A pattern is emerging. A researcher discovers that a product or service offered by a large (generally US-based) company contains a security flaw or a feature that compromises the privacy of internet users. The revelations are confirmed by other experts across the internet. The company responsible then goes through a predictable series of steps: first, "no comment", followed by indignant denial, then a PR-spun "explanation" and, eventually, an apology of sorts plus a declaration that the bug will be fixed or the intrusive practice terminated.
A recent example was Apple's extraordinary contortions over the discovery that its iPhone was covertly collecting location data and storing it in unencrypted form. But last week also saw the revelation that devices made by TomTom, the leading manufacturer of GPS navigation systems, had effectively been spying on Dutch users and that the aggregated data had been sold to the police in order to guide the location of speed traps.
Before that, there were the revelations that Google's street-mapping camera cars were also collecting data on every domestic WiFi network they passed. On the web, many sites now deploy hidden "history sniffing" codes to find out what other sites a user has visited, webmail servers "read" every email that passes through them and social networking sites reveal every detail of some subscribers' tastes, activities and location.
What these developments presage is a perfect storm of surveillance, orchestrated not by the state but by huge corporations. Meanwhile, information commissioners across Europe try to enforce data protection laws that were crafted in the mainframe era, long before the founders of Google, Facebook et al were born. Neelie Kroes, the European commissioner responsible for data protection, is determined to reform the law to make US-based companies respect the privacy of their European users. But her efforts are doomed unless those users wake up to the ways their privacy is undermined by the services and devices they use.