Fed sites can track users Report: 64 used unauthorized files

WASHINGTON People who log onto dozens of federal government Websites may be unknowingly tracked despite a privacy policy forbiddingit.

In one case, a government contractor was even given ownership ofall the information collected from a Web site, said a congressionalreport released Monday.

The report troubled Ari Schwartz, a policy analyst for the Centerfor Democracy and Technology.

"Generally when we think about privacy and the government, we wantto make sure that the government is transparent and does protectprivacy over and above the rest of the Internet and the rest of theprivate and nonprofit sector," Schwartz said.

The scope of the problem hasn't been nailed down. For example, thereport said NASA hasn't determined how many Web sites it operates soofficials don't know how many might be gathering the information.

The report found that 64 federal Web sites used files that allowthem to track the browsing and buying habits of Internet users.

The departments of Education, Treasury, Energy, Interior andTransportation used such unauthorized files, as did NASA and theGeneral Services Administration, the report said.

Schwartz's organization was one of several that signed a letterMonday urging the Bush administration to fill a post created byformer President Bill Clinton to see that agencies adhere to privacypolicies.

The report was released by Sen. Fred Thompson (R-Tenn.), thechairman of the Senate Governmental Affairs Committee. He said he wasupset by the findings and planned to introduce legislation that wouldestablish a commission to examine government privacy practices.

The only time agencies are supposed to be able to use trackingsoftware is when there is a compelling need and agency heads say itis OK. In those instances, the Web sites must explicitly tellInternet users about the practice. Contractors operating Web siteson behalf of the government also must abide by the policy.

The White House referred questions to the Office of Management andBudget, where spokesman Chris Ullman would say only that the policyremains in effect and the issue is "something that we certainly arekeeping an eye on."

Eleven Energy Department Web sites used the unauthorized files,known as "cookies," prompting Inspector General Gregory Friedman tosay the department "cannot provide reasonable assurance" the privacyof Web site visitors will be protected.

General Services Administration Inspector General William Bartonfound that a contractor managed the business operations of an agencysite that used the tracking technology. The agreement gave thecontractor ownership of all the information about the Internet userswho visited the site.

Of the agencies surveyed, the Transportation Department was mostlikely to use the tracking files, according to the report. It hadthem on 23 Web pages, but the devices have since been removed,according to John Meche, the agency's deputy assistant inspectorgeneral.