Recapping last week's Google D.C. Talk on cybersecurity

Thursday, July 2, 2009 at 3:05 PM



To help spark ideas and stimulate discussion following the release of the President's cyberspace policy review, last Friday we teamed up with the Center for a New American Security to bring together a panel of experts representing government, military, and industry for a Google D.C. Talk, "Developing a National Cybersecurity Strategy."

Included in the President's action plan is the goal of developing a "strategy to expand and train the workforce, including attracting and retaining cybersecurity expertise in the Federal government" -- a key point we discussed during Friday's event. Philip Reitinger of the Department of Homeland Security noted that we need to expand the talent pool, which will likely require getting young people excited about the possibilities of working in IT.

I'm convinced that there should be a long-term focus on educating and cultivating future computer scientists (including putting cybersecurity in the curriculum at every step). Students are introduced to foreign languages as early as grammar school -- why not also introduce them to the basics of code?

Beyond K-12, we should expand programs like the National Science Foundation's Scholarship For Service, which provides support to undergraduate and graduate students focusing on information assurance. Thoughtful investments in programs that support computer science education today will help us to build a strong pipeline for the next generation of cybersecurity professionals.

The panel also discussed the Cybersecurity Act of 2009, which some had argued would give the President the authority to shut down the Internet. Ellen Doneski, Chief of Staff for the Senate Commerce Committee, addressed these concerns head-on and explained that the language in the bill will be rewritten with input from stakeholders.

Check out video from the event to see what our panelists had to say:

Self-regulatory principles for behavioral advertising



As our Deputy General Counsel Nicole Wong mentioned in her congressional testimony a few weeks ago, we've been a part of a broad effort over the past several months to develop a set of self-regulatory principles for online behavioral advertising. In fact, we were one of the first companies to be involved in this discussion.

After a lot of discussion and hard work among a diverse group of companies and associations, those principles were released today, and I think the end result will be even more transparency and choice for Internet users about how their information is used.

When we launched our own interest-based advertising product in March, we worked hard to include several innovative features to give users more control and information -- including ads labeled "Ads by Google," a tool called the Ads Preferences Manager (which lets users view, add, and remove the categories that are used to show them interest-based ads), and the choice to opt out of interest-based ads altogether.

One of the key strengths of the principles is the fact that they apply to a broad range of companies participating in online advertising -- advertisers, publishers, and ad networks. Of course, for any self-regulatory effort to be effective, there has to be some kind of enforcement process. Between now and early 2010 -- when the principles are expected to be implemented -- the Better Business Bureau and Direct Marketing Association, two of the groups involved, will work to set up that process to make sure it has real teeth.

By applying technology in new ways -- like a strong opt-out mechanism, and tools like the Ads Preferences Manager -- we can help ensure that Internet users are active participants in their online experience by providing them with more information and more control.

British Columbia leading on open data and open government

Monday, June 29, 2009 at 3:10 PM



Maybe it's the clean ocean air, maybe it's the vast mountains, but there's an open government revolution afoot in British Columbia.

In May the City of Vancouver passed a motion to open its data to the public. Inspired by Washington D.C.'s open data project, the city hopes to promote civic engagement, improve decision-making, and deepen accountability.

Social media expert David Eaves has been one of the key proponents and advisers behind Vancouver's open data initiative. I recently saw David speak about his theory of the "long tail of public policy." He believes that while there's lots of expertise within government, there's also untapped expertise outside of government -- from you, me, your family, and your neighbors. This knowledge -- the long tail -- on any given public policy issue is greater than the collective knowledge within government. Policymakers therefore need to learn how to tap this know-how in order to make better decisions. Check out his presentation below:



Not to be outdone, the British Columbia provincial government has an office whose primary mandate is to improve citizen engagement and public deliberation using the collaborative tools on the Web.

While other provincial governments have banned Facebook at work, B.C. has recognized the power of social media. David Hume, Executive Director for Citizen Engagement at the B.C. Ministry of Citizen Services, has a great presentation on the inspiration for B.C.'s work in this area. Check it out:

Google D.C. Talk next week: Wired's Chris Anderson on the power of free



At our next Google D.C. Talk on Tuesday, July 7, Wired editor Chris Anderson will talk about the power of a price: $0.00.

In his new book, Free: The Future of a Radical Price, Anderson makes the provocative case that in many instances businesses can profit more from giving things away than they can by charging for them.

But if the product is free, where's the revenue? And how do you compete when your competitors are giving away what you're trying to sell? We'll ask Chris those questions and more.

Google D.C. Talks presents
A Conversation with Chris Anderson,
Free: The Future of a Radical Price
Tuesday, July 7, 2009
10:00 AM - 11:30 AM ET
Google Washington Office
1101 New York Avenue, NW, Second Floor
Washington, D.C.
Click here to RSVP

Got a question for Chris, but can't wait to the event? Submit your question now through Google Moderator or vote on the questions that others submit -- and we'll ask the top-rated questions at the talk.

Google endorses Declaration of Health Data Rights

Monday, June 22, 2009 at 9:00 PM



From its inception Google Health has been about giving patients control over their medical data. For starters, that means we help people access their health information, give them a safe and secure place to store it, and let them share it with others if they wish. Over time our goal is to help consumers play a larger role in their own healthcare by empowering them with the information they need to make better healthcare decisions.

As part of this effort, we're endorsing an industry-wide Declaration of Health Data Rights. Unveiled today at HealthDataRights.org, the Declaration aligns with the principles behind Google Health: consumer empowerment, privacy protection, and data portability. We've joined a diverse group of stakeholders -- including doctors, researchers, technology companies, writers, entrepreneurs, health economists, and others -- that have come together to support this effort to promote greater patient access to personal health data.

While most of the rights outlined in the Declaration are already included in the Health Insurance Portability and Accountability Act (HIPAA) and the recent American Recovery and Reinvestment Act (ARRA), there are still practical challenges to acting on these rights. For example, getting access to your medical records today often requires that you fill out a form at your doctor's office, pay a $35 copying fee, and then wait a month or more to receive your records in the mail. Under the law, this is your data, and we believe you should have it the day you visit your doctor.

We hope the Declaration will help raise public awareness about the rights already protected under HIPAA and also help drive the public debate towards increasing patient access and control over their own health data. Strong health data rights will help patients collaborate with their doctors in order to get better care and avoid medical errors.

Our recommendations for increasing citizens' access to government information



Given the tremendous volume of information online -- more than 1 trillion unique URLs and counting -- the ability for users to search for and find relevant content is critical. This couldn't be more true for the tens of millions of pages of content stored on government websites. Unfortunately, many agencies make it difficult or impossible for search engines to index their sites and make information available to citizens who are searching for it.

In response to President Obama's call for ideas on how to open up the government to its citizens, Google put forward recommendations last Friday in which we point to two simple steps government webmasters can take to make sure that search engine queries lead users to the right websites and hopefully, the right answers.

First, agencies can adopt the Sitemaps protocol, which allow search engines to crawl websites more intelligently. Most search engines offer free Sitemap generator tools -- check out Google Sitemap Generator.

Second, agencies can review their robots.txt files. Many agencies currently block large portions of their websites from search engines with robots.txt files, sometimes unknowingly. By reviewing and selectively using these files, webmasters can easily open up large amounts of content to citizens. Free analysis tools like Google's robots.txt test can help webmasters identify which pages are accidentally being blocked.

The next stage in the campaign for open government will come when the Administration encourages agencies to publish their most popular, timely, and relevant data on their websites and data.gov. Static, obscure, and dated information is not useful to citizens who want data relevant to their everyday lives, nor is it helpful to third parties who want to build tools that citizens can use to understand that data.

As it works towards its goal to bring greater transparency to government, we hope that the Administration continues to take the steps necessary to make government information more easily accessible to citizens on the web.

Online advertising and user choice

Thursday, June 18, 2009 at 9:00 AM



Two subcommitees of the House Committee on Energy and Commerce will hold a joint hearing this morning about online advertising. The focus of the hearing will be on industry practices and consumer expectations for advertising that's tailored to users' online activities, also commonly known as "behavioral advertising." Google Deputy General Counsel Nicole Wong will be testifying about our advertising products and our commitment to protecting the privacy of our users.

More specifically, Nicole will talk about interest-based advertising, which we launched in March in beta for our our AdSense partner sites and YouTube. Interest-based advertising uses information about the web pages people visit to make the online ads they see more relevant. Relevant advertising, in turn, has fueled the content, products and services available on the Internet today.

The most important point that Nicole will make is that consumers need and deserve greater transparency and choice when it comes to online behavioral advertising. Our launch of interest-based advertising includes innovative, consumer-friendly features that provide meaningful transparency and choice for our users — such as ads labeled 'Ads by Google,' a tool called the Ads Preferences Manager (which lets users view, add and remove the categories that are used to show them interest-based ads), and the choice to opt out of interest-based ads altogether.

You can read Nicole's complete testimony and you can watch a video about how interest-based advertising works on the Google Privacy Channel on YouTube:



UPDATE (6/19) Check out the video of Nicole's oral testimony below.

More footage from protests in Iran on YouTube

Wednesday, June 17, 2009 at 11:35 AM



(Editor's Note: Last week we blogged about researchers who had been studying online behavior prior to Iran's presidential election. This entry, cross-posted from the YouTube Blog, outlines how Iranians are using YouTube as a platform for free expression in the wake of election day.)

Last Friday marked a long-anticipated Election Day in Iran to choose the next Iranian president. While the voting process itself ran smoothly, widespread violence has since broken out in protest of current President Mahmoud Ahmadinejad's claim to a decisive victory over challenger Mir-Hossein Mousavi. Mousavi supporters, who believe Ahmadinejad rigged the election results, refuse to accept the verdict and have been openly protesting since Saturday.

Video clips that capture the chaos and rioting in the streets of Iran's capital, Tehran, have been streaming into YouTube for the past four days. Even though YouTube appears to be blocked in Iran -- the site is experiencing a small fraction of the traffic levels it normally receives from Iran (around 10%) -- we continue to see videos being uploaded to the site that document city streets crowded with angry demonstrators, violent clashes between protesters and state police, and visceral scenes of mass unrest.

In essence, YouTube has become a citizen-fueled news bureau of video reports filed straight from the streets of Tehran, unfiltered. Because the Iranian government is cracking down on local and international media coverage, these citizen-generated videos are providing an exclusive look at the developing violence. Here's a collection of some of those videos. (Please use your discretion before viewing, as some of them contain disturbing images.)



We've noticed some claims going around that YouTube has been engaging in acts of censorship and removing some of these videos from the site. Unless a video clearly violates our Community Guidelines, we will not take it down. In general, we do not allow graphic or gratuitous violence on YouTube. However, we make exceptions for videos that have educational, documentary, or scientific value. The limitations being placed on mainstream media reporting from within Iran make it even more important that citizens in Iran be able to use YouTube to capture their experiences for the world to see. Given the critical role these videos are playing in reporting this story to the world, we are doing our best to leave as many of them up as we can. YouTube is, at its core, a global forum for free expression.

Take note that if you see a video that is unavailable on the site, it may be because the user decided to remove the video him or herself.

We're following what's happening in Iran on the Citizentube blog (www.citizentube.com), so stay tuned for the latest.

Opening access to books means opportunities for everyone -- including Amazon

Tuesday, June 16, 2009 at 5:30 PM



At a Wired conference yesterday, Jeff Bezos, the CEO of Amazon, made some fairly critical comments about Google Books that have, predictably, created press attention. We can't presume to understand the full nature of Amazon's statements, but we believe they go to the heart of our continuing efforts to make books more available and were likely motivated by recent news about Google Books.

Last month at the BEA conference in New York, we discussed our plans to expand Google Books for our publishing partners. By the end of this year, we hope to give publishers, as well as authors, the ability to sell online access to their works so that people can find, purchase and read books on the devices they choose, including computers, mobile phones, laptops, netbooks, or e-readers from multiple vendors. This service will also be designed to allow multiple retail partners to distribute these books, similar to the way book sales work in the physical market.

We believe more choice is good. That's exactly why our vision for Google Books is to create an open platform that, among other things, allows any bookstore, library, publisher partner or individual website developer to provide their users with the ability to search across and preview books in a similar way to Amazon's Search Inside! feature.

Providing more choice is also why we entered into our settlement agreement last year with authors and publishers. The settlement will provide users with more access to books. We still strongly believe that copying for the sake of indexing is a fair use that is encouraged by existing copyright law precedents. Fair use is critical to the way web search and book search work and is already well established.

The settlement allows us to bring real benefits to users. It opens access to millions of books that are no longer published; it expands access for people with disabilities; and it compensates rightsholders for new uses. And, through the creation of the Registry, and a database of copyright claims information, the settlement makes it easier for others to find rightsholders and license their works. Other companies, including Amazon, and individuals can contact rightsholders directly or work through the Registry (if the rightsholder has authorized the Registry to do so) to license works for new uses. And for books whose rightsholders can't be found, we also support comprehensive orphan works legislation, as we've said in the past.

In the end, we believe more access is good for everyone, Google and Amazon alike. But most importantly, it's good for readers who simply want to find and enjoy books, and for authors and publishers who want to create and sell works.

HTTPS security for web applications



(Cross-posted from the Google Online Security Blog)

A group of privacy and security experts sent a letter today urging Google to strengthen its leadership role in web application security, and we wanted to offer some of our thoughts on the subject.

We've long advocated for — and demonstrateda focus on strong security in web applications. We run our own business on Google Apps, and we strive to provide a high level of security to our users. We currently let people access a number of our applications — including Gmail, Google Docs, and Google Calendar, among others — via HTTPS, a protocol that establishes a secure connection between your browser and our servers.

Let's take a closer look at how this works in the case of Gmail. We know that tens of millions of Gmail users rely on it to manage their lives every day, and we have offered HTTPS access as an option in Gmail from the day we launched.
If you choose to use HTTPS in Gmail, our systems are designed to maintain it throughout the email session — not just at login — so everything you do can be passed through a more secure connection. Last summer we made it even easier by letting Gmail users opt in to always use HTTPS every time they log in (no need to type or bookmark the "https").

Free, always-on HTTPS is pretty unusual in the email business, particularly for a free email service, but we see it as an another way to make the web safer and more useful. It's something we'd like to see all major webmail services provide.

In fact, we're currently looking into whether it would make sense to turn on HTTPS as the default for all Gmail users.

We know HTTPS is a good experience for many power users who've already turned it on as their default setting. And in this case, the additional cost of offering HTTPS isn't holding us back. But we want to more completely understand the impact on people's experience, analyze the data, and make sure there are no negative effects. Ideally we'd like this to be on by default for all connections, and we're investigating the trade-offs, since there are some downsides to HTTPS — in some cases it makes certain actions slower.

We're planning a trial in which we'll move small samples of different types of Gmail users to HTTPS to see what their experience is, and whether it affects the performance of their email. Does it load fast enough? Is it responsive enough? Are there particular regions, or networks, or computer setups that do particularly poorly on HTTPS?

Unless there are negative effects on the user experience or it's otherwise impractical, we intend to turn on HTTPS by default more broadly, hopefully for all Gmail users. We're also considering how to make this work best for other apps including Google Docs and Google Calendar (we offer free HTTPS for those apps as well).

Stay tuned, but we wanted to share our thinking on this, and to let you know we're always looking at ways to make the web more secure and more useful.

Update @ 1:00pm: We've had some more time to go through the report. There's a factual inaccuracy we wanted to point out: a cookie from Docs or Calendar doesn't give access to a Gmail session. The master authentication cookie is always sent over HTTPS — whether or not the user specified HTTPS-only for their Gmail account. But we can all agree on the benefits of HTTPS, and we're glad that the report recognizes our leadership role in this area. As the report itself points out, "Users of Microsoft Hotmail, Yahoo Mail, Facebook and MySpace are also vulnerable to [data theft and account hijacking]. Worst of all — these firms do not offer their customers any form of protection. Google at least offers its tech savvy customers a strong degree of protection from snooping attacks." We take security very seriously, and we're proud of our record of providing security for free web apps.

Street View: Exploring Europe's streets with new privacy safeguards

Friday, June 12, 2009 at 1:37 PM



(Cross-posted from the European Public Policy Blog)

In 2007 we began to look at bringing the highly innovative and very popular Street View to Europe, and I highlighted the new technological challenges this would present given different privacy laws and cultural norms. We pre-empted many of the different requirements and concerns and proactively introduced privacy enhancing technologies, namely industry-leading face and license plate blurring, and made it easy to flag inappropriate images for removal. We began a dialogue with the Article 29 Working Party, which brings together representatives from all 27 European Data Protection Authorities. In turn, they have asked us to make a few additional modifications to address local specificities to ensure Street View better aligns to local interpretations of privacy requirements across the whole of Europe.

First, they have asked us to continue to provide advance notice to the public about the project before we start driving in a new country. We already got a head start on this request earlier this year, when we worked closely with the press to announce details of when and where we would be driving in new countries such as Ireland, Belgium, Sweden, Norway, Finland, Denmark, Poland, Czech Republic, and Switzerland. As you can probably imagine, it can be tricky at times to say exactly where our cars will be and when; we're affected by lots of things outside our control such as the weather and lighting conditions, we also rely on the local knowledge of our drivers to decide which places it is best to drive when, taking into account traffic conditions and other local factors. Nonetheless, we are committed to working within the Article 29 Working Party's guidelines on this issue.

Second, the Article 29 Working Party has asked that we set a time limit on how long we keep the unblurred copies of panoramas from Street View, in a way that appropriately balances the use of this data for legitimate purposes with the need to deal with any potential concerns from individuals who might feature incidentally on the Street View imagery. To explain the issue here, although the images you see on Street View have faces and car license plates blurred out, we have to collect an original 'unblurred' copy of that image first. We then apply our highly sophisticated blurring technology and we make sure that only the blurred copy is ever made public.

The Article 29 Working Party have, however, asked us to take some additional steps to ensure that we don't keep the original 'unblurred' copy for longer than we need to. This is a challenge, but again one we're committed to meeting not just in Europe but globally. One of the technical challenges at stake with Street View--or any service that uses image detector software --is that the software sometimes makes mistakes, labeling part of the image as containing a face or a license plate when in fact it doesn't. While we like to think we've gotten pretty good at this stuff, we still have lots of these 'false positives'.

Some of these can be pretty funny like the blurred horse shown above, but this also affects the quality of Google Maps and so in turn affects our users - for example, it'd be pretty annoying if you couldn't find the phone number of that little deli across town where you think you might have left your purse, because our software mistook the phone number for a license plate. That's why we're constantly working on ways to improve our technology, and we are constantly training it to detect more of the relevant stuff, while reducing the number of 'false positives' it creates. To do this, though, we need access to the original unblurred copies of the images. Nevertheless, we've communicated to the Article 29 Working Party that we will meet their request that long term we only keep the blurred copy of Street View panoramas, and we will work with them and our engineers to determine the shortest retention period that also allows for legitimate use under EU laws.

It's important for companies operating services across Europe to be able to follow harmonised data protection guidance, and we're grateful to the Article 29 Working Party for their advice and collaboration on Street View. It is this coordinated approach that will best enable the expansion of consumer-facing services and innovative technology across the region. Street View has proven to be extremely popular in the countries in which it has launched and with these additional privacy safeguards we plan to bring it to even more countries in the European Union, allowing people to explore their home towns, tourist attractions or cities on the other side of the world. We are already receiving many requests to come drive new areas so that imagery can be used to showcase a town, promote tourism and improve travel planning and we are of course always happy to consider these. Read about our latest addition to Street View - tourists and Mickey Mouse fans can now virtually explore the Disneyland parks in Paris.

Searching for clues on Iran's presidential election

Thursday, June 11, 2009 at 7:08 PM



Iranians head to the polls tomorrow to vote in their 10th post-revolution presidential election, and some observers are studying online behavior for clues on how to predict a contest that looks too close to call.

In an article in Foreign Policy, Scott Hartley asks, "Who's winning Iran's Google war?" With more than one third of Iranians now online, search data offers unique insight into what voters might be thinking. Armed with English and Farsi results from Google Insights for Search, Hartley infers that challenger Mir-Hossein Mousavi's appeal is highest among urban elites in Tehran and Shiraz, while incumbent Mahmoud Ahmadinejad dominates the less-cosmopolitan cities of Qom, Karaj, and Mashhad. Hartley also points to a fascinating map of the Persian blogosphere developed by Harvard's Berkman Center for Internet & Society, which outlines the diversity of political viewpoints across 400,000 blogs.

How will it ultimately play out? We'll have to wait and see. But as Internet penetration increases around the world, search data and other online behavior may continue to emerge as key research tools in future elections.