Matt-Hughes.com Official Forums

Matt-Hughes.com Official Forums (http://www.matt-hughes.com/forums/index.php)
-   The Woodshed (http://www.matt-hughes.com/forums/forumdisplay.php?f=15)
-   -   White House exempts YouTube from federal privacy rules (http://www.matt-hughes.com/forums/showthread.php?t=47)

Spiritwalker 01-22-2009 08:24 PM

White House exempts YouTube from federal privacy rules
 
VERY Interesting

http://news.cnet.com/8301-13739_3-10147726-46.html



The new Web site for Obama's White House is already drawing attention from privacy activists and tech bloggers. While the initial focus has been on the site's policies relating to search engine robots, a far more interesting tidbit has so far escaped the public eye: the White House has quietly exempted YouTube from strict rules relating to the use of cookies on federal agency Web sites.

The new White House Web site privacy policy promises that the site will not use long-term tracking cookies, complying with a decade-old rule prohibiting such user tracking by federal agencies. However, the privacy policy then reveals that Obama's legal team has exempted YouTube from this rule (YouTube videos are embedded at various places around the White House Web site).

While the White House might not be tracking visitors, the Google-owned video sharing site is free to use persistent cookies to track the browsing behavior of millions of visitors to Obama's home in cyberspace.

No other company has been singled out and rewarded with such a waiver.

In a blog post back in November, I criticized the Obama transition team's Change.gov Web site for its use of embedded YouTube videos. At the time, I stated that the practice might violate long-standing federal rules that forbid federal agencies from using persistent tracking cookies on their Web sites. It turns out that I was wrong: the transition team was technically not a federal agency and thus not bound by the anti-cookie rules.

Now that Obama is president, his official Web site is required to abide by the cookie regulations. Furthermore, as of Wednesday afternoon, several YouTube videos have been embedded on the White House blog. As soon as a visitor surfs to one of the blog pages that contain a YouTube video, a long-term tracking cookie is automatically set in the user's browser--even for those users who do not click the "play" button.

Someone on the Obama legal team seems to have read my previous blog post, as they've modified the White House privacy policy to specifically exclude YouTube's tracking cookies from federal rules that would otherwise prohibit their use:

"For videos that are visible on WhiteHouse.gov, a 'persistent cookie' is set by third party providers when you click to play the video.

This persistent cookie is used by YouTube to help maintain the integrity of video statistics. A waiver has been issued by the White House Counsel's office to allow for the use of this persistent cookie."

YouTube and cookies
Each time a new user visits YouTube, a unique permanent tracking cookie is issued by the Web site to the user's browser, which it stores. Whenever the user later revisits YouTube, that cookie is transmitted to the video-sharing site, allowing it to identify users and monitor their video viewing habits.

YouTube is also able to set and access a user's tracking cookie when she visits a third-party Web page that has embedded a video stored on the YouTube site (such as a blog or other Web site), even if the user never clicks the play button.

The moment that the flash file containing the video player is downloaded from YouTube's servers and displayed in the user's browser as part of another Web page, the cookie is transmitted to YouTube's servers. Considering how widespread the practice of embedding YouTube videos has become, this gives Google an amazing amount of data on the Web-browsing activities of hundreds of millions of Internet users--many of whom may not realize that such tracking data is being collected.

The White House policy is not being followed
The YouTube-related text in the new White House privacy policy implies that not all users will be tracked by YouTube. The policy notes that:

"If you would like to view a video without the use of persistent cookies, a link to download the video file is typically provided just below the video."

As of Thursday morning, this statement is false.

In multiple tests by this blogger with both Internet Explorer and Firefox, merely visiting pages on the White House blog causes YouTube to set a long-term tracking cookie in the browser--even if the user does not press the play button to start the video. After eight months, this cookie will be automatically deleted by the user's browser--unless, of course, the user visits another Web page somewhere else on the Internet containing a YouTube-embedded video, in which case, the eight-month cookie clock is reset. Given how widespread YouTube video embeds have become, this cookie essentially lasts forever.

While it is obvious that I am rather critical of this entire affair, I am willing to give the Obama Web team the benefit of the doubt in one area: the fact that their current Web infrastructure does not deliver on the promises made by their privacy policy.

The Obama White House Web site is only two days old, and so it is certainly possible that the team simply hasn't gotten around to deploying a more privacy-preserving system for YouTube video embeds. Protecting users who do not click "play" from automatically receiving a cookie is certainly possible; the Electronic Frontier Foundation in 2008 released a wrapper script for YouTube videos that provided this very feature. Let us hope that the Obama team deploys such a technology in due course.

Can YouTube be justified as a "compelling need"?
For the past 10 years, federal agencies have been prohibited from using tracking cookies on their Web sites, except in a few special cases. The Office of Management and Budget rule M-03-22 states that:

"Agencies are prohibited from using persistent cookies or any other means (e.g., web beacons) to track visitors' activity on the Internet except .... [when there is] a compelling need."

The question we must now focus on is this: Is the need for Obama to use embedded videos hosted by YouTube (and not, say, another company's video-streaming platform that does not force cookies upon its users) a use that can be reasonably described as compelling?

Presumably, this has been justified on the basis that YouTube forces cookies on the visitors of any Web site that embeds one of its videos. However, while Joe or Jane blogger has no bargaining power with YouTube/Google, the federal government certainly does.

In just the past couple weeks, YouTube has launched dedicated pages for both the House and Senate to show off their own videos, and the site also recently started allowing users to directly download copies of some videos. This latter feature has not yet been widely deployed across the site, and is seems to be limited to videos posted by Obama's team.

Given the famously close connections between Obama and Google, you'd think his tech team could negotiate for a cookie-less way to embed videos. At a technical level, this would be an easy enough change, even if it would deny Google the ability to collect even more information on millions of Americans.

Cookies and other federal agencies
Finally, the new White House YouTube rule may have a far broader impact on the way that federal agencies use Web 2.0 content. Simply put, if another federal agency embeds a YouTube video in its Web site without first having the agency's legal team issue a waiver, have federal rules been violated?

Up until this week, federal agencies have been free to embed Web 2.0 content in their own sites without any real need to consider the privacy risks posed to end users. The fact that the White House Counsel has felt it necessary to issue such a waiver for YouTube videos appearing on the White House Web page could be reasonably interpreted to mean that such a waiver is now required for all embedded Web 2.0 content that might force cookies upon end users. This is certainly new legal ground.

Consider, for example, the Transportation Security Administration, which has posted YouTube videos to its blog numerous times over the past year. Its privacy policy makes no mention of YouTube cookies. Could this lead to issues for the TSA Web team, or perhaps even congressional investigations? Given my own history with TSA, I certainly hope so.

Tyburn 01-23-2009 07:33 PM

Does it matter if he wants to know who views his Videos?

I am pretty sure that most Governments have people who simply sift through search engines, videos and forums to discover what people are thinking and saying.

In this day and age we should all be accountable for what we say online, or watch online. So I dont understand what the issue is. :huh:

Hughes_GOAT 01-25-2009 05:55 AM

Quote:

Originally Posted by Tyburn
So I dont understand what the issue is. :huh:

that's because you're British...Americans do things differently.:punch:

Tyburn 01-25-2009 09:23 PM

Quote:

Originally Posted by Hughes_GOAT
that's because you're British...Americans do things differently.:punch:

:blink: They dont like being held accountable for what they watch????

He's surely just trying to find who looks at his website :huh: I think thats clever...:unsure-1:

Spiritwalker 01-25-2009 09:31 PM

Quote:

Originally Posted by Tyburn
:blink: They dont like being held accountable for what they watch????

He's surely just trying to find who looks at his website :huh: I think thats clever...:unsure-1:

Maybe it's nobody's business what I watch.

Tyburn 01-25-2009 09:41 PM

Quote:

Originally Posted by Spiritwalker
Maybe it's nobody's business what I watch.

Do you know of any insitution thats doesnt monitor what you watch online?

Besides...they cant see what you have watched online in general...just that you have seen THEM online.

This isnt about invading privacy...its about market research...Obama is interested in finding how many hits he's getting, and from what sections of societies...that might inform him who likes him and who doesnt...it might help him in future campaigns

I think your a bit niaeve if you dont ASSUME that you are being watched online...I'm sure Youtube keeps records of every single video I watch...on my profile it shows me how many I have watched...I bet the administrators can find which ones aswell

I suspect usually the information lies dormant because there are just so many users, using and watching...but if they HAD to, I bet they COULD. I always assume that with companies online...doesnt suprise me one bit that Obama can find the details of every computer that hits his site...I would assume that even if he told me that he didnt know, and couldnt know...he could.

You might find that Barack is just being more honnest about what every other president might have already done...not that many others have used youtube...the guy is a genius in conecting with people...he is USING the power of the Internet as if it were a political tool...why not...Damn sure his enimes already do!

Its a valuable tool...look at me, I've generated in the past three years a whole existence online practically...I do it because it saves money until I have enough to live properly again...He does it because he wants to know what is going on in the world so that he can plan and use strategies others maynot know the details of

IMHO...he's just doing his job to the best of his ability by using a tool thats powerful...but which noone else has properly utilized. :)

atomdanger 01-25-2009 10:16 PM

Quote:

Originally Posted by Spiritwalker
Maybe it's nobody's business what I watch.

Not maybe... definitely none of mine, or Obama's business.

Tyburn 01-25-2009 10:21 PM

Quote:

Originally Posted by atomdanger
Not maybe... definitely none of mine, or Obama's business.

:blink: they know....I honnestly believe they know...I dont think Obama is doing anything that anyone else doesnt who owns a site.

Dont you know what an IP address is?? Each computer has one...I think, its like a footprint that leaves its mark on everything you look at...I think...and cookies are like a websites IP in reverse...you leave them your IP, they leave you with a cookie

Trade your IP for a cookie...you know you can delete Cookies from you machine anyway...view his site...then delete his Cookie if your really that upset about it...I soooo dont think this is news...I soooo believe this happens EVERYWHERE...your details are probably safer with Obama...then someone who might try and steal your credit card details if you order anything online! :ninja:

Spiritwalker 01-25-2009 11:34 PM

Quote:

Originally Posted by Tyburn
Do you know of any insitution thats doesnt monitor what you watch online?

Besides...they cant see what you have watched online in general...just that you have seen THEM online.


Maybe you don't know what I do for a living?

Nothing online is anonymous. Nothing.

"Ohh I go to a library.. can't be seen there.."

Nah.. the library requires members to register for use, from there, all Internet usage can be seen and what then determined who went were..

Tyburn 01-26-2009 12:01 AM

Quote:

Originally Posted by Spiritwalker
Maybe you don't know what I do for a living?

Nothing online is anonymous. Nothing.

"Ohh I go to a library.. can't be seen there.."

Nah.. the library requires members to register for use, from there, all Internet usage can be seen and what then determined who went were..

I have nothing to hide. :ninja:

at least...what I do is all off the computer :laugh:


All times are GMT. The time now is 05:40 PM.

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.