Am I the only one who thinks it's creepy that the largest advertising company in the world, and particularly one based outside the country, has so much data on what UK citizens access on their own government websites for health, tax, social welfare information etc?
In the case of things like page views, this is something addressable by just gathering the data yourself. If you put in the effort up front, it'll be more accurate than Google (as you don't miss anyone who Google misses).
This is an inefficient use of government money to in-source everything. If private industry can do something cheaper and more effective, use common sense.
At what point do you think that sovereignty outweighs price? I think that is the point that GF is on about.
There is a good case for some sort of in-sourcing when it comes to national systems. For example if, say, a Chinese diplomat toddled on over to you (let's say you are a US citizen and an important one) and asked you to use his country's foremost VPN solution for secure communications. Would you?
Now let's muddy the waters somewhat. Zoom? sounds a bit Anglo/Sax ... ish. It isn't of course. It also seems that Zoom forgot to encrypt their encrypted channels. lol.
There's more to security and stuff than cash. I do the boring old security thing for a living. It is boring but I like boring.
Private industry by definition can't do something cheaper and more effectively because its goal is to make money, not to make a quality or cheap product.
If existing companies utilize cloud providers and CDNs rather than investing in their own in-house infra, doesn’t that signal to you that perhaps your analysis of the situation is flawed?
It’s possible the government is a big enough customer that they could get the necessary economy of scale to make it cost effective, but it also means that they’re going to need to develop a bespoke solution that all government services build on which itself is an expensive endeavor (and politically a liability since such a project can fail to deliver and just balloon in cost).
The government could rent our spare compute as a cloud provider, of course, to recapture expense. Then we can ask how dare the government spy on private citizen web traffic like that.
Let's imagine that I had to make a website that could host a million concurrent users once per year. What do you think is cheaper, me acquiring all of the hardware to scale to a million users and then leaving it idle 99.9% of the time, or outsource handling that peak traffic to someone who's already operating at the scale for it?
The UK government does not remotely need the same year-round capacity as a top-tier CDN.
Some analytics information is public, if you know where to look. You can add /info to the start of the URL path, and that might reveal some information about the page.
General statistics on site usage would be interesting. But what about all the other data that could be extracted, both on a personal and national level?
You could, for example, determine which areas are more likely to access HIV information on the NHS website. Insurance companies would like that but would it benefit the public or be in line with people's basic privacy expectations for government services?
(I'm sure Google claim that they won't add a user looking at cancer information on the NHS site to their data profile but I wonder what other insights could be generated.)
Comments
Am I the only one who thinks it's creepy that the largest advertising company in the world, and particularly one based outside the country, has so much data on what UK citizens access on their own government websites for health, tax, social welfare information etc?
This having Google track your users has impacts internally when your own tooling becomes even less accurate because you have to start asking for consent: https://github.com/alphagov/content-data-admin/pull/707
In the case of things like page views, this is something addressable by just gathering the data yourself. If you put in the effort up front, it'll be more accurate than Google (as you don't miss anyone who Google misses).
Governmental sites should have everything self-hosted.
No Google Analytics, no CDN, no nothing.
Just like they shouldn't have presence in Private Social Media Networks. But that's my opinion.
Then the website would have burned to the ground during this announcement.
Not if they had enough servers and bandwidth.
This is an inefficient use of government money to in-source everything. If private industry can do something cheaper and more effective, use common sense.
At what point do you think that sovereignty outweighs price? I think that is the point that GF is on about.
There is a good case for some sort of in-sourcing when it comes to national systems. For example if, say, a Chinese diplomat toddled on over to you (let's say you are a US citizen and an important one) and asked you to use his country's foremost VPN solution for secure communications. Would you?
Now let's muddy the waters somewhat. Zoom? sounds a bit Anglo/Sax ... ish. It isn't of course. It also seems that Zoom forgot to encrypt their encrypted channels. lol.
There's more to security and stuff than cash. I do the boring old security thing for a living. It is boring but I like boring.
Of course sovereignty and overall data security should be considered. My point is that a blanket "no outsourcing" rule is daft and counterproductive.
Private industry by definition can't do something cheaper and more effectively because its goal is to make money, not to make a quality or cheap product.
If existing companies utilize cloud providers and CDNs rather than investing in their own in-house infra, doesn’t that signal to you that perhaps your analysis of the situation is flawed?
It’s possible the government is a big enough customer that they could get the necessary economy of scale to make it cost effective, but it also means that they’re going to need to develop a bespoke solution that all government services build on which itself is an expensive endeavor (and politically a liability since such a project can fail to deliver and just balloon in cost).
The government could rent our spare compute as a cloud provider, of course, to recapture expense. Then we can ask how dare the government spy on private citizen web traffic like that.
Let's imagine that I had to make a website that could host a million concurrent users once per year. What do you think is cheaper, me acquiring all of the hardware to scale to a million users and then leaving it idle 99.9% of the time, or outsource handling that peak traffic to someone who's already operating at the scale for it?
The UK government does not remotely need the same year-round capacity as a top-tier CDN.
They don't. The data is anonymous, and no user tracking is used
It should all be public information in the first place.
Some analytics information is public, if you know where to look. You can add /info to the start of the URL path, and that might reveal some information about the page.
For example: https://www.gov.uk/info/find-coronavirus-local-restrictions
That's very cool, I had no idea! How did you find this?
A while back, I worked on the code https://github.com/alphagov/info-frontend
Nice! Do you know if historic data is available somewhere too? Or is it always just the last 6-weeks?
General statistics on site usage would be interesting. But what about all the other data that could be extracted, both on a personal and national level?
You could, for example, determine which areas are more likely to access HIV information on the NHS website. Insurance companies would like that but would it benefit the public or be in line with people's basic privacy expectations for government services?
(I'm sure Google claim that they won't add a user looking at cancer information on the NHS site to their data profile but I wonder what other insights could be generated.)
We can already do this. Have a look at the Public Health England "Fingertips" website.
https://fingertips.phe.org.uk/
https://fingertips.phe.org.uk/profile/sexualhealth
https://fingertips.phe.org.uk/profile/sexualhealth/data#page...
Not really, it will include who is accessing this data, which can be used to infer information on UK citizens.
USA has a dedicated website : https://analytics.usa.gov/
I don't know if the data is from GA or a custom made solution