An Honest Man Has Nothing to Fear: User Perceptions on Web-based Information Disclosure Gregory Conti Edward Sobiesk Dept of Electrical Engineering and Computer Science Dept of Electrical Engineering and Computer Science United States Military Academy United States Military Academy West Point, New York West Point, New York [email protected] [email protected] ABSTRACT comfortable with their privacy on the web -- despite the fact that the vast majority admitted to at times searching for things they In today’s era of the global ubiquitous use of free online tools and would not want their parents or future employers to know about. business models that depend on data retention and customized On the other hand, they professed only guarded trust of top web advertising, we face a growing tension between the privacy search engines and e-commerce companies and were largely concerns of individuals and the financial motivations of unaware of the duration that data is retained. They admitted to organizations. As a critical foundation step to address this not knowing how to surf anonymously, but did not seem problem, we must first understand the attitudes, beliefs, behaviors, concerned. To summarize our findings, they spoke with a and expectations of web users in order to create an environment common voice that their trust of the web is calculated and that where user privacy needs are met while still allowing online they view privacy as their responsibility. With this foundation, companies to innovate and provide functionality that users desire. we believe they feel an honest man has nothing to fear. As security and usability professionals we must identify areas where misperceptions exist and seek solutions, either by raising Web-based data retention is an extremely important, but awareness, changing policy, or through technical means. In this contentious subject. Information pours into the databases of the paper, we explore these issues and report the results from a survey largest service providers at unprecedented rates. For example, of 352 college undergraduates and a comparison group of 25 Google users conduct an estimated 100 million search queries per middle aged adults The results were at times surprising and even day. These queries are processed by approximately two dozen contradictory to the views held by security professionals. To globally dispersed data centers. These data centers offer nation summarize our findings, the students we surveyed believe that “an state level information processing resources provided by an honest man has nothing to fear.” estimated 450,000 servers with four petabytes of RAM, 200 petabytes of storage and bandwidth of 3 petabits per second [1]. Categories and Subject Descriptors Other web-based service providers, in domains such as email and messaging, generate similar amounts of data. For example, H.3.3 [Information Search and Retrieval]: Information Search Hotmail has 260 million users and MSN messenger has 240 and Retrieval, K.4.2 [Computers and Society]: Social Issues, million users. As discussed in previous works, the sum total of K.4.3 [Computers and Society]: Organizational Impacts, K.4.4 these interactions paint unprecedented, detailed portraits of the [Computers and Society]: Electronic Commerce. personal and professional lives of web users, as well as the companies they work for [2, 3]. General Terms Security, Human Factors, Legal Aspects. In the era of web-based information services and e-commerce, long-term data retention is a reality. In fact, it is a best practice Keywords for these service-oriented businesses, but due to the potential consumer backlash it is rarely publicly discussed by them. data retention, web search, googling, privacy, anonymization, Business models of the largest web based information service usable security, information disclosure, anonymity, companies depend on data retention for customized advertising fingerprinting, AOL, Google, Yahoo!, MSN and hence large portions of their billion-dollar revenue. Similarly, in the search industry, businesses pursue perfect search 1. Background and Motivation and individual customization [4], both of which are probably “If you give me six lines written by the hand of the most honest of unachievable without some form of user data retention. Formal men, I will find something in them which will hang him.” accounts of data retention policies by top web search companies Cardinal Richelieu (1585-1642) are scarce, but anecdotal evidence suggests that every interaction with these companies is scrupulously logged and stored Does web-based information disclosure and data retention really indefinitely. In one of the rare instances where this subject is matter to today’s web users? We set out to explore this question addressed, Usama Fayad, Chief Data Officer of Yahoo! stated that by surveying 352 college undergraduates regarding their attitudes, Yahoo! collects 10 terabytes of user data a day, not including behaviors, beliefs, and expectations associated with their use of content, email or images. Additionally, he stated that the first and the web. The results were surprising and sometimes largest data mining challenge is the “ability to capture all of this contradictory. On one hand, the students generally felt data reliably, process it, reduce it, and use it to feed the many, Copyright is held by the author/owner. Permission to make digital or many reports and applications.” [5] Combining the ever hard copies of all or part of this work for personal or classroom use is granted without fee. Symposium On Usable Privacy and Security (SOUPS) 2007, July 18-20, 2007, Pittsburgh, PA, USA. decreasing cost of long-term storage with business models that Most notably, New York Times reporters Michael Barbaro and depend upon the customization of information, we believe (in Tom Zeller demonstrated the trivial nature of working backwards direct contradiction with some survey participants) that nothing is from an “anonymous” cluster of web searches in the dataset to the ever discarded. This belief, as well as the sensitivity of the real-world user who created them [13]. In the months following aggregated data, is validated by the outcry surrounding AOL’s the disclosure, a number of websites were created to provide an inadvertent disclosure of a large search query dataset in August easy to use interface to the data and eventually these sites added 2006. We believe, in fact, these databases of user interactions additional analysis functionality that allowed Internet users to represent some of the most highly prized assets of online collaboratively examine, rate, and, in some cases, identify each companies. Further, we argue that the mere existence of user [14,15,16]. information stockpiles of this magnitude guarantees that the data Given the backdrop of the AOL disclosure, our main focus is to will be coveted by many. Government agencies, law enforcement determine user perceptions regarding information disclosed to organizations, and industrial competitors greedily eye the data as free online services in the context of a perceived “private” a way to seek competitive advantage. Despite being in the best interaction. In other words, when the user provides data to the interest of online companies, and their shareholders, to protect the online service, such as a search query, the user believes it should data, there exist many legal (and illegal) mechanisms to gain be kept private. It is important to note that we are not addressing access. In this paper we seek to contrast these realities, with the interactions where the user expects the information will be attitudes, behaviors and beliefs of web-based information service published, as in the case of social networking sites [17,18]. Nor users. The key contributions of this paper are detailed insights are we considering the information disclosed through a suspect into the following questions: how do typical users employ free host or network, perhaps due to spyware, phishing, an web tools, what is their expectation of privacy, and how do they untrustworthy operating system, bootstrapping sequence, or believe their data will be handled, used, and retained. Given malicious ISP. today’s legal and business environment, we discuss where we feel these users are right and where their perceptions may be incorrect. Surveys that cover web-based information disclosure and data retention are sparse. In 2002, the Danish Presidency distributed a This paper is organized as follows. Section 2 places our questionnaire to European Union member nations that covered contribution in the field of related work. Section 3 describes the current data retention laws and mandatory data retention at the construction of the survey as well as the demographics of the nation state level. However, the results have not been released respondents. Section 4 presents the results of the survey. Section citing security concerns [19]. In 2005, Deloitte conducted a 5 provides detailed analysis as well as emergent themes from the survey of Chief Security Officers in the financial sector that survey. Finally, Section 6 presents our conclusions and suggested included privacy and data retention coverage, but only from the areas for future work. organizational perspective, not that of typical end users. One important finding from this survey is that only 68% of the 2. Related Work respondents in 2005 had a program in place for managing privacy The novelty of our work springs from our direct examination of compliance within their organizations and only 25% allowed end user perceptions on anonymity and privacy in a post-AOL customers to manager their privacy preferences [20]. Conducted disclosure world. The study of anonymity and privacy when during late 2006, ISP-Planet surveyed Managed Security online is not new. Online privacy and data retention have been Providers, again focusing at the corporate level and not individual growing concerns since the World Wide Web was created 16 users, and found that nine providers offered services which years ago [6]. Organizations such as the Electronic Frontier monitored web content transferred via HTTP and HTTPS [21].