Is Google Evil? The Jury Is Out

Google's move doesn't surprise me. In fact, three years ago, I gave a presentation at an RSA conference saying that the information that Google was gathering through its wide-ranging services was just too tempting and that consolidation of that data was inevitable, despite the compromise of privacy that would result. (The presentation wasn't recorded, but you can view an interview I did at the time that summarizes what I had to say.)

The title of my presentation was "Is Google Evil?" Now, as then, I think the answer is no. It is a business. It exists in order to create value, and it has done that by making use of personal information that consumers freely give to it. Consolidation of that information carries serious privacy implications, but the company that does such a thing isn't evil. Companies will do what they can within the law to get the most value out of their assets. We'll get to the question of just what should be allowed by law when it comes to personal information, but let's drop the name-calling. Companies are expected to extract value where they can, and when they do so they can't be called evil any more than a lion that chases down and tears into the weakest gazelle.

Until now, we could think of all of these as stand-alone services. Each had information about us, but the threat of privacy invasion seemed manageable. It's a different story when it all gets consolidated. Now, for all practical purposes, a single entity has the ability to put together your past, present and future. Who calls you on your Android phone can be combined with what you are searching. The interests you repeatedly post about can be combined with your location. Your appointments can be cross-referenced with your acquaintances' appointments.

What we know is that Google tries to monetize the information it has about the users of its services by selling advertising that is carefully targeted to their interests. Facebook and other companies do similar things. Some people have been sized up pretty well just based on their searches. Others have not. Wired recently ran a short piece on how Google currently can be inaccurate in its current analysis of a user's searches . After consolidation, though, there will be little ambiguity.

"Your grandmother purchased a 30-day supply of fungicide and it is about to run out. Consider buying some for her upcoming birthday."

"Stephen browses lesbian porn on YouTube. Consider buying these videos for him as an anniversary present."

"Your employee John is currently in your competitor's office. Would you like to wish him well?"

"Your husband is scheduled to meet Linda at the Best Western. There is an Applebee's next door. Would you like to buy them a gift certificate for dinner?"

"Mary just purchased a new vibrator. Recommend batteries for her."

Extreme examples perhaps, but I'm pretty sure that embarrassment and humiliation via Google await all of us. And I am able to imagine all of these things while assuming that Google is not evil. Should it ever cross the line, then all of that information it has could be used for truly nefarious and malicious purposes, including extortion and harassment.

But that's just paranoia, right? After all, Google is saying that its new policy of consolidation will only be used in ways that are helpful to its users. OK, that sounds good. But wait a minute. Didn't Google used to say that all that information wouldn't be consolidated? And now it is being consolidated. Which means: Google can change its mind. It can rewrite its policies anytime it wants so that they say anything it wants.

Meanwhile, Google just keeps on growing. A few short years ago, how many people foresaw all that Google would eventually involve itself in? Not many, considering the non-reaction to my presentation at RSA. Chances are, more growth is coming. And it's a pretty good guess that every move will bring the company a little deeper into our lives.

Still, technically not evil. Google is just a very intelligently run business that is making the best legal use of the resources it has. So the question we really need to ask is, "What should be legal when it comes to the use of personal information that is freely given up to a corporation?"

And this is where my presumption that Google is not evil runs up against a big problem. Because I have to believe that Google always intended to combine the data from all of the businesses that it built or acquired. I have too much respect for the company to think otherwise. I saw the potential for this three years ago; isn't it likely that Google did as well? But there is currently nothing in the law stopping a company from getting people to offer up their personal data under one privacy policy, even though the company fully intends to change the policy and use the data for other purposes.

Now, you could argue that any company that did that had to induce people to use its services under false pretenses. And that sounds, well, evil.

In the wake of Google's policy change, eight members of Congress sent the company a list of questions about the new policy's effects on privacy. Google responded on Monday, basically saying that its approach to privacy has not changed . My expectation is that in the end Google will make some small concessions, and the lawmakers and various privacy advocates will play those up so we'll all think they're looking after our welfare. To my mind, that's not nearly good enough. If Google is really going to live up to its corporate mantra of "Don't be evil," then it should undo this latest move and support regulation that would stop other companies from making similar changes. Because, unlike lions on the savannah, a company's worst impulses can be constrained.

Ira Winkler is president of Internet Security Advisors Group and author of the book Spies Among Us. He can be contacted through his Web site, irawinkler.com .

Read more about privacy in Computerworld's Privacy Topic Center.