January 2006

Boing Boing reports that Apple’s iTunes 6.0.2 has a new “feature” where clicking on a song in your playlist pops up related albums on sale at the iTunes Music Store in a little window at the bottom. Apple does it by sending the song, artist, album, genre and ID to Apple (presumably — the IP addresses are in the 69.144.123.xx range, which is Akamai).

GET /WebObjects/MZSearch.woa/wa/ministoreMatch?an=Music+From+The+Motion+Picture&gn=soundtrack&kind=song&pn=Austin+Powers+-+The+Spy+Who+Shagged+Me HTTP/1.1

This is rightly being decried as spyware (really, how could it not be?) though at least iTunes will stop announcing what you’re listening to if you close the mini-store window (using the new “box with up-arrow” button in the lower-right corner).

My PhD thesis was all about designing software that provides information based on what you’re doing and I have a soft spot for applications like this, but I see three fundamental problems in what Apple has done here. First and most importantly, the mini-store is for their benefit rather than mine — they’re taking advantage of the impulse buyer in all of us, hoping we’ll make purchases we wouldn’t make if we had time to think about it. Second, their application requires that personal (if not personally identifiable) information be sent over the net rather than processed locally, with no idea how long the info is kept or how it might be used. Music collections are personal things, and even if I liked the mini-store application I’d think twice about clicking on a lewd song for fear of how that info might be used or eventually tied back to me. Finally and most obviously wrong, they’re snooping without asking, which is just plain rude and makes me distrust the company and the software.

Update 1/12/05:As Charles points out in the comments, MacOSXHints reports that Apple has told them that absolutely no information is (currently) being collected from the MiniStore. I’m glad to hear it (and would have been a little surprised if it was otherwise), but it doesn’t change my not liking such data going beyond the bounds of my own domain. If the Mini-store was actually useful to me I might be willing to make that sacrifice, but as it is it’s just annoying.

Tom Owad over at Applefritter has a nice simple example of the kind of homebrew data aggregation that’s possible with just a little bit of programming knowledge and a home internet connection.

The thing that scares me about data mining is not that super-secret information about me is revealed — my Amazon wish-list doesn’t contain anything I’d be embarrassed or concerned if it was seen by any of my friends or for that matter 99% of the other people in the world. And odds are good that anyone bothering to look me up by name or go to my website will fall into that category. The trouble is that if I pop up in a trolling-expedition at all it’s much more likely the troller is among that 1% of the people that I would be upset about reading my wish-list. Ed McMahon doesn’t mine the Internet to pick winners of the Publishers Sweepstakes, but over-zealous FBI agents do look for people promoting the wrong politics, companies look for suckers to blast with seemingly perfect-for-you product announcements, con artists look for rich recently-widowed women above a certain age, and pedophiles look for young latch-key kids with their own webcams.

From Bruce Schneier’s Cryptogram, in a recent post comparing Bush’s recent (and continuing!) wiretapping to Project Shamrock in the 1960s:

Bush’s eavesdropping program was explicitly anticipated in 1978, and made illegal by FISA. There might not have been fax machines, or e-mail, or the Internet, but the NSA did the exact same thing with telegrams.

We can decide as a society that we need to revisit FISA. We can debate the relative merits of police-state surveillance tactics and counterterrorism. We can discuss the prohibitions against spying on American citizens without a warrant, crossing over that abyss that Church warned us about twenty years ago. But the president can’t simply decide that the law doesn’t apply to him.

This issue is not about terrorism. It’s not about intelligence gathering. It’s about the executive branch of the United States ignoring a law, passed by the legislative branch and signed by President Jimmy Carter: a law that directs the judicial branch to monitor eavesdropping on Americans in national security investigations.

It’s not the spying, it’s the illegality.

Personally, I think it’s the illegality and the spying, but in the name of keeping the debate clear I’m happy to keep the two arguments separate.