Unit Structures Fred Stutzman’s thoughts about information, social networks and technology.

YouTube’s Privacy Catastrophe

In a decision catastrophic to digital privacy rights, a federal judge has ordered that Google turn over the video-consumption histories of all YouTube users. The order, which represents the decision of Judge Louis Stanton in the ongoing YouTube et. al. v. Viacom et. al., stipulates that Google must turn over the following:

• A record of every video watched on YouTube or embedded in a third-party website via YouTube
• The viewing histories of all IP’s in YouTube’s database
• The viewing histories of all users in YouTube’s database

The only videos that are granted protected under Judge Stanton’s decisions are those explicitly private; Google will be compelled to turn over all of the records of every other public video you’ve watched. The EFF states that the order is in violation of the Video Privacy Protection Act, a law enacted following the disclosure of Supreme Court nominee Robert Bork’s video rental records.

That the court failed to understand the privacy implications of such a disclosure is astounding. YouTube’s records capture the viewing habits of a wide swath of the web’s users. Such data should be considered personal and private, such as search data, log data, and telephone records. Such disclosure, public or private, is a clear violation of privacy rights, and sets a dangerous precedent going forth.

In a moment of hubris for the behemoth Google, Judge Stanton cited Google’s own public policy blog, that foolishly argued that IP’s are not personally identifiable information. Indeed, IP’s, usernames and histories are identifiable, certainly in corpora the size of YouTube’s.

I’m certainly not a lawyer, but there are a few procedural questions I’d like answered: What processes or procedures exist for the judge to amend this opinion? Even if the case can’t be made against the transfer of data, can he amend his ruling to allow for anonymizing the data? Additionally, what protections follow the data, post transfer? In the worst case, do the logs become public record? Can Viacom et. al. analyze the logs, using them for business or future legal action?

And what can we, the internet, do to convince the judge of his error? I know that I wave my arms about Google and privacy a lot, but this is not the time to gloat. This is a dangerous precedent, and I hope that we can harness the collective to see if we can put it right.

Other smart people writing about the issue:

• My SDP colleague Joris van Hoboken discusses the decision
• BBC reports on the decision
• ZDNet has good analysis

Update: Via Siva Vaidhyanathan, this quote from Michael Froomkin:

While it may be the case that some of these videos are trying to share copyright protected materials under the radar, it is undoubtedly the case that many of these videos are (1) truly private and of very limited distribution and (2) the author would be identifiable from the associated information ordered to be disclosed. (The order also is opaque as to what sort of precautions if any Viacom would be required to take to prevent leakage of this data.)

There are some procedural obstacles to getting an immediate interlocutory appeal of this decision, but assuming they can be surmounted I think there’s a strong chance of reversal before the 2nd Circuit.

Update 2: The NYT has quotes from Viacom:

“We are investigating techniques, including anonymization, to enhance the security of information that will be produced,” said Michael D. Fricklas, Viacom’s general counsel.

Mr. Fricklas said Viacom would not have direct access to the data, and that its use would be strictly limited by the court order. Viacom would not, for example, chase down users who had illegally posted clips from “The Colbert Report.”

“The information that is produced by Google is going to be limited to outside advisers who can use it solely for the purpose of enforcing our rights against YouTube and Google,” Mr. Fricklas said.

I’d really be surprised if this remained a precedent for very long - the reasoning is so flimsy that I can’t imagine it surviving appeal.

This of course would be an absurd, obscene precedent were it to stand, but that really doesn’t seem likely.

I just ran across your name in a yahoo article named “‘Public’ online spaces don’t carry speech, rights”. Unfortunately, I feel this article may pertain to the deletions of thousands of my comments on YouTube. Sometime nearly a year ago, I decided to post comments and become an online activist supporting greater freedoms, autonomy, an end to abuses of Tibetans within Tibet, and reform of Communist Party of China (CCP) policy in Tibet. I spent many hours each day posting comments on YouTube videos that were about Tibet. For some reason specific users focused in on me and replied for many more hours, showing particular disdain when I posted news quotes about mistreatment of Tibetans. Mysteriously, one day, all of my comments were deleted- even from videos that had nothing to do with Tibet.

This occurred again a few months later around December, when after graduating from my University, I spent even longer posting on YouTube. I emailed YouTube security, fearing a hacking attack (shortly afterward, I got the bright idea of getting anti-virus/anti hacking trialware- showing attacks). I got no reply. I even went so far as getting someone online, who had YouTube’s phone number and fax number, to call and fax them on my behalf. I did the same; both of us failed to make any contact or receive any replies. A few months earlier I had successfully contacted a lady by email who worked for YouTube’s advertisement department regarding advertisement fees for NGO’s. She returned my email, however, when I contacted her a few months later regarding the deletions of my posts she did not return my email.

I was never told that I was doing anything wrong, nor did I believe that I did. I quoted my news sources and when I gave my opinions, I was respectful even towards those who were hostile towards me. YouTube never warned me of any violations, nor did they delete my account. You can even see that people are replying to the ‘mysterious’ Dem, Dementia, etc… on the video entitled ‘Tibet-Story of a Tragedy’. My user name was dementia664 (named after my ex-girlfriends pet cat and a parody of 664- the neighbor of the beast). I put in many hours posting comments. I have gotten no explanation and my comments were never re-posted as I had requested.

The prevailing opinion of an online contact from Japan was that Google used software that was specifically created for China to delete controversial information that originated within China, however mine did not. I believe that it is possible that Google or YouTube was contacted by CCP or some Chinese nationalists and decided an individuals free speech (ironically they claim to represent free speech) wasn’t worth a loss of income or greater restrictions on what could be posted on YouTube. (It is also possible, that a google or YouTube employee who was sympathetic to Chinese nationalism and/or Anti-Tibetan autonomy/rights may have deleted the comments.) I however, believe that it is the individuals, collectively, who can make a difference in the Tibetan cause, and, ironically, whose free speech YouTube claims to want to protect.

Is there anyway that you can assist me in getting an explanation from YouTube regarding this matter, and possibly even getting the comments re-posted? If you can not directly assist me, can you offer advice or other people who may be able to assist me with this matter?

Thanks for your time.