• PC World
• » Security

The rise in the number of ways that private information can be collected about Web users, often without their knowledge, is spurring the market for vendors who say their wares ensure privacy. But with more and more companies offering software to keep private information private, it can be confusing for users to figure out how to find the product or service that serves them best.

"I think it's important to look closely at these technologies and see if they actually employ genuine techniques to limit or eliminate the use of personal information," says Marc Rotenberg, executive director of the Electronic Privacy Information Center. "Cash, subway tokens, movie tickets, those are completely anonymous transactions."

There's plenty to be worried about when it comes to protecting personal information online. According to a study published in January by Privacy International, two-thirds of Internet sites surveyed collect some personal information, and almost all of those sites asked for details that made it easy to identify and contact the user. The study found that only 10 percent of sites targeting children asked children to get their parents' consent before giving personal information, or to tell their parents about it afterward.

"The average Internet user is 100 percent confused," says Austin Hill, executive vice president and cofounder of Zero Knowledge Systems in Montreal. "They're worried for a lot of the right reasons, but about a lot of the wrong details." For instance, users tend to worry about their online passwords being stolen, but that's a security issue and not a privacy concern, he says.

Many Methods for Attaining Privacy

Zero Knowledge offers a downloadable privacy management application, which allows users to control their information, through things like cookie management and a "keyword alert," which lets the user know when attempts are made to find personal information. Although the company won't disclose its user numbers--"We're a privacy company," Hill says--he estimates the number of those turning to privacy software will jump from less than 2 million users currently to between 10 million and 15 million over the next 18 to 24 months.

Other privacy vendors are taking a variety of different approaches to their software and technology. SafeWeb, which launched in October, is based on a simple end-user interface. SafeWeb is now generating 2.5 million page loads per day, according to the company. SafeWeb's technology is almost invisible to the user, and is as easy to use as an ordinary Web browser.

In fact, it is an ordinary Web browser. It's as simple as going to the company's Web site and typing a URL when asked to "enter the address of the Web site you wish to view securely." When a user types in a URL, another browser opens up, letting users anonymously access the Web through 128-bit SSL (secure socket layer) encryption.

"Anything you can do through the Web, you can do through SafeWeb," says Jon Chun, co-founder and president of SafeWeb.

Safety Isn't Always Total, Even With the CIA

However, not everything on the Web is made safe with SafeWeb. "Some things, like ActiveX plug-ins and complex Java code, is inherently insecure," Chun says. "In those cases, we give the user the choice to either accept them or reject them."

SafeWeb was founded because there was no such thing as a privacy application that was both easy to use and strong, Chun says.

"What we found is that privacy technologies are either really good and hard to use, or easy to use but not very good," he says.

The company has garnered a lot of attention, but one of SafeWeb's backers might not sit well with people who don't have a lot of trust in the government and certainly don't want it involved in privacy issues. The U.S. Central Intelligence Agency invested in SafeWeb through its private, nonprofit corporation, In-Q-Tel.

But user reaction to the CIA investment has not been all negative.

"It's actually been only slightly negative on the consumer side, but extremely positive on the business-to-business side," Chun says. "A lot of people realize it's very similar to the CIA licensing PGP (Pretty Good Privacy) or SSL."

In-Q-Tel is a minority investor, has no representation on the board, and is kept at arm's length, Chun says.

Some Oppose User Privacy

Not everyone agrees with SafeWeb's approach, though. Both corporations and governments have blocked access to the site. Governments inclined to censor where citizens can go on the Net sometimes block users from accessing specific "objectionable" sites, so users in those countries were accessing such sites through SafeWeb. In turn, SafeWeb's own site began to show up on the lists of banned sites. Recently, a group of companies and industry organizations have quietly undertaken a campaign to stifle Internet-privacy legislation in general, asserting that it will cost too much money.

SafeWeb has been blocked by the governments of Saudi Arabia, the United Arab Emirates, Syria, and China, Chun says.

SafeWeb fought back against governments blocking its site by creating a piece of software called "Triangle Boy." If a user in the United States is running Triangle Boy, a user in a different country can go to the U.S. user's IP (Internet Protocol) address, instead of SafeWeb's own.

"We then encrypt the information from a third-party site, and use IP spoofing to return the information," Chun says. "All the government sees is a two-way conversation between the end user and the Triangle Boy volunteer."

Some privacy organizations are more on the fringe. Those like The Freenet Project are more concerned with sharing information, including files, on a completely anonymous basis.

"Our users are on the fringe at the moment," Freenet's founder and project coordinator Ian Clarke says, "but there are people out there who do a lot to push people to systems like Freenet." Clarke gave as one example the Recording Industry Association of America, which has been involved in an ongoing lawsuit against MP3 trading service Napster for alleged copyright violation.

"The whole MP3 debate and copyright debacle is not the core of what we're about," Clarke says. "Except when people advocate shutting us down, then we get dragged into the debate unwillingly."

The Ant Colony Approach to Anonymity

"The aim of this system is to provide free communication on the Internet," Clarke says. "And anonymity is an essential quality of any such system."

Running Freenet involves downloading client-server software, much like Napster. However, with Freenet, there are no central servers as there are with Napster, and the system is not controlled by any user.

"If anybody controlled this system, it could lead them to bribery or blackmail to shut it down," Clarke says. The open model can be compared to an ant colony (with the exception of the queen ant). "Each ant in the colony is pretty much identical, but they all do different things," Clarke says. "Some get food, some protect the colony, et cetera."

A study in November by O'Reilly & Associates came to the conclusion that 59.4 percent of text documents available on Freenet were drug related, and that 89 percent of still images and more than 79 percent of the video clips available on Freenet were of a pornographic nature. However, the author of the study acknowledged that he hadn't seen any of the text, images or video clips, merely categorizing them based on their "key name."

Although Clarke says the study had "serious flaws in the way the research was done," he acknowledges that the article was "probably not far off."

Freenet is designed for everybody to be able to share whatever they want, Clarke says. So although there is a fair amount of questionable material on the service, that's because people can put anything they want on the network. "If the producer of information does not remain anonymous, they can be punished, which would discourage other people from doing the same," Clarke says.

Although Clarke's views on things like patent ownership and copyright law may seem a little unorthodox, the ultimate goal of the system is a noble one.

"Ultimately, it would be nice to make censorship impossible on the Internet; that is our goal," he says.

For further information on this and related topics, see PCWorld's ongoing coverage of privacy concerns.

• See more like this:
• SSL encryption,
• secure socket layer,
• privacy,
• Electronic Privacy Information Center,
• EPIC,
• Privacy International,
• cookies,
• SafeWeb,
• Active X plug-ins,
• In-Q-Tel,
• Central Intelligence Agency,
• CIA,
• Napster,
• RIAA,
• Recording Industry Association of America,
• O'Reilly & Associates,
• anonymity