1. Personal Privacy and the Public Internet
John E. Carter
Kennesaw State University
IT 3700

2. How Much Did You Tell?
"Most privacy violations don't come from whopping big intrusions but from the aggregation of hundreds of small bits of knowledge, none of which individually seems important. Who cares if someone knows your ZIP code or your social security number? What about a tossed-out receipt from your ATM or an old credit card receipt? What's your mother's maiden name? But put those violations all together and you're well on your way to identity theft -- or worse."
InfoWorld. March 20, 2001.
Electronic communication, the Web in particular, and data mining have changed the ways personal information can be collected. It’s not how much information you reveal at one time, but how much you reveal over time.

3. How Did You Tell?
Cookies
Web Bugs

4. How Safe Are Cookies?
Cookies were intended to provide long-term “state” information, such as user ID’s or site preferences.
By design, only a Web server in the domain of the server that creates a cookie can read that cookie.
Internet Explorer 5.5 and 6.0 have a “backdoor” that allows any Web server to read any cookie on the user’s PC.

5. What’s in a Cookie?
FALSE / FALSE awMember John_Carter
FALSE / FALSE awMember
gserv.zdnet.co.uk FALSE / FALSE Apache
This looks innocent enough, if reading is limited to the creator Web server.
The hole in IE puts a different face on this information.

6. What’s in a Cookie?
FALSE / FALSE awMember John_Carter
FALSE / FALSE awMember
gserv.zdnet.co.uk FALSE / FALSE Apache
Now any Web server has the potential to get my name and address - and associate them with one or more IP addresses.
Very specific identification of this user.

7. Innocent Website?
This is how your browser normally sees this page from Microsoft’s Business Center.

8. Web Bugs - Invisible Invaders
This is how the Bugnosis plug-in for IE sees the page.
The little graphics mark the locations of “invisible” graphics - the Web bugs.

9. What Bugnosis Sees Tiny - very small
Once - appears one time on the page
Domain - not the same domain as the page you’re viewing
TPCookie - a third party site is setting/reading a cookie
Red = probable Web bug
Yellow = suspicious

10. What Do The Links Mean?
As the “invisible” graphics are downloaded from the specified server, some minimum information is being collected about the viewer by that server:
Operating System
Browser Type and Version
IP Address
Previous Page Viewed
These items are part of the standard Web protocol and the teansactions are normally logged.
The image server logs are analyzed for trends and for potential targets.

11. How Is the Information Used?
The intention is to track hits on pages and your page viewing to provide targeted advertising.
If you visit two sites with digital camera information, the next ads you see will relate to digital cameras and accessories.

12. Do You Want Them to Know Where You’ve Been?
The Network Advertising Initiative has a page that provides “opt-out” from most advertising data collection:
Not all Web advertising companies participate in this organization.
Marketers consider your profile to be worth $0.10 to $2.50 depending on your interests and ZIP code.
This is an additional source of income for the advertising companies.

13. Summary Do not reveal personal information inadvertently.
Turn on cookie notices in your Web browser, and/or use cookie management software.
Keep a “clean” address.
Don’t provide any more information than is absolutely necessary.
Consider whether the benefit offered in exchange for your address or filling out a survey is worth the risk.

14. Questions? The original paper is on-line at

15. Thank You