Hide and seek on the Web

(continued from previous page)

Web are becoming an attractive defense as a result.

Privately held Anonymizer, based in San Diego, began selling a corporate Internet cloaking service in 2003 called the Enterprise Chameleon. The product, a piece of hardware and software linked to a corporate server, will filter all employee traffic through its IP-changing servers and randomly issue untraceable IP addresses.

Sales of the product jumped 500 percent from 2003 to 2004, and this year the company expects corporate sales to comprise 50 percent of its revenue. (The other half comes from individual customers.) Anonymizer caters to government agencies and corporations, including pharmaceutical and biotechnology companies.

In general, cloaking works through a simple script that commands the Web server to deliver a set Web page whenever it detects the designated IP address. The IP address can be traced to an Internet service provider and, with special tools, to a geographic location. Because IP addresses are often static, the script could also mark whole blocks of numbers assigned to an Internet service provider, a geographic range, a specific company or government entity.

"You give up a tremendous amount of information when you're going to a competitor's site, like what you're working on, what products you're interested in, etc."

--Lance Cotrell, president, Anonymizer

In one practical example of IP-based filtering called geo-targeting, an online retailer can display Polar Fleece clothing to Alaskans by detecting their IP address and hence, their whereabouts. Advertisers use the same technology to send specific promotions to consumers, and search engines sniff IP addresses to display results based on a user's locale.

While privacy is an afterthought to many consumers online, corporations running a Web site or doing research on the Internet are increasingly aware of the perils of too much data and detection.

"As more information is easily traced, you can look at an IP address and determine the owner of that, or the company that owns that block of IP addresses...You can start to look at other types of things, like that the company is sponsoring certain types of events, and you can see certain patterns," said Alex Fowler, co-lead of national privacy practice with PricewaterhouseCoopers.

"When you're using a cloak, you're trying to avoid this logging of data," he added.

Privacy experts say that pharmaceutical and biotechnology companies are interested in keeping their online moves private, for fear of outsiders' ability to reverse engineer what's looked at in public databases. What companies research and read in the form of white papers could tip outsiders off to future products, for example.

Companies also have reverse engineered IP filtering to target and attract new employees. For example, during the dot-com heyday when hiring was tough, 3Com changed its Web page to highlight employment opportunities when it appeared Cisco employees were visiting, according to Lance Cottrell, the president of Anonymizer. Fowler said that auditing firm Ernst & Young had done the same to staff of rival PricewaterhouseCoopers.

Cottrell said that as much as 90 percent of corporations are mining competitive intelligence from their Web log files. "You give up a tremendous amount of information when you're going to a competitor's site, like what you're working on, what products you're interested in, etc.," he said.

In one example, he said Company A was interested in buying out

[BillThomas3]

My company does it also

Great article Stephanie! I asked my companies IT director and we provide our competitors with "fake" web pages. I didn't realize it was so prevalent! That said, we're concerned our competitors are doing the same thing to us and watching where we go on their sites.

How much does the Anonymizer service cost?

Regards,
Ben

[tomfaster]

Nice. Thanks for the heads up. As an online retailer we can put this to good use.

Tom