Before the Federal Trade Commission Washington, DC 20580 In the Matter of ) ) Google, Inc. ) __________________) REQUEST FOR INVESTIGATION AND COMPLAINT FOR INJUNCTIVE RELIEF INTRODUCTION 1. Google, the largest search engine in the United States, has repeatedly touted the numerous ways in which it protects user privacy, particularly with regard to the terms that consumers search for using the company’s search engine. However, the company has consistently designed its services to ensure that these search queries, which often reflect highly sensitive information, are routinely transferred to marketers and other third parties. 2. This complaint concerns the intentional leakage of search query information to third parties by Google. This practice adversely impacts billions of searches conducted by millions of consumers. Google’s sharing of this data is a Deceptive Trade Practice, subject to review by the Federal Trade Commission (the “Commission”) under section 5 of The Federal Trade Commission Act, and should be reversed. PARTIES 3. Christopher Soghoian is a Washington, DC based Graduate Fellow at the Center for Applied Cybersecurity Research at Indiana University, and a Ph.D. Candidate in the School of Informatics and Computing at Indiana University. His research is focused at the intersection of security, privacy, law and policy. He has previously worked for the Federal Trade Commission, 1 the Berkman Center for Internet and 1 Mr. Soghoian was employed by the Federal Trade Commission between September, 2009 and August, 2010 as a technologist within the Division of Privacy and Identity Protection. During his time at the FTC, Mr Soghoian was prohibited from working on any Google related matters, per a decision by the Office of General Counsel, who determined that Mr. Soghoian’s pre‐FTC academic research and other writings were sufficiently critical of Google to create the possibility of a perception of bias against the company. Mr Soghoian came up with the idea for this complaint, did all the research, and wrote the entire thing himself, in his own time. He has not been instructed to write this complaint by someone else, nor financially compensated for it in any way. 1 Society at Harvard University, The American Civil Liberties Union of Northern California, Google, Apple and IBM Research. 4. Google, Inc. ("Google") was founded in 1998 and is based in Mountain View, California. Google’s headquarters are located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. At all times material to this complaint, Google’ course of business, including the acts and practices alleged herein, has been and is in or affecting commerce, as "commerce" is defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 45. THE IMPORTANCE OF PRIVACY PROTECTION 5. The right of privacy is a personal and fundamental right in the United States. The privacy of an individual is directly implicated by the collection, use, and dissemination of personal information. The opportunities to secure employment, insurance, credit, to obtain medical services and the rights of due process may be jeopardized by the misuse of personal information. 6. Courts have recognized a privacy interest in the collection of information that concerns Internet use even where the information may not be personally identifiable. 7. The Federal Trade Commission has a statutory obligation to investigate and prosecute violations of Section 5 of the Federal Trade Commission Act where the privacy interests of Internet users are at issue. STATEMENT OF FACTS SEARCH ENGINE QUERIES CONTAIN SENSITIVE, PERSONAL DATA DESERVING OF PRIVACY PROTECTIONS 8. Leading thinkers in the privacy community have long argued that consumers “treat the search [engine] box like their most trusted advisors. They tell the Google search box what they wouldn’t tell their own mother, spouse, shrink or priest.”2 Peer reviewed academic studies confirm this fact, particularly regarding the use of search engines to look up sensitive health information.3 2 http://www.theinvestigativefund.org/investigations/rightsliberties/1274/the_cloud_panopticon 3 Gunther Eysenbach and Christian Köhler, “How do consumers search for and appraise health information on the world wide web? Qualitative study using focus groups, usability tests, and in‐depth interviews,” BMJ 2002; 324:573, available at http://www.bmj.com/cgi/content/full/324/7337/573. 2 9. In August 2006, AOL released an “anonymized” dataset of 20 million search queries conducted by 650,000 AOL users over a three month period. The data included search queries revealing names, addresses, local landmarks, medical ailments, credit card numbers and social security numbers. AOL’s management soon apologized for the “screw up,”4 firing the company’s Chief Technology Officer and several other employees.5 AOL’s release of the data also resulted in a FTC complaint from the Electronic Frontier Foundation6 and a class action lawsuit.7 10. Journalists from the New York Times were able to re‐identify individual “anonymized” AOL search users due to the vanity searches they had conducted, and then link other, non‐vanity search queries in the dataset to those individuals through the cross‐session identifiers (cookies) included in the dataset.8 11. While there are several technologies available to consumers to better protect their privacy online, none effectively protect users’ vanity searches.9 12. Soon after the release of the search query data by AOL, Google CEO Eric Schmidt called AOL's release of user search data "a terrible thing."10 4 Michael Arrington, “AOL: This was a screw up,” TechCrunch, August 7, 2006, available at: http://techcrunch.com/2006/08/07/aol‐this‐was‐a‐screw‐up/. 5 Barry Schwartz, “AOL Fires CTO & Two Employees After Search Records Slip Up,” Search Engine Watch, August 21, 2006, available at: http://blog.searchenginewatch.com/060821‐142810. 6 Electronic Frontier Foundation, Request for investigation and complaint for injunctive relief, August 14, 2006, available at https://w2.eff.org/Privacy/AOL/aol_ftc_complaint_final.pdf. 7 Danny Sullivan, “Class Action Lawsuit Filed Against AOL Over Search Data Release,” Search Engine Watch, September 26, 2006, available at: http://blog.searchenginewatch.com/060926‐075713. 8 Michael Barbaro and Tom Zeller Jr, “A Face is Exposed for AOL Searcher No. 4417749,” The New York Times, August 9, 2006, available at: http://www.nytimes.com/2006/08/09/technology/09aol.html. 9 Christopher Soghoian, “The Problem of Anonymous Vanity Searches,” I/S: A Journal of Law and Policy for the Information Society, Volume 3, Issue 2, 2007, available at: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=953673. 10 J. Nicholas Hoover, “AOL Search‐Term Data Was Anonymous, But Not Innocuous”, InformationWeek, August 14, 2006, available at: http://www.informationweek.com/news/software/showArticle.jhtml?articleID=191901983 3 13. In 2006, the Department of Justice sought to compel Google to produce thousands of users’ individual search queries. To its credit, Google fought the government’s request. In a declaration submitted to the court describing the kind of personal information that can end up in the company’s search query logs, Matt Cutts, a Senior Staff Engineer at Google stated: “There are ways in which a search query alone may reveal personally identifying information. For example, many internet users have experienced the mistake of trying to copy‐and‐paste text into the search query box, only to find that they have pasted something that they did not intended. Because Google allows very long queries, it is possible that a user may paste a fragment of an email or a document that would tie the query to a specific person. Users could also enter information such as a credit card, a social security number, an unlisted phone number or some other information that can only be tied to one person. Some people search for their credit card or social security number deliberately in order to check for identity theft or to see if any of their personal information is findable on the Web.”11 INTRODUCTION TO HTTP REFERRER HEADERS 14. When a consumer visits a web page using their computer or mobile device, every major web browser (Internet Explorer, Firefox, Chrome, Safari) by default reports the last page that the consumer viewed before clicking on a link and visiting the current – that is, the page that “referred” them to the current page. This information is transmitted in the HTTP Referer (sic) header (“referrer header”).12 15. The original technical standard, or Request For Comments (RFC) document that outlines the HTTP specification notes that this header can include private information, and advises web browser designers to include privacy protecting features in their products that will allow users to protect themselves: “Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing 11 Declaration of Matt Cutts, February 17, 2006, in Gonzales v. Google, 234 F.R.D. 674 (N.D. Cal. 2006) at page 9, available at: http://docfiles.justia.com/cases/federal/district‐ courts/california/candce/5:2006mc80006/175448/14/0.pdf 12 The term “referer” was misspelled in the original technical standards document, and thus, this incorrect spelling is also used in many other technical documents. 4 openly/anonymously, which would respectively enable/disable the sending of Referer and From information.”13 16. Although this 15‐year old technical standard recommends that browser vendors allow users to control the transmission of the referrer header, not all have done so, and none make it easy. 17. Google’s Chrome browser can be configured to not transmit referrer information. Users can enable this feature with an obscure, poorly documented parameter (‐no‐referrers) that must be entered when the browser starts.