U.S.-China Surveillance

The San Franciscos Chronicles’ “TheTech Chronicles,” along with a number of other media outlets, is reporting that Google has will “halve the time it stores logs of user web searches” from 18 to 9 months. Charitably, one could call this a misleading statement, but it really is just plain wrong. Google keeps its search logs indefinitely. It only “anonymizes” search logs after the set period of time, and just what anonymization means is up to Google. When Google first announced 18 month policy in March of 2007, I reprinted this section of the Google blog’s FAQ that helps illustrate the limitations:

Will governments be able to subpoena server log data after it is anonymized? Will anonymized data still be able to identify an individual user by cookie or IP address? Google does comply with valid legal process, such as search warrants, court orders, or subpoenas seeking personal information. Logs anonymization does not guarantee that the government will not be able to identify a specific computer or user, but it does add another layer of privacy protection to our users’ data.

Will this policy change make it more difficult for law enforcement to prevent and detect crime or child exploitation? No, current laws allow the government to request that companies preserve user data. We regularly comply with such laws.

What happens to the logs at the end of the expiration date? Are they deleted? At the end of the expiration date we will still keep server logs but they will be anonymized.

At the time, the process of anonymization involved deleting the first four digits of the IP address and altering associated individual cookie data in an unspecified way. With the new 9 month policy, Google states that it might do something different. The only thing that this policy means is that your search logs data older than nine months will not be used for services like “automatic search correction,” which corrects typos on the fly based on your prior search patterns, or to serve you ads. It does not mean that your personal search behavior older than 9 months won’t be accessible to state policing organizations.