August 1st, 2008
Cuil's stance on privacy - "We have no idea who you are"
The less popular search engines always have the best privacy policies, it’s a fact. Take Cuil, the recently launched search
engine pitching itself as the most comprehensive index of the Web, and their stance on privacy. The privacy policy may in fact be a privacy watchdog’s fantasy come true, if we exclude the lack of P3P compliance of course :
“Privacy is a hot topic these days, and we want you to feel totally comfortable using our service, so our privacy policy is very simple: when you search with Cuil, we do not collect any personally identifiable information, period. We have no idea who sends queries: not by name, not by IP address, and not by cookies (more on this later). Your search history is your business, not ours. We do not keep logs of our users’ search activity. We do not record the information in your cookies on our servers; your browser sends your preferences to us with each search request. This way, we do not store any personal information about you on our servers.”
No matter how good it sounds, it’s violating each and every data retention policy there is, that’s for sure.
Such marketable statements aiming to increase the “heart share” of their potential users may in fact be untrue, and the only reason why you’re not going to see their privacy policy changing anytime soon is due to the fact I doubt they would turn into a household brand that easily, thereby attracting the necessary attention to their privacy practices.
Another example of a realistic marketing strategy sticking to data retention practices, of course, the details of which can be found hidden in their FAQ, is Ask.com’s AskEraser exceptions rule, another not so popular search engine. And while they make it look the the user is in control of their privacy, their exceptions totally undermine the idea :
Is there any reason Ask.com will stop deleting my search activity? Even when AskEraser is enabled, Ask.com may temporarily retain your search activity data in certain situations:
- Legal obligations — Ask.com must abide by federal, state, and local laws and regulations. Even when AskEraser is enabled, we may store your search activity data if requested to do so by law enforcement or other governmental authority. In such cases, we may retain your search data even if AskEraser appears to be turned on.
No matter the privacy policy and the marketable tools “putting you in control”, what you see is not what you get.
Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog. See his full profile and disclosure of his industry affiliations.
Subscribe to Zero Day via Email alerts or RSS.
