[freehaven-dev] [Fwd: P3P: Pretty Poor Privacy (EPIC)]

["Michael J. Freedman" <mfreed@zeroknowledge.com>]

> EPIC Report: Pretty Poor Privacy (June 2000)
> An examination of the P3P technology and some of the shortcomings.
> 
>         http://www.epic.org/reports/prettypoorprivacy.html
> 
> ----------------------------------------------------------------------------
> ----
> 
>         Pretty Poor Privacy:
>         An Assessment of P3P and Internet Privacy
>         June 2000
> 
>         Electronic Privacy Information Center
>         www.epic.org
> 
>         Junkbusters
>         www.junkbusters.com
> 
> ----------------------------------------------------------------------------
> ----
> 
> Summary
> 
> This report examines whether P3P is an effective solution to growing public
> concerns about online privacy. The report surveys earlier experience with
> "cookie" technology and notes similarities. The report finds that P3P fails
> to comply with baseline standards for privacy protection. It is a complex
> and confusing protocol that will make it more difficult for Internet users
> to protect their privacy. P3P also fails to address many of the privacy
> problems specifically associated with the Internet. The report further finds
> that earlier versions of P3P were withdrawn because the developers
> recognized that the proposed negotiation process was too burdensome for
> users and that the automatic transfer of personal information would be
> widely opposed. It is anticipated that this version of P3P will also be
> significantly overhauled once it is reviewed. The report concludes that
> there is little evidence to support the industry claim that P3P will improve
> user privacy citing the widely accepted Fair Information Practices.
> 
> The report recommends the adoption of privacy standards built on Fair
> Information Practices and genuine Privacy Enhancing Techniques that minimize
> or eliminate the collection of personally identifiable information. Simple,
> predictable rules for the collection and use of personal information will
> also support consumer trust and confidence. P3P, on the other hand, is
> likely to undermine public confidence in Internet privacy.
> 
> 
> 
> Table of Contents
> 
> Understanding Privacy
> Current Internet Privacy Risks
> Cookies -- The Precursor to P3P
> What is P3P and How Does it Work?
> Relating Cookies to P3P
> Failure to Establish Privacy Standards
> Exclusion of Non-Compliant Sites
> Absence of Enforcement
> Prognosis for Adoption
> Impact on Privacy if P3P is Deployed
> P3P Fails to Satisfy Jurisdictions with Strong Privacy Standards
> Better Alternatives Exist
> Conclusions and Recommendations
> References
> 
> 
> Understanding Privacy
> 
> To assess a proposed technical standard for privacy protection for the
> Internet, it is necessary to understand the nature of privacy protection and
> the legal and ethical norms associated with privacy protection.
> 
> Privacy protection is widely understood as the right of individuals to
> control the collection, use and dissemination of their personal information
> that is held by others. This central principle has been adopted in U.S. law,
> privacy laws outside of the United States and many international agreements,
> including the U.S. government, the 1980 OECD (Organization for Economic
> Cooperation and Development) Guidelines on the Protection of Privacy and
> Transborder Flows of Personal Data. The OECD Privacy Guidelines and privacy
> laws are based on a set of Fair Information Practices that describe the
> obligations of organizations that collect personally identifiable
> information and the rights of individuals who give up their personal
> information.
> 
> Central to the concept of privacy and the aim of Fair Information Practices
> are the goals of transparency and fairness. Transparency means that when
> organizations collect information about individuals they should make known
> to the individual the information that is collected and how it used.
> Fairness means that information is used only for the purpose for which it is
> collected. If the organization wishes to use personal information for
> additional purposes, it is obligated to obtain the explicit permission of
> the individual involved. Together the principles of transparency and
> fairness help establish trust and confidence in commercial relations where
> personal information is acquired. It is widely understood that for these
> principles to be effective they need to apply on a widespread basis, with
> few if any exceptions.
> 
> Privacy protection is also understood as the ethical obligations associated
> with the collection and use of personal information. Doctors, lawyers,
> accountants, and professionals all understand the obligation to hold in
> trust personal information that is obtained in the provision of a service.
> 
> Central to the legal and ethical norms for privacy protection is the
> recognition that individuals should not be required to negotiate or choose
> among Fair Information Practices. Such negotiations would invariably
> disadvantage those who could not purchase sufficient privacy and would lead
> to a gradual decline in the level of protection available to the general
> public. Privacy protection exists where Fair Information Practices are
> enforced.
> 
> 
> 
> Current Internet Privacy Risks
> 
> To assess a proposed technical standard for privacy protection for the
> Internet, it is necessary also to understand the privacy problems that are
> unique to the Internet.
> 
> Today the Internet faces a wide range of privacy problems. The Internet
> Protocol (IP) used to transmit web pages creates a privacy risk that is not
> imposed by web browsers but in the transmission of web pages through the IP.
> When a browser requests a page from a server, the browser's IP address is
> transmitted as the return address to which the requested page is to be sent:
> a kind of digital caller ID. Various services are available today to
> disguise one's IP address. These are true privacy-enhancing technologies,
> because they remove identifying information.
> 
> An example of a privacy-impacting feature is the "referrer" header that
> identifies the URL of the page that caused the current page to be requested.
> This can happen in two ways. The first is where the user clicks on a link;
> this allows sites to see where their visitors are coming from. The second is
> if a graphic is included in a page; the most important case for privacy is
> where a banner ad is served on a page returned by a search engine. The
> companies that serve banner ads use this feature to target advertising:
> search for "station wagon" for example, and you may get an ad for Volvo.
> This feature might be acceptable as providing transient information only,
> were it not for another feature that allows long and potentially revealing
> records of search queries to be assembled. That feature goes under the
> innocent-sounding name of "cookies."
> 
> 
> 
> Cookies -- The Precursor to P3P
> 
> Before cookies, HTTP was a "stateless protocol": nothing linked your request
> for one page on a site to subsequent requests. Netscape decided to extend
> the protocol to allow sites to tag your browser with information that would
> be available to the site when you returned. As a result, the ability of
> Internet users to freely navigate the Internet was diminished.
> 
> Subsequent public outcry and growing awareness of cookies has led browser
> manufacturers over a period of several years to slowly give users some
> measure of control over cookies, assuming the user is aware of them and
> knowledgeable enough to exercise the choices that have been provided. Still,
> these measures are confusing and impractical and falls far short of what
> privacy advocates have asked for.
> 
> In Netscape's original patent application, engineers did not intend cookies
> to be privacy-invasive; they anticipated that the contents of shopping carts
> would be kept on the shopper's PC for the duration of the visit. But since
> 1996 they have been almost universally used in one way: to assign a unique
> visitor number to the PC, and to keep all relevant information on the server
> side indefinitely.
> 
> A third party can also set cookies when accessing a web site. Third party
> banner advertisers such as DoubleClick typically do this. This permits a
> history of browsing behavior to be assembled, and linked to other
> information. These so-called third-party cookies practice are clearly
> privacy-invasive, and since 1997 privacy advocates have asked browser
> manufacturers to remove them.
> 
> In the same year a document before the Internet Engineering Task Force, RFC
> 2109 proposed the same change. These requests have met with resistance and
> inaction because by making that simple change of disallowing third-party
> cookies, the privacy damage being done by Internet advertisers could have
> been avoided. The browser makers decided the privacy of surfers was not as
> important as that the data-gather opportunities of their companies and their
> commercial partners. Rather than fix the problems with cookies, which
> Microsoft and Netscape could have done long ago, the companies that develop
> browser software are now promoting P3P which will raises even more privacy
> problems than cookies.
> 
> 
> 
> What is P3P and How Does it Work?
> 
> P3P is a protocol that requires Internet users to reveal their privacy
> preferences before they are allowed to access information on the Internet.
> 
> The Platform for Privacy Preferences (P3P) is a protocol developed by the
> World Wide Web Consortium (W3C), with funding from many private sector
> organizations that have opposed privacy legislation. P3P presumes no single
> privacy standard, such as the OECD Privacy Guidelines, which would provide a
> simple, predictable, uniform environment for online transactions. Instead,
> P3P proposes the development of an elaborate range of privacy "choices" that
> require individual Internet users to make selections about the collection
> and use of personal data, even for online activities that would not normally
> require the disclosure of personal information, such as simply visiting a
> web site.
> 
> P3P attempts to accomplishes these goals by creating a complicated and
> confusing language for web sites to describe their privacy policies in a
> machine readable format. Major elements of the protocol allow policies to
> describe the contact information of the legal entity making a privacy
> statement, whether users will have access to information collected about
> them, numerous categories of data being collected (physical contact
> information, online contact information, unique identifiers, purchase
> information, etc.), the purpose(s) for collection (web site administration,
> research and development, profiling, etc.), and what organizations will have
> access to collected data (primary service provider only, delivery services,
> unrelated third parties, etc.).
> 
> According to W3C, P3P also allows for the creation of user agents that can
> be configured to reflect the privacy preferences of individual end users.
> Once configured, a user agent would compare its preferences with the machine
> readable privacy statements made by various web sites. If a web site's
> policy matches a user's privacy preferences, access to the site will be
> granted. If there is a conflict, a pop-up window describing the discrepancy
> might notify the user, or access to the site may be blocked.
> 
> A sample P3P transaction might look something like the following. Joe Surfer
> configures his P3P enabled web browser to say that he does not want to
> disclose his home address unless he is purchasing a product that will be
> delivered to his home. When Joe then connects to a popular news site that
> requires the disclosure of his home address before he can view content on
> the web site, Joe's P3P-enabled browser will block access to the site. If
> other popular news services also require home addresses, Joe's P3P-enabled
> browser will prevent Joe from receiving news over the Internet. Or he will
> have to give up his choice to keep his home address private.
> 
> It is reported that in earlier versions of the protocol, P3P also had
> "negotiation" and "data transfer" modules. The negotiation module would
> require an end user and a web site to haggle over the terms of access by
> negotiating an acceptable privacy agreement. Negotiation was dropped due to
> concerns about the complexity of the process. The data transfer module would
> have allowed for the automatic exchange of personal information after an
> acceptable privacy agreement was reached between a user agent and a web
> site. This idea was dropped due to polling data that revealed widespread
> public opposition to the automatic transfer of personal information.
> 
> 
> 
> Relating Cookies to P3P
> 
> The history of cookies illustrates several problems with industry-developed
> Internet standards, without privacy laws, that are likely to reappear with
> P3P.
> 
> Cookies by default are set as a silent tracking device rather than asking
> the user by default whether they wish to be tracked by a particular company.
> Similarly, we anticipate that P3P browsers will set a low standard of
> privacy before the user is "alerted."
> 
> Studies have found that web users find changing the default cookie settings
> to be burdensome and confusing. This is partly due to the many different
> versions of browsers that have been released over the years. (See for
> example http://www.junkbusters.com/cookies.html for a sampling of the
> various instructions for changing cookie settings.) On most browsers
> multiple clicks are need to get to relevant setting, and even if people who
> are aware of the need to change the default find it difficult to determine
> the appropriate action and understand the extent of its effects. P3P
> promises to be vastly more complex.
> 
> Many browsers also require the user to say "no" to each cookie when a users
> asks to be informed when cookies are placed, which can be very burdensome
> when several attempts are made per page. Useful features provided by
> third-party cookie management software is still not standard equipment: the
> ability to nominate certain sites that are permitted to set cookies, and
> have all others silently rejected.
> 
> 
> 
> Failure to Establish Privacy Standards
> 
> Technical methods to implement Fair Information Practices seek to give
> individuals greater control over the collection and use of personal
> information and to enable access to information. But P3P does not take this
> approach. It fails to establish privacy standards.
> 
> P3P builds on the notice and choice privacy approach. This is a weak model
> for privacy protection because it fails to ensure the observance of Fair
> Information Practices. This is also not the approach that the United States
> has typically taken to ensure privacy protection in other sectors with
> rapidly changing technology. The privacy of cable subscriber records is
> protected because of a provision in the Cable Act. The privacy of video
> rental records is protected by the Video Privacy Protection. The privacy of
> telephone calling records is protected by a series of laws and regulations.
> 
> Many in industry believe that the P3P standard will help solve the privacy
> problem because it will facilitate choice about privacy practices. But the
> real choice offered is not how to protect privacy, but how much privacy to
> give up. The FTC Chairman, in a report released in May 2000, made the point
> very well that the reason we need privacy laws today is that consumers are
> too often asked to give up their privacy for some benefit.
> 
> Strong technical measures are needed that give people greater control over
> the collection and use of personal information, and that limit where
> possible the collection and use of personal data.
> 
> 
> 
> Exclusion of Non-Compliant Sites
> 
> P3P will effectively exclude good web sites that lack P3P code even though
> the privacy practices of these sites may far exceed sites those that are
> "P3P compliant."
> 
> P3P is developed from a self-regulatory aspect giving web sites the option
> of whether to incorporate the P3P protocol on their web site. When a web
> site collects too much data they probably will not incorporate the P3P
> protocol. If few sites support P3P, consumers will have little incentive to
> use the technology, thus creating a sort of chicken and egg problem. "If not
> enough sites support the standard, consumers are not likely to deal with the
> daunting configuration, yet if not enough consumers demand it, marketers are
> unlikely to bother implementing it (Bruner, 1998)." Citigroup, who helped
> author the original P3P specification, presented this situation for data
> marketers in their white paper on P3P.
> 
> According to W3C, P3P also does not address how it will handle third party
> data collection on web sites. P3P currently cannot handle multiple privacy
> policies for one web page. For example, lets assume that the member only
> part of the site uses cookies for user tracking purposes, while the
> guest-only section uses cookies for session tracking. Since there can only
> be one policy per resource there is no way to accurately represent the
> distinctions between these two policies. It is suggested that the more
> restrictive of the two policies be in force for the target. However, that
> solution is not 100% accurate.
> 
> 
> 
> Absence of Enforcement
> 
> P3P lacks any means to enforce privacy policies.
> 
> Even where there is agreement about the privacy terms for a particular
> transaction, P3P provides no means to ensure enforcement of the stated
> privacy policies and the P3P developers do not seem particularly concerned
> about this problem. According to the most recent P3P specification:
> 
> Although P3P provides a technical mechanism for ensuring that users can be
> informed about privacy policies before they release personal information, it
> does not provide a mechanism for making sure sites act according to their
> policies. Products implementing this specification MAY provide assistance in
> that regard, but that is up to specific implementers and outside the scope
> of this specification. (Cranor et al, 2000)
> Thus in jurisdictions where there are no privacy rights established in law,
> Internet users will have to rely on the non-enforceable policies represented
> in the P3P protocol.
> 
> 
> 
> Prognosis for Adoption
> 
> After more than three years in development, P3P still faces a number of
> serious challenges that will likely preclude its widespread adoption.
> 
> There is no user base and no user demand. Companies have been reluctant to
> adopt the complicated protocol structure, and governments has shown little
> indication that it will address public concerns about privacy protection.
> 
> Experience with cookies sheds light on another possible P3P user agent-side
> problem. Those consumers, who have taken the time to configure their
> browsers to notify when receiving, or reject cookies, have found that web
> surfing becomes nearly impossible.
> 
> The same situation will likely apply to P3P user agents. Concerned users
> will configure their P3P user agents to reflect high privacy protections.
> However, when these users attempt to access the majority of commercial web
> sites, endless pop-up windows warning them that a site wishes to go beyond
> their specified privacy preferences will result. Users who have configured
> their agents to block sites that do not meet their preferences may well find
> that there are few web sites left to surf. Consumers will likely respond to
> this frustrating situation by begrudgingly reverting to low P3P privacy
> protective configurations, thus maintaining industry's present privacy
> invasive status quo.
> 
> The incredible complexity of P3P, combined with the way that popular
> browsers are likely to implement the protocol could also undermine
> well-established privacy standards particularly where legislation is in
> place. P3P may actually strengthen the monopoly position over personal
> information that U.S. data marketers now enjoy.
> 
> 
> 
> Impact on Privacy if P3P is Deployed
> 
> Given the bleak prospects for adoption, P3P will likely serve to delay other
> efforts to establish privacy standards.
> 
> Microsoft and Netscape/AOL are likely to implement P3P in a way that sets
> very low privacy preference defaults. This is true because these companies
> are paid through advertisements and data collecting, so it in their best
> interest to have the lowest privacy preference as defaults. If this is the
> case, user agents may actually facilitate the collection of even more
> information than is now typical. The perverse effect of possible P3P
> implementations which seeks to extract privacy rather than protect it, is
> that those people who most value their privacy will be shut out of the web.
> 
> Critiques of P3P also call into question its much-hyped role as a
> self-regulatory "solution" to the online privacy problem. Rather than a
> Privacy Enhancing Technique (PET), P3P may well prove to be a Privacy
> Intrusive Technique (PIT) (Rotenberg, 2000).
> 
> 
> 
> P3P Fails to Satisfy Jurisdictions with Strong Privacy Standards
> 
> P3P has not impressed those jurisdictions that have considered its use to
> implement legal rules for privacy.
> 
> The European Union, which does have baseline, legally enforceable privacy
> rights in the form of the EU Data Directive, has explicitly rejected P3P as
> part of its privacy protection framework. In a strongly worded January 1998
> opinion statement, the European Commission identified numerous problems with
> the protocol. First it argued that P3P "has not been developed with
> reference to the highest known standards of data protection and privacy, but
> has instead sought to formalize lower common standards." Next it pointed out
> the information asymmetry problem, noting that:
> 
> A technical platform for privacy protection will not in itself be sufficient
> to protect privacy on the web. It must be applied within the context of a
> framework of enforceable data protection rules, which provide a minimum and
> non-negotiable level of privacy protection for all individuals. Use of P3P
> in the absence of such a framework risks shifting the onus primarily onto
> the individual user to protect himself, a development which would undermine
> the internationally established principle that it is the "data controller"
> who is responsible for complying with data protection principles.
> Finally, there was concern that P3P might create confusion about the
> obligations of EU-based companies, and the privacy rights of EU consumers:
> 
> There is a risk that P3P, once implemented in the next generation of
> browsing software, could mislead EU-based operators into believing that they
> can be discharged of certain of their legal obligations (e.g. granting
> individual users a right of access to their data) if the individual user
> consents to this as part of the online negotiation. In fact those
> businesses, organizations and individuals established within the EU and
> providing services over the Internet will in any case be required to follow
> the rules established in the data protection directive 95/46/EC (as
> implemented in national law) as regards any personal data that they collect
> and process. P3P might thus cause confusion not only among operators as to
> their obligations, but also among Internet users as to the nature of their
> data protection rights. (European Commission, 1998)
> For these reasons, the EU has not adopted P3P as a technical mechanism for
> enforcing its privacy laws.
> 
> 
> 
> Better Alternatives Exist
> 
> There are much better technical methods for Internet privacy protection than
> P3P currently available to Internet users.
> 
> The P3P developers claim that the P3P protocol is the only widespread
> standard for privacy protection, but this is nonsense. At present, there is
> hardly any P3P enabled web sites in the world. Meanwhile, there are many
> genuine technologies for privacy protection widely available on the
> Internet. A quick survey of the EPIC Online Guide to Practical Privacy Tools
> [http://www.epic.org/privacy/tools.html] shows a wide range of services
> currently available for anonymous surfing, defeating cookies, HTML filters
> and more.
> 
> Those techniques that protect privacy minimize or eliminate the collection
> of personally identifiable information. There are many tools currently
> available that provide these privacy solutions and many more are being
> developed.
> 
> 
> 
> Conclusions and Recommendations
> 
> P3P fails to comply with baseline standards for privacy protection. It is a
> complex and confusing protocol that will make it more difficult for Internet
> users to protect their privacy. P3P also fails to address many of the
> privacy problems specifically associated with the Internet.
> 
> Earlier versions of P3P were withdrawn because the developers recognized
> that the proposed negotiation process was too burdensome for users and that
> the automatic transfer of personal information would be widely opposed. It
> is anticipated that this version of P3P will also be significantly
> overhauled once it is reviewed.
> 
> Companies that seek to promote online privacy will not burden web visitors
> with P3P. Good privacy standards will be built on Fair Information Practices
> and genuine Privacy Enhancing Techniques that minimize or eliminate the
> collection of personally identifiable information. Simple, predictable rules
> for the collection and use of personal information will also support
> consumer trust and confidence. P3P, on the other hand, is likely to
> undermine public confidence in Internet privacy.
> 
> 
> 
> References
> 
> Ackerman, M.S. and Cranor, L.F. (1999, September). Privacy critics:
> Safeguarding users' personal data. WebTechniques.com. Available:
> http://www.webtechniques.com/archives/1999/09/ackerman/ .
> 
> Bruner, R.E. (1998, 30 June). P3P: Programming privacy. Executive Summary, 1
> (7). Available: http://www.exec-summary.com/trends/980630.phtml .
> 
> Cerasale, G. and Faley, P. (1998, 6 July). Comments of the Direct Marketing
> Association on elements of effective self regulation for the protection of
> privacy and questions related to online privacy. Testimony before the
> Department of Commerce. Available:
> http://www.ntia.doc.gov/ntiahome/privacy/mail/disk/DMA.htm .
> 
> Clarke, R. (1998). Platform for privacy preferences: A critique. Available:
> http://www.anu.edu.au/people/Roger.Clarke/DV/P3PCrit.html .
> 
> Coyle, K. (1999, June). P3P: Pretty poor privacy? A social analysis of the
> Platform for Privacy Preferences. Available: http://www.kcoyle.net/p3p.html
>  .
> 
> Cranor, L., et al. (2000, 10 May). The Platform for Privacy Preferences 1.0.
> W3C Working Draft. Available: http://www.w3.org/TR/P3P/ .
> 
> Einstein, D. (1997, 27 May). New standard offers privacy protection. San
> Francisco Chronicle, C1.
> 
> European Commission. (1998, January). Platform for Privacy Preferences and
> the Open Profiling Standard. Draft opinion of the Working Party on the
> Protection of Individuals with regard to the processing of Personal Data.
> Available: http://www.epic.org/privacy/internet/ec-p3p.html .
> 
> Federal Trade Commission. (2000, May). Privacy online: Fair information
> practices in the electronic marketplace. Report to Congress. Available:
> http://www.ftc.gov/reports/privacy2000/privacy2000.pdf .
> 
> Federal Trade Commission. (1996, 4 June). Testimony: Public Workshop on
> Consumer Privacy on the Global Information Infrastructure. Available:
> http://www.ftc.gov/bcp/privacy/wkshp96/pw960604.pdf .
> 
> Guglielmo, C. (1999, 26 January). Privacy proposal faces patent challenge.
> Inter@ctive Week. Available:
> http://www.zdnet.com/intweek/stories/news/0,4164,2194490,00.html .
> 
> Hunter, C.D. (1999). Filtering the future? Unpublished thesis in
> Communication. Annenberg School for Communication, University of
> Pennsylvania.
> 
> Lee, K. and Speyer, G. (1998). Platform for Privacy Preferences project and
> Citibank. Citibank White Paper. Available:
> http://www13.w3.org/P3P/Lee_Speyer.html .
> 
> Mulligan, D. et al, (2000, 28 March). P3P and privacy: An update for the
> privacy community. Available:
> http://www.cdt.org/privacy/pet/p3pprivacy.shtml .
> 
> Netscape Communications Corporation. (1997, 27 May). Netscape, Firefly and
> Verisign propose Open Profiling Standard (OPS) to enable broad
> personalization of Internet services. Netscape press release. Available:
> http://www.netscape.com/flash4/newsref/pr/newsrelease411.html .
> 
> Reagle, J. and Cranor, L. (1998). The Platform for Privacy Preferences.
> World Wide Web Consortium NOTE. Available:
> http://www.w3.org/TR/1998/NOTE-P3P-CACM/ .
> 
> Reagle, J. and Wenning, R. (2000, 18 April). P3P and privacy on the web faq.
> Available: http://www.w3.org/P3P/P3FAQ.html .
> 
> Rotenberg, M. (2000, 7 February). What Larry doesn't get: Fair information
> practices and the architecture of privacy. Paper presented at the Stanford
> Law School Symposium on Cyberspace and Privacy Available:
> http://stlr.stanford.edu/STLR/Symposia/Cyberspace/00_rotenberg_1/
> article.htm .
> 
> Rotenberg, M. (1998, 26 March). Testimony before the House Judiciary
> Committee. Available:
> http://www.epic.org/privacy/internet/rotenberg-testimony-398.html .
> 
> Weitzner, D. J. (2000, 25 May). Testimony before the United States Committee
> on Commerce, Science, and Transportation. Available:
> http://www.w3.org/2000/05/25-Senate-Privacy-Testimony.html .
> 
> World Wide Web Consortium. (1999a, 21 September). Removing data transfer
> from P3P. P3P Working Group. Available:
> http://www.w3.org/P3P/data-transfer.html .
> 
> World Wide Web Consortium. (1999b, 28 October). World Wide Web Consortium
> clears patent hurdle for web privacy. W3C press release. Available:
> http://www.w3.org/1999/10/28-P3P- IntermindPatentAnalysis-PressRelease.html
>  .
> 
> World Wide Web Consortium. (1998a, 19 May). The W3C publishes first working
> draft of P3P 1.0. W3C press release. Available:
> http://www.w3.org/Press/1998/P3P .
> 
> World Wide Web Consortium. (1998b, 19 May). P3P 1.0 testimonials. W3C press
> release. Available: http://www.w3.org/Press/1998/P3P-test.html .
> 
> World Wide Web Consortium. (1997a, 23 May). W3C Platform for Privacy
> Preferences (P3) project approved. W3C press release. Available:
> http://www.w3.org/Privacy/announce/P3Approval.html .
> 
> World Wide Web Consortium. (1997b, 11 June). W3C announces the Platform for
> Privacy Preferences project at FTC workshop. W3C press release. Available:
> http://www.w3.org/Press/P3 .
> 
> World Wide Web Consortium. (1997c, 30 October). World Wide Web Consortium
> announces completion of P3P project phase one. W3C press release. Available:
> http://www.w3.org/P3P/press_release.html .
> 

-- 
"Not all those who wander are lost."      mfreed@zeroknowledge.com