Friday, December 30, 2005

NSA Caught Placing Cookies on Web Visitors' Computers

NEW YORK — The National Security Agency's Internet site has been placing files on visitors' computers that can track their Web surfing activity despite strict federal rules banning most of them.

These files, known as "cookies," disappeared after a privacy activist complained and The Associated Press made inquiries this week, and agency officials acknowledged Wednesday they had made a mistake.

Nonetheless, the issue raises questions about privacy at a spy agency already on the defensive amid reports of a secretive eavesdropping program in the United States.

"Considering the surveillance power the NSA has, cookies are not exactly a major concern," said Ari Schwartz, associate director at the Center for Democracy and Technology, a privacy advocacy group in Washington, D.C. "But it does show a general lack of understanding about privacy rules when they are not even following the government's very basic rules for Web privacy."

Until Tuesday, the NSA site created two cookie files that do not expire until 2035 — likely beyond the life of any computer in use today.

Don Weber, an NSA spokesman, said in a statement Wednesday that the cookie use resulted from a recent software upgrade. Normally, the site uses temporary, permissible cookies that are automatically deleted when users close their Web browsers, he said, but the software in use shipped with persistent cookies already on.


"After being tipped to the issue, we immediately disabled the cookies," he said.

Cookies are widely used at commercial Web sites and can make Internet browsing more convenient by letting sites remember user preferences. For instance, visitors would not have to repeatedly enter passwords at sites that require them.

But privacy advocates complain that cookies can also track Web surfing, even if no personal information is actually collected.

In a 2003 memo, the White House's Office of Management and Budget prohibits federal agencies from using persistent cookies — those that aren't automatically deleted right away — unless there is a "compelling need."

A senior official must sign off on any such use, and an agency that uses them must disclose and detail their use in its privacy policy.

Peter Swire, a Clinton administration official who had drafted an earlier version of the cookie guidelines, said clear notice is a must, and "vague assertions of national security, such as exist in the NSA policy, are not sufficient."

Daniel Brandt, a privacy activist who discovered the NSA cookies, said mistakes happen, "but in any case, it's illegal. The [guideline] doesn't say anything about doing it accidentally."

The Bush administration has come under fire recently over reports it authorized the NSA to secretly spy on e-mail and phone calls without court orders.

Since The New York Times disclosed the domestic spying program earlier this month, President Bush has stressed that his executive order allowing the eavesdropping was limited to people with known links to Al Qaeda.

But on its Web site Friday, the Times reported that the NSA, with help from American telecommunications companies, obtained broader access to streams of domestic and international communications.

The NSA's cookie use is unrelated, and Weber said it was strictly to improve the surfing experience "and not to collect personal user data."

Richard M. Smith, a security consultant in Cambridge, Mass., questions whether persistent cookies would even be of much use to the NSA.

They are great for news and other sites with repeat visitors, he said, but the NSA's site does not appear to have enough fresh content to warrant more than occasional visits.

The government first issued strict rules on cookies in 2000 after disclosures that the White House drug policy office had used the technology to track computer users viewing its online anti-drug advertising. Even a year later, a congressional study found 300 cookies still on the Web sites of 23 agencies.

In 2002, the CIA removed cookies it had inadvertently placed at one of its sites after Brandt called it to the agency's attention.

White House Crumbles a Cookie

White House denies security specialist's claim that its web site issues cookies in possible violation of government policy.
December 30, 2005

The White House on Friday denied published reports that it uses small programs, called cookies, to track the movement of visitors on the White House web site.

Web software security specialist Richard M. Smith and the Associated Press reported that the White House web site, through a web analytics contractor called WebTrends, was using cookies that were specifically banned by a two-year-old directive issued from the Office of Management and Budget.

David Almacy, the White House Internet director, denied that the White House web site is issuing cookies to any visitors to its Web site, but confirmed the site does keep track of what pages are viewed and for how long with the help of WebTrends. He blamed Mr. Smith’s software, called a packet sniffer, for the confusion.

“What was happening was that users that visited other WebTrends sites picked up WebTrend cookies from these other sites,” said Mr. Almacy. “Mr. Smith’s packet sniffer program then assumes that because we use WebTrends our site placed the cookies on his hard drive.”

Mr. Smith dismissed the White House responses as “very predictable” and called it a “do not inhale excuse.” He noted that such third-party cookies still allow tracking across multiple sites.

Associated Press writer Anick Jesdanun wrote that while the White House doesn’t issue cookies, it employs a tiny graphic image called a “web bug” sent by WebTrends that allows the company to know when a specific page is viewed on the White House site.

“The only information we track is what pages are being viewed and we count site visits and the length of time each visitor spends on our site,” said Mr. Almacy. “We don’t track any personal information about the user.”

Mr. Smith and the AP reported earlier this week that the National Security Agency’s web site was issuing cookies to web visitors (see NSA Caught Serving Cookies). The NSA said that the cookies were being distributed unbeknownst to the NSA staff because of a recent software upgrade. The agency said it had taken care of the problem.

Cookie Assurance

Cookies are small files placed on computers by web programs residing on sites visited by those computers. They were originally designed to hold identifying information to make web surfing easier and faster.

Today cookies are used to store all kinds of information, including the content of a web surfer’s electronic shopping cart. Many web surfers are concerned about the lack of privacy involved in the surreptitious placement of cookies on their computer hard drives.

They are helpful, for the most part, but they carry the potential for abuse because they can monitor and document the activities of web surfers.

“No information is gleaned from cookies on a user’s computer on our web site,” said Mr. Almacy.

“We are not allowed to use some of the advanced web technology available to others because of the privacy concerns that we are committed to.”

Tuesday, December 6, 2005

A better way to count clicks?

Web publishers may soon have to change the way they count visitor traffic, whether they like it or not.

An Internet standards body is hammering out new rules for tallying traffic numbers on Web sites and their content partners, in an initiative called the Nomenclature Project. Under changes proposed by the Interactive Advertising Bureau (IAB) and its members, publishers will have to work under more stringent rules about what can and can't be counted as part of their site.

One prominent issue comes down to branding. For example, sports news site ESPN.com attracts an estimated 15 million unique visitors a month, according to the audience-metric firm Nielsen NetRatings. Included in its traffic are an estimated 1.2 million unique visitors from content partner Active.com, an activity event site that displays a small logo from ESPN.com at the top right-hand corner of its pages.

Theoretically, under proposed rules that are still being worked out, ESPN would have to change Active.com's pages in order to count that traffic. In fact, ESPN must be the dominant brand on the page, or comprise 75 percent of the brand attribution, in order to count it, according to proposed rules. ESPN could not be immediately reached for comment.

Everybody suffered a little pain, but it's for the gain of the overall industry and the audience measurement business.

--Leo Scullin,

vice president, IAB

This change could affect ESPN.com's rivalry with the likes of No. 2 sports-news site, FoxSports.com, which according to Nielsen, draws about 13 million unique visitors monthly. However, FoxSports.com, a channel on MSN, might have to change branding on one of its popular sites, Scout.com, for it to retain the same traffic figures. "I'm keenly interested and support this project," said Andrew Hossom, director of marketing at FoxSports.com.

Why is this important? In one word--advertising. The sites with a bigger audience can command more advertising dollars. And up to now, there's been no one way that everyone agrees to tally that Web traffic. Nomenclature Project organizers hope the changes, which are not yet finalized and should go into effect in the middle of next year, will help Web publishers and their advertisers get a better understanding of how many people are visiting which sites, and how often.

"The measurement companies have had different hierarchies, and each partner site was able to roll up traffic in different ways, causing great consternation around the industry," said Leo Scullin, an IAB vice president who is driving the initiative.

The project has been in the works for the last two years. Scullin agrees that it could cause problems for some publishers, but he believes those issues have been identified well before the rules changes takes place.

"Everybody suffered a little pain, but it's for the gain of the overall industry and the audience measurement business," Scullin added

A maturing medium

IAB company members are working on the project with audience measurement firms including ComScore and Nielsen. Other IAB members include Yahoo, MSN and CNET, publisher of News.com. Nielsen declined to comment for the story and ComScore did not return a request for comment.

The initiative is part of a long-running campaign by the Web publishing industry to cast the Internet as a mature, accountable medium for advertising. More importantly, it's designed to make Web ads easy for advertisers to buy, so that traditional advertisers of TV, print and radio will be comfortable shifting their spending to the Internet.

The changes come at a time when industry ad sales are steadily growing. Interactive ad sales are rising at roughly 25 percent

annually, according to estimates. To keep the momentum, executives believe they need to smooth out kinks in the system.

"The way traffic is measured today is a very top-line view of the quality and loyalty of a given audience," said Adam Gerber, a former director of innovation at ad agency MediaVest Worldwide who's now handling advertising for Brightcove, a service that helps companies bring video online. "A media buyer needs a much clearer view of how audiences (find a specific site) because the Web is so dynamic."

Some would argue that agreed-upon metrics are a long time coming.

The online ad industry took more than a few lumps during the dot-com bust because it looked so complex to digital newcomers on Madison Avenue. Web advertising's appeal was not only in the promise that it could deliver a targeted ad to the right buyer at the right time--which didn't pan out then--but also in its measurability. For the first time, advertisers could see data on when a visitor "clicked" or responded to their ad.

A blessing and a curse

But the Internet's measurability turned out to be a blessing and a curse. Publishers had various methods of tracking clicks, ad delivery, visitors and page views (the number of people who look at a page), much to the bafflement of advertisers. Wading through the various data often taxed the patience of ad buyers. And advertisers were often disappointed in the response to their ads.

On the flip side, Web publishers have long been disgruntled over discrepancies in traffic figures from their own records and those of the audience-metric companies, the main supplier of figures to advertisers. Companies like Nielsen NetRatings rely on relatively small representative panels to estimate total traffic to a Web site. For example, it monitors roughly 20,000 people at home and 4,000 people at work to extrapolate figures. Publishers typically draw data from in-house analytic tools that measure actual traffic to their sites.

Related to that issue are variations in how publishers and metric firms count traffic, as well as how they "roll up" various Web sites into their properties.

"Traffic assignment is a huge issue," said Mark Friendler, CEO of GameDaily, a gaming news and download site.

"A lot of companies are rolling up any sites that will assign them their traffic to have the largest possible number to be on the radar" of an advertiser, he said.

Since the Internet bust, industry leaders have been trying to clean up the messy spots. One project finalized this past year, for example, pushed to create new standards for counting advertisements as they are delivered to a page. In that instance, the Web publishing industry reached consensus on counting ad "impressions" as when the visitor has the opportunity to see the ad on the page, or when the graphic is fully loaded on the page, as opposed to when the graphic is merely sent from an ad server. Some top sites are still changing their pages to meet the standard.

George Ivy, of the Media Ratings Council, an organization that looks at media measurement and accuracy across all media, is working on the standardization project with the IAB. He said that the ultimate goal of the project is to develop common methods for how to count the number of unique visitors to a site. Before that can be accomplished, he said, the task force must devise rules for what counts as a page view--can it be counted twice or only once for content partners?--and how digital tags known as "cookies" play into it.

For example, a certain number of visitors can be identified as "persistent" when they have a browser cookie set and associated with their computer. But many other visitors delete cookies and change computers. "How do you identify traffic from people that don't use cookies?" Ivy said.

Traffic from co-branded Web sites will also be a focus. Publishers that supply content to third parties would have to forgo traffic they used to count on their books. So regardless of whatever short-term pain the project causes, boosters are adamant that it will be a long-term gain for the Web publishing industry.

"It's a great project," said Gerber. "That's because it's going to drive organization and standardization for how content is effectively reported and measured."

No More Milk and Cookies for Santa Claus?

New Lactose Intolerance Diagnosis Makes Dairy Less Merry for Santa This Year

FORT WASHINGTON, Pa., Dec. 5 /PRNewswire/ -- Millions of Americans will soon participate in the time-honored Christmas Eve tradition of leaving milk and cookies out for Santa Claus. But this year, that glass of milk may present a problem for Saint Nick, who recently shared that he suffers from lactose intolerance.
According to The LACTAID® Brand(1) holiday survey, 48% of adults who have left something for Santa have offered up the traditional plate of cookies and a glass of milk. However, like the estimated 30 to 50 million other Americans who are lactose intolerant(2), Santa Claus can no longer digest the milk sugars found in dairy and often experiences unpleasant side effects as a result. This means that drinking all of those glasses of milk each Christmas Eve can result in a very uncomfortable ride back to the North Pole.

"For years, I've felt ho-ho-horrible after my night-time milk and cookie stops, but I always thought I'd just eaten one too many holiday goodies," said Santa Claus in a recent interview from his workshop. "Now that I know that I'm lactose intolerant, I'll be looking for something else to wash down my favorite sweet treats this year."

Lucky for Santa, lactose intolerance is one of the most common digestive disorders and symptoms can be easily and effectively managed without eliminating dairy. With a little help from the makers of LACTAID® Brand Products, Mrs. Claus has stocked Santa's workshop with his favorite lactose-free milk, new holiday eggnog, and ice cream products.

With Christmas Eve rapidly approaching, Santa asks all Americans to be sensitive to his new condition and spread the word: If you're going to offer up some holiday tidings this year, make Santa's glass of milk lactose-free. With nearly half of Americans believing that milk is Santa's favorite beverage(1), a few cartons of LACTAID® Milk will make for a much more pleasant sleigh ride home -- and maybe a few extra stocking stuffers from a very grateful Saint Nick.

Monday, December 5, 2005

Cookies Misunderstood by Consumers, According to BlueLithium

Ad Network Identifies a Need for Further Education to Ease Web Surfers' Privacy Fears


SAN JOSE, Calif.--(BUSINESS WIRE)--Dec. 5, 2005--Many Internet users do not understand the benefits behind cookies. Web surfers mistakenly believe cookies invade privacy, according to an online poll recently conducted by BlueLithium, a San Jose-based direct response and brand marketing ad network.
The poll of more than 150 Internet users suggests that consumers have a universal privacy misconception of cookies, the backbone of behavioral optimization technology. Cookies enable online advertisers to determine useful demographic information about their online audiences. Sixty-four percent of online users surveyed are uninformed in believing cookies invade privacy.

Cookies are small text files that store non-invasive user actions, allowing a web site to better fulfill advertiser requests. Cookies cannot read or store personal or identifiable data stored on a user's computer. Only basic information such as the type of browser used, date and time a web site is visited and connection speed is available. BlueLithium and other online advertisers are reversing consumers' distrust by educating them on the benefits of cookies.

Poll results also reveal that 39 percent of respondents delete their cookies and temporary internet files on a weekly basis, making it difficult for online advertisers to target audiences according to online behavior. In addition, 52 percent of Internet users surveyed disable cookies needlessly before shopping online.

"Consumers incorrectly assume cookies allow the outside world to peek into their private lives and personal data," said Gurbaksh Chahal, CEO of BlueLithium. "A common misconception has developed among consumers that cookies are related to spyware and adware. We are changing this theory. Cookies do not invade privacy, and are actually beneficial to online users."

BlueLithium's behavioral optimization technology uses cookies to deliver information on products and services relevant to Internet users, advertisers, and publishers. This technology allows BlueLithium to bridge the gap between web site content and advertisements -- creating a more relevant Internet experience.

Cookies Pegged as Privacy Threat

NEW YORK Well over half of users believe Internet tracking cookies invade their privacy, according to a new poll.

In a survey of 150 Internet users, 64 percent said cookies represent an invasion of their privacy. The poll was conducted by online ad network Blue Lithium, which recruited participants through banner ads.

The survey is the latest sign of trouble for Internet cookies, which are employed by Web advertisers and publishers to anonymously track users to target ads and measure their effectiveness.

Web advertisers and publishers have held that consumers concerned about cookies invading their privacy don't fully understand how they work. The Blue Lithium survey, however, found 83 percent of respondents claim they are familiar with cookies. Many consumers are not aware of the benefits of cookies, which can be used to keep passwords and personalization features at Web sites: 52 percent said they preferred to use the Internet with cookies disabled.

Various surveys have pegged the cookie-deletion rate by users at between 39 percent and 50 percent. Thirty-nine percent of respondents to Blue Lithium's survey said they deleted their cookies on a weekly basis and 25 percent do so monthly. Fifty-two percent said they disabled cookies before shopping online, fearing they could be used to collect personal data.