Legal Drama For Google & Its Users

Larry Magid On Privacy Battle Between Gov't & Search Engine Giant

(CBS)  As a feature, Google allows users to establish an account and sign into the service. If you have such an account and if you’re signed in, then Google definitely tracks your searches and displays your search history for you to see. That can be convenient if you want to retrace your search history, but it requires that Google store this information and associate it with your account.

If you ever sign in, Google stores your sign-in information in a "cookie" on your PC so the next time you go to Google you may still be signed in. Even if you sign in to Gmail to check your mail or Google Groups to participate in a discussion, you may remain logged in when you do a subsequent search until you click the "sign out" option.

But even if you’re not signed in, according to security expert Steve Gibson, Google may still be able to associate you with a particular search.

There are two reasons. First, Google plants cookies on your hard drive that can identify you, according to Gibson, "as an anonymous user with a sort of serial number identity, but they wouldn't know who you were in the physical world." In theory, however, it's possible to correlate data from different cookies on your machine to determine who you are, but Google says that's not something it does.

Second, Google, like all Web sites, is able to determine the IP (Internet Protocol) address of any computer that accesses its site. I can vouch for that. I have my own Web site and I can determine the IP addresses of my visitors.

In many cases, it is possible to associate an IP address with a user, but it is not necessarily easy. Most people who use the Web, access it through an Internet Service Provider which could be a dial-up service like AOL or EarthLink, or a broadband provider like a phone company or cable company. Regardless, each person is assigned an IP address by that company.

That IP address may change (AOL gives you a new one each time you sign on while DSL and cable companies may change yours on a periodic basis), but your ISP can certainly associate you with your IP address.

So, in most cases, for a Web site operator to know the actual identity of the person who visits their site, they would have to have the cooperation of that person’s ISP. ISPs, of course, want to protect the privacy of their customers so no reputable ISP is going to turn over that information unless it is legally obligated to do so.

Still, if compelled by a court, ISPs and Web sites can and will cooperate to identify someone. Gibson tells of a time when his Web site was being plagued by a denial of service attack. He knew the IP addresses of the suspected attackers and was able to track them down on his own as belonging to customers of Cox Cable in Southern California.