Google admits Gmail lack of privacy

[atlrus]

Figured this would be rather interesting news for those using Gmail or any other Google services:

In a stunning admission contained in a brief filed recently in federal court, lawyers for Google said people should not expect privacy when they send messages to a Gmail account.

‘a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’

Source: [consumerwatchdog.org...]

How in-your-face evil can these guys get?!?

[BeeDeeDubbleU]

Shocking!

[jamesMP]

While I haven't read the whole article and these "headline" quotes *could* have been taken out of context, it does just seem plain wrong. Surely this is the equivalent of (say) the Royal Mail opening my post en-route and then the postman saying, as (s)he hands over my mail, "I see from your bank statement the funds in your current account are running a little low - here's details of a payday loan company [which we don't endorse/vet but accept payment from]..."

And:

Google uses the content of the email messages ... for its own benefit ... unrelated to the service of email

I realise that what they're doing is probably covered by G.'s T&C's (which they probably rely on no-one reading), but what about a non-gmail user who sends an email to a gmail account? They didn't sign up to and T&C's and yet their private correspondence is now the property(?) of G.

[BeeDeeDubbleU]

Good points James.

What beats me about Google is that they now seem to be untouchable. We hear revelation after revelation about their unethical behaviour and in some cases blatant law breaking and they continue to thrive. It seems their stock price rises no matter what they do.

[Staffa]

What beats me about Google is that they now seem to be untouchable.

Too many agencies interested in their vast data centres

[ChanandlerBong]

Also, who would they be accountable to? The US government? Who are already snooping on the entire world.

Form an orderly queue, judge will be with you in five minutes....

[piatkow]

IIRC the manual that came with my first computer made it perfectly clear that the level of security on an email was about the same as on a post card.

[graeme_p]

If you read the actual motion, that is a quote of what the judge said in a case Google says is a precedent:

[consumerwatchdog.org ]

see page 19

What Google is saying is that if you send an email to an Gmail address, you implicitly agree to Google's processing of email messages, including automated scanning to of the contents to insert relevant ads. Once you send the email to Google's servers, Google can do with what ever processing the recipient has consented to (and the Gmail TOS include the consent).

The argument is that it is not like a postal service opening a letter, but someone who has been asked to open letters by the recipient opening the letter.

Google says

a sender of a letter to a business colleague cannot be surprised that the recipient’s assistant opens the letter

[Samizdata]

What Google is saying is that if you send an email to an Gmail address, you implicitly agree to Google's processing of email messages, including automated scanning to of the contents to insert relevant ads.

Whereas, of course, we actually agree to no such thing, implicitly or otherwise.

Simply replying to an address at a domain is not consent to anything.

...

[graeme_p]

Of course you consent to it, and a lot more. Any reasonably person knows that if you send someone an email:

1) If you send it to a work address it may be read by a colleague (say someone covering for them), an assistant, or by people whose job it is to monitor email.

2) If may be analysed and processed by spam filters on the server.

3) The recipient may forward it to someone else.

4) It may be processed on the server for modification of automatic deletion- e.g. the mail server may be configured reject emails above a certain size, or remove certain types of attachment.

5) It may be scanned for viruses, links to phishing sites, or for other security reasons.

If there is no implicit consent that messages can be processed by the receiving server, then all of the above are illegal. If there is implicit consent, then analysing emails in order to place ads, with the consent of the recipient, is also legal.

[BeeDeeDubbleU]

Graeme, most of us are very well aware of what Google is saying.

Most of the general public are not.

It's the ethics of this that are questionable and being questioned.

[Samizdata]

Of course you consent to it

Being powerless to stop something is not the same as consenting to it.

When I respond to an email from any of the millions of domains out there I am not agreeing to any terms and conditions that those millions of domains might seek to unilaterally impose.

I am simply being polite.

...

[graeme_p]

In that case you do you both object to automated spam filtering etc. as well? Do you think automated processing of emails is OK or not.

Do you think it is not ethical for someone to get an assistant to open their letters and process them (decide which to send a form reply to, which to put in the bosses in-tray, etc.)? That is a MUCH greater invasion of privacy than Google's purely automated processing.

What about the other examples of automated processing above? They are just as great an invasion of privacy. Are the ethics of those questionable? Should Gmail also not have spam filters?

[BeeDeeDubbleU]

Do you think it is not ethical for someone to get an assistant to open their letters and process them (decide which to send a form reply to, which to put in the bosses in-tray, etc.)? That is a MUCH greater invasion of privacy than Google's purely automated processing.

Delegation is not an invasion of privacy.

[graeme_p]

@Samizdata, the point is not that you agree to their TOS - you do not. The point is that you agree to let them process your email in accordance with whatever agreement they have with the recipient.

@BeeDeeDubbleU, and delegating to a subordinate is not very different from buying in email service rather than running your own server. Whoever runs the server can process email addressed to you in ways you have agreed to.

Let me boil this down to a simple question. Do you think Gmail's spam filter is an invasion of privacy? If not, in what way is the processing for ad placement a greater invasion of processing for spam filtering?

[BeeDeeDubbleU]

@BeeDeeDubbleU, and delegating to a subordinate is not very different from buying in email service rather than running your own server.

You may thinks so. I think this is a rather strange analogy. ;)

[graeme_p]

The point is that if you send me an email, then I can authorise someone to process for me, just as I can authorise someone to open a letter you sent me.

[bird]

Every mail service provider processes your messages in various ways, usually without telling you the details. Google has always very clearly communicated that they will process mail content for both filtering and ad matching. Why should they now say something different when asked about it in court?

I don't quite get the news value of this topic.

[BeeDeeDubbleU]

Very clearly communicated? I would be willing to bet that greater than 90% of users are unaware of this.

[BeeDeeDubbleU]

A hearing in the case, In re Google Inc. Gmail Litigation, Case No. 5:13-md-02430-LHK, will be held before Judge Lucy H. Koh in U.S. District Court in San Jose, CA. at 1:30 p.m., Sept. 5.

“Google’s brief uses a wrong-headed analogy; sending an email is like giving a letter to the Post Office,” said Simpson. “I expect the Post Office to deliver the letter based on the address written on the envelope. I don’t expect the mail carrier to open my letter and read it. Similarly when I send an email, I expect it to be delivered to the intended recipient with a Gmail account based on the email address; why would I expect its content will be intercepted by Google and read?”

Let's wait and see what the court says.

[graeme_p]

90% of users are unaware, probably true but:

1) If they are Gmail users they have not bothered to read the TOS, or read anything about Gmail, or have given any thought about how the free service is paid for.

2) If they are not Gmail users, it does back to the recipient whether the sender of an email can restrict what the recipient does with it.

In either case you must know Google does some sort of processing with it. Google does not "intercept" the concept, they are sent the content with the expectation that it will be stored on their servers.

[Samizdata]

The point is that you agree to let them process your email in accordance with whatever agreement they have with the recipient.

No, the point is that once an email leaves my server I am powerless to stop the recipient doing whatever they please with it, in the same way as a snail-mail letter.

That does not mean that I agree or consent to anything that is done with the message.

They might, for example, selectively edit the text to change the meaning, enlarge it and put it on a billboard (with my name underneath) endorsing the Ku Klux Klan.

I have not consented to that, or to anything else.

For the avoidance of doubt, I have not consented to my emails being read by the NSA either, by implication or otherwise, regardless of their relationship with Google Inc.

...

[bird]

Consumerwatchdog doesn't seem to live quite in the same world as I do.

"if you care about your email correspondents’ privacy don’t use Gmail.”

If you care about the privacy of your correspondence, don't use (unencrypted) email at all.

“sending an email is like giving a letter to the Post Office,” said Simpson.

The relevant analogy to email was never an enveloped letter, but always a postcard that anyone along the way can read with no problems.

why would I expect its content will be intercepted by Google and read?

According to US wiretapping laws, no processing done by a mail service provider using their own equipment can be considered "interception".

Of course, the court has the final word. But it would be very interesting to see their legal arguments should they end up deciding against Google. Similar past cases have been dismissed out of hand for the mentioned reasons.

[graeme_p]

@Samizdata, you are misinterpreting what I said. I did not say the recipient can do ANYTHING with an email, I said you have consented to certain things you can reasonably expect them to do.

I have not consented to that, or to anything else.

You have not consented to their forwarding the email, or printing it out. Should those be illegal? If you send spam, you have not consented to it being processed by a spam filter, so should spam filters be illegal?

To repeat my question, do you think the Gmail spam filter is an invasion of privacy?

[BeeDeeDubbleU]

1) If they are Gmail users they have not bothered to read the TOS, or read anything about Gmail, or have given any thought about how the free service is paid for.

And that is what Google uses to build their dominance. It may not be illegal but it certainly is not ethical.

[graeme_p]

Why is it inethical? They are not selling your info to third parties, it is not even being looked at by human beings. It is subjected to a little additional processing by Google's servers, which have to process the email anyway to deliver it, store it, filter spam etc.

It is a lot better than the TOS for Windows that you do not get to read until AFTER you have bought a computer with Windows on it.

It is not a secret. The ads appear in Gmail Google can hardly be pretending they do not place ads. It is a perfectly reasonable practice, no different from using search keywords to place ads on Google search.

What do you expect Google to do? Not let users sign up until they have completed an exam to ensure they have read the TOS?

[BeeDeeDubbleU]

I can see that you are quite passionate in your support for Google so we'll have to agree to disagree on this one. ;)

[graeme_p]

Support for Google? Certainly on this issue - not everything! I think they are entirely right, and I have not seen a single argument from those who disagree that actually replies to my argument.

[atlrus]

I think the point was lost in all this technical discussion. And the point being the quote:

a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties

Today it may be for spam filtering, but tomorrow we could find out something different. Don't know about any of you, but I do expect privacy when I send an email or snail-mail. You know who doesn't expect privacy when communicating? Prisoners. Google telling you in your face that your emails will not be private and you choosing to continue using the service is your problem.

I personally could care less in this case, since I opted out of gmail the minute it was understood that they will read your emails for the purpose of advertising.

[Samizdata]

You have not consented to their forwarding the email, or printing it out. Should those be illegal?

No, because my consent is not required.

To repeat my question, do you think the Gmail spam filter is an invasion of privacy?

Whether it is or not is besides the point.

I cannot consent to something that I cannot alternatively refuse consent to.

I said you have consented to certain things you can reasonably expect them to do

Apparently I can reasonably expect the NSA to read my email too.

It is not a secret.

That does not mean that I have given my consent.

I have no option to withhold it.

...