CHAPTER
TEN
Waking the Government
Bear
While a full chorus of incensed media—advertising
agencies, publishers, newspapers, television and telephone
companies, and tech companies like Microsoft—complained about the
growing power of Google, the Bush administration, steadfast in its
belief that a free market provides its own regulation, was silent.
Stepping into this breach was Brooklyn-born public interest
advocate Jeffrey Chester, executive director of the Center for
Digital Democracy in Washington, D.C. Chester founded this
two-person organization with an annual budget of two hundred
thousand dollars in 2001. He has mounted a ferocious campaign to
induce the world’s governments to handcuff Google. Its first
petition was filed before the FTC in the fall of 2006, prodding
them to investigate how online marketing encroaches on privacy. In
the spring of 2007, Chester, then sixty-two, began to press for an
antitrust investigation of the rapid consolidation of the online
advertising sector, and urged the FTC to reject Google’s proposed
merger with DoubleClick. He petitioned the European Commission to
do the same.
A voracious reader of
trade publications, Chester became obsessed by what he saw as the
pernicious power of the Internet to compile data on consumers.
Chester is difficult to ignore. His Brooklyn-accented voice is loud
and piercing. He hounds people. He speaks passionately and rapidly,
leaping in midsentence from privacy to monopoly to a conversation
he had that morning with an FTC staffer. He wears horn-rims and
short-sleeved shirts with the neck open and the pockets bristling
with pens. His tiny office on Connecticut Avenue is adorned with
movie posters that assail McCarthyism and corporate power. He has
little regard for the advertising industry, but knows that if he
railed against commercialism and consumerism it would open him up
to attack as a left-wing former social worker, which, of course, he
is. So he sticks to the privacy issue. “The basic model for
interactive advertising,” he said, “combines this very powerful
data-collection business designed to know your interests in a
daily, updated way that is then utilized to create very powerful
multimedia to get you to behave in some fashion, whether it’s
buying a product or liking a brand.”
Marc Rotenberg, the
executive director of the Electronic Privacy Information Center,
rents a single office to Chester’s organization and works just down
the hall. He is in nearly all ways Chester’s opposite. He wears
charcoal business suits and has degrees in law and computer
science; no pens can be found in his shirt pockets. But he and
Chester work closely together to advance privacy protection
measures. Rotenberg believes the central question should not be, Is
Google invading people’s privacy? Rather, it should be, Why does
Google need to collect all of this information?
GOOGLE’S SERVERS NOW
CONTAIN a tremendous amount of data about its users, and this
database grows exponentially as search and a variety of Google
services multiply. With the latest techniques to discern what
really motivates consumers—often categorized as “behavioral
targeting”—companies and advertisers will know even more. Some
forms of such targeting are widely seen as helpful, such as when
Amazon extrapolates from the browsing and purchase histories of a
customer to recommend books. Other forms might be alarming to the
lay consumer. New technology will allow cameras built into
television set-top boxes to be armed with algorithmic models that
read our facial expressions and tell advertisers what we do and
don’t like; Nielsen is investing in brain reading—called
NeuroFocus—which is meant to take the guessing out of why consumers
react to what they see on a screen or read or listen
to.
New smart phones
collect enormous amounts of data. Mobile telephone companies gather
and store digital data on calls made and received and how long each
lasted. In addition, the chips in the phone’s GPS track a user’s
location, the length of stay, and other mobile users she is in
touch with. Tapping this sort of data is known as reality mining,
and is a cousin to Brin’s data mining. Although telephone companies
don’t share the names of customers, they have begun to sell this
data to companies seeking to market products. Phorm, an American
company with offices around the world, proposed to go one step
further, approaching telephone and broadband Internet service
providers with software that tracks each consumer’s online
activities, so that a nameless portrait of each consumer can be
created. In return for supplying the data, the telephone and cable
companies can open a new revenue spigot. By late 2007, Phorm had
done three deals in England that yielded data on two-thirds of
Britain’s broadband households.
Publicity about Phorm
aroused the ire of Tim Berners-Lee, a senior researcher at MIT and
the inventor of the World Wide Web. Because Berners-Lee refused to
patent his invention, to cash in financially, or to become a
talk-show celebrity, his opinion carries heft. In a rare interview
with the BBC, Berners-Lee expressed outrage: “I want to know if I
look up a whole lot of books about some form of cancer that that’s
not going to get to my insurance company and I’m going to find my
insurance premium is going to go up by 5 percent because they’ve
figured I’m looking at those books.”
The data did not
belong to Phorm or the telephone or cable company, he said. “It’s
mine—you can’t have it. If you want to use it for something, then
you have to negotiate with me. I have to agree.” This seemed to be
the view of many European Union officials, for they were gathering
evidence to determine whether to impose restrictions on this
practice.
Because the financial
rewards will be so huge if corporations can capture and use this
data, pressure to do so will increase. Describing the effort to
track the identity of an online user, Irwin Gotlieb invokes an
imaginary user searching for an SUV: “If you’re searching for an
SUV and you price out a couple of them and you go to a site that
requires you to register, I now have your name. If you want
pricing, dealer costs, you’ve got to give me your name, your e-mail
address. Now as soon as you do that, we’ve got more on you. There
are lots of ways we can track you. If I’ve identified you with your
address, I can go to DMV records and see what cars you own. I can
then go to Experian and see what your credit history is. And if I
find out you’re in the last month of a thirty-six-month lease on a
Land Rover ...” He doesn’t finish the sentence but smiles, as if
he’s trapped his prey. “I can’t do that today. In a few years I
can.”
There’s no question
that new technologies spur ways to improve services, and also to
quietly redefine privacy. A home becomes less of a castle. Google’s
Street View has cameras on city streets that reveal street activity
and traffic—and also license plate numbers and the faces of a
passersby. If you know the address of a celebrity (or an old
girlfriend), it allows close-ups. Similar closed-circuit television
cameras on streets and in stores help police solve crimes, but
might also catch an old paramour or celebrity smooching. Cell
phones help parents track the location of their children, but can
track much more. Part of YouTube’s appeal is that it shares private
moments. Facebook is a glass house, a complaint sometimes voiced by
parents of teenagers who share their sexual exploits. Marketing
companies create ads that annoyingly pop up when people are online,
offering a premium—free telephone calls—in exchange for permission
to monitor your activities.
Google’s Web site
acknowledges that it collects information about its users, but not
names or other personally identifying information. It does,
however, collect the names, credit card information, telephone
number, and purchasing and credit history of those who sign up for
such features as Google Checkout, a service that enables customers
to make online purchases. In its five-page Checkout privacy policy,
Google said that it may also “obtain information about you from
third parties to verify the information you provide.” Google said
it “will not sell or rent your personal information to companies or
individuals outside Google”—unless individuals give their “opt in
consent.” But even if consumers choose not to opt in, Google still
retains a wealth of personal information, which it is free to use
to better target search or YouTube advertising. This data, mingled
with its search data and the data gathered by DoubleClick, induces
privacy anxiety. Companies like eBay and Amazon.com, among others,
also retain credit card and other personal information, but there
is a difference: Google uses this data to assist advertisers, and
eBay and Amazon do not have advertisers to assist.
This is where the
specter of Big Brother enters the discussion. “In 1984, Winston
Smith knew where the telescreen was,” observed Lawrence Lessig. “In
the Internet, you have no idea who is being watched by whom. In a
world where everything is surveilled, how to protect
privacy?”
Big Brother comes in
different guises. Under the federal Patriot Act rushed to passage
after 9/11, the executive branch can, without a warrant or users’
knowledge, gain access to what Americans e-mail, search, read, say
on the telephone, watch on YouTube, network with on Facebook, or
purchase online. There are tens of millions of surveillance cameras
on our streets and in buildings. Candidates for public office can
be harmed by damaging leaks to reporters of the most private
information, as nearly happened to Supreme Court nominee Clarence
Thomas when his in-store video rentals were leaked, suggesting he
was partial to pornographic films. Advertisers can pay Google and
other companies to access better targeting data. Telephone or cable
companies can offer free services in exchange for a record of a
consumer’s every click, encoding the knowledge of every song they
listen to, product they buy, ad they like. In recent years, AOL
(among other companies) was publicly embarrassed when it extracted
and shared the names of some users from the Internet protocol
address found on every browser on every computer.
Google may be viewed
with suspicion by many media industries, but it enjoys a
well-deserved reputation for earning the trust of users. In its
2007 annual ranking of the world’s most powerful brands, the
Financial Times and the consulting firm
Millward Brown awarded Google a number one rating. Still it is hard
to imagine an issue that could imperil the trust Google has
achieved as quickly as could privacy. One Google executive
whispers, “Privacy is an atomic bomb. Our success is based on
trust.” The Interactive Advertising Bureau’s Randall Rothenberg
employs a different image: “Privacy is one of those third rails
with unknown amounts of electricity in it. People think about
advertising and worry. That’s part of America’s don’t tread on me
attitude.” Yet Rothenberg is unsure about the amount of electricity
in the privacy issue because he is acutely aware that Americans
hold contradictory attitudes toward privacy; they tend to distrust
governments, businesses, or advertisers that can spy on them, yet
“if they really cared enough about privacy they’d never have credit
cards. They’d never subscribe to cable TV” They wouldn’t parade
their most private thoughts on Facebook. So how does a company like
Google locate and not step on the third rail?
To find that third
rail requires a degree of sensitivity not always found in
engineers. Yet Google has at times been sensitive. When, in 2006,
the Justice Department subpoenaed a number of Internet companies to
turn over all child pornography search queries, Google, opposing
the request as a “fishing expedition,” took the U.S. government to
court and won. (The judge ruled that Google had to turn over fifty
thousand suspicious URLs, but none of its user’s names.)
“Unfortunately,” said Schmidt, “our competitors”—including Time
Warner, Yahoo, and Microsoft—“did not hold the same position, and
complied.” He is outspokenly critical of the Patriot Act, which he
believes violates privacy and grants the president too much power.
Schmidt implicitly agrees that privacy is a do-not-step-on third
rail: “If we violate the privacy of our users, then we’ll be
hosed.”
Trust is essential to
Google, as it is to much of modern commerce. If we didn’t trust
waiters or Amazon, we couldn’t use credit cards. If banks didn’t
trust that we’d pay back loans, they would not grant mortgages.
Sergey Brin notes that users don’t like intrusive ads or junk mail,
and Google deserves credit for siding with users against these,
even sacrificing revenues to do so. From a user’s perspective,
Google is not wrong when it says the more information it has about
our search histories, the better the search results will be because
it can anticipate a user’s intent. And it is also undeniably true
that many users search the ads to comparison shop. “We think of the
ad as content,” said Google’s vice president of engineering, Jeff
Huber. The portrayal of Google as Big Brother frustrates people who
work there. “It’s a fear of the possibility rather than the
reality,” said Huber.
FEAR OF “THE
POSSIBILITY” was enough to motivate privacy advocates. In May 2007,
the Bush administration decided that the Federal Trade Commission
(FTC), not the Justice Department, would look at whether the merger
might violate antitrust laws, and the commission quietly began a
preliminary investigation. Chester pushed for the FTC to broaden
its probe to include privacy, and the agency scheduled a town hall
meeting in November to explore those issues. “I got the hearing,” Chester boasted. “There’s
nobody watching the store.”
Chester is not the
stereotypical lobbyist, the ingratiator, the affable fund-raiser,
the guy you’d join for a drink or a steak dinner at the Palm.
Chester annoys people, concedes a senior FTC staffer, “but he is
responsible for the hearing.” Chester helped persuade Democratic
senators on the Judiciary Committee to conduct a one-day hearing in
September 2007 focused on the merger and online advertising.
Knowing that European governments have more stringent privacy
protections, he urged the EU to hold up the merger until Google
better explained its privacy policies. Chester stayed in touch with
government regulators elsewhere. He filed additional complaints
with the FTC. He had no expectation that the FTC would reject the
merger. His best hope was that the FTC would compel Google to admit
that its warehouse of data required more stringent privacy
safeguards. Chester and Rotenberg were more hopeful that the
European Union would reject the merger; and privately, Google
officials conceded that an EU rejection would scuttle the
deal.
By the end of 2007,
it was apparent that privacy issues were gaining traction, spurred
by a crescendo of news stories about real or potential invasions of
privacy. Many were chilled when President Bush declared that under
the Patriot Act he did not need judicial or congressional approval
to wiretap the phones of anyone the executive branch suspected of
consorting with, or knowing, alleged terrorists. It was revealed
that telephone companies, at the request of the Bush administration
but without court approval, turned over oceans of data concerning
the phone calls and e-mails of individuals.
There is often an
inherent conflict between privacy and Google’s belief that data is
virtuous. Eric Schmidt, as we’ve seen, said that the more Google
knows about a user, the better the search results. His and the
founders’ ideal? For Google to know enough to be able to anticipate
the user’s true intent in a search query, eventually getting to the
point where Google could improve the user’s experience by supplying
a single answer to a question. Better targeted ads, Google
believes, serve the consumer as well as the advertiser. In an
October conference call with analysts to discuss Google’s third
quarter and its new products, Schmidt said, “We’re working on
expanding our breadth of ads, offering all sorts of new types of
ads—gadget ads, video ads, others coming. And each of these
initiatives gives advertisers new and interesting ways to build
relationships with their customers. So by building these deeper ad
solutions, we really can deliver more value.” More “types of ads”
equals more data, which equals more assistance to advertisers,
which can be a service to consumers, but also an invitation to
nibble at privacy constraints. Schmidt insists Google would never
risk violating user privacy because Google’s success pivots on user
trust. Rotenberg counters, “If people knew what Google was doing,
they’d lose trust.”
In a voice as steady
as a dial tone, Schmidt said Google users can click to “opt out” of
allowing Google to track its cookies by clicking on the Privacy
choice on the Google home page and following the instructions, a
feature most users are probably not aware of or have a difficult
time finding. Rotenberg, Chester, and others say that instead,
Google should allow users to opt in, meaning that they would have
to actively volunteer their cookies. That would be a mistake,
Schmidt said, because the quality of a Google search would be
inferior if it stored none of the cookie data; that’s what helps
Google better answer a search question. Without information about
the user, Google would not be able to narrow search results based
on prior searches. Without a cookie, an American living in Paris
would receive search results in French, not English. Schmidt
disputes the notion that advertisers have become as important to
Google as the user, reciting the company’s official first two
principles: One is “the quality of the search as seen by the end
user. The second one is the quality of the ads as seen by the end
users, not by the advertisers.”
When asked why
consumers should trust that Google would not abuse the private data
it collects, Sergey Brin in 2007 told me that the fears people have
are tied to a distaste for advertising and to a fear of Big
Brother, which is sometimes “irrational.” He wondered: “How many
people yesterday do you think had embarrassing information about
them exposed as the result of some cookie? Zero. It never happens.
Yet I’m sure thousands of people had their mail stolen yesterday
... I do think it boils down to irrational fears that all of a
sudden we’d do evil things.”
Irrational or not,
Google was assailed from many sides and compelled to play an
unaccustomed role: defense. Nick Grouf, CEO of Spot Runner, an
advertising/marketing agency that counted among its investors
Martin Sorrell’s WPP Group, believed Google was engaged in too many
battles. He said that traditional media woke up to the Google
threat not when the company did its IPO or was sued by book
publishers, but when it bought YouTube. “When you pay $1.6 billion
for a site that is on the cover of every newspaper and magazine,
and is the centerpiece of the zeitgeist as the future of
media”—suddenly Google was widely perceived as a media company. By
2006 and into 2007, Grouf said, Google was battling with television
and newspapers and book publishers and Microsoft and eBay and
advertising agencies. “It’s hard to compete on all fronts. And
people start to whisper: ‘These guys have gargantuan
ambitions.’”
IN NOVEMBER, the FTC
held a two-day town hall meeting on privacy, a series of tame panel
discussions that became more a seminar than an inquisition,
disappointing Jeff Chester. The commission decided that the
often-baffling issue of privacy would be excluded from the decision
of whether to approve Google’s acquisition of DoubleClick. The
focus, instead, was on whether the marriage was anticompetitive. It
was difficult to argue that the merger harmed competition when,
within months, companies such as Microsoft and Yahoo and AOL and
the WPP all acquired digital advertising companies of their own.
The FTC prefers “to wait for a violation before we act,” an agency
official said on the eve of the approval of the merger. The EU did
compel Google to make concessions and to tighten its privacy
policies, but it, too, would approve the merger.
By mid 2007, Google
was worried about the many restive bears it had provoked. It began
to reach out to Washington. To allay privacy concerns, the company
announced that it would reduce from two years to eighteen months
the information it keeps in its database about the Web search
histories of its users. Claiming that privacy laws were out of
date, Google put out a press release proposing uniform
international privacy rules and perhaps laws that recognized how
the Internet and technology posed new privacy challenges. Instead
of one “uber cookie” that permanently tracks a user, Google said it
was experimenting with “crumbled cookies” that would disappear over
time.
The public battles
probably made Google’s executives somewhat wiser. Google was only
guilty, they believed, of naivete, not arrogance. “The product
brand was very strong,” said Alan Davidson, Google’s senior
director of government relations and public policy, who is a
computer scientist as well as a lawyer and who oversees Google’s
Washington office. “The political brand was very weak. Because we
were not here to define it, it was being defined by our enemies.”
He paused a moment, and added, “Enemy
is a strong word. It was being defined by our competitors.” Gigi
Sohn, the president and cofounder of Public Knowledge, a nonprofit
organization that lobbies for both an open Internet and more
balanced copyright laws, said that like many Silicon Valley
companies, Google chose to have a smaller presence in the nation’s
capital. But Google was more extreme, she said. “They were almost
alone among Silicon Valley companies in failing to recognize that
you have to play in the sandbox. If you want progressive spectrum
policies, the free market does not ensure that.”
Google’s one-man
operation in Washington expanded in 2007 to include twenty-two
staffers. Among them were Jane Horvath, a former senior privacy
attorney in the Bush administration’s Justice Department; Johanna
Shelton, former senior counsel to Democrat John Dingell, then
chairman of the House Energy and Commerce Committee; Robert
Boorstin, a former speechwriter for President Bill Clinton; and
Pablo Chavez, former chief counsel to Republican senator John
McCain. To advance its Washington agenda, Google had established
its own PAC (NETPAC), and soon hired three outside firms to lobby
on its behalf: the mostly Democratic Podesta Group; King &
Spalding, where Google relied on former Republican senators Connie
Mack and Dan Coats; and Brownstein Hyatt Farber Schreck, which had
recently hired Makan Delrahim, a former deputy assistant attorney
general who’d been in charge of the Antitrust Division in the
administration of George W Bush. “We’ve been under the radar, if
you will, with government and certain industries,” observed David
Drummond, the Google senior vice president who oversees all of the
company’s legal affairs and policy interaction with governments.
“As we’ve grown, we’re engaging a lot more.”
The most immediate
concerns of Google’s Washington office were the privacy issues
raised by the acquisition of DoubleClick. By the end of 2007,
Google was battling the image that it was the Microsoft of 2000.
“No question that people here regularly discuss Microsoft’s
experience and use that as a cautionary tale,” said Elliot Schrage,
the vice president of global communications and public affairs. On
the subject of Microsoft, Brin said, “Microsoft is a bit of an
unusual company. They don’t seem to like any of us being successful
in the technology space.”
So Google sought to
demonstrate that it was reaching out to media companies as well as
to Washington. To preserve copyrights, YouTube announced that it
was testing new antipiracy software to block unauthorized content
from being uploaded and viewed. In an ecumenical spirit, the word
partnership was constantly invoked by
Google executives. Repeatedly, they celebrated its “more than
100,000 partners,” the more than three billion dollars it then
distributed annually to Web sites and mostly small business
partners in its AdSense program. As 2007 progressed, said General
Electric’s Beth Comstock, relations with Google thawed and by
summer, G.E.’s NBC negotiated for Google to sell some of the
network’s remnant ads. “In the end, I was less concerned that
Google was out to replace our entire sales force,” she
said.
Google, however, was
still clear-eyed about the inevitable gap between its engineers and
traditional media. Google’s engineering prowess would, inevitably,
make the consumption of media and the selling of advertising more
efficient, Larry Page told me one afternoon as we sat in the small,
bare-walled conference room steps from his office. So was it
inevitable, I asked, that “Google would sometimes bump into
traditional media?”
Without hesitation,
he corrected me. “I would say, always,” he said in his deep
baritone, emitting a subdued chuckle. His was not a boast; rather,
it was a candid recognition of reality. He believes Google’s
engineers can eradicate most inefficiencies if given the time and
resources.
Page had reasons to
feel confident. Google had a great year in 2007. Measured by
growth, it was Google’s best year, with revenues soaring 60 percent
to $16.6 billion, with international revenues contributing nearly
half the total, and with profits climbing to $4.2 billion. Google
ended the year with 16,805 full-time employees, offices in twenty
countries, and the search engine available in 117 languages. And
the year had been a personally happy one for Page and Brin. Page
married Lucy Southworth, a former model who earned her Ph.D. in
bioinformatics in January 2009 from Stanford; they married seven
months after Brin wed Anne Wojcicki.
But Sheryl Sandberg
was worried. She had held a ranking job in the Clinton
administration before, joining Google in 2001, where she supervised
all online sales for AdWords and AdSense, and was regularly hailed
by Fortune magazine as one of the fifty
most powerful female executives in America. Sandberg came to
believe Google’s vice was the flip side of its virtue. “We’re an
engineering company in that products come first,” she said. “A lot
of the reason we’re winning is because our engineering is better.”
Reminded that she once was quoted as saying Google made a mistake
in not speaking to publishers and answering their questions before
announcing plans to digitize all books, she added, “Sometimes we
make mistakes here because we move too quickly”
Eric Schmidt would,
inadvertently, prove her point. In August 2007, he piloted his
Gulfstream G550 to Aspen, Colorado, to give the keynote speech at a
dinner held by the free-market oriented Progress and Freedom
Foundation. In the speech, he described four “basic principles,” as
he referred to them, that he believes are vital for media and tech
companies to embrace: freedom of speech, universal broadband
access, net neutrality, and transparency. Missing from his prepared
remarks were thoughts about privacy and copyright—and how far
Google might push the permissible boundaries. (When, for instance,
does anticipating a user’s wants become an intrusion? When does
fair use become copyright infringement?)
A few weeks later,
seated in his tiny conference room on the Mountain View campus, I
discussed that speech with Schmidt. Why, I asked, didn’t he mention
privacy in his Aspen talk?
There was a long
pause before he said, “No particular reason. It’s sort of a given.
If we violate the privacy of our users, they’ll leave
us.”
And why no mention of
copyright?
“Maybe it was the
altitude! I was just chatting away.” Besides, he said, copyright
“was not an absolute right” and had to be balanced by fair
use.
Isn’t it true that
Google wants to push the envelope on privacy and
copyright?
“That’s probably
correct,” Schmidt conceded. “If there’s a legal case, we’re going
to favor the legal one that favors users.”
“Google, if it were a
person, has all the flaws and all of the virtues of a classic
Silicon Valley geek,” said Columbia’s Tim Wu, who between jobs
teaching law worked for a spell in the Valley. “In some ways, they
are very principled.” He cited Google’s 20 percent time, saying
that few “money-crazed companies would allow” such a thing. “But
they have this total deaf ear to certain types of issues. One of
them is privacy.” Why? Because, he said, “They just love that data
because they can do neat things with it.”