Google has long claimed that the server log data it collects are a critical driver of innovation. Over the years, to appease privacy advocates, the company has tweaked its treatment of those data and the length of time it stores them. Google continues to collect IP addresses, though it makes them anonymous after nine months (it used to do so only after 18-24 months).

This may soon change. And not because of any initiative on Google’s (GOOG) part but because of one by Microsoft (MSFT).

Responding to Article 29 Working Party guidelines for protecting users’ personal data online, Microsoft this morning said its new search engine, Bing, will purge all the data it collects on users after six months. Not make the data anonymous, but purge.

“Today we sent a letter to the Article 29 Working Party notifying them of our intention to make a change to Bing’s data retention policy,” Bing Privacy Manager Reese Solberg wrote in a post to the Bing blog. “Specifically, we are reducing the amount of time we store IP addresses from searchers to 6 months. Currently we keep that information for 18 months before we delete it.”

Elaborating, the letter continues, “Generally, when Bing receives search data we do a few things: first, we take steps to separate your account information (such as email or phone number) from other information (what the query was, for example). Then, after 18 months we take the additional step of deleting the IP address and any other cross session IDs associated with the query.”

In conclusion, the letter describes Microsoft’s initiative succinctly: “Under the new policy, we will continue to take all the steps we applied previously–but now we will remove the IP address completely at 6 months, instead of 18 months.”

Microsoft’s move leaves Google in the uncomfortable position of being far less a friend to privacy than Microsoft. And hard as the company might argue in favor of storing user data, it will likely have to match Microsoft.

It’s difficult to claim that server log data are “a crucial arm in the battle to protect the security of our services against hacks and fraud” when a prominent rival is essentially claiming exactly the opposite.

In a statement, the telecommunications provider said that a business customer, which it declined to name, was the target of a denial-of-service attack on Friday. The attack originated from IP addresses connected to 4chan, and to prevent it from spreading to other customers, AT&T blocked those addresses for its Internet-service subscribers.

“This action was in no way related to the content at img.4chan.org; our focus was on protecting our customers from malicious traffic,” AT&T said. It removed the block late Sunday.

Read the rest of this post on the original site

One of the tools gaining attention is Tor, an application that makes it difficult for outside parties to monitor a consumer’s Web use. “The idea is similar to using a twisty, hard-to-follow route in order to throw off somebody who is tailing you–and then periodically erasing your footprints,” the site for the Tor Project says. (MIT’s Technology Review has a video of Tor Project’s Roger Dingledine explaining its origins.)

Andrew Lewman, Tor Project’s executive director, told CNET that the organization has seen Tor users with Iranian IP addresses double in recent days.

Read the rest of this post on the original site

That will no doubt come as a shock to Google (GOOG), Yahoo (YHOO) and Microsoft (MSFT), who all retain search data for a year or more. But it can’t be nearly as shocking as the Working Party’s recommendation that IP, or Internet Protocol, addresses be protected as personal information, a requirement that, were it to be implemented, could interfere with their ability to deliver relevant ads.

From the Working Party document:

A key conclusion of this opinion is that the Data Protection Directive generally applies to the processing of personal data by search engines, even when their headquarters are outside the EEA, and that the onus is on search engines in this position to clarify their role in the EEA and the scope of their responsibilities under the Directive.

“This Opinion concludes that personal data must only be processed for legitimate purposes. Search-engine providers must delete or irreversibly anonymize personal data once they no longer serve the specified and legitimate purpose they were collected for and be capable of justifying retention and the longevity of cookies deployed at all times. The consent of the user must be sought for all planned cross-relation of user data, user-profile enrichment exercises. Web site editor opt-outs must be respected by search engines and requests from users to update/refresh caches must be complied with immediately. The Working Party recalls the obligation of search engines to clearly inform the users upfront of all intended uses of their data and to respect their right to readily access, inspect or correct their personal data.”

… For Google, privacy did not begin and does not end with our acquisition of DoubleClick. And we believe that privacy for legislators, regulators, privacy groups and other stakeholders shouldn’t begin or end with Google. Privacy is a serious issue that spans several industries from financial services to entertainment to e-commerce, and that ought to be addressed holistically in the interest of individuals throughout Europe and the world. One particular company–and certainly one particular merger–should not be singled out.”

–Peter Fleischer, Google’s Global Privacy Counsel

The Federal Trade Commission’s decision to approve Google’s proposed $3.1 billion acquisition of online ad-serving vendor DoubleClick without condition hasn’t exactly elicited resounding calls of huzzah! from the European Union. On the contrary, European parliamentarians seem out to spoil the deal.

At a hearing before the European Parliament’s Civil Liberties Committee to discuss the legality of search companies’ privacy policies, talk quickly turned to the acquisition and its potential impact on citizens’ online privacy. Seems a few of the EU’s top privacy regulators feel that IP, or Internet Protocol, addresses should be protected as personal information when they can be used to identify an individual on a computer network. Google, which uses IP addresses to identify users’ geographical location, among other things, disagrees.

After first upbraiding the committee for attempting to shoehorn a privacy case into a competition law review, Peter Fleischer, Google’s Global Privacy Counsel, pointed out that IP addresses aren’t always personally identifiable. “There is no black or white answer: Sometimes an IP address can be considered as personal data and sometimes not,” he said. “It depends on the context and which personal information it reveals.” And this is true to some extent, but becoming less so as we move toward Internet Protocol version 6 (IPv6).

Of course, were IP addresses to be categorized as personal information, Google would have a more difficult time delivering relevant search results and, more importantly, ads. Which, as Dutch parliamentarian Sophie in ‘t Veld pointed out is the real reason Google is arguing so vehemently against treating IP addresses as sensitive personal data. “The reason you want to have the data is because it gives you a competitive advantage,” she said. “It is business. I don’t think they can be completely disconnected. And we should discuss that side of things too. … Having that much information is market power.”

… For Google, privacy did not begin and does not end with our acquisition of DoubleClick. And we believe that privacy for legislators, regulators, privacy groups and other stakeholders shouldn’t begin or end with Google. Privacy is a serious issue that spans several industries from financial services to entertainment to e-commerce, and that ought to be addressed holistically in the interest of individuals throughout Europe and the world. One particular company–and certainly one particular merger–should not be singled out.”

–Peter Fleischer, Google’s Global Privacy Counsel

The Federal Trade Commission’s decision to approve Google’s proposed $3.1 billion acquisition of online ad-serving vendor DoubleClick without condition hasn’t exactly elicited resounding calls of huzzah! from the European Union. On the contrary, European parliamentarians seem out to spoil the deal.

At a hearing before the European Parliament’s Civil Liberties Committee to discuss the legality of search companies’ privacy policies, talk quickly turned to the acquisition and its potential impact on citizens’ online privacy. Seems a few of the EU’s top privacy regulators feel that IP, or Internet Protocol, addresses should be protected as personal information when they can be used to identify an individual on a computer network. Google, which uses IP addresses to identify users’ geographical location, among other things, disagrees.

After first upbraiding the committee for attempting to shoehorn a privacy case into a competition law review, Peter Fleischer, Google’s Global Privacy Counsel, pointed out that IP addresses aren’t always personally identifiable. “There is no black or white answer: Sometimes an IP address can be considered as personal data and sometimes not,” he said. “It depends on the context and which personal information it reveals.” And this is true to some extent, but becoming less so as we move toward Internet Protocol version 6 (IPv6).

Of course, were IP addresses to be categorized as personal information, Google would have a more difficult time delivering relevant search results and, more importantly, ads. Which, as Dutch parliamentarian Sophie in ‘t Veld pointed out is the real reason Google is arguing so vehemently against treating IP addresses as sensitive personal data. “The reason you want to have the data is because it gives you a competitive advantage,” she said. “It is business. I don’t think they can be completely disconnected. And we should discuss that side of things too. … Having that much information is market power.”