[IP] More on Does Google retain logs of personally identifiable search data?
Begin forwarded message:
From: Adam Fields <ip20398470293845@xxxxxxxxxx>
Date: January 27, 2006 1:29:01 PM EST
To: Jeff Ubois <jeff@xxxxxxxxx>
Cc: dave@xxxxxxxxxx, ip20398470293845@xxxxxxxxxx
Subject: Re: More on Does Google retain logs of personally
identifiable search data?
(Dave, the message I'm replying to was not marked for IP. With Jeff's
permision, feel free to copy this response back to the list.)
On Fri, Jan 27, 2006 at 10:08:23AM -0800, Jeff Ubois wrote:
At least until relatively recently, and maybe even now, the short
answer to Adam Fields' question was "yes."
Do you have some specific information by which you come to that
conclusion? I'm not interested in further speculation about what they
could be doing.
I highly doubt that Google is using the default configuration for
their webservers. They could very well be stripping that information
before they save it. I have some third hand unverified claims that
they do, but that seems to be not substantiated by the public facts.
Part of the problem here is that it's hard to define personally
identifiable information. PII can be derived by combining multiple
log files and other sources of data, none of which by itself contains
PII.
I would posit that if that's true, then the keys used to bind the
disparate pieces of information together also qualify as personally
identifiable. This would cover unique identifiers, IP addresses,
cookie values, etc...
Standard policies and new default settings in Apache and other web
servers to
1) delete the final octet of the IP addresses in log files
2) delete everything after the question mark in the URLs kept in
referrer logs
In many cases, this is not the solution, as it would completely
destroy any utility of the log files themselves.
would go a long way towards mitigating the potential damage from log
data. There are various trade offs (e.g. store all data for 30 days,
then delete it) that can help balance privacy and accountability.
Some kind of public dialog about this issue would be a good thing.
Thanks,
Jeff
From: Adam Fields <ip20398470293845@xxxxxxxxxx>
Date: January 26, 2006 5:26:42 PM EST
To: dave@xxxxxxxxxx
Subject: Does Google retain logs of personally identifiable search
data?
For IP, if you wish:
In conversations about Google, the question has come up - does Google
keep logs of searches correlated with IP address or other personally
identifiable information for users who have not logged in?
I don't think Google has made a public statement on this matter, and I
have been unable to find an answer. I wonder if any of the IP readers
know.
All of the analysis I've read has seemed to start from the assumption
that they >do< keep these logs, based on the fact that they
could<. Is there any definitive evidence that you know of that they
do, or is this just speculation?
I've written a blog post elaborating on this and some of the
implications:
http://www.aquick.org/blog/2006/01/26/does-google-keep-logs-of-
personal-data/
--
- Adam
** Expert Technical Project and Business Management
**** System Performance Analysis and Architecture
****** [ http://www.everylastounce.com ]
[ http://www.aquick.org/blog ] ............ Blog
[ http://www.adamfields.com/resume.html ].. Experience
[ http://www.flickr.com/photos/fields ] ... Photos
[ http://www.aquicki.com/wiki ].............Wiki
[ http://del.icio.us/fields ] ............. Links
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/