January 2009
A Telegraph-Era TLD? (9 January 2009)
YouTube, the Government, and Privacy (13 January 2009)
More on YouTube, the Government, and Privacy (22 January 2009)

More on YouTube, the Government, and Privacy

22 January 2009

I noted a few days ago the privacy risks from having government videos hosted on YouTube: that site can plant (or retrieve) its own tracking cookies. The Obama White House is aware of the problem, but has done exactly the wrong thing in response.

Cookies are, as has been widely documented, a privacy issue. This is recognized by the government’s own privacy policies. (Also see the links here. None of the links are that page are newer than 2008. I don’t know if I’m looking at an older page or an artifact of the transition, or whether privacy policies simply weren’t updated during the Bush years.) But rather than solving the problem, the new White House privacy policy defines it out of existence:

For videos that are visible on WhiteHouse.gov, a ‘persistent cookie’ is set by third party providers when you click to play a video. (We may experience some engineering difficulties as the new Whitehouse.gov is posted and reviewed. We intend, however, to fully enforce the above provisions as soon as possible. If you are experiencing any difficulties, please contact us.)

This persistent cookie is used by YouTube to help maintain the integrity of video statistics. A waiver has been issued by the White House Counsel’s office to allow for the use of this persistent cookie.

If you would like to view a video without the use of persistent cookies, a link to download the video file is typically provided just below the video.

Apart from the fact that the last part isn’t true, at least at the moment, on what grounds was such a waiver issued? (Chris Soghoian’s post is well worth reading for many other reasons; he provides many more details.) The OMB regulation pointed to by the web page (which got the link wrong, but that’s undoubtedly a transition issue) requires
  • the nature of the information collected;
  • the purpose and use for the information;
  • whether and to whom the information will be disclosed; and
  • the privacy safeguards applied to the information collected.
in the privacy policy. Has anyone ever gotten clear answers to those points from Google? And yes, these rules apply to contractors operating web sites for the government.

Obama’s team has been in charge for only about a day, and rough spots are to be expected. The video issue isn’t new, though; Soghoian posted about it almost two months ago. Simply saying "it’s allowed here" doesn’t solve the problem. I look forward to a real change.