A pattern is emerging. A researcher discovers that a product or service offered by a large (generally US-based) company contains a security flaw or a feature that compromises the privacy of internet users. The revelations are confirmed by other experts across the internet. The company responsible then goes through a predictable series of steps: first, ‘no comment’, followed by indignant denial, then a PR-spun ‘explanation’ and, eventually, an apology of sorts plus a declaration that the bug will be fixed or the intrusive practice terminated.

A recent example was Apple’s extraordinary contortions over the discovery that its iPhone was covertly collecting location data and storing it in unencrypted form. But last week also saw the revelation that devices made by TomTom, the leading manufacturer of GPS navigation systems, had effectively been spying on Dutch users and that the aggregated data had been sold to the police in order to guide the location of speed traps.

Before that, there were the revelations that Google’s street-mapping camera cars were also collecting data on every domestic WiFi network they passed. On the web, many sites now deploy hidden ‘history sniffing’ codes to find out what other sites a user has visited, webmail servers ‘read’ every […]