It turns out that the company sporting the motto "don't be evil" has been asking parents nationwide to disclose their children's personal information, including Social Security Numbers, and recruiting schools to help them do it, all by entering an art contest.
The Contest is called "Doodle-4-Google". The company is even offering prize money to schools to enlist their help. Google even “OK’s” and “partners with” the following after school activities per their FAQ (I wonder how much who paid whom?):
“The Contest is also open to students who participate in one of the following “After School
Programs” and are also enrolled in a U.S. School as defined above: (i) Boys & Girls Clubs of America; or (ii) Girl Scouts of the USA.” They avoided the Boy Scouts, though.
It sound like fun? Don't you want your kid to enter too?
OK! Who’s Eligible?
“4. Eligibility. The Contest is open to students enrolled in private or public elementary and secondary schools (grades K–
12) as well as home schools (grades K-12) in the 50 United States and the District of Columbia, excluding U.S. territories
(collectively, “U.S. School(s)”). The Contest is also open to students who participate in one of the following “After School
Programs” and are also enrolled in a U.S. School as defined above: (i) Boys & Girls Clubs of America; or (ii) Girl Scouts of
the USA. Registration opens January 19, 2011. Registration ends March 2, 2011 at 11:59:59 P.M. Pacific Time (PT).
Only one doodle per Entrant is allowed. In the case of duplicate or multiple entries from the same Entrant, then the first
entry to arrive at the designated submission address (as determined by the “received by” date) will be accepted as the entry
into the Contest. Internet access is required to register for the Contest. At the time of submission of a Doodle, each Entrant
must: (i) be a U.S. citizen or a permanent U.S. legal resident (e.g., must be able to show proof of legal permanent
residence, for example, a “green card”); (ii) be enrolled in a U.S. School (defined above); (iii) have obtained his or her
parents’ or legal guardians’ prior permission and have agreed to be bound by these Rules on the Parent Consent Form.”
The reason Google gives for doing this competition in their FAQ says it's because "We love to encourage and celebrate the creativity of young people..." etc. isn’t that nice?
W a i t a minute:
A huge database of names and addresses of American children, especially one that includes their dates of birth and SSNs, would be worth many millions to marketing firms and retailers, wouldn’t it?
You see, what Google knows (and many parents don't know) is that a person's city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number.
“Part of the security problem lies with the method used to assign SSNs. The researchers note that only four digits of the nine digit SSN are random. The first three digits are called the Area Number (AN) and the next two are the Group Number (GN). ANs are allocated to specific states and GNs to specific birth years. Given the date of birth and place of birth, researchers need only guess at the final four digits.” - Alessandro Acquisti and Ralph Gross
Carnegie Mellon University.
So…. with the form you see above, you’ve just given Google your child’s Social Security Number. They don’t even have to guess. And you were worried about computer security?
So: If you can obtain those last four SSN digits explicitly, you've unlocked countless troves of personal information from someone who didn't even understand that such a disclosure was happening. This kind of data can be linked with other databases to target advertising, but Google wouldn’t do that, surely? Faster than a long tailed tom cat in a room full of rockers, I say.
It's worth many times more than what Google will spend on prizes (each State Finalist gets a T-shirt! The winner gets a Wacom tablet! Wow!). Maybe the TShirt should look like this?
To be strictly fair, Google hasn’t disclosed any such plan, nor has evidence surfaced exposing one. The entry form is one half page followed by five pages of legal mumbo-jumbo in (you guessed it) small print.
Google could have plans to just throw the data away, right? Maybe “the last 4” was inadvertently added to the competition form? There are all sorts of innocent and inconceivable explanations for this, aren’t there? So why (from their FAQ) is “Doodle 4 Google is still designed to work with schools across the nation (public, private and home schools).” Why not schools outside the USA? Maybe because those kids have no “last four”?
So, one question keeps haunting me: “Why the hell does Google need the “last four”?”
Additional links:
http://itmanagement.earthweb.com/secu/article.php/3828716/Social-Security-Numbers-Easy-to-Hack.htm
http://www.google.com/doodle4google/faqs.html