Nearly undetectable tracking device raises concern
            By Stefanie Olsen
            Staff Writer, CNET News.com
            July 12, 2000, 2:05 p.m. PT

            A widely used, yet virtually undetectable, means of tracking
            people's Internet surfing habits is joining its better-known
cousin,
            the cookie, as the subject of several lawsuits and a privacy
            initiative by the government.
            The technology, often called Web bugs or 1-pixel gifs, is
prompting further concern that the once-freewheeling Web is becoming more
like an Orwellian Big Browser.

Like cookies, Web bugs are electronic tags that help Web sites and
            advertisers track visitors' whereabouts in cyberspace. But Web
bugs are invisible on the page and are much smaller, about the size of the
period at the end of this sentence.
            A Web bug "is like a beacon, so that every time you hit a Web
page it sends a ping or call-back to the server saying 'Hi, this is who I
am and this is where I am,'" said Craig Nathan, chief technology officer
for privacy start-up Meconomy.com and former technical
            liaison for Personify.
            Most computers have cookies, which are placed on a person's
hard drive when a banner ad is displayed or a person signs up for an
online service. Savvy Web surfers know they are being tracked when they
see a banner ad. But people can't see Web bugs, and anti-cookie filters
won't catch them. So the Web bugs wind up tracking surfers in areas online
where banner ads are not present or on sites where people may not expect
to be trailed.
            That was the case last month when the White House ordered its
drug policy office to stop using Web bugs on the government's anti-drug
site Freevibe.com. Following the mandate, the Clinton administration
issued strict new rules regulating federal use of the technology, which
can surreptitiously collect personal information.
            Web bugs can "talk" to existing cookies on a computer if they
are both from the same Web site or advertising company, such as
            DoubleClick, which uses bugs and dominates the online
advertising market.
            That means, for example, that if a person visited Johnson &
            Johnson's YourBaby Web site, which uses DoubleClick Web bugs,
the bug would read the visitor's DoubleClick cookie ID number, which
            shows the past online behavior for that computer. The
information would then go back to DoubleClick.
            Ad networks and agencies say cookies and other tracking
devices are used to help both consumers and Web sites. Under fire from
privacy advocates, ad executives have consistently said the information
            collected is kept private and is the sole property of the
company that is being advertised.
            The "evil" of Web bugs
            But privacy advocates see an insidious side to the tiny tag.
            "The danger of that is that if you were going to a site on
yeast
            infections, the second it loads up, before the screen loads,
            somewhere in the world the fact that you visited the site is
now
            registered. That's the evil of Web bugs," said Ira Rothken, a
lawyer at the technology-oriented Rothken Law Firm, based in San Rafael,
Calif.
            The problem is magnified, he said, when a company can tie your
            cookie number to personal identifying information such as a
phone number and address.
            This became a real concern last November when DoubleClick
bought
            Abacus Direct, a company that holds detailed consumer profiles
on more than 90 percent of U.S. households. Syncing DoubleClick's
            database about Net surfers with personally identifiable data
set off a firestorm of criticism, as well as a government inquiry.
            DoubleClick has since dropped plans to link the databases
until
            there is agreement between government and the industry on
            appropriate standards.
            "Web bugs were developed to not let you know (you're being
tracked)  and for the simple design aspect of an invisible dot," Nathan
said.  Rothken filed a consumer Internet privacy suit against DoubleClick
in February, and there are three other similar suits against the ad
network.
            Also in February, the state attorney general in Michigan began
legal proceedings against DoubleClick. The attorney general claimed the
company had violated consumer protection laws by not telling Web
            visitors that DoubleClick regularly put cookies and Web bugs
on
            their hard drives.
            The other side of the coin is that Web bugs, like cookies, can
be useful. For consumers, cookies can store passwords and other sign-on
information. For Web sites, Web bugs can help better manage content by
knowing what is effective. They also give online ad agencies a way to
track campaigns when a banner isn't present.
            Bang for their advertising buck
            "Using traffic-log cookies or clear gifs is a way for
advertisers to learn whether they're getting the most bang for their
advertising dollar," said Jules Polonetsky, chief privacy officer at
            DoubleClick. "It's a tool that does not provide any personal
            information but allows the Web site to learn how users are
visiting different areas of their site and learn which ads brought them to
their site.
            "We are contractually obligated to maintain that information
solely for the use of the site; it's critically private information,"
            Polonetsky said.
            Web bugs have sparked much criticism from Net experts of late.
                  Online privacy
            Richard Smith, a computer security expert, said that a wide
variety of medical and pornography sites are using the tags. He said there
are Web bugs on such sites as Procrit, which has information about AIDS
drugs, and iFriends.net, an online version of an adult peep
            show.
            Smith has set up a Web site that searches for Web bugs. A
quick
            search on that site for such bugs issued by DoubleClick, for
            example, returned more than 80,000 hits.
            Web bugs can also be used in email. For example, companies can
send a bulk HTML email newsletter that has Web bugs, which will determine
how many people read the letter, how often they read it, and whether they
forward it to anyone. The email "would include your email
            address in the URL or include a coded ID or encrypted email
address to track when you opened it," Smith said.
            "Web bugs are like carbon monoxide for Internet privacy," said
Jason Catlett, a privacy advocate with Junkbusters. "You can't see them,
but they can damage your privacy anyway."


________________________________________________________________________
________________________________________________________________________


VICUG-L is the Visually Impaired Computer User Group List.
To join or leave the list, send a message to
[log in to unmask]  In the body of the message, simply type
"subscribe vicug-l" or "unsubscribe vicug-l" without the quotations.
 VICUG-L is archived on the World Wide Web at
http://maelstrom.stjohns.edu/archives/vicug-l.html