the risks of “outsourcing to the web”

It seems that within the last few months, much has been made of so-called Web 2.0 sites. The fact that it is impossible to even attribute a noun to describe “Web 2.0” — is it a paradigm? a metaphor? a meme? (ugh) — should be enough to convince you that “Web 2.0” is just the latest buzzword to describe webpage design and innovation, but I digress. My objective today isn’t to complain about the use of the term Web 2.0, but to talk about one alarming aspect of these new Web 2.0 sites: the fundamental outsourcing of your private data storage to commercial entities.

Many of the new, highly interactive web properties like Flickr, Gmail, Friendster, and the like, use sophisticated technology — at least in the context of the Internet — to make their sites operate much like thick clients (traditional software running on your desktop computer). One of the primary technologies in use, of course, is Asynchronous Javascript and XML (AJAX), which creates the illusion that you are interacting with a web application without a connection to the server. This has made it possible to create web-side lookalikes of traditional desktop applications, such as e-mail (e.g. GMail), bookmark managers (e.g. del.icio.us), CRM applications (e.g. Salesforce) and even office applications like a word processor (e.g. Writely). A number of factors have made these sites particularly attractive to the end user:

• ease of use
• no need to worry about data storage on one’s local (volatile) storage device
• no need to be maintain one’s locally-installed software, apply security/bugfixes, etc.
• ability to quickly “upgrade” to new vendor-released versions since the application is centrally-managed

We can expect the adoption rate of these applications to increase both as more users discover their utility, and as more such applications are created.

In the move from the desktop to the web (the so-called “outsourcing to the web”), many issues such as privacy, data retention, etc. are frequently glossed over or simply not recognized by end users as being important. It is difficult for many users to understand even one site’s privacy policy, never mind five or ten. The perplexing question of “How is the data from my personal documents such as e-mails, letters, word-processing files, etc. being used?” may not be adequately answered even by privacy policies, because such privacy policies often cover only the information being stored itself, not any derivative works. By derivative works, I mean that statistical data about your e-mail or Writely documents might be used to target ads to you, or the aggregate statistics of word frequency amongst all Writely users might be shared or sold to marketers for data mining purposes. As one marketing guru said to me recently, the possibilities for data mining are endless (the exact words he used were “we data mine the hell out of things!”)

Another big concern is that many of the applications currently being created revolve around Google in some way. Not only has Google been the primary developer of many rich web applications, with products such as Google Maps, Google Desktop, Google Page Creator, Writely and of course, GMail, but many other developers have taken advantage of Google’s open API to create their own derivative applications (such as Frappr). What happens when Google decides to use the stored user data in new ways? Or what if Google, formerly seen as the benevolent hacker’s workshop, changes its tune and becomes more corporate and controlling like Microsoft? The concentration of power around one publicly-traded corporation should be alarming to any consumer. (I could repeat the same arguments about Yahoo, given attempt to compete in the same space as Google, but by acquisition — their purchases of del.icio.us, upcoming.org, and so on being prime examples of this strategy.)

What is the solution? As I pointed out already, I expect the adoption of such rich applications to increase, not decrease; not only because of their technological merits, but because they frequently build online communities that are appealing to users (and marketers, of course). However, I think that any user who values his or her privacy and finds the notion of data mining based on one’s personal correspondence to be uncomfortable would do well to continue using traditional desktop software to manage these.