A privacy/security nut asked me recently how I knew that email sent via Gmail and files shared with Dropbox.com were not being read by employees of Google or Dropbox.
https://www.dropbox.com/security is pretty clear:
We guard your privacy to the best of our ability and work hard to protect your information from unauthorized access.
Dropbox employees are prohibited from viewing the content of files you store in your Dropbox account, and are only permitted to view file metadata (e.g., file names and locations). Like most online services, we have a small number of employees who must be able to access user data for the reasons stated in our privacy policy (e.g., when legally required to do so). But that’s the rare exception, not the rule. We have strict policy and technical access controls that prohibit employee access except in these rare circumstances. In addition, we employ a number of physical and electronic security measures to protect user information from unauthorized access.
I couldn’t find anything comparable among the forest of Google documents on how important privacy is to them. Mostly Google seems to write about how they won’t share “personal information” (used in http://www.google.com/intl/en/privacy/privacy-policy.html; defined in http://www.google.com/intl/en/privacy/faq.html#toc-terms-personal-info ), which seems to be name and email address.
https://mail.google.com/support/bin/answer.py?hl=en&answer=1304609 says that the answer to “Is Google reading my mail?” is “No” but doesn’t elaborate other than to talk about some computer programs that try to read the mail in order to determine what ads to serve.
Has Google gone on record saying that they won’t read the contents of a letter stored in Google Docs? If so, where?
here’s a strange little story that happened to me a while ago – I set up a gmail account to deal with nigerian letters and such (I wanted to collect some data to report the spammers/thieves, without compromising my actual e-mail address in the process). I set this up with a fake username (something like george.thompson or so) and a password which included the word “nigeria” in it. Lo and behold, after my first login (before sending/receiving any mail) the targeted advertising in gmail included some nigerian ads (nigerian holidays, nigerian business bureau, etc). coincidence?….
When you send an email across the ‘net doesn’t it hop from server to server? Is there anything that tells you that it isn’t read along the way?
Why wouldn’t this be covered by wiretap provisions?
I found this: http://mail.google.com/support/bin/answer.py?answer=6603
https://mail.google.com/support/bin/answer.py?hl=en&answer=1304609
“Is Google reading my mail?
No, but automatic scanning and filtering technology is at the heart of Gmail. Gmail scans and processes all messages using fully automated systems in order to do useful and innovative stuff like filter spam, detect viruses and malware, show relevant ads, and develop and deliver new features across your Google experience. Priority Inbox, spell checking, forwarding, auto-responding, automatic saving and sorting, and converting URLs to clickable links are just a few of the many features that use this kind of automatic processing.”
That seems clear enough to me. Note that I work for Google, but have no role in setting policy or working on the products involved here. More important for me is that I also use Google for my personal mail – which I would not do if I felt Google employees (besides me obviously) could read my email.
mtX,
Cookies on your computer might have helped Google identify interest in Nigeria, hence the ads.
@mtX, unless you completely wiped your computer between those actions, I’d bet money the advertising was a result of your recent browsing and searching of websites relating to nigerian spam. Unfortunately, clearing cookies is not usually enough. And you did not indicate that you cleared your cookies, so I can assume otherwise.
You don’t need to read further than this article about this EXACT issue…where a Google employee with FULL access to your Google account.. all of it.. chat, mail, photos etc…
http://gawker.com/5637234/
Here is where they say it. Also answers the first comment.
https://mail.google.com/support/bin/answer.py?hl=en&answer=1304609
@mtX Had you been doing any searches and visiting websites related to the Nigerian scams prior to signing up? Your search and browsing history would be the most direct way to target ads to you, not your password.
A Google Apps help page (http://www.google.com/support/a/bin/answer.py?answer=60762) has this statement:
“What kind of scanning/indexing of user data is done?
/—/ It’s important to note that our scanning and indexing procedures are 100% automated and involve no human interaction.”
http://www.google.com/goodtoknow/data-on-google/advertising/ this page has the following statement:
“Ad targeting in Gmail is fully automated, and no humans read your email in order to target advertisements or related information”.
So basically it is on record, although not in an easily findable way.
If google want to read my mail and enlarge their penis with a free trial, or solve their impotency then they’re more then welcome to the inners of my mail box.
@mtX
It’s pretty clear they do this in an automated fashion. If you use gmail to discuss for example ‘buying a car’ you will receive car ads from local dealers in your side bar.
It is of course still a far cry from google employees manually trawling through your emails – there is more than likely strict internal policy and access control to stop rogue employees from reading your emails.
On re-reading your comment, you have probably been googling ‘nigerian scams’ or something similar in the last few days.
From the privacy policy page you linked to in your article:
“We restrict access to personal information to Google employees, contractors and agents who need to know that information in order to process it on our behalf. These individuals are bound by confidentiality obligations and may be subject to discipline, including termination and criminal prosecution, if they fail to meet these obligations.”
mtX,
This could be done automatically using google massive algos. It need not mean your files were read!
mtX, I think we already know that Gmail accounts are scanned by a computer for keywords for targeted ads. That said, I’ve experienced some other issues with Gmail recently, included with the fact that point made by the post is muddy, I’ll most likely be switching soon.
@mtX:
It’s been known for a while that if a Facebook page is logged in, Facebook is able to scan and log the activity in your other browser windows (presumably via scripts surfing the browser’s document object model). I could easily imagine Google doing a similar trick. Or perhaps they just found a cookie stashed a while ago, and linked it up with past search history indicating you were “interested” in Nigeria.
I am really not getting a very good impression of your commenters For the record:
No, Google employees don’t read your e-mail in order to do ordinary business stuff. That completely wouldn’t scale.
Yes, innumerable Google employees have no trouble reading your e-mail, chat logs etc. As some have demonstrated in the past. ( http://gawker.com/5637234/ ). Google doesn’t really have IT, instead regular engineers are responsible for—and hence have access to—servers and server data.
Google promises you they won’t have humans reading your mail as a business practice; nowhere do they promise no human can read your mail.
If a human reads your mail, and misuses the information, and gets caught, and a stink is raised, and the human is not too important to the company, he will quite likely be fired. This is at least one step better than simply transferring him to a different diocese, but at least one step worse than turning him over to the law.
Yahoo and AOL exemplify the “multi-faceted operation also hosts your mail”; do they make any promises?
Folks: The problem with Google promising to hold “personal information” confidential is that a document may not meet the definition of “personal information” given in http://www.google.com/intl/en/privacy/faq.html#toc-terms-personal-info . For example, if you write down some ideas for a new product and keep it as a Google Doc there may be nothing in the document that identifies you as the author and therefore it might be okay for Google to read or distribute the document.
Generally speaking the Google privacy docs address a separate issue from the question of keeping email or documents confidential. They are about the question of whether your identify is kept confidential when you’re browsing around the Web and Google is figuring out what your interests and demographics are. Worthy stuff to be writing about, no doubt, but it doesn’t shed much light on the subject of whether a Google employee can copy and paste paragraphs from your email messages or Google docs.
Another starting point:
http://news.cnet.com/8301-30684_3-20021090-265.html
Do you guys know anything about email? It travels the net in plain text unencrypted. Anyone can read your email.
Now stop and thing about spam protection … of course they can read your mail. Its a requirement of the software being able to run..
But drop box doesnt … so what? Its a totally different service .. its not like you can spam someone on here.
PLease article fails to understand email. As for the IP issue that is a whole other kettle of fish.
John: Email from one gmail address to another doesn’t travel the net at all, does it? It stays within Google’s cloud. Access to gmail is via SSL. So at the very least I might be able to expect that a gmail I receive from another gmail user would be kept for my eyes alone? Google Docs are accessible only via HTTPS as well and otherwise they don’t travel the network. So why couldn’t I expect the same privacy in Google Docs that I can get from Dropbox?
As a side answer. I’ve been told by dentists and doctors that they cannot distribute patient information by gmail (even to the patient), because Google’s privacy policy does not pass HIPPA(sp?)’s confidentiality test. I would put private medical information in the same boat as “the next great idea that could make tons of coin and that can’t fall into the hands of someone else who might develop it and steal your potential earnings by developing VHS before you can finish and market Betamax.”
Let’s stop dancing around the issue and declare that Philip has raised a valid concern. If I was Apple, Microsoft, or Amazon, I would not put any confidential information on Google’s servers. Likewise, if you need to keep something truly confidential, Google is not the place. Worst of all, at the risk of sounding paranoid, under the Patriot Act the US Government can access the same email and Docs without your prior knowledge and consent.
Bottom line: if you have truly confidential information, don’t put anywhere in Google.
To my previous post, some relevant links:
http://epic.org/privacy/cloudcomputing/google/ (see many further links at end)
http://www.google.com/transparencyreport/governmentrequests/userdata/
This recent blog post by Chris Soghoian is tangentially relevant: “Google’s products do not meet the privacy needs of journalists, bloggers, small businesses (or anyone else concerned about government surveillance).” Phil, if you can get his attention, Chris would be an EXCELLENT guy to run your concerns by.
As it would not be very practical for Google to read every document or email message, I think it is possible that the lack of an explicit policy against reading any document or email message may be due to an oversight. Google gets so much attention for subtle privacy issues, e.g., will they tell an advertiser that you’ve been surfing a lot of car review sites lately?, that maybe their lawyers and product managers just did not notice the elephant in the room. Does Google truly wish to retain the right for itself or its employees to read Google Docs that have been authored by users?
If x makes a statement like “Is x doing y? No, but…” does that actually legally PREVENT x from doing y in the future?
What short memories we have. When Gmail was introduced, Google made it clear that the business model involved placing advertisements along the side based on the contents of the email. When I first got the service I amused myself by trying to get advertisements for certain things to appear by using keywords in the messages.
Mark: The original posting is not about Google’s automated system looking for keywords and displaying related ads. I don’t think many people are bothered when computer programs read their private documents. Microsoft Word, for example, is obviously reading the text of a private document from one’s hard drive.
Apropos of privacy with Microsoft Word, I work on a Mac laptop & use Microsoft Word for writing docs. I file docs by a subect line that includes date, project acronyms & key words. Mac filing is supposedly noted for filing docs in odd places. That rarely happens to me because I always look at the file-destination when I log the file. What I have noticed, because it has happened often enough, is that certain key words correlate with a default routing to the Microsoft Office file in Applications – way off the beaten track for filing. Google GG & G+ have been among those key words. And of course I do have an
internal correlation for those entities …