so far as to say, "While a number of companies share some of these negative elements, none comes close to achieving status as an endemic threat to privacy."

All of this means that Google has a big security burden to bear which is becoming increasingly cumbersome as their success grows. Google has a track record of building cool products that people love to use but they also have an ethical responsibility to match their ambition in features with security. If ethics don't win out, change may come at a higher price through regulation and shaken consumer confidence. Here are a few open questions that need answers: How is information provided to Google pushed out to partners, advertisers, and the public? What security mechanisms are in place to protect aggregated data on servers from vulnerabilities (this goes beyond masking the identity of the person whose behavior is tracked and speaks to the behavior data itself)? What is Google's policy for disclosing a breach of any search/behavior data that isn't covered by current (and narrow) breach disclosure legislation? I look forward to hearing your thoughts/opinions on this either as public comments on this blog or privately to hthompson@peoplesecurity.com.

Hugh Thompson is chief security strategist at People Security and author of the upcoming Protecting the Business: Software Security Compliance (John Wiley & Sons, 2007).