Both Bruce Schneier, here, and Paul Madson, here, discuss TrackMeNot, a firefox extension that sends semi-random search queries to a semi-random selection of search engines, supposedly to make attempts at tracking real searches more difficult. Both, quite rightly, point out that it’s pretty useless - that patterns of searching and the queries that are made do not really hide anything.
One point that Schneier picks up on is that some of the search terms are actually worse than strings that might get picked up on during an investigation - actually making one more likely to be subjected to further checks and that there are better ways of avoiding being tracked (denying cookies is a good start and I’ve previously mentioned Scroogle as an alternative), but I can actually see some use for such software with a bit of lateral thinking…
I have great problems with using someone’s search engine records as even a preliminary indicator of guilt. To me, it’s no better than monitoring library habits for signs of subversion - something that most people would disagree with. Just because someone checks out a book on a subject it does make them a criminal, likewise Google searches for bomb-making, converting to Islam, overthrowing Governments, buying guns or murdering one’s wife (from the recent release of AOL search records, IIRC!) does not make one a criminal - I could just as easily be researching a book. I bet the number of searches for those terms have gone up recently simply because of mentions of the news piquing interest in people - “Say, I wonder just what these people might have found” - it’s not very different from the the way that almost everyone searches for porn when first on the Internet - just to see how much there is. I’ve found myself in the past, quite innocently, discussing plans on web forums and mailing lists to assassinate, steal, kidnap and many other crimes but purely in a fictional sense - should these activities be monitored and participants treated as suspicious because of this?
My point is that adding random search strings to one’s own search records might not improve privacy, but if everyone added random searches to their records then targeting on them would become impossible - even better would be targeted searches containing terms similar to the above. A relatively small proportion of people could expose this ridiculous practice. I won’t get started on what a couple of decent spammers could do with encrypted emails with subject lines likely to attract attention (actually, the search engine idea could be done by Trojan as well…).
I’m not suggesting that anyone do this (why would I? I’m a law abiding citizen), but to me it does show that there are problems with these methods of investigation and means that we have to think very carefully about defining when criminal action actually takes place - we can’t make it illegal to discuss a criminal action, but can we criminalise the planning, or is the crime only actually committed when the action takes place? We’re veering into the realms of thought-crime and the dangers thereof. I learnt when studying law that there are two essential aspects to guilt - mens rea and actus reus, more and more it seems that guilt is to be determined by either (and in some cases not even that!).
