by Spencer S. Hsu and Cecilia Kang, Staff Writers
Washington Post
11 August 2009
The Obama administration is proposing to scale back a
long-standing ban on tracking how people use government Internet
sites with "cookies" and other technologies, raising alarms among
privacy groups.
A two-week public comment period ended Monday on a proposal by
the White House Office of Management and Budget to end a ban on
federal Internet sites using such technologies and replace it with
other privacy safeguards. The current prohibition, in place since
2000, can be waived if an agency head cites a "compelling need."
Supporters of a change say social networking and similar
services, which often take advantage of the tracking technologies,
have transformed how people communicate over the Internet, and
Obama's aides say those services can make government more
transparent and increase public involvement.
Some privacy groups say the proposal amounts to a "massive" and
unexplained shift in government policy. In a statement Monday,
American Civil Liberties Union spokesman Michael Macleod-Ball said
the move could "allow the mass collection of personal information
of every user of a federal government website."
Even groups that support updating the policy question whether
the administration is seeking changes at the request of private
companies, such as online search giant Google, as the industry's
economic clout and influence in Washington have grown rapidly.
Two prominent technology policy advocacy groups, the Electronic
Privacy Information Center and Electronic Frontier Foundation,
cited the terms of a Feb. 19 contract with Google, in which a
unnamed federal agency explicitly carved out an exemption from the
ban so that the agency could use Google's YouTube video player.
Contract Terms
The terms of the contract, negotiated through the General
Services Administration, "expressly waives those rules or
guidelines as they may apply to Google." The contract was obtained
by EPIC through a Freedom of Information Act request.
"Our primary concern is that the GSA has failed to protect the
privacy rights of U.S. citizens," EPIC Executive Director Marc
Rotenberg said. "The expectation is they should be complying with
the government regulations, not that the government should change
its regulations to accommodate these companies."
Cindy Cohn, legal director for Electronic Frontier Foundation,
called the contract "troubling."
"It appears that these companies are forcing the government to
lower the privacy protections that the government had promised the
American people," Cohn said. "The government should be requiring
companies to raise the level of privacy protection if they want
government contracts."
The episode recalls a dispute in January when critics
complained that a redesigned White House Web site featured
embedded Google YouTube videos -- depicting events such as the
president's weekly address -- that used tracking cookies. The
White House and Google later reassured users that they had stopped
collecting data.
But the current ban on cookies, according to senior OMB
officials, applies only to federal agencies and not third parties.
That means that a visitor to http://www.whitehouse.gov, for
example, isn't tracked by the government, but information about a
user who clicks on a YouTube video on the site could be tracked by
Google, according to a source at the company with knowledge of the
partnership with the Obama administration.
Google spokeswoman Christine Chen directed broader questions to
the government, but said in a statement that the White House use
of YouTube "is just one example of how government and citizens
communicate more effectively online, and we are proud of having
worked closely with the White House to provide privacy protections
for users."
GSA and White House officials would not answer questions,
releasing only a statement by OMB spokesman Kenneth Baer that said
the administration is committed to protecting users' privacy.
"That is why when we asked for public comment on a new cookie
policy, we specifically identified privacy considerations as a
main area of focus," Baer wrote.
In a May 28 letter responding to EPIC's public records request,
Zachariah I. Miller, a GSA presidential management fellow, said
"...GSA and the rest of the Government do take personal privacy
seriously and apply all existing privacy statutes and regulations
in this area."
Similar to Online Stores
Vivek Kundra, the government's chief information officer, and
OMB official Michael Fitzpatrick, wrote in a July 24 blog posting
that the policy review is intended to improve customer service by
allowing agencies to analyze how people use their sites and to
remember individual visitors' "data, settings or preferences."
Such use is similar to online stores' creation of personalized
"shopping cart" services that have won wide public acceptance.
The pair proposed that if the change is made, visitors be
clearly notified that tracking technologies are being used and
allow them to opt out without penalty. For technologies that track
users over more than a single Internet session, known as
"persistent identifiers," there would be higher levels of privacy
safeguards, they said.
EFF and another group, the Center for Democracy and Technology,
have said that the time has come to expand privacy safeguards to
new tracking technologies. At the same time, they say that the
cookie ban might be too broad, keeping the government from
improving its services for the public.