latest news
Google Falsely Labels TrackMeNot as Malware
On May 12th, we received an e-mail from Google stating that our TrackMeNot browser extension, which protects users from tracking by search engines, was at risk of being removed from the Chrome Store. The alleged reason: it violated several of the Chrome Web Store’s Program Policies, such as providing an inaccurate description of its functionality or requesting permissions that it did not use. The e-mail also warned us that we had two weeks to make the necessary changes to avoid removal of TrackMeNot (TMN) from the store. Yet, in spite of the 14-day grace period, Google blocked TMN from the Chrome Store the very next day.
Blocking TMN from the Chrome Store had two immediate consequences. First, Google notified all current users of the software that the extension “contained malware”. Many long-time users (TrackMeNot has been listed in the Chrome Store since 2011, as well as the Mozilla store and other app platforms since 2006) contacted us to ask how and why they had received this notification, while others started a thread on Reddit to discuss why the extension had been disabled, and how it could be restored.
1
how it works
TrackMeNot runs as a low-priority background process that periodically issues randomized search-queries to popular search engines, e.g., AOL, Yahoo!, Google, and Bing. It hides users' actual search trails in a cloud of 'ghost' queries, significantly increasing the difficulty of aggregating such data into accurate or identifying user profiles. TrackMeNot serves as a means of amplifying users' discontent with advertising networks that not only disregard privacy, but also facilitate the bulk surveillance agendas of corporate and government agencies, as documented recently in disclosures by Edward Snowden and others. To better simulate user behavior TrackMeNot uses a dynamic query mechanism to 'evolve' each client (uniquely) over time, parsing the results of its searches for 'logical' future query terms with which to replace those already used.
TrackMeNot is user-installed and user-managed, residing wholly on users' system and functions without the need for 3rd-party servers or services. Placing users in full control is an essential feature of TrackMeNot, whose purpose is to protect against the unilateral policies set by search companies in their handling of our personal information.
2
why we created TMN
The practice of logging user search activities and creating individual search profiles - sometimes identifiable - has received attention in mainstream press, e.g. the recent front-page New York Times article on AOL's release of collected data on individual searchers; also this front-page New York Times Business Section article describing the User-Profiling Practices of Yahoo!, AOL, Bing & Google.
We are disturbed by the idea that search inquiries are systematically monitored and stored by corporations like AOL, Yahoo!, Google, etc. and may even be available to third parties. Because the Web has grown into such a crucial repository of information and our search behaviors profoundly reflect who we are, what we care about, and how we live our lives, there is reason to feel they should be off-limits to arbitrary surveillance. But what can be done?
Legal approaches -- urging legislators to support limits on access, or courts to extend Fourth Amendment protection -- might be effective, but would require orchestrated efforts by many parties. Appeals to search companies themselves seem even less hopeful as their interests, at least on the surface, are in direct conflict with such limits. Both, at best, are long term prospects.
We have developed TrackMeNot as an immediate solution, implemented and controlled by users themselves. It fits within the class of strategies, described by Gary T. Marx, whereby individuals resist surveillance by taking advantage of blind spots inherent in large-scale systems1. TrackMeNot may not radically alter the privacy landscape but helps to place a particularly sensitive arena of contemporary life back in the hands of individuals, where it belongs in any free society.
3
background
4
Public awareness of the vulnerability of searches to systematic surveillance and logging by search engine companies, was initially raised in the wake of a case, initiated August 2005, in which the United States Department of Justice (DOJ) issued a subpoena to Google for one week's worth of search query records (absent identifying information) and a random list of one million URLs from its Web index. This was cited as part of its defense of the constitutionality of the Child Online Protection Act (COPA). When Google refused, the DOJ filed a motion in a Federal District Court to force compliance. Google argued that the request imposed a burden, would compromise trade secrets, undermine customers' trust in Google, and have a chilling effect on search activities. In March 2006, the Court granted a reduced version of the first motion, ordering Google to provide a random listing of 50,000 URLs, but denied the second motion, namely, the request for search queries.
While viewed from the perspective of user privacy this seems a good outcome, yet it does bring to light several disquieting points. First, from court documents we learn that AOL, Yahoo!, and Microsoft have complied with the government's request, though details are not given. Second, we must face the reality that logs of our online searches are in the hands of search companies and can be quite easily linked to our identities. Thirdly, it is clear we have little idea of, or say in, what can be done with these logs. While, in this instance, Google withheld such records from the Government, it would be foolish to count on this outcome in the future.
TrackMeNot is a work in progress, and we welcome feedback from the community:
Daniel C. Howe
School of Creative Media, HK
https://rednoise.org/daniel
Email: daniel<at>rednoise.org
Helen Nissenbaum
Cornell Tech, Digital Life Initiative, NYC
https://nissenbaum.tech.cornell.edu
Email: helen.nissenbaum<at>cornell.edu
Vincent Toubiana
http://unsearcher.org
Email: v.toubiana<at>free.fr
5
Cornell Tech's Digital Life Initiative, NYU Dept of Computer Science, the Media Research Lab, the Mozilla Foundation, Missing Pixel, the Portia Project, Babelzilla, Ernest Davis, Michael Zimmer, John Fanning, and Robb Bifano.