[Don]

Source: New York Times.com
July 4, 2008

Google Told to Turn Over User Data of YouTube

By MIGUEL HELFT
SAN FRANCISCO — A federal judge has ordered Google to turn over to Viacom its records of which users watched which videos on YouTube, the Web’s largest video site by far.

The order raised concerns among YouTube users and privacy advocates that the video viewing habits of tens of millions of people could be exposed. But Google and Viacom said they were hoping to come up with a way to protect the anonymity of the site’s visitors.

Viacom also said that the information would be safeguarded by a protective order restricting access to the data to outside lawyers, who will use it solely to press Viacom’s $1 billion copyright suit against Google.

Still, the judge’s order, which was made public late Wednesday, renewed concerns among privacy advocates that Internet companies like Google are collecting unprecedented amounts of private information that could be misused or fall unexpectedly into the hands of third parties.

“These very large databases of transactional information become honey pots for law enforcement or for litigants,” said Chris Hoofnagle, a senior fellow at the Berkeley Center for Law and Technology.

For every video on YouTube, the judge required Google to turn over to Viacom the login name of every user who had watched it, and the address of their computer, known as an I.P. or Internet protocol address.

Both companies have argued that I.P. addresses alone cannot be used to unmask the identities of individuals with certainty. But in many cases, technology experts and others have been able to link I.P. addresses to individuals using other records of their online activities.

The amount of data covered by the order is staggering, as it includes every video watched on YouTube since its founding in 2005. In April alone, 82 million people in the United States watched 4.1 billion clips there, according to comScore. Some experts say virtually every Internet user has visited YouTube.

Google and Viacom said they had had discussions about ways to further protect users’ anonymity, but as of Thursday evening the two companies had yet to agree on how to do that.

“We are investigating techniques, including anonymization, to enhance the security of information that will be produced,” said Michael D. Fricklas, Viacom’s general counsel.

Mr. Fricklas said Viacom would not have direct access to the data, and that its use would be strictly limited by the court order. Viacom would not, for example, chase down users who had illegally posted clips from “The Colbert Report.”

“The information that is produced by Google is going to be limited to outside advisers who can use it solely for the purpose of enforcing our rights against YouTube and Google,” Mr. Fricklas said.

In a letter sent Thursday, Google’s lawyers pressed their counterparts at Viacom to accept a more limited set of data. “We request that plaintiffs agree that YouTube may redact user names and I.P. addresses from the viewing data in the interests of protecting user privacy,” wrote David H. Kramer, a partner at Wilson Sonsini Goodrich & Rosati.

In a response, a Viacom lawyer wrote that Viacom was “committed to working with Google” on the privacy issue.

Interestingly, Google has rejected demands by privacy groups for more stringent protections for I.P. address records, saying that in most cases the addresses cannot be used to identify users. Yet Google argued that YouTube viewing data should be kept from Viacom, in part, to protect the privacy of its users.

Judge Louis L. Stanton of the Southern District of New York, who is presiding over Viacom’s lawsuit against Google and YouTube, referenced Google’s past statements on I.P. addresses to conclude that its “privacy concerns are speculative.”

“It is an ‘I told you so’ moment,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center, an advocacy group in Washington.

Other privacy advocates said they welcomed Viacom’s commitment to limit its use of the information, but they remained concerned about user rights.

“Users should have the right to challenge and contest the production of this deeply private information,” said Kurt Opsahl, senior staff lawyer at the Electronic Frontier Foundation, an online civil liberties group.

That right is protected by the federal Video Privacy Protection Act, Mr. Opsahl added. Congress passed that law in 1988 to protect video rental records, after a newspaper disclosed the rental habits of Robert H. Bork, then a Supreme Court nominee.

Mr. Opsahl also said that even records that did not include a user’s login name and I.P. address might be able to be associated with specific people.

In 2006, after AOL released for research purposes the search records of thousands of anonymous users, reporters from The New York Times were able to track down one person by analyzing her search queries. Mr. Opsahl said anonymous viewing habits may similarly yield clues about the identity of viewers.

Viacom wants the viewing data in part to help it determine the extent to which YouTube’s success was built on the popularity of copyrighted clips that were illegally posted to the site. Outside experts say that without the data it would be virtually impossible to pin that down.

Judge Stanton agreed that the information could help Viacom make its case. “A markedly higher proportion of infringing-video watching may bear on plaintiff’s vicarious liability claim, and defendants’ substantial noninfringing use defense,” he wrote.