Pocket SEO - Practical SEO Techniques

Google to Hand Over Your IP Address and Data to Viacom

2008-07-06T19:11:07Z

My longer post on how to protect yourself against Google is coming soon, but in the meantime here is another article about Google and privacy:

Judge Louis L. Stanton, presiding over the federal court for the Southern District of New York, has ordered Google to give Viacom the IP addresses and other data about the users who watched YouTube videos, either on YouTube itself or embedded on a third party website.

If you watched a copyrighted video on YouTube, Viacom is going to have your IP address and other data about you. Google has a lot of data about you.

More about the story on eff.org.

It doesn’t matter how nice most of the people at Google are; the collection of too much data about individual users by one company is dangerous.

Google and Privacy in the News

2008-07-06T19:02:37Z

As promised, I have one more longer post about Google and privacy risks coming soon.

In the meantime, here are some recent related news items about technology and privacy:

Excerpt:

New details continue to emerge on the spying scandal that has hit German telecommunication giant Deutsche Telekom. In addition to rifling through telephone records for a year from 2005 to 2006 to determine the extent of contacts between management and journalists, it now looks as though Telekom was also using mobile phone signals to keep track of their locations.

EDIT: I’m mentioning the mobile phone articles because Google is going into mobile devices with their Android platform.

Why Is Google Still Indexing Feeds?

2008-04-23T06:25:17Z

Why is Google still indexing feeds, especially URLs that do a 301 redirect?

I see Feedburner and other feeds in the SERPs. The Feedburner feeds do 301 redirects so they shouldn’t be indexed.

I’ve seen this in the regular Google SERPs and also in the Google Custom Search Engine SERPs.

Why You Shouldn’t Trust Google

2008-04-22T04:13:29Z

I’ve wanted to write a post about Google and privacy for a long time. I’m writing this post now mainly because I’ve seen discussion among non-profit organizations about whether they should use Google Apps for Nonprofits or other Google services.

This post is primarily written in response to non-profits who are thinking about using Google Apps, but the material is relevant to anyone who uses Google’s services, including universities, businesses and individuals.

Text Message Service for Activists Subpoenaed

A couple of weeks ago, I read a news item about how a text message service for activists was subpoenaed in New York City. The Government (specifically the New York City Law Department) is requesting all text messages, along with information about their senders, that took place by demonstrators during the 2004 Republican National Convention:

The subpoena, which was issued Feb. 4, instructed Mr. Hirsch, who is completing his dissertation at M.I.T., to produce a wide range of material, including all text messages sent via TXTmob during the convention, the date and time of the messages, information about people who sent and received messages, and lists of people who used the service.

I know this event makes a lot of activists angry, but at the same time I see a lot of nonprofit organizations leaning towards using Google Apps. These kinds of events make me wonder why if people are upset about the government having access to information about activists, why would non-profit organizations want to use services from Google — a company that has very serious privacy issues?

Don’t Be Evil

Google has an unofficial motto: "Don’t Be Evil". People often say things like, “Google has not betrayed their motto, and we don’t have to worry about them yet.”

I think that most of the employees at Google are probably well-meaning people who believe in what they do, but I don’t think they are looking at the bigger picture. Google doesn’t have to specifically “do evil” to be evil - the act of collecting so much personal data on users is evil in itself.

Google’s mission statement is:

…to organize the world’s information and make it universally accessible and useful.

The idea of building something like a modern day, Internet-based Alexandria is nice, but Google has gone much farther than just becoming a library of useful information. Google has become obsessed with gathering information about its users. That is where they have gone wrong.

How Google Tracks You

Whenever you visit a Web page that contains a Google service, you leave a trail in Google’s logs. That information can be reconstructed to create a very detailed profile of who you are and what you do online.

Google’s share of search in the US is approaching 70%. Even after you leave Google’s search results page Google is often still tracking you.

Google controls almost 70% of all online advertising. Every time you visit a Web page with Google Adsense or DoubleClick advertising on it you leave your footprint in Google’s logs. If you are also logged into your Google Account you are giving them way too much data.

Every time you visit a site that tracks visitors with Google Analytics, you are leaving a detailed trail in Google’s logs.

When you visit a page with a YouTube video embedded in it, you are leaving footprints in Google’s logs. Some of Google’s services, like YouTube, use Flash cookies which remember your personal information even after you clear your browser’s privacy settings.

Google also tracks Internet users with services like Feedburner and Google Reader.

If you use Gmail, or send email to Gmail accounts, Google stores your email and has sophisticated tools to read the contents of your emails in order to serve you ads. This email reading software potentially has the capability to build a sophisticated profile about you.

Google also tracks your IM chats if you use Gmail chat or Google Talk or if you chat with someone who is using those services.

Google Checkout tracks your payments.

Google Docs stores your word processor documents, spreadsheets, school papers, presentations, etc.

Google might claim that they don’t datamine their logs for malicious purposes, but one danger is that the data will be available for a long time.

Indefinite Storage of Data

Google doesn’t need to do anything evil right now because the data will be available for as long as they want to keep it. If I am not mistaken, their privacy policy allows them to keep your deleted email indefinitely on their backup servers:

Google’s Gmail privacy policy says that, “…deletions [of email] or terminations [of your account] will take immediate effect in your account view. Residual copies of deleted messages and accounts may take up to 60 days to be deleted from our active servers and may remain in our offline backup systems.“.

Google has over 20 years worth of Usenet postings stored—how long will Google store your data now that storage is so cheap? They claim that their logs will be “anonymized” after a certain period, but once the data is collected by Google there is nothing stopping 3rd parties (like the US Government) from tapping into Google’s data and saving it indefinitely.

Even if Google does really delete your data from their backup servers after you push the “delete” button, your non-deleted documents and mail are sitting on Google’s servers.

Secret Government Access

The US Government already has the “right” to full, secret access to Google’s data:

Patriot Act haunts Google service

The U.S. Patriot Act, passed in the weeks after the September, 2001, terrorist attacks in the United States, gives authorities the means to secretly view personal data held by U.S. organizations.

[…]

Some other organizations are banning Google’s innovative tools outright to avoid the prospect of U.S. spooks combing through their data. Security experts say many firms are only just starting to realize the risks they assume by embracing Web-based collaborative tools hosted by a U.S. company

[…]

…Darren Meister, associate professor of information systems at the Richard Ivey School of Business, who specializes in how technology enhances organizational effectiveness [said,] “If I were a business manager, I would want to be very careful about what kind of data I made accessible to U.S. law enforcement.”

Using their new powers under the Patriot Act, U.S. intelligence officials can scan documents, pick out certain words and create profiles of the authors - a frightening challenge to academic freedom, Mr. Puk said.

For instance, a Lakehead researcher with a Middle Eastern name, researching anthrax or nuclear energy, might find himself denied entry to the United States without ever knowing why. “You would have no idea what they are up to with your information until, perhaps, it is too late,” Mr. Puk said. “We don’t want to be subject to laws of the Patriot Act.”

[…]

Montreal security strategist Jeffrey Posluns says Google’s software suite may suit some small businesses because cost savings are significant. But he warns that the deciding factor should be the sensitivity of the organization’s information.

It may be true that the US Government has access to everything you do online through your ISP and through other means. But if you use only one central source to store all the data about you, including everything you do online and everywhere you go (via cell phone GPS) it makes it very easy for privacy laws to be abused.

The current US Government is not bound by privacy laws and doesn’t seem to care about the 4^th Amendment. If the Government already has full, secret access to Google’s data, there is nothing to stop them from making copies.

I’m not saying that the Government copies Google’s data, but this is already a government that believes that “Privacy no longer can mean anonymity” and that has already been caught illegally spying on its own citizens.

What happens when a Government has too much data about you? You might get a special visit to your home if you check the wrong book out of the library, or someone might use the data to silence you or decide that the collected data should be used to build even more comprehensive databases.

Google’s Privacy Policies

Google is known for their very bad privacy policies:

Rights group Privacy International rated the search giant as “hostile” to privacy in a report ranking web firms by how they handle personal data.

…Privacy International singled put Google at the bottom of its rankings for what the group called its “numerous deficiencies and hostilities” to privacy.

Google created a silly video that tries to counter those claims and to convince people that Google protects privacy.

The video doesn’t talk about how extensive Google’s data collection is or that data can be scraped and combined from different logs to reconstruct a lot of information about you. If you have every used a sophisticated analytics program you know how much data can be extracted from the small breadcrumbs that users leave behind when they surf the Web.

When you visit Google’s search results, Google knows which links you click on. When you leave Google.com, Google still has the ability to track you you through Google AdSense, Google Analytics, Google toolbar PageRank lookups, Feedburner scripts/images, and other services. Every time you hit Google’s logs, you leave a trail. It is too much information to give to one company.

The Big Prize

All of that data is a big prize for whoever can gain access. What happens when Google sells? Or when Google partners or merges with companies that you don’t like (e.g., Rupert Murdoch). Or the political situation turns for the worse? Or people from other countries want that information? Everything you ever did online is in Google’s servers, ready to be data-mined by people with bad intentions.

If you are a non-profit organization involved in political or environmental activism and you are using Google Apps, you have potentially just given a current or future US Government an easy backdoor to all of your data.

This post is primarily about nonprofits that use Google, but I think that even individuals should avoid Google’s services like Gmail and Google Talk whenever possible.

Google’s Creepy Obsession With Your Personal Data

Google’s interest in personal data often goes well beyond what could be considered reasonable:

Google’s Eavesdropping Technology

For example, Google has developed a software prototype that uses your computer’s microphone to listen to the sounds of your living room’s TV and serve you ads based on spying on what TV program you are watching.

Google claims that when they eavesdrop on you through your computer’s microphone that you should trust them to filter out any personal data:

“…the fingerprinting technology used in the Google prototype makes it impossible for the company to eavesdrop on other sounds in the room, such as personal conversations, according to the Google team. In the end, the researchers say, the only personal information revealed is TV-watching preferences.

If you have been following the illegal government surveillance programs in the USA, it might make you a little hesitant to trust current or future bad leaders not to use the full ability of powerful surveilleince tools:

"Power corrupts; absolute power corrupts absolutely."

The US Government is already looking for ways to tap into social networking Web sites in order to datamine more information about you. Google’s data is more comprehensive than most social networking sites…

Google’s idea of eavesdropping on your household through your computer’s microphone is a serious proposal:

“Google research director Peter Norvig predicts that the prototype, which uses an audio identification technique invented outside Google and applied to a uniquely large database of recorded sound, will eventually evolve into a product.

Google Wants Your Hard Drive’s Data

Another example of Google’s obsession with gathering your data is Gdrive — an idea to store the entire contents of your hard drive on their servers:

Google Copies Your Hard Drive - Government Smiles in Anticipation
…”Coming on the heels of serious consumer concern about government snooping into Google’s search logs, it’s shocking that Google expects its users to now trust it with the contents of their personal computers,” said EFF [Electronic Frontier Foundation] Staff Attorney Kevin Bankston.

More information about Gdrive can be found on BBC and The Register.

Google will track your location with your cell phone:

Google has a new feature to determine your physical location through your cell phone. As Google moves into cell phone software and hardware they are going to be able to log a lot of location data about you. Where were you at 11:07pm on January 18, 2011? Google may have the answer in their future logs, just based on your carrying a Google-connected cell phone around with you.

Societies are already becoming too complacent about serious privacy issues like human tracking with cell phones.

Google May Track Your Location Via Wireless

Google services like free wireless Internet access also may be monitoring your physical location. Google’s “Wifi help” says:

We may use information about the geographic location of the Google WiFi node through which you connect to the network to provide information relevant to that location.

Other Search Engines

Before you run off to use another search engine, consider that the other engines may be just as bad. Yahoo and Microsoft also gather huge amounts of personal information. Microsoft is particularly bad because they also have full access to your operating system. The German military considered it a serious enough problem to have banned Microsoft software.

How to Protect Yourself Against Google

I’m not saying that Google necessarily uses their data for sinister purposes — yet. I believe that people with bad intentions are hungry for Google’s data and that once the data has been collected it is a threat to privacy because of the ability to datamine it in the future.

Non-profit organizations (as well as schools, businesses, and individuals) should be very wary of Google’s services, not because Google employees are necessarily “evil”, but because the very act of collecting so much data is evil.

People often let Google get away with things that would raise serious red flags if they were done by any other company. I think it’s past time that people took a closer, more critical look at Google (as well as other search engines and social networking sites).

The next post in this series will go over some ways to protect your personal data from Google. To be notified when it is published, please subscribe to my RSS feed.

Glaring Omission from Google’s Cloaking Examples

2008-04-08T11:28:31Z

I was reading through Google’s Webmaster Guidelines for the section that said, “do not cloak your site by giving search engines text content but giving users a login screen.” I wanted to give someone a definitive answer on why they could not cloak their content by presenting a login screen to human visitors. But it doesn’t say anything about that on the cloaking guidelines.

Google only says:

Some examples of cloaking include:

Serving a page of HTML text to search engines, while showing a page of images or Flash to users.

Serving different content to search engines than to users.

I think that one of the most annoying and common examples of cloaking is clicking through Google’s search results and landing on a login page that says “you need to subscribe to access this content”, or “you need to register to access this content”.

I think the reason that Google doesn’t use the example of cloaking with a login page, is because Google selectively approves of certain types of cloaking.

I just wanted to add my complaint to the many other complaints out there.

WordPress Comment Spam Warning

2008-04-02T04:36:31Z

The /wp-content/1/ WordPress attack is being followed up by a comment spam campaign.

The spammer is sending out casino & poker comment spam that links to the hacked pages that are found in /wp-content/1/ — it looks like this:

To block this spam from wasting your time, just go into your WordPress comment settings and add wp-content/1/ to your comment blacklist. That should automatically mark all of those fake comments as spam:

How Long Does It Take For a Google Reinclusion Request?

2008-03-29T06:51:16Z

As mentioned on the 20th, PocketSEO.com was hacked and penalized by Google. I submitted a reinclusion request the same day that I discovered the problem.

Today is the first day that the site is coming back in Google’s rankings (8 days). I don’t think that Google has followed up on the reinclusion request. I think that Google has just finally re-spidered the hacked pages that were covered with porn before, but are now clean.

A few days ago, doing a Google search for pocketseo wouldn’t bring up this site at all. Now pocketseo.com is back at #1:

I’ve only gotten a partial return of my rankings though, because I am at #97 for a search for “metapredict” when I used to be #1:

I can tell that Google has spidered the cleaned-up versions of my pages because the pages are now cached. Before I was hacked, I had a noarchive meta tag on the site.

I haven’t gotten any word back from Google on my reinclusion request, but at least this site is starting to recover in the rankings…

Japanese Blogging is #1 (37% Japanese; 36% English)

2008-03-27T08:12:45Z

Interesting fact about Japanese being the #1 language for blogging:

There are more blog posts in Japanese than any other language, according to Technorati Inc., which tracks nearly 113 million blogs globally. Last year, Technorati found 37 percent of all postings were in Japanese — about 1.5 million per day. Postings in English — from Americans, Britons, Australians and people in many other countries — accounted for 36 percent of the total.

The original article is here, though it is on a different topic.

I suspect that Chinese is also high on the list. Here is a book on Blog marketing in Chinese that I found in a Taipei bookstore:

Technorati information page:

Is Rook Analytics Metapredict?

2008-03-26T10:14:24Z

RookAnalytics.com was mentioned in a comment on my Metapredict post (essential reading for anyone who has ever bought a domain name). Basically, they are a company that swipes peoples’ domain names right after they are searched for. They also do business as Ultrarpm.

Here is what the home page of RookAnalytics.com says:

Rook Analytics is a next generation, predictive data analysis company. Rook Analytics seeks to use its proprietary algorithms to identify and create higher ROI online marketing opportunities.

We cater to large volume customers who value hands on service. To be considered as a potential client, please contact us with your anticipated volume, and any special needs you may have. Someone will respond to you soon.

It’s similar wording to Ultrarpm.com’s Web site:

UltraRPM is a next generation, predictive data analysis company. UltraRPM seeks to use its proprietary algorithms to identify and create higher ROI online marketing opportunities.

Read more about domaining and the end of domain tasting.

UPDATE: I found a domain registered by Rook Analytics and it looks like they are based in Germany? I think this is just the tip of the iceberg.

Registrant:
Rook Analytics
Feringastr. 6
85774 Unterfoehring
Germany
+49 (0) 89 99216 476 (v)
+49 (0) 89 99216 170 (f)

Domain Name: unicief.com
Created on: 2007-12-04 12:21:49
Expires on: 2008-12-04 12:21:49

Administrative Contact:
Administrator, Domain
Rook Analytics
Feringastr. 6
85774 Unterfoehring
Germany
+49 (0) 89 99216 476 (v)
+49 (0) 89 99216 170 (f)

Technical Contact:
Administrator, Domain
Rook Analytics
Feringastr. 6
85774 Unterfoehring
Germany
+49 (0) 89 99216 476 (v)
+49 (0) 89 99216 170 (f)

Domain servers in listed order:
SK.S1.NS1.NS178.CNOMY.COM
SK.S1.NS2.NS178.CNOMY.COM

The email address in the registration info is admin@rookanalytics.com so it appears to be the same company.

The Final Cure for WordPress Link Injection

2008-03-23T17:04:15Z

Here is an idea for a WordPress hack defense that I think would put an end to WordPress link injection hacking. I don’t have time to write this script, but maybe someone else will.

The script would do the following:

log into your WordPress server over SSH
take a snapshot of your filesystem including filesizes and permissions
repeat with cron
if there are any discrepancies, email the diff to you - or, if it’s a desktop program, then show the status in your desktop widget
If it were a desktop program, it could have a list of new files to moderate. Once you checked that you approve the file changes, then the program would recognize those new files as being safe

Just brainstorming here. It could be a shell script, or a GUI program that sits in your taskbar, or even a widget/gadget…

There would be discrepancies every time you uploaded a new file, but better to get a notification about the change than to have your site hacked and penalized by Google.

If someone wants to program this, contact me because I have more ideas about it. Please make it GPL and cross platform