DOCSLIB.ORG

Is Your Company Googling It's Security and Privacy Away? Raj

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Is Your Company Googling It's Security and Privacy Away? Raj Is Your Company Googling It’s Security and Privacy Away? Raj Goel investigates. It’s no secret that Google retains search data and metadata regarding searches—in fact, they’re quite open about it. What’s unsure though is the long-term threat to information security and privacy. Most consumers regard privacy as a basic right. They do not expect their private transactional details—whether it’s what they purchased or complained about, or how they paid for the purchase—to be part of the public record. As long as companies have retained consumer data, there have been privacy breaches. Stone tablets, paper ledgers, data warehouses—it doesn’t matter how you store it, eventually, some of it will leak out. Here are some examples of the ways that data has been leaked: • Criminal acts: theft of data; insiders selling data • Carelessness: putting unshredded paper records in the trash bin; shipping unencrypted backup tapes • Lack of privacy awareness: prior to legislation such as the Healthcare Insurance Portability and Accountability Act, it was legally acceptable to place records in the trash; using personally identifiable numbers such as Social Security numbers as primary keys even though the various amendments to the Social Security Act reserved the use of SSNs to the US Treasury • Going out of business: once a company ceases operations, all privacy policies are null and void. What’s Google Role? So far, Google hasn’t lost information, other institutions have. However, Google plays an ever-increasing role in our consumer and business lives. It has built a substantial business and reputation, which could pose a serious threat to consumer privacy worldwide. Let’s review the Google’s elements: Google Search: This search engine is gathering many types of information about our online activities. Its future products will include data gathering and targeting as a primary business goal. All of Google’s properties—including Google Search, Gmail, Orkut and Google Desktop —have deeply linked cookies that will expire in 2038. Each of these cookies has a globally unique identifier (GUID), and can store search queries every time you search the web. Note, Google does not delete any information from these cookies. Hence, if a list of search terms is given, Google can produce a list of people who searched for that term, which is identified either by IP address and/or Google cookie value. Conversely, if an IP address or Google cookie value is given, Google can also produce a list of the terms searched by the user of that IP address or cookie value. Orkut: Google’s social networking site contains confidential information such as name; e-mail address; phone number; age; postal address; relationship status; number of children; religion; hobbies. As per Orkut’s terms of service, submitting, posting or displaying any information on or through the orkut.com service automatically grants Orkut a worldwide, nonexclusive, sub-licensable, transferable, royalty-free, perpetual, irrevocable right to copy, distribute, create derivative works of, and publicly perform and display such data. GMail: The primary risk in using GMail lies in the fact that most of its users give their consent to make GMail more than an e-mail delivery service and enable features such as searching, storage and shopping. This correlation of search and mail can lead to the potential risks such as: • GMail may not get the legal protection the Electronic Communications Privacy Act (ECPA; see box) gives on e-mail. • The storage of e-mail on third-party servers for more than 180 days can lead to the loss of those privileges. This in turn creates a danger that we may redefine whether an e-mail has the reasonable expectation of privacy. ECPA ECPA, an act enacted in 1986, includes provisions for access, use, disclosure, interception and privacy protection of all electronic communications. It declared e-mail as a private means of communication that has the same level of privacy as phone calls and letters. The employees of email companies cannot disclose emails to others and even the police in the US would need a wiretap warrant to read emails. Though email in transit is protected, those in law enforcement believe that once the mail is processed and stored, it is no longer a private letter, but simply a database service. The biggest selling point of GMail is that they don’t simply deliver your mail, but also store and index it so that you can search for it. In US v. Warshak the Dept of Justice (DOJ) argued that Gmail/Hotmail/any ISP-hosted emails are not subject to ECPA at all, and therefore should not require subpeonas for disclosure. So far, the courts have ruled against the government – however, this shows that the DOJ is actively seeking access to emails and online activities without notifying US citizens and is looking to circumvent ECPA and Stored Communication Act (SCA). GMail Mobile: More and more phones comes with gmail applications built-in, or you can download Gmail for your phone. The question becomes: How uniquely does your cellphone identify you? When was the last time you changed it? GMail Patents: Gmail's Patent #20040059712 emphasizes on ªServing advertisements using information associated with email.º This allows Google to create profiles based on various information derived from e-mails related to senders; recipients; address books; subject line texts; path name of attachments; etc. Google Desktop: Google Desktop allows users to search their desktops using a Google-like interface. All word files, spreadsheets, e-mails and images on a computer are instantly searchable. Index information is stored on the local computer. Google Desktop 3 allows users to search across multiple computers. GD3 stores index and copies of files on Google's servers for nearly a month. In the United States, using Gmail and Google Desktop on computers that contain health records, financial records, educational records or credit applications could when is it considered a violation? be a violation the Family Educational Rights and Privacy Act, HIPAA, Gramm-Leach Bliley, PCI-DSS and state privacy laws if protected information is accidentally or maliciously leaked. Given the XSS attacks that Gmail has suffered; the attacks that OpenSocial demonstrated (google for “First OpenSocial app hacked in 45 minutes”); and the privilege- ignorance flaw that let users of GDS3 see other users' files and the XSS attacks that GDS is subject to (see http://news.zdnet.com/2100-1009_22-151299.html), it's only a matter of time before protected information is leaked and the covered entities (healthcare personnel for HIPAA, Educators for FERPA, Merchants for PCI, etc) point fingers at Google. It's an open question whether the courts will buy the “Google leaked it, not me” defense or whether they'll hold the covered entities liable for the leakage. One potential problem with the desktop search products is that they enable other people with access to the desktop to discover information about other users. For example, spouses can read indexed e-mails or browsing history and discover their partners’ infidelity or online shopping trails. In business, competitors and malicious employees could use desktop search products to locate proposals or negotiation documents. Chrome: Chrome is Google's browser. It's available for download today ± and will be installed on new PCs in the near future. Some of the risks it poses include: • Every URL you visit gets logged by Google; • Everything you type into the location bar—every word, partial word or phrase, even if you don’t click the enter/return button—gets logged by Google; • Chrome sends an automatic cookie along with every automatic search it performs in the location bar. Android: Android is Google's operating system for cell phones. It retains information about dialed phone numbers; received phone call numbers; web searches; e-mails; geographic locations at which the phone was used. Google Health: This product allows consumers—such as employees, co-workers and customers —to store their health records with Google. Recently, CVS Caremark, along with WalGreens and Longs Drugs in the United States, agreed to allow Google Health users to import their pharmacy records into GH. Future Threats So far, we’ve looked at dangers posed by using or installing Google products. Most of these threats can be mitigated by uninstalling these products or using competitive tools. What about dangers to your organization just from Google Search? Look no further than Google Flu Trends. h ttp://www.google.org/images/flutrends/annual_cdc_comparison.png Google correlated CDC flu data from 2003-present with Google’s search data. Spikes in users’ searches about flu treatments correlated tightly with the CDC data. Using Flu trends, Google has demonstrated its ability to analyze search data for a specific term or set of terms. And Google’s privacy policies state they record IP addresses. So, what’s to stop Google from analyzing all search data from Citibank’s networks? Or yours? How many firewalls or proxy servers does your company use to control Internet access? One? Five? 500? What’s the difference between analyzing flu trends and “Top 100 search terms from XYZ Corp.”? Or what if someone were to correlate regional threats from swine flu, avian flu, floods, etc., with search data from Google Health/Prescription data and then analyze the health of their employees and detect long-term effects? Google, as does Sun, Oracle and Microsoft, has a history of working with and selling data to the U.S. Central Intelligence Agency, U.S. National Security Agency and others. Long-Term Threats Overall, the most critical threat is our reliance on GMail—whether the setting is universities, cities, companies or countries switching to GMail en masse, or the newest employees in the organization using GMail as their primary or sole e-mail platform.
Load more

Recommended publications
  • 4. Google Health a Number of Companies Offer to Store Personal
    4. Google Health A number of companies offer to store personal health records on the Web. Companies in this business hope to capitalize on the huge market of interested consumers seeking online health information and controlled health spending. The newest entry is Google Health with its technical know-how, deep pockets, and familiarity to consumers. A trial of Google's program with Cleveland Clinic patients was quickly oversubscribed, quelling fears that patients would worry about the security of their records. Google Health users will create their own electronic medical record online, with the capability to enter and manage health information and access it online from anywhere. This portable medical record will be accessible regardless of doctor, moves, insurance changes, etc. The record can be set to send reminders to refill prescriptions and schedule return medical visits. Permission from the patient is required to access the patient's record; however, there are important exceptions noted in the Google Health Terms of Service and Sharing Authorization to which users must agree when they sign on for the service. Google Health is free to users. Experts have long touted electronic medical records as a way to overcome the lack of coordination among health care providers. In addition, electronic records provide patients and providers with search capability linking information in the patient's records with information about health care alternatives, thereby giving patients more control over their health care choices. Access is available to patients, and to providers with patient consent. Google Health allows the patient to determine what information is shared with medical providers and pharmacies.
    [Show full text]
  • Testimony of Marc Donner, Director of Engineering, Google Health
    Testimony of Marc Donner, Director of Engineering, Google Health National Committee on Vital and Health Statistics Executive Subcommittee on Privacy, Confidentiality & Security Hearing on Personal Health Records May 20, 2009 Good afternoon and thank you for the opportunity to testify before the subcommittee on the important issue of Personal Health Records (PHRs). My name is Marc Donner and I am the Engineering Director for Google Health™. I have over thirty years of experience in engineering of hardware, software, and complex systems, and I hold a Ph.D. in Computer Science from Carnegie-Mellon University. My role on the Google Health team is to supervise the infrastructure and product design of Google Health. The focus of my attention is on ensuring our ability to scale, receive standards-compliant data from as many sources as possible, protect the integrity and privacy of PHR information, and increase the usefulness of Google Health data for our users. In my testimony today, I would like to focus on three main points: First, I'd like to discuss PHRs and their role in the healthcare industry. Second, I'll describe Google's health-related initiatives including Google Health, our own PHR product. Finally, I will make a handful of policy recommendations based on the experience that Google™ has had to date with health information technology generally and PHRs specifically. PHRs and how they fit into the bigger picture Google Health launched its PHR in the spring of 2008. In 2006, it was estimated that were roughly 200 PHRs. 1 In the past three years, many more products have emerged, along with Google’s offering.
    [Show full text]
  • Google's 'Project Nightingale' Gathers Personal Health Data
    Google's 'Project Nightingale' Gathers Personal Health Data on Millions of Americans; Search giant is amassing health records from Ascension facilities in 21 states; patients not yet informed Copeland, Rob . Wall Street Journal (Online) ; New York, N.Y. [New York, N.Y]11 Nov 2019. ProQuest document link FULL TEXT Google is engaged with one of the U.S.'s largest health-care systems on a project to collect and crunch the detailed personal-health information of millions of people across 21 states. The initiative, code-named "Project Nightingale," appears to be the biggest effort yet by a Silicon Valley giant to gain a toehold in the health-care industry through the handling of patients' medical data. Amazon.com Inc., Apple Inc. and Microsoft Corp. are also aggressively pushing into health care, though they haven't yet struck deals of this scope. Share Your Thoughts Do you trust Google with your personal health data? Why or why not? Join the conversation below. Google began Project Nightingale in secret last year with St. Louis-based Ascension, a Catholic chain of 2,600 hospitals, doctors' offices and other facilities, with the data sharing accelerating since summer, according to internal documents. The data involved in the initiative encompasses lab results, doctor diagnoses and hospitalization records, among other categories, and amounts to a complete health history, including patient names and dates of birth. Neither patients nor doctors have been notified. At least 150 Google employees already have access to much of the data on tens of millions of patients, according to a person familiar with the matter and the documents.
    [Show full text]
  • Future of Patient Data Patient of Future Insights from Discussions Multiple Around the Expert World
    Future of Patient Data Insights from Multiple Expert Discussions Around the World World Expert the Around Multiple Discussions from Insights FUTURE OF PATIENT DATA Insights from Multiple Expert Discussions Around the World 1 Future of Patient Data Insights from Multiple Expert Discussions Around the World World Expert the Around Multiple Discussions from Insights 2 Future of Patient Data Insights from Multiple Expert Discussions Around the World World Expert the Around Multiple Discussions from Insights FUTURE OF PATIENT DATA Insights from Multiple Expert Discussions Around the World 3 Contents Foreword 6 Acknowledgements 7 Introduction 8 Future of Patient Data Context 16 Shared Challenges 26 Integration 28 Ownership vs. Access 38 Trust 45 Insights from Multiple Expert Discussions Around the World World Expert the Around Multiple Discussions from Insights Security and Privacy 52 Future Opportunities 58 Personalisation 60 Data Marketplaces 68 The Impact of AI 73 New Models 86 Emerging Issues 96 Data Sovereignty 98 Digital Inequality 102 Privatisation of Health Information 111 The Value of Health Data 115 Conclusions 120 Questions 122 Appendix 124 4 Charts Project Summary 10 Healthcare Spend vs Life Expectancy 12 Growth In Healthcare Data 17 Doctors with EHR and Multifunctional Health IT Capacity 30 Consumers Willing To Share Health Data 46 Future of Patient Data Data Breach Cost Per Capita 53 Number of Personalised Medicines (US - 2008 to 2016) 63 Genetic Disorders with Diagnostic Tests Available 65 Number of Artifical-Intelligence Companies
    [Show full text]
  • THE DIGITAL HEALTH DEBATE Ci C
    THE DIGITAL i C C NOV 2015 HEALTH DEBATE i A REPORT ON HOW DOCTORS ENGAGE WITH DIGITAL TECHNOLOGY IN THE WORKPLACE THE DIGITAL HEALTH DEBATE 2015 | ©CELLO HEALTH INSIGHT FOREWORD i C C i PAUL MANNU Master Practitioner, Behavioural Insights [email protected] Advances in digital technology have The research explores doctors’ perceptions Online interviews with become ubiquitous within healthcare, of how smart technology such as apps bringing about breakthroughs in diagnosis, and wearables can be used by patients to new treatment options and at the same better manage their health. time heralding the expansion of companies usually associated with technology into the The appendix section also includes our market place. findings on doctors’ preferences when 1,040 participating in research via a mobile app. certified doctors Enter Google Health, Apple Health, and Microsoft HealthVault. These major players Throughout this report, consideration has are accompanied by IBM with ‘Watson’, been given as to what the survey findings a new cognitive system that processes mean for pharmaceutical marketing information more like a human than a strategies. If you would like to know computer. IBM claim Watson will be able more about the specific relevance of this to ‘see’ medical images once its advanced research to marketing, sales and business image analytics and cognitive capabilities intelligence please get in touch. are merged with a newly acquired medical imaging management platform. For more information about the full extent of the survey research, please do not 8 The potential for these new and symbiotic hesitate to contact us. Markets relationships is vast and doctors are at the heart of it.
    [Show full text]
  • Accessible Telehealth - Leveraging Consumer-Level Technologies and Social Networking Functionalities for Senior Care
    Accessible Telehealth - Leveraging Consumer-level Technologies and Social Networking Functionalities for Senior Care Jaspaljeet Singh Dhillon and Burkhard C. Wunsche¨ and Christof Lutteroth Department of Computer Science, University of Auckland, New Zealand [email protected], [email protected], [email protected] Abstract— The increasing cost of healthcare represents a our framework for a novel telehealth system and Section V serious challenge to most developed countries. Telehealth has and VI explain its design and implementation, respectively. been widely promoted as a technology to make healthcare more We evaluate our prototype in Section VII and conclude the effective and affordable. However, current telehealth systems suffer from vendor lock-in and high cost, and are designed paper in Section VIII with a summary of our contributions for managing chronic diseases, rather than preventing them. and future work. In this paper we evaluate technologies for supporting senior health consumers. Based on this we propose a framework for a II. CONSUMER-LEVEL HEALTH INFORMATICS novel telehealth system overcoming many of the shortcomings APPLICATIONS of existing technologies. The new system is web-based, has a Facebook-like plug-in architecture for adding new health The most common consumer-level health informatics ap- applications, and incorporates social networking functionalities. plications are telehealth systems, health record management We discuss the challenges in implementing the system, and systems, health information websites, and exergames. summarize a user study evaluating the system. Our results Telehealth systems consist of vital signs measurement de- demonstrate that health consumers have a positive view of this vices and a patient station, which allows interaction between new telehealth technology, and that it can positively change the attitude of users towards their health.
    [Show full text]
  • Changing the Game: Tech Briefs August 2007
    the way we see it Changing The Game: Monthly Technology Briefs January 2009 Google Health: A Business Technology & Web 2.0 Use Case Read the Capgemini Chief Technology Officers’ Blog at www.capgemini.com/ctoblog Google Health: A Business Technology & Web 2.0 Use Case The UK government got the wrong type of headlines for its attempt to provide shared access to health records across hospitals, doctors, and other health professionals when its NHS Connecting for Health program ran into difficulties. At the same time, Google was successfully delivering an almost identical program called Google Health in North America. The difference was that the techniques used by the UK NHS (National Health Service) program were based on conventional database driven management. It attempted to build a huge master database that would combine all the necessary data and was then surrounded by various user applications. The questions of scale and governance were only outweighed by those of security and authorization. Google Health takes an entirely different approach and is a good example of a Business Technology (BT) solution that is built using Web based technology. The solution is also powered by the Cloud as an ‘Invisible infostructure’. Web Services are deployed to provide ‘Interactions rather than Transactions’. Users have a high degree of freedom in how they choose to personalize their use of the health records: the ‘You Experience’. This combination, with many other sources of information, is a prime example of how to ‘thrive on data’. The whole system is built upon a ‘Standards based’ approach and allows the invocation of flexible ‘Process on the Fly’ between participants that can connect to existing IT applications when necessary.
    [Show full text]
  • Using Google to Search for Articles in the Health Sciences
    Using Google to search for articles in the Health Sciences You may have had a professor who said, “Don’t use Google to do your research.” Or you may have heard, “Only use the library databases.” Well, I’m going to let you in on a little secret. Google can actually be a great tool for searching for articles in the Health Sciences. Google is a very powerful search engine, and you can use it to find lots of good material. The problem is it’s a double edged sword. Along with the good stuff, you can also get a lot of junk in the form of bogus websites, advertisements, mindless blogs, and so on. So this tutorial is designed to show you a few tips on how to use Google to find credible sources of information. First, if you’re looking for peer-reviewed articles, I’d recommend switching from Google to Google Scholar. If you’re not familiar with it, Google Scholar is a module of Google that searches the scholarly literature and locates articles, theses, books, abstracts, court opinions, and patents, thus eliminating the junk you’d get searching in regular Google. To get to Google Scholar, simply enter the url scholar.google.com. You’ll see the landing page is similar to regular Google, but the results will be different. Let’s try the search high blood pressure diet exercise vitamin c. There is a date filter on the left side of the results page. Sometimes you are asked to only use articles from the last 5 years, or some similar date restriction.
    [Show full text]
  • April 5, 2012 Isabelle Falque-Pierrotin Presidente CNIL 8, Rue
    April 5, 2012 Isabelle Falque-Pierrotin Presidente CNIL 8, rue Vivienne 75002 Paris, FR Re: Google Dear Madame la Presidente, Thank you for your letter and questionnaire of March 16, 2012, responding to our letter to you of February 28, 2012. We are happy to provide the additional information you request. Your questionnaire is wide ranging, covering a number of technical and legal areas in detail. Only some of the 69 questions you ask relate to our new Privacy Policy changes specifically, with many of the questions exploring broader privacy matters. While we are committed to providing the CNIL and all European data protection authorities with answers to the questions asked, we will, as agreed with your staff, need slightly longer than the time you have suggested to respond. As an interim step, we attach our responses to questions 1 to 24. The rest will follow as soon as complete. In addition to our written responses, Google would, as noted in our letter of February 28, 2012, also welcome the chance to meet with the CNIL to explain and discuss Google’s approach to providing information to users. This is an important issue for us. We have taken a great deal of time and care in designing our approach. In our very first letter to the CNIL on this topic, we emphasised that while we did not feel able to pause the implementation of our Privacy Policy, we would welcome the opportunity to discuss how and where Google provides information to our users. We have reached out many times to the CNIL asking for a meeting to discuss this, and we make that offer again now.
    [Show full text]
  • Tech Companies and Public Health Care in the Ruins of COVID
    International Journal of Communication 15(2021), 1617–1636 1932–8036/20210005 Tech Companies and Public Health Care in the Ruins of COVID SHINJOUNG YEO1 Queens College, City University of New York, USA The COVID-19 pandemic has proven the cruelty of the U.S. market-driven health care system that disproportionately affects the poor. It illuminates how much a well-funded public health care system is vital for the survival of all. However, amidst the ruins of the pandemic and economic crisis, digital capitalism is driving a new round of capitalist restructuring with the health care sector at the center of capital’s new digitization push. Tech companies are at the forefront of this capitalist endeavor. Long before the outbreak, these companies and others have been cultivating the health sector into their profit- making enterprise. The pandemic has further opened the door. This article demonstrates how tech companies are weaving themselves into the medical-industrial complex built over the last several decades. By exploiting the pandemic, they are quickly grasping an opportunity to occupy the public health system. Keywords: COVID-19, Internet industry, public health care, medical-industrial complex, digital capitalism At the time of this writing in 2021, the coronavirus is ravaging the planet, killing hundreds of thousands of people, and exposing the undeniable violence of the capitalist system that treats public health as a profit-making enterprise that harshly and disproportionately affects the poor who already subsist with few if any social protections. With the absence in the United States of publicly funded universal health care provision for most of its citizens, private companies are “stepping up” as they are loath to let any crisis go to waste.
    [Show full text]
  • A-Review-Of-PHR-EMR-And-EHR
    JIMS 8i- International Journal of Information, Communication and Computing Technology (IJICCT) A Review of PHR, EMR and EHR Integration: Personalized Healthcare and Public Health Dr. Ruchi Agarwal1,Tanya Arora Kochhar2 doi: 10.5958/2347-7202.2017.00011.1 Individual wellbeing records (PHR) are online frameworks ABSTRACT utilized by patients, and are intended for straightforwardness To audit and present the relationship and requirement for of data and to empower patients to be better educated and incorporating EMR, EHR and PHR data, by featuring its locked in. (2). These frameworks entwine and may enhance utilization and esteem difficulties and dangers. Electronic understanding consideration. In its own area (hierarchical Medical Records (EMR) and Electronic Health Records and individual) each gives access and data to wellbeing (EHR) are utilized by doctors to enhance nature of care and experts and patients. EHR and EMR use by clinicians has contain costs. Though EMR is generally viewed as an been appeared to be important in medicinal care (Wright et interior hierarchical framework, the EHR is characterized al, 2014; Reis et al, 2013) and PHR has been appeared to as a between authoritative framework. As of late, a increment engagement, inclusion, intrigue, mindfulness and modernized stage for understanding focused medicinal care comprehension among patients. On the off chance that known as Personal wellbeing records (PHR) was presented, joined, these frameworks may facilitate the helpful as an empowering influence for self-administration of procedure since all gatherings included would be better medicinal records. PHRs are online frameworks utilized by educated. What's more, their reconciliation could help make patients.
    [Show full text]
  • Google KI Workshop 2010 RSA Conference
    Business value of Federated Login for Enterprises Enterprise SaaS vendors Consumer websites Eric Sachs Product Manager, Google Security & CIO organization My Identity Enterprise Space 2008 - Cloud Computing (Google Security, Google CIO) 2003 - SaaS (Google Apps for your Domain) 1997 - ASP (co-development with both IBM/Lotus and Microsoft) 1992 - Email Outsourcing (Lotus Notes/cc:Mail) Consumer Space Google Accounts, Google Health, orkut.com, ... Internet Standards OAuth, OpenID, WRAP, OpenSocial, ... Slides online Slides available in case your IT admin wants to know more Google search for "oauth goog" and click first result Or http://bit.ly/esachs Search on the page for RSA Google in 2003 Only a few thousand employees, but already using many SaaS vendors Nooglers introduced each week on Fridays Ops team manually provisions SaaS accounts Uh oh... Mike was fired yesterday, and we forgot to go to each vendor and remove Mike's account, so he is still able to get in We think Frank's password might have been stolen too, but its so much work to change it in all these places Federated Login Harder then it looks Reliability? Ran in a single data center Ran on a single RAID server Not uncommon for login system to be inaccessible, while apps were still up Security threat? Single-sign on systems on internal networks Federated login systems Internet accessible Other Enterprises using Google Apps reported the same problems Federated Login as a service Google noticed a growing set of Enterprises who were using an IDP SaaS service Vendors such as Ping, Tricipher, Symplified, ... IDP services built many custom adapters for SaaS vendors Google wants to see better standards by SaaS vendors Launched OpenID support for Google Apps as another "IDP service" Asking our corporate SaaS vendors to use OpenID Four options 1.
    [Show full text]