Editorial: Earn trust through privacy

Agencies have been caught in something of a cookie conundrum in the past month as news organizations — including this one — have found government Web sites using persistent cookies despite a rule that prohibits their use.

Cookies, text files that a Web site can put on your computer to track how you traverse the site, have raised the ire of privacy advocates because of the potential implications. For example, they could track a visitor's travels to other sites.

The National Security Agency was the first agency to be caught with its hand in the cookie jar, which adds to its scrutiny after the recent revelation that the Bush administration has permitted NSA to conduct warrantless wiretaps. Then the White House's Web site was found to be using cookies' more perilous cousin, the Web bug, which is more difficult to track than traditional Web cookies. Then scores of other government Web sites were found to be using Web cookies.

Cookies are not the biggest privacy issue this country faces. For example, their use pales in comparison to the significant issues raised by NSA's warrantless wiretaps. But because the problem is so easy to fix, continued cookie use indicates privacy issues' low priority at most agencies.

At its heart, the cookie conundrum is about more than just privacy — it's about citizens' trust in their government.

Years ago, Deidre Lee, who was administrator of the Office of Federal Procurement Policy at the time, told an audience of information technology contractors her rules for government procurement: Tell them what you are going to do, and then do it. She was speaking about contracts, but the rule works for privacy, too.

People should be able to visit U.S. government Web sites without worrying that Big Brother is tracking their every online move. When agencies need to track their visitors' activities, they should tell visitors what is going on.

We do not oppose the use of cookies, per se. Cookies have good uses. But agencies should proceed cautiously and be aware of the potential implications. To that end, the Office of Management and Budget's guidance is probably correct: Use cookies only when you need to, and if you do need to, get approval.

That is a good formula for building trust.

— Christopher J. Dorobek