In 2000, Sun Microsystems CEO Scott McNealy famously said about life on the Internet, “You already have zero privacy – get over it.”

“That was very annoying,” says Chris Palmer, chief technologist at the Electronic Frontier Foundation (EFF), a San Francisco-based organization that advocates for online free speech and civil liberties issues. Palmer emphasizes that while most users can live happily without anonymity, for some people it’s crucial – such as those who criticize repressive regimes, blow the whistle on bosses, or discuss sensitive personal issues.

Fortunately, there are many ways – from reconfiguring browser preferences to using emerging Web technologies – to mask one’s identity online. “It’s all about how great your need is and how much work you’re willing to do,” Palmer says.

The issue of online anonymity has come into high relief in recent weeks. Microsoft, AOL, and Yahoo quickly complied with a request from the U.S. Department of Justice to turn over search records, which the DoJ wants to use in court to demonstrate how easy it is for minors to access online pornography. Google, so far, is resisting the request, winning plaudits from online privacy advocates.

But even though the records that the DoJ wants would not contain information linking searches to specific people, the controversy has caused average Internet users to ask themselves the reasonable question: Did the search engine really notice when I browsed that website? You know, that one.

For the vast majority of users, the answer is a qualified yes. Generally, online services use two methods to identify users: cookies and Internet Protocol (IP) addresses. Cookies can track what you do online, while IP addresses can reveal where – and who – you are.

Cookies are snippets of nonexecutable code, more like a watermark or a token than an application, handed to the browser by a website or an advertisement within the site. The browser stores the cookies and can send them back to remote servers. Cookies can be used for logging in users, or tracking what sites you browse; for example, the online ad company DoubleClick uses cookies served by its ads on various sites to track which ads you click on. The company then builds a user profile so it can target ads that an individual user might want to see. For example, if you browse gaming sites, DoubleClick may serve up an ad for a Sony PlayStation Portable rather than a subscription to Martha Stewart Living.

One can deal with cookies from within a Web browser relatively easily. Most browsers offer a setting under the “preferences” or “options” menu items to control which cookies it will accept, or whether it should ask your permission before accepting them. In addition, most browsers allow you to delete cookies. Camino and Apple’s Safari have reset functions that erase all cookies, while the latest version of Firefox includes a similar function, “Clear all private data.” Doing this will obscure your past tracks, although it may require you to log in again for your Web-based e-mail and any member-only discussion boards.

More telling, and more difficult to mask, is your IP address. Every computer on the Internet has an IP address, much like every phone has a number. You can see what your computer’s address is by visiting http://www.showmyip.com; and others can see this address, too. Google and other search engines note the IP address of each user, which can then be used to locate which Internet service provider (ISP) the user is on. Theoretically, a private company or government can then request the user’s personal information from the ISP. This method could be used to locate a blogger in Iran, or to track an employee who has leaked records of a company’s polluting habits.

What is worrisome for many about the recent standoff between Google and the U.S. Department of Justice is not what the government is currently asking for, but what it could ask for in the future. The current DoJ request would not reveal user identities; but if Google or its competitors were compelled to release the IP addresses associated with their search records, each user’s habits could be tied to a name. (Google’s policy is to release such information only when the company has a “good faith belief” that the request is valid. For more on Google’s privacy policies, see http://www.google.com/privacypolicy.html.)

EFF’s Palmer notes that there are ways to travel online while masking one’s IP address. The EFF itself funded a piece of software, called Tor, for a year, after it was initially funded by the Office of Naval Research. (Currently, Tor is not funded, although its original programmers are seeking donors and volunteer programmers to help upgrade the system.)

Users install the Tor client on their computers, and the client communicates with a dedicated Tor server picked at random. (There are currently about 300 Tor servers worldwide, often called “onion servers” because they work together in layers.) The first server randomly picks another, which picks another; the data sent are encrypted at each step, and each server knows only of the one immediately connected to it.

However, according to the EFF, Tor protects mainly the transfer of data. Someone could still sniff out your identity by tracking down information related to your IP address, or through clues sent out through hypertext transfer protocol (HTTP), the very protocol that enables Web browsing.

To cover that possibility, Tor can be used in conjunction with a “filtering proxy” called Privoxy. Filtering proxies are servers that block or allow the transmission of information, depending on how they are configured by administrators. Privoxy, for example, hides the information your computer sends through HTTP. Privoxy can also manage cookies and block pop-ups and other ads, but the HTTP filtering is what keeps the user’s information private. Installing and using Tor and Privoxy, though, require a good deal of computer savvy – it’s tricky for the average user.

For occasional use – say to check out a web site blocked by your company’s firewall – you can use a standard proxy server (a filtering proxy is one type of proxy server). These are services or Web pages you can navigate to and enter a URL; the server will then send the request for the page under its own IP address and return the results to you. Many proxy servers exist, some commercial, such as Megaproxy.com, and some free, such as Anonymouse.org and Proxybuster.net. (Ironically, one can easily search Google for “proxy server.”)

The best known proxy server is probably the free Anonymizer, although it’s a “single hop” server, which means there’s only one step between you and the target site – not as secure as Tor’s scheme. Another downside is that Anonymizer runs on a single server, owned by San Diego-based Anonymizer Inc., which can make secure browsing a slow process. The company also sells subscriptions to the service, which grants access with greater bandwidth.

The Java Anonymous Proxy is another proxy system that offers anonymous Web browsing. It also provides anonymity for other Internet services, such as e-mail and messaging; but it does so through a cascade of servers, where a single server picks the chain of other servers. Although data is encrypted, the first server knows the path the data will take – providing one point where users’ identities could be revealed.

All this can keep your identity private while browsing online; but there are still many ways nonexperts can expose themselves online: through insecure e-mails, spyware, file-sharing applications, and viruses. Users should ask themselves: What’s at stake when I browse, and how much care do I need to take to maintain my privacy? To paraphrase slightly a famous line: The price of anonymity is eternal vigilance.

Home page image courtesy of Brian Stauffer.