and different technologies.  

"We hope that it will make privacy policies easier to find, easier to 
understand," he said.  

The standard has been under development for about three years by 
the W3C, AT&T Labs , and major companies like IBM, Microsoft and 
America Online. The Center for Democracy and Technology, an 
online civil liberties group, has also been a key supporter of the 
project.  

Basically, P3P sets standards that will allow browsers to 
automatically read privacy policies that have been posted on 
participating Web sites. The browser will then only go to sites that 
agree to follow the preferences pre-selected by the computer user. It 
will alert them before going to any Web sites that collect more 
information than they are willing to give.  

For instance, computer users could choose to visit only Web sites 
that promise not to track their movements or to collect personal 
information. Or they could say they will go to Web sites that collect 
personal information, like their name and address, but only if that 
company promises not to share that information with anyone else.  

If a site has a banner ad capable of planting tracking technology, 
like cookies, to follow their movements on the Internet, computer 
users will be notified. They will also be alerted before their browsers 
display Web sites that do not have P3P-readable policies.  

For the technology to work, however, it will be have to be adopted by 
the millions of Web sites on the Internet. As of Wednesday, the 
White House and 13 other Web sites -- mostly the companies and 
groups involved in the project -- had created privacy policies that 
could be read by P3P enabled software.  

Deidre Mulligan, a lawyer with the Center for Democracy and 
Technology who has been involved in the project since it began, 
said the focus now is to work with industry groups to aggressively 
promote the new standard and get Web sites to start using it.  

Several companies have already developed software that translates 
written privacy polices to the code needed for P3P enabled browsers 
to read them.  

And the first software that will let computer users begin using P3P in 
their browsers will be launched next week at PC Expo by a company 
called YouPowered. That new software, called Orby Privacy Plus, 
has four settings users can choose: private, cautious, trusting and 
open.  

At Wednesday's introduction, another company, Idcide, previewed a 
similar software product that is in development. And Microsoft and 
the AOL-Netscape said they hope to have P3P plug-ins for their 
browsers later this year. The standard will also be part of the next 
version of Windows, due for release at the beginning of next year, 
Microsoft said.  

But not everyone is falling in line behind the project, which has been 
controversial since it was announced in the summer of 1997.  

Webwasher.com AG, a German privacy software company affiliated 
with Siemens AG, called P3P "too little, too late." P3P will actually 
damage privacy by aggregating personal information and releasing 
it to any Web site with a compliant privacy policy, said Dr. Horst 
Joepen, chief executive of the company that develops privacy 
protection software.  

"Since no one ever verifies that Web sites actually conform to their 
stated policies," he said, "P3P effectively transforms your browser 
into a lockbox full of sensitive personal information that can be 
opened with a publicly available key."  

A group of privacy advocates also blasted the standard as a 
"complex and confusing protocol that will make it more difficult for 
Internet users to protect their privacy."  

"We do not view P3P as technology that will promote privacy," said 
Marc Rotenberg, executive director of the Electronic Privacy 
Information Center, which put together a report on P3P along with a 
company called Junkbusters Corp., Computer Professionals for 
Social Responsibility and Chris Hunter, a doctoral candidate at the 
University of Pennsylvania's Annenberg School for 
Communications.  

Catlett said his biggest concern about the technology was that 
companies were promoting it as an alternative to new laws setting 
baseline privacy standards for Web sites to follow. TheFederal 
Trade Commission recently asked Congress for authority to 
implement such standards, saying few companies on the Internet 
have adopted acceptable standards for both notifying consumers 
about their practices or giving them a choice and control over how 
their personal information is used.  

But officials involved in developing P3P emphasized that the 
technology was designed to work globally -- both in countries with 
self-regulatory regimes and those with strict data privacy protection 
laws -- not as an alternative to regulation.  

P3P is designed to encourage more transparency on the part of 
companies collecting personal information, Mulligan said. Right 
now, many Web sites have no posted policies about how they 
gather and use information collected from visitors. Those that do 
often have policies that are lengthy and hard to understand.  

"This is only part of the solution," said Lorrie Faith Cranor, a 
researcher with AT&T Labs who chaired the P3P project. "It offers an 
easy way for Web sites to communicate about their Web policies in 
a machine-readable format."  

Faith Cranor said she hopes that additional work on P3P will allow it 
to negotiate different privacy policies without users noticing any 
slowdown in browsing speed.  

Unless the standard is widely adopted, however, anyone who uses 
the technology with a high privacy setting will likely have little 
success in finding Web sites that their browser will visit.  

Copyright 2000 The New York Times Company  

 



* * * * * * * * * * * * * *  From the Listowner  * * * * * * * * * * * *
.	To unsubscribe from this list, send a message to:
majordomo at scn.org		In the body of the message, type:
unsubscribe scn
==== Messages posted on this list are also available on the web at: ====
* * * * * * *     http://www.scn.org/volunteers/scn-l/     * * * * * * *