Google Accused of Wiretapping in Gmail Scans

http://www.nytimes.com/2013/10/02/technology/google-accused-of-wiretapping-in-gmail-scans.html?hp

by hudibras • 13 years ago

45 63 13 years ago

natrius2• 13 years ago

Google makes a good point: if it's illegal to scan emails to serve ads, doesn't that mean it's also illegal to scan emails to filter spam and prioritize email?

barista• 13 years ago

scanning for spam does not have to extract the context. Scanning for serving ads probably does?

vkou• 13 years ago

Scanning to apply a filter (Machine-taught, or user-defined) definitely does.

unreal372• 13 years ago

Modern email spam detectors definitely read the contents of the email and even try to extract context through certain words appearing together.

cynwoody8• 13 years ago

What does it mean to extract the content?

To filter spam, you need to make enough sense of the email to identify it as spammy, according to some algorithm. To serve an ad, you need to make enough sense of the email to indicate it's about something one or more of your advertisers cares about. I can't think of a way to distinguish between the spam robot's access vs the ad robot's.

greenyoda• 13 years ago

There's a difference: filtering spam and prioritizing mail is something that's done for the benefit of the user. However, scanning e-mails to maximize ad revenue (they can charge the advertisers more for "relevant" ads) is Google using the contents of your e-mail for their own benefit.

natrius2• 13 years ago

My hunch is that there's no law that makes such a distinction.

Flenser• 13 years ago

Revenue which pays for the FREE service. If the choice was gmail with ads or no gmail I know which I'd choose.

georganos• 13 years ago

Would making money to pay for the services the users use count as being towards the benefit of the user?

res0nat0r3• 13 years ago

It is greatly beneficial to me. It keeps gmail free.

cynwoody8• 13 years ago

Google and the Gmail user both benefit. This why there are so many Gmail users!

The Gmail user gets a free email account with a large storage allowance, an effective search engine, and a dynamite spam filter. Google gets to collect revenue in excess of cost (Google is very good at server farms) for the opportunity to show said user relevant ads.

Thus, Google's access to the content of the user's email benefits both Google and the user!

gibwell12• 13 years ago

One is to provide a feature for the end user's benefit. The other is taking the user's private communication and using it to make money for Google.

If this business model is allowed, imagine all the other kinds of profile that communications providers would be able to sell about you based on the contents of your email.

DannyBee3• 13 years ago

"One is to provide a feature for the end user. The other is taking the user's private communication and using it to make money for Google."

Assume this is true for a second. I'm not aware of any legal caselaw that has ever drawn such a distinction for the acts in play here. So I guess i don't get while people keep saying this like it should or would matter.

(I can't really opine on the case itself for obvious reasons)

magic_haze• 13 years ago

The _only_ reason they provide the feature is so they can make money. Why is this so complicated to understand? Google isn't a charity. They are not obligated to provide anyone anything (unless you pay them. And you can get rid of the ads if you have a Google apps subscription AFAIK.) Do not equate government with a company: their aims are completely different.

001sky• 13 years ago

“Google’s alleged interceptions are neither instrumental to the provision of email services, nor are they an incidental effect of providing these services. The Court therefore finds that Plaintiffs have plausibly alleged that the interceptions fall outside Google’s ordinary course of business...”

From the e-mail case, but this logic would generate the relevant distinction. Their initial legal positioning seems open to question, but only time will tell.

smtddr• 13 years ago

In light of the whole NSA thing, it's difficult to see where this registers on the scale of importance/relevance. Let's say Google is guilty of scanning email text for ads. What does that mean? Judge then orders G to stop, and they do. G pays a big fine(which is nothing to them). Will people feel safer about their Gmail afterwards? I guess filters will be out of the question unless you opt-in for Google to scan your email, which I suspect most users will. Some big ol' wall of text EULA/ToS next time you login, you'll have to accept... or at first you'll deny and your emails will be a mess... then you go back and accept.

gibwell12• 13 years ago

It's highly relevant. If we say Google can scan your email just to support an arbitrary business model, how can we make an argument that the NSA should be prevented from doing it in the name of national security.

It isn't a good thing for Google to try to make loss of privacy seem like business as usual.

marshray• 13 years ago

I don't like that Google would build a profile on me by scanning the contents of my emails, but it's an agreement I knowingly enter into when I occasionally use Gmail.

But what about a non-Gmail-using party who sends emails to one or more Gmail users? Is Google building a dossier on them based on their return address? Are they associating that person's email with other tracking mechanisms Google employs?

I don't know if Google does these things, but if they did, would it be OK?

If some or all of the collected raw data is at most a 'probably foreign' request away for military spies, is it OK to scan and store every bit of data that would be permissible in a mutual-trust-based civil society?

cynwoody8• 13 years ago

That's easy.

You signed up for Gmail knowing how your email service is being paid for.

As for National Security, well, the hell with it! No role for a nation or security unless I get to define the parameters of my privacy!

Snowden 2020! (When he'll be over 35 ;)).

notatoad2• 13 years ago

"Let's say Google is guilty of scanning email text for ads."

that's not the question here. google scans the text of email so they can deliver relevant ads. they freely admit to that, have never tried to hide it, and have been doing it for 10 years with little to no public concern about it. The only question to be decided here is whether scanning your emails for the purposes of advertising counts as wiretapping.

ds9• 13 years ago

Not just "scanning emails for the purposes of advertising", but scanning the emails of people who are not Google customers and have never agreed to Google terms. That is the only point in contention.

reddiric2• 13 years ago

What I got from reading the excerpt of Judge Koh's response in the article was that she was maintaining a vertical separation between the business / activities of sending and receiving mail and other business activities. From my following, I'd imagine that filters and priority inbox and other details would be related to the business of sending and receiving mail.

If Google can win the argument that the way they're using their interception and reading of messages in serving personalized ads is a part of their everyday business activities, it seems to completely undermine the purpose of the law. Google, with G+, is trying to itself be a single unified product with all of these features. Social networking is a feature, videos are a feature, websites, blogs, instant messaging and email and targeted advertising. If Google can say that displaying targeted ads is a part of their normal business activities, then what activity does the law against wiretapping actually protect against?

If Google can read your email for the purpose of enabling a tangential feature of displaying targeted advertising to you, how does that same logic not apply to me if I claim my normal business activities are delivering your mail while opening it, reading it, and selling useful information I find inside of it? I could say it was essential to my business, because I actually deliver for free and just pay my bills with the info I sell.

notatoad2• 13 years ago

It's definitely an interesting case. It seems clear that scanning email solely for the purpose of providing advertisements against it would be illegal (let's ignore the discussion of whether or not this is a stupid law). It also seems clear that scanning emails for spam and categorization is legal. So given that google has a legal reason for scanning the content of emails, is there anything prohibiting them from using the data from that scan for their other business activities? It sounds to me that once you have the reason to get the data, how you actually use it is just up to the product's TOS.

and regarding your last paragraph, you have to remember that this is all consented to by the user. it's not akin to somebody reading and selling your mail before they deliver it to you, it's akin to somebody doing that because you hired them to.

infocollector• 13 years ago

1. Do we know that Google is only using this information to show Advertisements on Gmail? What else does it do with this information? (Suggestion to Google: Trade stocks automatically ;-)

2. Does Implicit consent argument make sense?

3. Perhaps scanning for spam can be done without looking at content? Or looking at content at the client side instead of server side?

Lets for a moment assume that this is perfectly valid business model. Then what stops Windows from sending MS keywords, pictures and everything else from your home computer. Or sensor information from android/iphone to the parent companies.

Not to mention every car/house that was made by now should be sending everything you speak inside the car to GM/Ford/Builders?

Something does not sound right to me. A TOS should not allow a company to do whatever it wants with data.

inerte• 13 years ago

Everybody is quick to remember how gmail users accepted the terms and how the ads pay for the free service, but for me the most interesting part of the article is what happens for those that send emails to a gmail account?

This person never agreed to have its email scanned. Never agreed that its email address would become an index key on a profile to serve ads. Never agreed that its writing/attachments, commercial or not, would be part on how Google makes its money.

I've heard about people manipulating HTML forms to submit lower prices when shopping online. What happens if I send a poem that I wrote to a gmail account and append a Terms of Service to it, basically saying if Google scans this email with commercial intent they must pay me money? Is something like this even possible?

asperous2• 13 years ago

I personally think you do agree to it when you send an email to a @gmail.com address. It would be similar to agreeing to have your email permanently recorded when you send it to a @congress.gov account.

Can someone explain where this right to privacy in email came from? When did it become law that emails have to be protected the same way usps mail is? Or did people just start assuming that? If your email isn't encrypted then it's transmitted in plain text, one of my bosses once said "we're sending it through the public internet, that's like shouting it to on the street corner!"

benologist2• 13 years ago

Emailing someone seems extremely unlikely to be construed as accepting Google's terms - the average person wouldn't have a clue what Google does with emails, nor would they know if an email address is being forwarded to or collected by gmail, or gmail under a custom domain, nor have they been presented any terms, nor should they be expected to have sought out, read and understood the terms for the almost infinite number of services they don't use.

unreal372• 13 years ago

You could argue that if you send an email to a gmail user, it's no longer your email. You've lost all rights to it.

Like sending a postal letter, the paper is no longer yours. You've given it away to the recipient. Along with the rights to open it.

x0054• 13 years ago

Email is not like a letter, it's like a postcard, where the contents are clearly visible to anyone who ever handles it (including all the relay servers). Theoretically speaking your expectation of privacy in a FB message is probably hire than in an email.

cynwoody8• 13 years ago

If you care about such, you need to encrypt the content of your email. Then it will be like a letter instead of a postcard.

Alexander the Geek will still get to add your metadata to his haystack, but, FWIW, the body of your email will remain in a long, long decryption work queue.

cynwoody8• 13 years ago

Substitute for Google's silicon assistant a human personal assistant of the intended Gmail-using recipient. "If any person other than X reads this proprietary poetry, they owe inerte big bux!"

The mail recipient chose Google to handle his email. He could also have chosen some random human to assist him with handling his email. There is no difference.

If you wish to correspond with such a user, you must trust him not to show your email to parties you find obnoxious. If he betrays you in that regard, your beef, such as it is, is with him, not the parties he hired to handle his email.

gibwell12• 13 years ago

As stated in the case, most users don't know what the assistant is doing. So by your analogy the assistant is reading the mail without permission and then secretly using what they learn to make money for themselves.

In such a case, we would certainly blame the assistant.

eggnet• 13 years ago

Google also has to scan your email to index it, for searching. And as far as privacy is concerned, that is the biggest danger, the NSA (or whoever) being able to ask google for all email with a certain keyword in it.

To summarize, they scan for spam filtering to make email usable, advertising to make it free, and indexing for searching.

I don't see how web based email can function without scanning it. And frankly, I don't see how high quality spam filtering can be done without scanning and sharing data across users in general, not specific to web mail.

ma2rten• 13 years ago

What does it even mean to "scan" emails? If Google receives the email, saves it to disk and later retrieves it again, maybe reformats it, is that really fundamentally different from a technical point of view? It's all bits and bytes after all.

Targeted advertising is creepy to humans, because there is some notion that the computer "understands" what you are sending and builds up a profile about you. But, if you take a sober technical point of view, it's hard to accuse Google of anything. Maybe Google should educate it's users more how those ads are generated?

znowi• 13 years ago

Google lawyers are presenting a clever argument, which on the surface looks quite sensible. But the accusation is not about scanning, but wiretapping, which, as the judge notes "primarily used to create user profiles and to provide targeted advertising". It is not the same as sorting out email or looking for virus signatures in attachments.

If you follow Google's notion of implicit consent to such practices, then any traffic online can be lawfully intercepted and profiled. When you send data over a third party router, you give permission to spy on yourself. I don't think so.

deathanatos• 13 years ago

If you follow Google's notion of implicit consent to such practices, then any traffic online can be lawfully intercepted and profiled. When you send data over a third party router, you give permission to spy on yourself. I don't think so.

I disagree. Google is not intercepting traffic willy nilly: you _sent_ the traffic to Google, when you emailed john.smith@google.com. Comparing Google reading traffic that was transmitted to it with a wholesale "any traffic online and be lawfully intercepted and profiled" is exaggerating the scope of what is going on here.

Also, what is the prosecution hoping to gain here? If they win, and Google can't serve relevant ads… are we out of a good email service? (I suppose Google could still try to serve ads, but they just would be in the dark w.r.t. the email content.)

dingaling2• 13 years ago

you _sent_ the traffic to Google, when you emailed john.smith@google.com

How about when you emailed @guardian.co.uk? @specsavers.com?

Under the covers they're using Postini + Gmail. Did you consent to sending that traffic to Google?

Wat about people living in LA, who have no option but to send their traffic to Google when they e-mail their local Government at @lacity.org?

NOAA, State of Wyoming.. the list goes on.

http://www.google.com/intx/en_uk/enterprise/apps/business/cu...

cynwoody8• 13 years ago

Google's Gmail business model has been common knowledge ever since they surfaced it as a new, invitation-only beta.

This whole debate about the appropriateness of a content-driven ad-supported business model has been front and center all along.

It should be sorted out in the marketplace, not the court room.

hrasyid• 13 years ago

Wow, how did they manage to find a judge who seems very knowledgeable on tech issues?

walid• 13 years ago

And how is scanning your email different from scanning your facebook posts both private and public. If the plaintiff wins, bye bye advertising supported services.

Google Accused of Wiretapping in Gmail Scans

Related Stories