Privacy and Quaero's Quest for the Perfect Search Engine: Threats - PowerPoint PPT Presentation

Privacy and Quaero's Quest for the Perfect Search Engine: Threats and Opportunities Michael Zimmer, PhD Fellow, Information Society Project Yale Law School

Privacy and Quaero's Quest for the Perfect Search Engine: Threats and Opportunities 1. Perfect Search Engine: 10 100 2. Faustian Bargain 3. Quaero’s Perfect Search 4. Threats & Opportunities

Perfect Search Engine • “process and understand all the information in the world” – perfect reach • “understand exactly what you mean and give back exactly what you want” – perfect recall “Like the mind of God” 3

Perfect Reach “Organize the world’s information and make it universally accessible and useful.” 4

Perfect Reach • God-like omnipotence • Personal data previously obscure is now searchable – Usenet posts – Court documents – Old, incorrect news articles – Images, video, blog comments, etc. 5

Perfect Recall • Provide results that suit the context and intent of the search query: “Paris Hilton” • User satisfaction & loyalty • Increased revenues 6

Perfect Recall • God-like of omniscience • Collect as much information as possible about the searcher – Server logs – Cookies – User accounts 7

Server Logs 123.45.67.89 - 25/Mar/2003 10:15:32 - http: // www . google . com / search ? q = join + alcoholics + anonymous Firefox 1.0.7; Windows NT 5.1 - 740674ce2123e969 Cookie ID Date & Time IP Address Search terms: Join Alcoholics Anonymous Also likely includes results clicked, referring page, and other clickstream data 8

Perfect Recall • Over two dozen products & services • Interconnected via cookies & Google Accounts • Contacts, news, subscriptions, blogs, books, stocks, appointments, e-mail, friends, computer files, discussion groups, URLs… 9

Faustian Bargain • Perfect search engine promises breadth, depth, efficiency, and relevancy… • …but lose “security via obscurity” • …and involves the widespread capture of personal and intellectual information Will Quaero offer to re-negotiate this Faustian bargain? 10

Quaero’s Perfect Search • Combined sound, image and video search • Technologically sophisticated, professional search applications • Index of cultural heritage • Public-private initiative Offers both threats & opportunities to preserve user privacy… 11

Privacy Threats: Reach • Technologically sophisticated multimedia search: a possible scenario – User-generated content – Tagging: GPS data, date & time – Facial recognition • While increasing Quaero’s reach, these combine into possible privacy threats… 12

13

GPS: 40.75704, - 73.98597 Date: 10-Sept-2007 Time: 20:25 Camera: Nokia N95 14

15

Privacy Threats: Reach • These are cute, user-generated examples • But more serious threats persist when indexing images of events of more cultural and historical importance 16

Surveillance Protest 17

Gay Pride March 18

Neo-Nazi Demonstration 19

Privacy Threats: Reach • Great value in user-contributed images • And image recognition systems make search more powerful • But must not allow a new Faustian bargain to emerge – Just because in public doesn’t mean image should be identified, indexed and searched – Unfounded association, assumptions, discrimination, etc. 20

Privacy Threats: Recall • Similar threats persist with potential logging of user search activity • What will it mean to have one’s search history tied to controversial or illegal subjects? – Holocaust denial information – Historical meeting places for Islamic radicals More harmful than what Google knows about me? 21

Opportunity • Value-conscious design – Include values of moral & ethical import in initial design process – Pragmatic engagement & collaboration with technical designers • Too late to engage with Google – Recent changes trivial • But designers of Quaero can build in values from the ground-up 22

Wikia Search Model • Transparency – Openness in how the systems and algorithms operate • Community – Everyone is able to contribute in some way; strong social and community focus. • Quality – Significantly improve the relevancy and accuracy of search results and the searching experience. • Privacy – Must be protected, do not store or transmit any identifying data. 23

Design for Privacy 1. Quaero must be designed in such a way as to prevent any substantive response to a civil or criminal subpoena of user activity 2. Quaero must be designed so IP addresses and cookies cannot be associated with particular users or accounts 3. Query traffic must be encrypted to prevent 'man in the middle' monitoring 4. Quaero must provide transparency in the data it collects about users, how it is used, who uses it, and how long it is retained 24

Design for Privacy 5. Quaero must not engage in personalized or behaviorally-targeted advertising 6. Quaero must take steps to remove or obscure personally-identifiable images (faces, license plates, etc) from its searchable index 7. Quaero must provide individuals the ability to remove or obscure personally-identifiable data from its searchable index 8. Quaero must provide users the ability to view, edit, and delete any search history data associated with their account 25

Summary • Unique proposition – Build a robust, sophisticated search engine of cultural knowledge and history – Relatively unfettered by traditional market forces • Unique opportunity – Design for values – Protect user privacy – Avoid another Faustian bargain with “the mind of God” 26

Privacy and Quaero's Quest for the Perfect Search Engine: Threats and Opportunities Michael Zimmer, PhD Fellow, Information Society Project Yale Law School michael.zimmer@yale.edu Http://michaelzimmer.org