Betrayed by a browser: The scandal surrounding the snooping ‘Web of Trust’ add-on for Chrome and Firefox proves that when it comes to the internet, there’s no escape from data collectors
An alleged 140 million internet users use the Web of Trust (WOT) browser add-on to protect them from data snoops, hackers and rip-off artists when they’re using the internet. However, the manufacturer (myWOT) was caught offering highly volatile user data on the data market: Lists of all the web addresses that millions of WOT users visited within a period of one month – In fact, the sample data set acquired by NDR reporters contained the detailed surfing histories of millions of WOT-users. An anonymous statement provided by the manufacturer claimed that it was just an accidental slip-up, and promised that the situation would be fixed.
However, Wolfie Christl is not too optimistic. According to him, this incident is a disaster beyond all expectations: “It’s quite absurd that an add-on that was supposed to provide security ends up creating insecurity by forwarding data in an extremely negligent manner.” The Vienna-based expert in the trade in data knows how companies collect, evaluate and sell data – And what happens to data that emerges from things like the WOT add-on. He collaborated with the researcher Sarah Spiekermann to write a book on the subject: It’s an extremely precise study of how usage data is covertly turned into money – This often takes place in a legal and ethical grey area, but it’s always the user who comes up short.
Money From Data
Browser data such as that sold by myWOT is particularly valuable in the realm of data capitalism, says Mr Christl: “Such data is used to create personality profiles for targeted advertising, but there are also other motives.” The websites and web services used by a particular person can reveal quite a lot about his habits and needs. This is quite problematic in itself – But unfortunately, it has been part of the normal state of affairs for quite a long time. The companies that want to use data acquired in such a manner operate within a relatively tight legal framework.
Nevertheless: This is not enough. What’s critical is that the data should be distorted to such an extent that it cannot be traced back to a single person. And this is where myWOT turned out to be sloppy – It’s not known whether this was a result of wilful intent or a simple inability to perform.
“It looks like myWOT didn’t just log and sell the visited web addresses and sub-parts. They seem to have done the same thing with the entire URL and its parameters”, says Mr Christl. The first of these two things has become quite customary, and the digital advertising industry does it on a large scale. “However, the second case clearly represents an enormous security risk.” Along with the web address, complete URLs often contain data that can be traced back to the respective user, such as the user’s e-mail address, links on private cloud memories or profile names for social networks and forums. You can easily track this data in your personal browser history. Thanks to this, myWOT sold data that was particularly worthy of protection, and which can be de-anonymised quite easily. The company also violated the WOT data protection regulations.
Extensive Profiles
The scandal didn’t surprise Christl at all: Browser add-ons have been considered to be a security risk for a long time. However, he believes that myWOT represents a relatively minor node in the data dealers’ network. “There are many companies that track our surfing patterns.” The situation involves billions of internet users and millions of websites and internet services. After all, a form of data capitalism has emerged around user data: The more data you collect and exploit, the more valuable the data becomes. When the dossiers about preferences, personality traits and behavioural patterns (which can be updated in real time) become more detailed, it becomes possible to contact and manipulate individual users in a more efficient way. This situation doesn’t just revolve around advertising anymore: Such methods are also used to determine creditworthiness or exhaust payment reserves.
“All of these companies are trying to establish links between our surfing behaviours, our purchases and our behavioural data across multiple devices, platforms and spheres of life.”, explains Christl. Instead of a name, the data dealers use their dossiers to create a pseudonym, which is a unique letter code. A hash function is used to derive this code from relatively stable personal details such as known mail addresses or telephone numbers. This unique code is assigned to a person as soon as the person in question is recognised by a tracker – This can happen when the person is surfing the internet at home, using the internet at the office, using an internet TV or using a debit card.
Dangerous Magnitude
“Extensive profiles regarding our daily routine and lives are being created, which go far beyond what any powerful entity in human history has ever known about specific individuals. This is an enormous problem!” In such a system, anonymity is nothing more than a farce. You don’t need to know a person’s name to sell something to him. If you want to understand the true dangerous nature of the data leaked by WOT, it’s not enough to be aware of the information content of apparently-harmless browsing data. What’s just as frightening is the sheer magnitude of the trade in data – This involves the worldwide market for the process that collects such data and refines it to create predictive user profiles. Here’s just one example from Mr Christl’s book: Oracle acquired the tracker-company AddThis over the summer. According to its own statements, it monitors a total of three billion users on 15 million websites. It has created a dossier for each one of these users. On such a scale, conventional anonymisation methods flop big time: Names no longer have a role to play if there is a dossier for each surfer that can be uniquely correlated with the said surfer. The identification code would then be his new name. However, the core of the problem is the data companies’ desire to control users in a better manner.
It’s unrealistic to prohibit individual companies from trading in data. We currently don’t know what a realistic form of data protection would look like under such circumstances. Luckily, the WOT case is a lot simpler – In addition to a lack of programming skills, this situation apparently also involved a lack of good intentions. According to Wolfie Christl, if the company had – as it claimed in its statement – been serious about anonymisation, it would have given short shrift to the collected data. The WOT add-on would have been able to achieve its purpose by just saving domains, instead of the telltale URL strands. This data would still have been valuable in the data market – But it would have been a lot less risky for the users.