the following is from  http://lists.indymedia.org/pipermail/imc-tech/2005-November/1124-9a.html


[IMC-Tech] Google user and IP tracking on sf.indymedia.org
A at indymedia.org
Thu Nov 24 12:40:05 PST 2005

* Previous message: [IMC-Tech] access to contact database
* Next message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Hi!

I just browsed the San Francisco IMC website at  http://sf.indymedia.org/

I realized that it uses so-called Google Analytics, which is basically a
remotely hosted (by Google) statistic and user tracking software called
Urchin which Google recently acquired. Seemingly most of the web pages
(not the main page, though) on sf.indymedia.org contain this tracking code:




_uacct = "UA-83072-1";
urchinTracker();


I do not consider Google a trustable party organization, I would not
give away statistical information to them, especially not users' IP
addresses, even more so not those of an Indymedia website.

If I was planning to do anything similar to this, I would definately
make sure that all the users of the web site know about their access to
the web site being tracked, their IP addreses being stored, in
externally controlled databases, by an enterprise size company which is
known to have had and still has repeated cooperations with governmental
organizations and which the web sites users would possibly decide not to
trust and even more so not want to give their IP address, time of visit
and, web browser, clickpath and additional information to.

I assume this must have been a mislead decision, probably caused by lack
of understanding of how this system works. I cannot imagine any other
good reason for why this code was added to the site.

Maybe there has been an informational campaign on this decision, and -
being no regular visitor of this site - I just missed it. But even then
it should probably be noted in bold type on the website that
sf.indymedia.org is now a user behaviour and IP address sniffing tool
working for Google, its advertisers (whoever that is) and possibly
others which would be very much against the lately proposed (and now
blocked) PoU addition about not even logging IP addresses on IMC servers.

I know I should have calmed down more before sending this email, but I
think even though the above words may sound lurid, this doesn't change
the facts. This makes me sad and disappointed, and I'd love to learn
that I'm somehow mistaken. In any case I'd like to see any statement on
this by the people running the sf.indymedia.org site.

Thanks for reading,
A




[IMC-Tech] Google user and IP tracking on sf.indymedia.org
g at linefeed.org
Thu Nov 24 13:01:03 PST 2005

* Previous message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Next message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> I realized that it uses so-called Google Analytics, which is basically a
> remotely hosted (by Google) statistic and user tracking software called
> Urchin which Google recently acquired. Seemingly most of the web pages
> (not the main page, though) on sf.indymedia.org contain this tracking code:

As already explained to A in irc (not sure why its not reflected
here), I put that on there so I could see the interface (I've used
Urchin a lot professionally and wanted to see Google's adaptation of
it). In the end, it took over 12 hours to start collecting stats so I
just never activated it. The Javascript code is no longer on the site.

To the extent that it was never working, I think you'd have to be kind
of paranoid to assume that the stats were being recorded without our
knowledge (also explained to A in irc).

-g/sfimc


[IMC-Tech] Google user and IP tracking on sf.indymedia.org
A at indymedia.org
Thu Nov 24 13:24:13 PST 2005

* Previous message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Next message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

g:
>>I realized that it uses so-called Google Analytics, which is basically a
>>remotely hosted (by Google) statistic and user tracking software called
>>Urchin which Google recently acquired. Seemingly most of the web pages
>>(not the main page, though) on sf.indymedia.org contain this tracking code:
>
>
> As already explained to A in irc (not sure why its not reflected
> here),

This is both because
- - I wrote the email before we had the chat
- - I thought that it would be just fair to give you some more time to
decided whether or not and which answer you send than you had when
replying to me on IRC

> I put that on there so I could see the interface (I've used
> Urchin a lot professionally and wanted to see Google's adaptation of
> it). In the end, it took over 12 hours to start collecting stats so I
> just never activated it. The Javascript code is no longer on the site.
>
> To the extent that it was never working, I think you'd have to be kind
> of paranoid to assume that the stats were being recorded without our
> knowledge (also explained to A in irc).

I do not think that Google anonymizes its web server logs.

The point here is this: sf.indymedia.org currently contains a HTML
instrcution which causes the website visitors' browsers to download and
execute javascript code from a google.com webserver.

This means that as long as this code remains there (and yes, I have read
that you intend to remove this code)

- - the IP addresses, web browser versions, and serveral other information
about the users of the sf.indymedia.org web site will be sent to a
google.com server, and will assumeably be stored on their web server
logs, possibly on their data mining database (that's what Google
Analytics is to me), too.

- - the web browsers of the users visiting the sf.indymedia.org web site
will download and run javascript code from a file on a Google web
server. The javascript code on this file is run silently and may change
any time without the user nor the server admins noticing it.

Just think of what would happen if Google got subponaed right now
because of an article published on sf.indy which the government of the
country Google happens to have their company central in dislikes the
articles' contents... they would probably be asked to give away their IP
logs.

Maybe I *am* a little bit paranoid, and I'd really prefer if more IMC
techs were if that results in saving 'our' users from dangers they are
not neccessarily aware of.

A


[IMC-Tech] Google user and IP tracking on sf.indymedia.org
g at linefeed.org
Thu Nov 24 13:48:57 PST 2005

* Previous message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Next message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> The point here is this: sf.indymedia.org currently contains a HTML
> instrcution which causes the website visitors' browsers to download and
> execute javascript code from a google.com webserver.

As I wrote, I took the javascript code out.

> - - the IP addresses, web browser versions, and serveral other information
> about the users of the sf.indymedia.org web site will be sent to a
> google.com server, and will assumeably be stored on their web server

Again, it wasn't collecting the data that I could tell, so you would
have to be paranoid to assume that the data was being collected but
kept secret from the account holder.

-g




[IMC-Tech] Google user and IP tracking on sf.indymedia.org
T indymedia at machine.org.uk
Thu Nov 24 14:14:01 PST 2005

* Previous message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Next message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thursday 24 Nov 2005 21:24, A wrote:
> G:
> > I put that on there so I could see the interface (I've used
> > Urchin a lot professionally and wanted to see Google's adaptation of
> > it). In the end, it took over 12 hours to start collecting stats so I
> > just never activated it. The Javascript code is no longer on the site.
> >
> > To the extent that it was never working, I think you'd have to be kind
> > of paranoid to assume that the stats were being recorded without our
> > knowledge (also explained to A in irc).

Personally, I wonder if such a thing is entirely sensible. I'd suggest a
separation of personal and indymedia interests. I certainly wouldn't modify
content on the web servers I host Indymedia sites on for personal reasons,
despite the fact that as high traffic sites, it might be interesting to do
so.

Cheers,
T




[IMC-Tech] Google user and IP tracking on sf.indymedia.org
j at indymedia.org
Thu Nov 24 14:32:44 PST 2005

* Previous message: [IMC-Tech] Google user and IP tracking on sf.indymedia.org
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

g wrote:
[chop]
>In the end, it took over 12 hours to start collecting stats so I
> just never activated it. The Javascript code is no longer on the site.

What do you mean it took 12 hours? Doesn't the javascript go out to
their site each hit? And then go to apache logs or whatever? Does it
read any google cookies? Or give any? I'm just curious what the urchin
did to folks visiting the site during those 12 hours.

> To the extent that it was never working, I think

What wasn't working? Were people not directed to google's site? Or the
web interface that aggregates the site for google's customer didn't
display the stats?

> you'd have to be kind of paranoid

yep, thankfully no one 'round these parts has reason to be paranoid.

> to assume that the stats were being recorded without our
> knowledge (also explained to A in irc).

Uh, so the people that visited sfimc during those 12 hours were not
tracked? It seems to me if their browser made /any/ connection
whatsoever to google's site after they hit sfimc they were tracked.
Methinks google logs all hits...

I'm really surprised g inserted this code into sfimc, fwiw. /spank

-J


 http://lists.indymedia.org/pipermail/imc-tech/2005-November/1124-9a.html



--------------------------------------------

on 11/24/05 the following code was from  http://www.google-analytics.com/urchin.js

//-- Google Analytics Urchin Module
//-- Copyright 2005 Google, All Rights Reserved.

//-- Urchin On Demand Settings ONLY
var _uacct=""; // set up the Urchin Account
var _userv=1; // service mode (0=local,1=remote,2=both)

//-- UTM User Settings
var _ufsc=1; // set client info flag (1=on|0=off)
var _udn="auto"; // (auto|none|domain) set the domain name for cookies
var _uhash="on"; // (on|off) unique domain hash for cookies
var _utimeout="1800"; // set the inactive session timeout in seconds
var _ugifpath="/__utm.gif"; // set the web path to the __utm.gif file
var _utsp="|"; // transaction field separator
var _uflash=1; // set flash version detect option (1=on|0=off)
var _utitle=1; // set the document title detect option (1=on|0=off)
var _ulink=0; // enable linker functionality (1=on|0=off)

//-- UTM Campaign Tracking Settings
var _uctm=1; // set campaign tracking module (1=on|0=off)
var _ucto="15768000"; // set timeout in seconds (6 month default)
var _uccn="utm_campaign"; // name
var _ucmd="utm_medium"; // medium (cpc|cpm|link|email|organic)
var _ucsr="utm_source"; // source
var _uctr="utm_term"; // term/keyword
var _ucct="utm_content"; // content
var _ucid="utm_id"; // id number
var _ucno="utm_nooverride"; // don't override

//-- Auto/Organic Sources and Keywords
var _uOsr=new Array();
var _uOkw=new Array();
_uOsr[0]="google"; _uOkw[0]="q";
_uOsr[1]="yahoo"; _uOkw[1]="p";
_uOsr[2]="msn"; _uOkw[2]="q";
_uOsr[3]="aol"; _uOkw[3]="query";
_uOsr[4]="lycos"; _uOkw[4]="query";
_uOsr[5]="ask"; _uOkw[5]="q";
_uOsr[6]="altavista"; _uOkw[6]="q";
_uOsr[7]="search"; _uOkw[7]="q";
_uOsr[8]="netscape"; _uOkw[8]="query";
_uOsr[9]="earthlink"; _uOkw[9]="q";
_uOsr[10]="cnn"; _uOkw[10]="query";
_uOsr[11]="looksmart"; _uOkw[11]="key";
_uOsr[12]="about"; _uOkw[12]="terms";
_uOsr[13]="excite"; _uOkw[13]="qkw";
_uOsr[14]="mamma"; _uOkw[14]="query";
_uOsr[15]="alltheweb"; _uOkw[15]="q";
_uOsr[16]="gigablast"; _uOkw[16]="q";
_uOsr[17]="voila"; _uOkw[17]="kw";
_uOsr[18]="virgilio"; _uOkw[18]="qs";
_uOsr[19]="teoma"; _uOkw[19]="q";

//-- Auto/Organic Keywords to Ignore
var _uOno=new Array();
//_uOno[0]="urchin";
//_uOno[1]="urchin.com";
//_uOno[2]="www.urchin.com";

//-- Referral domains to Ignore
var _uRno=new Array();
//_uRno[0]=".urchin.com";

//-- **** Don't modify below this point ***
var _uff, _udh, _udt, _ubl=0, _udo="", _uu, _ufns=0, _uns=0, _ur="-", _ufno=0, _ust=0, _ubd=document, _udl=_ubd.location, _utcp="/", _uwv="1";
var _ugifpath2=" http://www.google-analytics.com/__utm.gif";
if (_udl.protocol=="https:") _ugifpath2=" https://ssl.google-analytics.com/__utm.gif";
if (!_utcp || _utcp=="") _utcp="/";
function urchinTracker(page) {
if (_udl.protocol=="file:") return;
if (_uff && (!page || page=="")) return;
var a,b,c,v,z,k,x="",s="",f=0;
var nx=" expires=Sun, 18 Jan 2038 00:00:00 GMT;";
var dc=_ubd.cookie;
_udh=_uDomain();
_uu=Math.round(Math.random()*2147483647);
_udt=new Date();
_ust=Math.round(_udt.getTime()/1000);
a=dc.indexOf("__utma=" + _udh);
b=dc.indexOf("__utmb=" + _udh);
c=dc.indexOf("__utmc=" + _udh);
if (_udn && _udn!="") { _udo=" domain=" + _udn + ";"; }
if (_utimeout && _utimeout!="") {
x=new Date(_udt.getTime() + (_utimeout*1000));
x=" expires=" + x.toGMTString() + ";";
}
if (_ulink) {
s=_udl.search;
if(s && s!="" && s.indexOf("__utma=")>=0) {
if (!(_uIN(a=_uGC(s,"__utma=","&")))) a="-";
if (!(_uIN(b=_uGC(s,"__utmb=","&")))) b="-";
if (!(_uIN(c=_uGC(s,"__utmc=","&")))) c="-";
v=_uGC(s,"__utmv=","&");
z=_uGC(s,"__utmz=","&");
k=_uGC(s,"__utmk=","&");
if ((k*1) != ((_uHash(a + b + c + z + v)*1) + (_udh*1))) {_ubl=1;a="-";b="-";c="-";z="-";v="-";}
if (a!="-" && b!="-" && c!="-") f=1;
else if(a!="-") f=2;
}
}
if(f==1) {
_ubd.cookie="__utma=" + a + "; path=" + _utcp + ";" + nx + _udo;
_ubd.cookie="__utmb=" + b + "; path=" + _utcp + ";" + x + _udo;
_ubd.cookie="__utmc=" + c + "; path=" + _utcp + ";" + _udo;
} else if (f==2) {
a=_uFixA(s,"&", _ust);
_ubd.cookie="__utma=" + a + "; path=" + _utcp + ";" + nx + _udo;
_ubd.cookie="__utmb=" + _udh + "; path=" + _utcp + ";" + x + _udo;
_ubd.cookie="__utmc=" + _udh + "; path=" + _utcp + ";" + _udo;
_ufns=1;
} else if (a>=0 && b>=0 && c>=0) {
_ubd.cookie="__utmb=" + _udh + "; path=" + _utcp + ";" + x + _udo;
} else {
if (a>=0) a=_uFixA(_ubd.cookie,";", _ust);
else a=_udh + "." + _uu + "." + _ust + "." + _ust + "." + _ust + ".1";
_ubd.cookie="__utma=" + a + "; path=" + _utcp + ";" + nx + _udo;
_ubd.cookie="__utmb=" + _udh + "; path=" + _utcp + ";" + x + _udo;
_ubd.cookie="__utmc=" + _udh + "; path=" + _utcp + ";" + _udo;
_ufns=1;
}
if (_ulink && v && v!="" && v!="-") {
v=unescape(v);
if (v.indexOf(";")==-1) _ubd.cookie="__utmv=" + v + "; path=" + _utcp + ";" + nx + _udo;
}
_uInfo(page);
_ufns=0;
_ufno=0;
_uff=1;
}
function _uInfo(page) {
var p,s="",pg=_udl.pathname + _udl.search;
if (page && page!="") pg=escape(page);
_ur=_ubd.referrer;
if (!_ur || _ur=="") { _ur="-"; }
else {
p=_ur.indexOf(_ubd.domain);
if ((p>=0) && (p-1) { z=_uGC(dc,"__utmz=" + _udh,";"); }
else { z="-"; }
t=_uGC(s, _ucid + "=","&");
t2=_uGC(s, _ucsr + "=","&");
t3=_uGC(s,"gclid=","&");
if ((t!="-" && t!="") || (t2!="-" && t2!="") || (t3!="-" && t3!="")) {
if (t!="-" && t!="") c + ="utmcid=" + _uEC(t);
if (t2!="-" && t2!="") { if (c != "") c + ="|"; c + ="utmcsr=" + _uEC(t2); }
if (t3!="-" && t3!="") { if (c != "") c + ="|"; c + ="utmgclid=" + _uEC(t3); }
t=_uGC(s, _uccn + "=","&");
if (t!="-" && t!="") c + ="|utmccn=" + _uEC(t);
else c + ="|utmccn=(not + set)";
t=_uGC(s, _ucmd + "=","&");
if (t!="-" && t!="") c + ="|utmcmd=" + _uEC(t);
else c + ="|utmcmd=(not + set)";
t=_uGC(s, _uctr + "=","&");
if (t!="-" && t!="") c + ="|utmctr=" + _uEC(t);
else { t=_uOrg(1); if (t!="-" && t!="") c + ="|utmctr=" + _uEC(t); }
t=_uGC(s, _ucct + "=","&");
if (t!="-" && t!="") c + ="|utmcct=" + _uEC(t);
t=_uGC(s, _ucno + "=","&");
if (t=="1") o=1;
if (z!="-" && o==1) return "";
}
if (c=="-" || c=="") { c=_uOrg(); if (z!="-" && _ufno==1) return ""; }
if (c=="-" || c=="") { if (_ufns==1) c=_uRef(); if (z!="-" && _ufno==1) return ""; }
if (c=="-" || c=="") {
if (z=="-" && _ufns==1) { c="utmccn=(direct)|utmcsr=(direct)|utmcmd=(none)"; }
if (c=="-" || c=="") return "";
}
if (z!="-") {
i=z.indexOf(".");
if (i>-1) i=z.indexOf(".",i + 1);
if (i>-1) i=z.indexOf(".",i + 1);
if (i>-1) i=z.indexOf(".",i + 1);
t=z.substring(i + 1,z.length);
if (t.toLowerCase()==c.toLowerCase()) cs=1;
t=z.substring(0,i);
if ((i=t.lastIndexOf(".")) > -1) {
t=t.substring(i + 1,t.length);
cn=(t*1);
}
}
if (cs==0 || _ufns==1) {
t=_uGC(dc,"__utma=" + _udh,";");
if ((i=t.lastIndexOf(".")) > 9) {
_uns=t.substring(i + 1,t.length);
_uns=(_uns*1);
}
cn + + ;
if (_uns==0) _uns=1;
_ubd.cookie="__utmz=" + _udh + "." + _ust + "." + _uns + "." + cn + "." + c + "; path=" + _utcp + "; " + x + _udo;
}
if (cs==0 || _ufns==1) return "&utmcn=1";
else return "&utmcr=1";
}
function _uRef() {
if (_ur=="0" || _ur=="" || _ur=="-") return "";
var i=0,h,k,n;
if ((i=_ur.indexOf("://")) -1) {
k=h.substring(h.indexOf("/"),h.length);
if (k.indexOf("?") > -1) k=k.substring(0,k.indexOf("?"));
h=h.substring(0,h.indexOf("/"));
}
h=h.toLowerCase();
n=h;
if ((i=n.indexOf(":")) > -1) n=n.substring(0,i);
for (var ii=0;ii -1 && n.length==(i + _uRno[ii].length)) { _ufno=1; break; }
}
if (h.indexOf("www.")==0) h=h.substring(4,h.length);
return "utmccn=(referral)|utmcsr=" + _uEC(h) + "|" + "utmcct=" + _uEC(k) + "|utmcmd=referral";
}
function _uOrg(t) {
if (_ur=="0" || _ur=="" || _ur=="-") return "";
var i=0,h,k;
if ((i=_ur.indexOf("://")) -1) {
h=h.substring(0,h.indexOf("/"));
}
for (var ii=0;ii -1) {
if ((i=_ur.indexOf("?" + _uOkw[ii] + "=")) > -1 || (i=_ur.indexOf("&" + _uOkw[ii] + "=")) > -1) {
k=_ur.substring(i + _uOkw[ii].length + 2, _ur.length);
if ((i=k.indexOf("&")) > -1) k=k.substring(0,i);
for (var yy=0;yy=2;ii--) {
try {
var fl=eval("new ActiveXObject('ShockwaveFlash.ShockwaveFlash." + ii + "');");
if (fl) { f=ii + '.0'; break; }
}
catch(e) {}
}
}
return f;
}
function __utmLinker(l) {
if (!_ulink) return;
var p,k,a="-",b="-",c="-",z="-",v="-";
var dc=_ubd.cookie;
if (l && l!="") {
if (dc) {
a=escape(_uGC(dc,"__utma=" + _udh,";"));
b=escape(_uGC(dc,"__utmb=" + _udh,";"));
c=escape(_uGC(dc,"__utmc=" + _udh,";"));
z=escape(_uGC(dc,"__utmz=" + _udh,";"));
v=escape(_uGC(dc,"__utmv=" + _udh,";"));
k=(_uHash(a + b + c + z + v)*1) + (_udh*1);
p="__utma=" + a + "&__utmb=" + b + "&__utmc=" + c + "&__utmz=" + z + "&__utmv=" + v + "&__utmk=" + k;
}
if (p) {
if (l.indexOf("?") -1) {
i2=l.indexOf(s,i); if (i2 =0;i--) {
var c=parseInt(d.charCodeAt(i));
h=((h > 21));
}
return h;
}
function _uFixA(c,s,t) {
if (!c || c=="" || !s || s=="" || !t || t=="") return "-";
var a=_uGC(c,"__utma=" + _udh,s);
var lt=0,i=0;
if ((i=a.lastIndexOf(".")) > 9) {
_uns=a.substring(i + 1,a.length);
_uns=(_uns*1) + 1;
a=a.substring(0,i);
if ((i=a.lastIndexOf(".")) > 7) {
lt=a.substring(i + 1,a.length);
a=a.substring(0,i);
}
if ((i=a.lastIndexOf(".")) > 5) {
a=a.substring(0,i);
}
a + ="." + lt + "." + t + "." + _uns;
}
return a;
}
function _uTrim(s) {
if (!s || s=="") return "";
while ((s.charAt(0)==' ') || (s.charAt(0)=='\n') || (s.charAt(0,1)=='\r')) s=s.substring(1,s.length);
while ((s.charAt(s.length-1)==' ') || (s.charAt(s.length-1)=='\n') || (s.charAt(s.length-1)=='\r')) s=s.substring(0,s.length-1);
return s;
}
function _uEC(s) {
var n="";
if (!s || s=="") return "";
for (var i=0;i0) r=a.substring(i + 1,i2); else return "";
if ((i=a.indexOf(".",i2 + 1))>0) t=a.substring(i2 + 1,i); else return "";
var c=new Array('A','B','C','D','E','F','G','H','J','K','L','M','N','P','R','S','T','U','V','W','X','Y','Z','1','2','3','4','5','6','7','8','9');
return c[r>>28&m] + c[r>>23&m] + c[r>>18&m] + c[r>>13&m] + "-" + c[r>>8&m] + c[r>>3&m] + c[((r&7)>30&3)] + c[t>>25&m] + c[t>>20&m] + "-" + c[t>>15&m] + c[t>>10&m] + c[t>>5&m] + c[t&m];
}
function _uIN(n) {
if (!n) return false;
for (i=0;i"9") && (c!=".")) return false;
}
return true;
}

 http://www.google-analytics.com/urchin.js



Email SF-IMC at  sf@indymedia.org and let them know how you feel about this or go to  http://sf.indymedia.org/news/hidden.php?id=1722251 and do the same. See if they offer a full explanation for allowing Google to acquire and aggregate data obtained from their site's users.