Illustration: John Hersey
Google Larry Page and Sergey Brin, the two former Stanford geeks who founded the company that has become synonymous with Internet searching, and you’ll find more than a million entries each. But amid the inevitable dump of press clippings, corporate bios, and conference appearances, there’s very little about Page’s and Brin’s personal lives; it’s as if the pair had known all along that Google would change the way we acquire information, and had carefully insulated their lives—putting their homes under other people’s names, choosing unlisted numbers, abstaining from posting anything personal on web pages.
That obsession with privacy may explain Google’s puzzling reaction last year, when Elinor Mills, a reporter with the tech news service cnet, ran a search on Google CEO Eric Schmidt and published the results: Schmidt lived with his wife in Atherton, California, was worth about $1.5 billion, had dumped about $140 million in Google shares that year, was an amateur pilot, and had been to the Burning Man festival. Google threw a fit, claimed that the information was a security threat, and announced it was blacklisting cnet’s reporters for a year. (The company eventually backed down.) It was a peculiar response, especially given that the information Mills published was far less intimate than the details easily found online on every one of us. But then, this is something of a pattern with Google: When it comes to information, it knows what’s best.
From the start, Google’s informal motto has been “Don’t Be Evil,” and the company earned cred early on by going toe-to-toe with Microsoft over desktop software and other issues. But make no mistake. Faced with doing the right thing or doing what is in its best interests, Google has almost always chosen expediency. In 2002, it removed links to an anti-Scientology site after the Church of Scientology claimed copyright infringement. Scores of website operators have complained that Google pulls ads if it discovers words on a page that it apparently has flagged, although it will not say what those words are. In September, Google handed over the records of some users of its social-networking service, Orkut, to the Brazilian government, which was investigating alleged racist, homophobic, and pornographic content.
Google’s stated mission may be to provide “unbiased, accurate, and free access to information,” but that didn’t stop it from censoring its Chinese search engine to gain access to a lucrative market (prompting Bill Gates to crack that perhaps the motto should be “Do Less Evil”). Now that the company is publicly traded, it has a legal responsibility to its shareholders and bottom line that overrides any higher calling.
So the question is not whether Google will always do the right thing—it hasn’t, and it won’t. It’s whether Google, with its insatiable thirst for your personal data, has become the greatest threat to privacy ever known, a vast informational honey pot that attracts hackers, crackers, online thieves, and—perhaps most worrisome of all—a government intent on finding convenient ways to spy on its own citizenry.
It doesn’t take a conspiracy theorist to worry about such a threat. “I always thought it was fertile ground for the government to snoop,” CEO Schmidt told a search engine conference in San Jose, California, in August. While Google earned praise from civil libertarians earlier this year when it resisted a Justice Department subpoena for millions of search queries in connection with a child pornography case, don’t expect it will stand up to the government every time: On its website, Google asserts that it “does comply with valid legal process, such as search warrants, court orders, or subpoenas seeking personal information.”
What’s at stake? Over the years, Google has collected a staggering amount of data, and the company cheerfully admits that in nine years of operation, it has never knowingly erased a single search query. It’s the biggest data pack rat west of the NSA, and for good reason: 99 percent of its revenue comes from selling ads that are specifically targeted to a user’s interests. “Google’s entire value proposition is to figure out what people want,” says Eric Goldman, a professor at Silicon Valley’s Santa Clara School of Law and director of the High Tech Law Institute. “But to read our minds, they need to know a lot about us.”
Every search engine gathers information about its users—primarily by sending us “cookies,” or text files that track our online movements. Most cookies expire within a few months or years. Google’s, though, don’t expire until 2038. Until then, when you use the company’s search engine or visit any of myriad affiliated sites, it will record what you search for and when, which links you click on, which ads you access. Google’s cookies can’t identify you by name, but they log your computer’s IP address; by way of metaphor, Google doesn’t have your driver’s license number, but it knows the license plate number of the car you are driving. And search queries are windows into our souls, as 658,000 AOL users learned when their search profiles were mistakenly posted on the Internet: Would user 1997374 have searched for information on better erections or cunnilingus if he’d known that AOL was recording every keystroke? Would user 22155378 have keyed in “marijuana detox” over and over knowing someone could play it all back for the world to see? If you’ve ever been seized by a morbid curiosity after a night of hard drinking, a search engine knows—and chances are it’s Google, which owns roughly half of the entire search market and processes more than 3 billion queries a month.
And Google knows far more than that. If you are a Gmail user, Google stashes copies of every email you send and receive. If you use any of its other products—Google Maps, Froogle, Google Book Search, Google Earth, Google Scholar, Talk, Images, Video, and News—it will keep track of which directions you seek, which products you shop for, which phrases you research in a book, which satellite photos and news stories you view, and on and on. Served up à la carte, this is probably no big deal. Many websites stow snippets of your data. The problem is that there’s nothing to prevent Google from combining all of this information to create detailed dossiers on its customers, something the company admits is possible in principle. Soon Google may even be able to keep track of users in the real world: Its latest move is into free wifi, which will require it to know your whereabouts (i.e., which router you are closest to).
Google insists that it uses individual data only to provide targeted advertising. But history shows that information seldom remains limited to the purpose for which it was collected. Accordingly, some privacy advocates suggest that Google and other search companies should stop hoarding user queries altogether: Internet searches, argues Lillie Coney of the Electronic Privacy Information Center, are part of your protected personal space just like your physical home. In February, Rep. Edward Markey (D-Mass.) introduced legislation to this effect, but Republicans have kept it stalled in committee. Google, which only recently retained a lobbying firm in Washington, is among the tech companies fighting the measure.
When I first contacted Google for this story, a company publicist insisted I provide a list of detailed questions, in writing; when I said that I had a problem with a source dictating the terms for an interview, he claimed that everyone who covers Google—including the New York Times and the Wall Street Journal—submits advance questions. (A Times spokeswoman told me the paper sees no ethical problems with such a procedure, though individual reporters’ decisions may vary; an editor in charge of editorial standards at the Journal said the same thing.) The Google flack assured me that this was so he could find the best person for me to talk to—more information for Google, so that Google could better serve me.
Eventually he agreed to put me in touch, sans scripted questions, with Nicole Wong, Google’s associate corporate counsel. I asked her if the company had ever been subpoenaed for user records, and whether it had complied. She said yes, but wouldn’t comment on how many times. Google’s website says that as a matter of policy the company does “not publicly discuss the nature, number or specifics of law enforcement requests.”
So can you trust Google only as far as you can trust the Bush administration? “I don’t know,” Wong replied. “I’ve never been asked that question before.”
