ad info

Editions | myCNN | Video | Audio | Headline News Brief | Feedback  





Bush signs order opening 'faith-based' charity office for business

Rescues continue 4 days after devastating India earthquake

DaimlerChrysler employees join rapidly swelling ranks of laid-off U.S. workers

Disney's is a goner


4:30pm ET, 4/16









CNN Websites
Networks image

Burden of Proof

Is Your Privacy Lost in Cyberspace?

Aired July 20, 2000 - 12:30 p.m. ET


ROGER COSSACK, CO-HOST: Let's just say this, your mother-in-law is curious about your mental history. Your neighbors want to know how much you paid for your house. A kid browsing the Web wants to peek into your bank account. Can they?

And when you buy a fruit basket on-line, can advertising networks capture and sell your identity? Is your privacy lost in cyberspace? That's today on BURDEN OF PROOF.


SEN. JOHN EDWARDS (D), NORTH CAROLINA: People's every move on the Internet is being tracked then, and what happens is, it's being tracked and then that information is being stored in databases, and those databases are being sold many times without people's knowledge or permission.

ROBERT PITOFSKY, FEDERAL TRADE COMMISSION: Technology changes so rapidly that you see new opportunities for exploitation of people occurring much more rapidly than you would in the off-line marketplace.

JASON CATLETT, JUNKBUSTER.COM: Right now, we're living in a kind of a Wild West Web, where personal information is grabbed and there is very little protection for it.


ANNOUNCER: This is BURDEN OF PROOF with Roger Cossack and Greta Van Susteren.

COSSACK: Hello and welcome to BURDEN OF PROOF. Greta is off today.

The World Wide Web was born in university laboratories. A tight group of techies shared information about physics and computer science. Today, the explosion of information has energized free speech, powered the economy, and enabled market researchers to track your every move on the Web.

Advertising networks are even able to cross-link Web profiles with off-line purchasing histories. In other words, corporate America is watching and wants to know more about you. Joining us from Boston is Diane Cabell, a Berkman fellow at Harvard University's Center for Internet & Society. Joining us from San Francisco is Mark Wright of @Plan, an Internet marketing research firm. And here in Washington, Pervee Parekh (ph), Internet attorney George Clark, and Ari Schwartz of the Center for Democracy and Technology. And in the back, Brian Muse (ph), Jennifer Grant (ph) and Julie Eckert (ph).

Let's go right to you. Mark, is buying things on-line, is using the Internet like getting dressed in front of a mirror?

MARK WRIGHT, INTERNET MARKETING RESEARCHER: Yes, it is. It is the electronic equivalent of getting up in the morning, getting dressed in front a mirror, and having somebody behind that glass looking at everything you do.

COSSACK: And what is it that people and companies and corporations and seekers can find out about you from your use of the Internet?

WRIGHT: They can monitor precisely where you go on-line, when you do it, and how you are doing things on-line.

COSSACK: And what information do they find out?

WRIGHT: Pretty much, they monitor what we call your entire click stream. They monitor what specific sites you go to, how long you spend there, what your purchasing, and what your basic likes and dislikes are, as it relating to your on-line surfing behavior.

COSSACK: All right, well, let's go into some particulars, can they find out information about my bank account?

WRIGHT: Yes, they can. Yes, they can. I mean, I don't think consumers realize how much in the old bricks-and-mortar world that people could -- how much information that people could amass about themselves. However, on-line, with a few just clicks of a mouse, you can amass an awful lot of information.

COSSACK: Well, for example, you can find out about my bank account. Can you find out about whether or not I buy certain kinds of products?

WRIGHT: Yes, you can. Whenever you purchase something on-line that information is typically captured, put into databases, and often resold to other companies.

COSSACK: Diane, now you have all this information about me. What do you do with it, if you are a corporation? and how do you use it?

DIANE CABELL, CENTER FOR INTERNET & SOCIETY, HARVARD UNIVERSITY: I would use it -- I would market it, I would sell it. I would offer it to the kinds of places that would like to know whether I'm buying dresses from The Gap versus, you know, Neiman-Marcus. I would use it, not just general corporate people, but people you don't know can use it. They can access it just as easily as a corporation can. In fact, if they are operating illegally they can get more than a corporation can get. They can find out if you bought three new appliances, a new TV and a new computer, and say: Hey, there's a place we might want to hit and send our burglary team by.

COSSACK: Mark, how does this work? How is it that someone can find out this information about me just from my use of the Internet, you know, suppose I want to buy a fruit basket, or suppose I want to buy something on-line, how does it work?

WRIGHT: Often when you go on-line, a passive electronic tracking agent, typically called a cookie, is attached to you, but really more informally attached to your PC, and it monitors precisely where you go, and even if you go off-line, get off the computer, when you sign back on, automatically that cookie, if you will, is reattached and monitors precisely what you are doing.

COSSACK: How does that cookie get there?

WRIGHT: It is just a piece of software code that attaches on through -- really just through the digital networks available on-line.

COSSACK: Well, you know, someone has to put it on-line. I mean, someone has to install it. Does it come with your computer? Does it come in the program that's in your computer? Where does this cookie come from?

WRIGHT: There are a number of companies that specialize in those sorts of passive tracking systems.

COSSACK: But what I'm suggesting to you is I understand there are companies, but I mean, does it come with the program I buy? Suppose I'm on the Internet and I want to buy that fruit basket, I mean, where does this cookie comes from?

WRIGHT: Typically what happens is it is attached when you go to a specific Web site. Let's say that you so to an on-line retailer that sells clothes. Typically, your cookie would be attached at that point in time, and then tracks where you go.



COSSACK: Is there something that tells me this cookie is around?

CABELL: Absolutely. You've got a file on your own computer called "cookies," when you want to get rid of them, you just use the find feature, find the cookie file, and delete it.

COSSACK: And what would that do?

CABELL: It means that you won't be familiar to that site you shopped on before. So if you have registered at, and given them all your credit card number so that you can go back without having to reenter that data, you will have to reenter everything again. They won't know you when you return.

COSSACK: And Diane, what about the most personal history of all? for example, medical history, and things like that? Can people find that out about you?

CABELL: They can, if it is stored anywhere on a computer that's connected to the Internet and not protected by sufficient firewall.

COSSACK: So what you are suggesting, I suppose, is, if I'm right, is that anything that I enter into that computer, whatever program it may be, whether I want to tell them my golf handicap, whether I want to find out from some health program whether I'm overweight and they ask me all kinds of questions about myself, whatever it may be, there are people out there who can easily find it out and then use it?

CABELL: It's not only what you are telling other people on the Internet, it's all the private files you've put on your personal computer. If you write a list of complaints against your boss, and you've stored it as a Word document, someone can come in and grab that just as well. The net is a sieve. It is a link into your computer and everything that's there.

COSSACK: Suppose I wanted to write a love letter, could somebody find that out too?

CABELL: Absolutely, that's how they found one of the biggest hackers for the Melissa virus...

COSSACK: Which is they were able to come in...

CABELL: Each of those documents on Microsoft carries a special identification number for your machine, and that's how they find him.

COSSACK: Mark, is there any way I could write to these companies and say: I don't want you sharing this information with anyone?

WRIGHT: Yes, there is. I mean, people can opt out of these kinds of situations, but a consumer currently has to go through a lot of time and really just pain-in-the-neck process to get out of being monitored.

COSSACK: And that is the only way, right? by writing to these people?

WRIGHT: Writing, you can go to the sites directly and opt out as well, but it is a very arduous process. I mean, you are digitally naked when you are on-line.

COSSACK: All right, let's take a break. Up next, can anything stop the Web from stealing your privacy? Stay with us.

(COMMERCIAL BREAK) COSSACK: Good news for our Internet-savvy viewers: You can now watch BURDEN OF PROOF live on the World Wide Web. Just log-on to We now provide a live video feed, Monday through Friday, at 12:30 p.m. Eastern time. And if you miss that live show, the program is available on the site at any time via video-on-demand. You can also interact with our show, and even join our chat room.


JEFF EISENACH, PROGRESS AND FREEDOM FDN.: We have a lot of privacy protection laws in the United States. For example, I can't call up the college that you went to and get a copy of your transcript without your giving a signature allowing me permission to do that. We've blocked and made completely private people's videotape rental records, because people are particularly sensitive about that. And, of course, people are particularly sensitive and should be about their financial records and their health records.


COSSACK: When voters are asked about what affects their lives the most, privacy is usually at the top of the list.

George, we've heard these terrible things that can happen to our privacy earlier on in the show. What kind of legislation is there existing? and what kind of legislation could we have to protect us?

GEORGE CLARK, INTERNET ATTORNEY: I mean, there is legislation existing, for example, that deals a lot of time with government collection of information, certain the wiretaps law, the Electronic Consumer Private -- Communications Privacy Act, those things have been designed to deal more with the government.

COSSACK: And those don't really affect us, the innocent consumer. I mean, those, you know, hopefully the government is only wiretapping people that they suspect of committing crimes. I'm more concerned...

CLARK: There's been a lot about more that lately.

COSSACK: Well, I'm more concerned about the innocent consumer who logs on to buy a basket of fruit, and suddenly is telling these companies a whole lot of things that they don't intend to do.

CLARK: Well, there are a couple things about that. First of all, there are things that -- Most -- many of the sites now and the most popular sites, and a lot of consumer sites, have a privacy policy. If your information has gone somewhere other than what that policy said, you have a potential remedy against them.

Now, whether you've read that policy, and whether you've already given away that information because you have agreed to go on site, is a different issue. These was the big controversy with DoubleClick not too long ago with the sale of information, and litigation against DoubleClick, and the FTC against ToySmart out in California for trying to sell information, which it had gathered on people. COSSACK: Ari, do we need some baseline legislation?

ARI SCHWARTZ, CENTER FOR DEMOCRACY AND TECHNOLOGY: We think that baseline legislation is necessary...

COSSACK: What do you mean by that?

SCHWARTZ: We mean, really, that we can get consumers -- we can get companies to give consumers fair information practices. A lot of them to have really baseline standards, to go after the bad actors, the people that are purposely misleading consumers, or collecting information without notice, going after then. Allowing consumers to have choice, and gaining more control over their information.

COSSACK: Diane, is that enough? that kind of legislation? or do we need more than that?

CABELL: I don't think so because then you are dependent on some guy in Washington to protect you. I think you need to go to the next level, which is to have technical protection. We need to embed code and make software available to the user, to the consumer that protects them.

SCHWARTZ: Let me say that I completely agree with Diane. Technology needs to be a big part of it, that's why we are trying to get standards that give better notice, standards that give more control to users.

Today, Microsoft announced that they are going to have new cookie controls, that will put users -- that will put users in control. We are going to be following that very closely. But also, the third piece also needs to be, the companies are more responsible because this really has to do with consumer trust.

COSSACK: That's the issue. Mark, is it reasonable to believe that companies who depend on consumers and depend on this information to make their livelihood are going to be more responsible?

WRIGHT: They will have no choice. It is the number-one issue with on-line consumers. We've done a series of polls on this matter, and the on-line consuming public is adamant that very strict controls be enacted to protect their privacy.

COSSACK: But, you know, George, it seems to me what Mark says is true, but I think that -- we've been hearing about privacy for a long time, and yet we are talking about the future of putting in on-line controls. Maybe legislation is the answer.

CLARK: There may be some legislation needed with respect to what information may be gathered. But you've got something else going on here, and that is there are a lot of traditional protections that are given in invasion of privacy and in breach of contract with the agreements that there are. And you've got a lot of people, when you are putting some legislation through, especially federally, who trying to get in at what they want. And here you've got to be careful that you are going to get the exceptions, which may in fact create the problem, and keep it going. I think there is a lot of legislative unawareness of what needs to be done.

COSSACK: Diane, go ahead.

CABELL: Let me point something out, there is a criminal violation for copying a work that Disney Studios has produced. Why do we protect Pocahontas more strongly than we protect a person's medical records.

COSSACK: And the answer to that is why? It is because -- all right, I will answer the question since I think it is such a great question, the answer is because it is capitalism and commercialism, and that is exactly why. And that is what I think the reason that you cannot depend on self-enforcement. Do you agree, Diane?

CABELL: Absolutely.

COSSACK: Go ahead, Mark.

WRIGHT: Yes, the on-line public is adamant that they give explicit permission about any information that is collected from them to be used by somebody else. They are absolutely adamant.

CABELL: But it isn't just the collection. You go and rent a car, and you are in a hurry, and you are not going to stop and read through the fine print, where you give permission to them to use it.

COSSACK: That's right. That's correct. Ari, is it reasonable to believe that the on-line public, and I suppose I'm thinking about myself now, but do we really know what the heck we are doing, in that we are giving permission, or we are not giving permission? I just think it is unreasonable to expect that.

SCHWARTZ: It is, especially now, if you look at these privacy policies, they are seven pages long, they contradict each other in different places of the policy. We want to see consumers have more controls through technology, be given this kind of enforcement level, and given enforcement of it through legislation. You need both. You need the consumer -- you need really three areas where these -- where companies become more trustworthy in these areas.

COSSACK: All right, let's take a break.

CABELL: It isn't just consumer issues, what about your health records?

COSSACK: All right, I am going to take a break now. Up next, do we really want the growth of the Internet to be slowed by privacy laws? and what are the trade-offs? Stay with us.


Q: Families of three students killed in last year's Columbine High School shooting amended their lawsuit to include school officials. Why?

A: The families say school officials knew of the gunmen's violent tendencies before the shootings. The lawsuit alleges that violence was depicted in their schoolwork.



COSSACK: The Internet ushered in a brand-new age. Information is the power in the year 2000.

Diane, during the break, you mentioned a new way that perhaps consumers would be informed of what information the company has received by their use of the Internet. Tell us about that.

CABELL: Well, you know, at the Berkman Center at Harvard, we're a big fan of technology solving these problems. And one thing that is easy enough to do is to require vendors to have a screen pop up at the end of the user's transaction that identifies all the information they've collected and what they're going to do with it and let the consumer check off which of those requests they're willing to give permission to.

COSSACK: And how do we know that when we allow them to have this information and say, no, no, you can't have the rest of it, how do we know they dispose of that?

CABELL: Well, you don't, although you could embed an instant command that would erase it. It could be part of the platform, the protocol that sets this up.

COSSACK: Ari, we're living in the information age. The use of the computer is a convenience that, perhaps, was never even imagined until recently. Is the information that we give up, is that the price we pay for having the convenience and the use of being able to use the Internet?

SCHWARTZ: I don't think that it is. I think that consumers and citizens have the -- should have the ability to speak and use the technology in a way that gives them more control. That's what the technology is best at: putting people in control. That's why we have these great pricing schemes on the Internet, why people are so excited about it. We can do the same with privacy.

WRIGHT: That's right. Consumers are unwilling to make that tradeoff. They are insistent on having their personal privacy protected online.

COSSACK: But, Mark, you know, you say that, but up until today, at least when we're talking, we're talking about the future -- when you say consumers are unwilling. But they have seemed to be continually going online knowing full well that this information is being given up. I mean, isn't this an indication of, perhaps, they are willing to pay the price? WRIGHT: I don't think so. It's by far and away the number-one issue for the online public and I think you're going to see it develop into a major political issue in the near future.

CABELL: You know, it's interesting: In Norway, where they have the tightest privacy protection of any country on Earth, the government started offering a free tax service. They would calculate your tax for you if you gave them permission to go find all the information they needed to enter into your tax record. And they found that most taxpayers preferred that to having to do the calculations themselves and have given the government carte blanche to go invade their bank accounts and their sales and every other kind of record.

COSSACK: Do you see a distinction between, perhaps, giving more trust in Norway to the government than, perhaps, you would unknowingly be giving to some corporation?

CABELL: Their government protection is much stronger for privacy. Every agency has to be licensed to collect information there. They do trust their government more than we do.

COSSACK: George, we've talked about legislation and we've talked about the ability of the consumer to sue, but, in reality, you know, bringing a lawsuit isn't much of a remedy.

CLARK: It's certainly a difficult prospect for anybody to go through and to face that up on their own. However, some of what's happening here as law is developing in this area is companies have basically been ignoring and thinking there isn't an issue or I can get away with it. There will be further developments in here.

One of the things Diane talks about I think is very interesting there because, in fact, no matter what's put in legislatively, no matter whether we have the instant erase kind of thing, unless it's automatic, people are going to check the box that says go ahead. I mean, people talk about being concerned about privacy, I'm concerned about privacy, but I'm not sure, when it really comes down to dealing with it on the Internet, that people will.

COSSACK: Mark, you know, George says that people, even though they're concerned about privacy, would, perhaps, not check the box. In your studies, do you think that's true?

WRIGHT: Well, I think what the consuming -- what the online public is telling us is they want the explicit ability to review any information collected about them to verify its accuracy, and they want to be, in many cases, paid for that giving of that information.

COSSACK: Ari, what -- how much of an asset is the information that companies can get from us without our knowledge or even with our knowledge? I mean, what is the worth of that information?

SCHWARTZ: Well, it's really hard to say because there's such a range out there. I mean, the state of South Carolina was selling pictures of people from their driver's license for less than a penny. Most people would say that's far below the market value of that information. But there other instances where people buy this information online, buy unlisted phone numbers, even, online for $90 apiece. It really depends on the kind of information, the service that's being offered.

WRIGHT: Right, the number-one cost for online retailers is the cost of customer acquisition. And that information that makes that targeting more powerful to acquire those customers, that makes it enormously valuable to online commerce players.

COSSACK: All right, that's all the time we have for today. Thanks to our guests and thank you for watching.

Today on CNN's "TALKBACK LIVE," Indianapolis makes violent video games off-limits to kids under 18. Is it the city's responsibility? Weigh in today at 3:00 p.m. Eastern, noon Pacific.

And we'll be back tomorrow with another edition of BURDEN OF PROOF. We'll see you then.



Back to the top  © 2001 Cable News Network. All Rights Reserved.
Terms under which this service is provided to you.
Read our privacy guidelines.