EFF calls Ubuntu's Amazon search result feature a "major privacy problem"

The Electric Frontier Foundation has some choice words for the latest version of the Ubuntu operating system, calling its inclusion of search results from Amazon (and possibly other third parties) a “data leak” and a “violation” of privacy.

The criticism is directed at settings turned on by default in Ubuntu 12.10, which was released earlier this month. As previously reported, unless settings are changed, each time a user searches for a document, app, or other file using the Dash feature of the open-source OS, that search is funneled to Amazon. It can then include advertisements—sent in unencrypted text—in the results. So searches performed at cyber cafes and other places that use unsecured Wi-Fi can be easily intercepted by anyone else who is connected, said EFF Web developer Micah Lee.

“It’s a major privacy problem if you can’t find things on your own computer without broadcasting what you’re looking for to the world,” he wrote in a recent blog post. “You could be searching for the latest version of your résumé at work because you’re considering leaving your job; you could be searching for a domestic abuse hotline PDF you downloaded or legal documents about filing for divorce; maybe you’re looking for documents with file names that will give away trade secrets or activism plans; or you could be searching for a file in your own local porn collection.”

In addition to compromising user privacy on public networks, the new Ubuntu feature also gives Amazon the ability to correlate search terms with users’ IP addresses. Even worse, according to Ubuntu’s third-party privacy policy page, Facebook, Vimeo, and a variety of other services may also get to see the IP address and search terms of users who keep their default settings. Canonical, the company that develops Ubuntu, doesn’t say what these services do with the data. Instead, the page refers users to the privacy policy of each service.

There are several ways to turn off the behavior. One is to use the Gnome 3, KDE, or Cinnamon desktop environment instead of the Unity desktop that is included by default. A simpler method is to configure Dash to search only local computer files rather than Amazon and any other Internet sites that may be chosen by Ubuntu. To do that, open the Privacy app and switch “Include online search results” from on to off.

Lee has called on Ubuntu developers to change the default so Amazon is searched only when configuration changes are made.

“Users should be able to install Ubuntu and immediately start using it without having to worry about leaking search queries or sending potentially private information to third party companies,” he wrote. “Since many users might find this feature useful, consider displaying a dialog the first time a user logs in that asks if they would like to opt-in.”