Can you illustrate the kind of privacy problems that you think the merger will lead to?

That's a very fair question, and it turns out to be a hard question to answer -- in part because Google itself has actually been very quiet about what it plans to do with DoubleClick once it acquires it. They should be more open. For example, do they plan to combine [search engine data with] the data that DoubleClick currently has on Internet users who surf the Web? Which is information, by the way, that is not available to Google right now, and I'm sure [it's] a large part of the attraction of the deal.

If it is Google's intent to get access to that data, they will have the deepest and broadest profile of Internet users of any company in the world. And they are also under virtually no legal obligation to limit how they might use that data. So they might say today that they do primarily commercial advertising; tomorrow, perhaps they decide to do insurance evaluation or risk management, or border screening for the Department of Homeland Security. There are lots and lots of different ways that that data could be used. Google itself has been very secretive about its plans.

What kind of a profile do you think they could assemble on individual Web users?

There are two key elements to a profile. Most people tend to focus on the Big Brother data collection side, and that's simply taking information about a person from different aspects of their private life: their medical records, their financial records, where they go online, what they put in e-mail, who they call -- all that kind of information that can be put together to create a detailed profile of an individual.

But the second part -- which I don't think people think about very much but in many respects is becoming more important -- is the algorithm that is put on top of that data and the decisions that are made [based on an analysis of the information]. That's actually an area that EPIC is spending a lot more time on these days, because if you look at such questions as which banner ads an Internet user sees when they visit a Web site, or whether an airline passenger is pulled aside for secondary screening, what's really happening is a type of profiling that involves not only the data collection, but also some decision-making process that treats one person very differently from another person. That's also something that turns out to be secretive. Companies will not explain their proprietary algorithms for serving banner ads, nor will the Department of Homeland Security tell us why certain people are pulled aside for secondary screening and not others.