FC: A defense of Comcast's recording web traffic of subscribers

[Declan McCullagh <declan () well com>]

Sequence of events:
1. Word leaks out, first in mailing lists, then confirmed by Ted Bridis, 
that Comcast is recording user browsing data.
2. Expected privacy fuss ensues, with Rep. Markey, always ready to pounce 
on suspected corporate miscreants, writing Comcast the traditional nastygram.
3. Whoops! Turns out federal law says a cable operator "shall not use the 
cable system to collect personally identifiable information concerning any 
subscriber without the prior written or electronic consent of the 
subscriber concerned." (Let's hope that Comcast's lawyers did their 
homework when writing their privacy policy, otherwise might we see a class 
action lawsuit asking for statutory damages of $1,000 per user?)
4. Comcast backs down.

Call me a curmudgeon, but all this doesn't seem that terribly alarming -- 
assuming Comcast is telling the truth when saying (a) data were retained 
for only a week, (b) their privacy policy permitted this, and (c) the info 
was used for performance purposes and not given to anyone else. Put another 
way, there are benefits to aggregating information on web use: It can help 
improve network performance and lower the cost of the service.

So if Comcast's privacy policy permitted this, what's the big deal? Anyone 
looking for a more privacy-protective service (and the point about 
subpoenas for stored data is a good one) should have taken their business 
elsewhere. To Earthlink, for example, which seems to be offering just that.

-Declan

---

http://comcast.comcastonline.com/internetprivacypolicy.asp

   COMCAST STATEMENT ON INTERNET PRIVACY
   Philadelphia (February 13, 2002) - Comcast Cable Communications
   President Stephen B. Burke issued the following statement today
   regarding Internet privacy:
   "Comcast respects the privacy of all our subscribers and is committed
   to fully protect their rights. Comcast has not shared and will not
   share personal information about where our subscribers go on the Web,
   either for any internal purpose or with any outside party, except as
   required by law. Consistent with our subscriber agreement and our
   privacy policy, which every subscriber acknowledges before receiving
   our service, Comcast reviews information in aggregate form only for
   purposes of network performance management to ensure an optimal
   Internet network experience for our subscribers."
   "Since we launched our own Internet network six weeks ago in the wake
   of Excite@Home's bankruptcy, IP and URL information has been stored
   temporarily. This information has never been connected to individual
   subscribers and has been purged automatically to protect subscriber
   privacy. Beginning immediately, we will stop storing this individual
   customer information in order to completely reassure our customers
   that the privacy of their information is secure."

---

http://www.washingtonpost.com/wp-dyn/articles/A5567-2002Feb13.html

   By Ted Bridis
   Associated Press Writer
   Wednesday, February 13, 2002; 2:14 PM

   WASHINGTON Comcast Corp., the nation's third-largest cable company,
   pledged Wednesday to immediately stop recording the Web browsing
   activities of each of its 1 million high-speed Internet subscribers.

   Comcast said in a statement that it will stop storing the information
   "in order to completely reassure our customers that the privacy of
   their information is secure." The Associated Press reported Tuesday
   that the company had started recording each customer's visit to a Web
   page as part of a technology overhaul to save money and speed up the
   network. [...]

---

Date: Wed, 13 Feb 2002 09:30:33 -0500
From: "James Maule" <maule () law villanova edu>
To: <declan () well com>
Subject: News Item

Declan,

Article in Phila Inquirer about Comcast recording every move of its 
internet cable customers. Here's the link to the story. I'll let you write 
the introductory blerb and a Subject heading... you're quite adept at that. 
Note that the URL is responding rather slowly.

http://www.philly.com/mld/inquirer/2661259.htm

 Posted on Wed, Feb. 13, 2002

Comcast tracks users' Web browsing
The cable firm said it is being done to save money and improve service. It 
acknowledged it didn't notify customers.
By Ted Bridis
Associated Press

WASHINGTON - Comcast Corp., the nation's third-largest cable company, has 
begun tracking the Web-browsing activities of its one million 
high-speed-Internet subscribers without notifying them.
The Philadelphia-based company said yesterday that the tracking of each Web 
page a subscriber visits was part of a technology overhaul designed to save 
money and improve the speed of cable Internet service and was not intended 
to infringe on privacy.
But technology experts cautioned that the data could be subpoenaed by law 
enforcement agencies or lawyers in civil cases, and they questioned whether 
Comcast's move reflected a more cavalier attitude toward online privacy 
after the Sept. 11 terrorist attacks.

[rest of article not copied]

---

http://www.epic.org/privacy/internet/markey_comcast.html

   February 13, 2002

   Mr. Brian Roberts
   President, Comcast Corporation
   1500 Market Street
   Philadelphia, PA 19102-2148

   Dear Mr. Roberts:

   I am writing with respect to recent media reports regarding Comcast's
   use of cable facilities to gather personal data from consumers of
   Comcast's broadband telecommunications service. I have concerns about
   the allegations raised in these reports and the nature and extent of
   any transgressions of the law that may have resulted in consumer
   privacy being compromised.

   Consumer privacy in the digital era is fundamental to ensuring trust
   between citizens and the owners of nation's communications networks
   and services. The cable industry has a long history of safeguarding
   consumer privacy with respect to the television viewing habits of
   consumers through its provision of cable service. I believe that many
   consumers would be understandably concerned if our nation's cable
   operators begin to monitor Americans' use of cable systems for other
   services such as telecommunications services, including broadband
   access to Internet via cable modems.

   As you know, the cable industry has obligations to protect consumer
   privacy that are contained in Section 631 of the Communications Act
   (47 U.S.C. 551). It is clear that in enacting Section 631, Congress
   intended to place a high priority on consumer privacy and for that
   reason the applicability of Section 631 is very broad. The general
   requirement of Section 631 is that cable operators obtain "prior
   written or electronic consent" in order to utilize any personal
   information gathered from subscribers. These privacy obligations,
   however, are not limited to personal information gathered through a
   customers use of a "cable service." Rather, the privacy requirements
   of Section 631 apply to "any wire or radio communications service
   provided using any of the facilities" of the cable system, not solely
   a consumer's use of cable service.

   As part of the order by which the Federal Communications Commission
   (FCC) approved AOL-Time Warner merger last year, the FCC reiterated
   that, with limited exceptions, a "cable operator may not use the cable
   system to collect personally identifiable information nor may the
   cable operator disclose personally identifiable information without
   the prior

   Mr. Brian Roberts
   February 13, 2002
   Page Two

   written or electronic consent of the subscriber." As part of the
   order, the FCC required AOL-TW to certify compliance with the legal
   privacy obligations contained in the law. (From AOL-TW Merger FCC
   Order (CS Docket 00-30), adopted 1/11/01, released 1/22/01, paragraphs
   277-79.)

   I would greatly appreciate your response at the earliest opportunity.
   I also respectfully request a clarification of Comcast's current
   policy for collection and use of subscriber information and Comcast's
   position as to whether it intends to provide consumers of its
   telecommunications services, such as its cable modem service, with the
   right to affirmatively grant consent to data collection and use
   consistent with the consumer privacy requirements placed upon cable
   operators embodied in Section 631 of the Communications Act. I thank
   you in advance for your time and attention to this matter. If you have
   any questions with respect to these issues or my comments please feel
   free to call me or have your staff contact Colin Crowell in my office
   at (202) 225-2836.

     Sincerely,

     Edward J. Markey
     Ranking Democrat
     House Subcommittee on
     Telecommunications and the Internet

---

http://www4.law.cornell.edu/uscode/47/551.html

   Except as provided in paragraph (2), a cable operator shall not use
   the cable system to collect personally identifiable information
   concerning any subscriber without the prior written or electronic
   consent of the subscriber concerned.
   (2)
   A cable operator may use the cable system to collect such information
   in order to -
   (A)
   obtain information necessary to render a cable service or other
   service provided by the cable operator to the subscriber; or
   [...]

---




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
Declan McCullagh's photographs are at http://www.mccullagh.org/
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------