Yes, your boss can read your Gmail drafts | Hacker News Reader

Yes, your boss can read your Gmail drafts

mashable.com

44 pointsslowhand0914 comments

Um, yeah, the administrators for your GSuite instance can read your drafts. Unless your boss is a GSuite administrator, they can't, so they'd have to go ask IT for your drafts which in any sane company would be met with "Why?". This is a standard feature in pretty much every email system as part of the compliance features.

On the other hand, one can't expect much privacy at the workplace. Even the use of keyloggers could be legal and possibly is widespread.

That’s true but also doesn’t have to be that way

Outside of administrators, drafts may also be accessible if your boss was given access to relevant search terms as part of Google Vault, G Suite's e-discovery functionality. Or if an OAuth service account was created and given domain-wide IMAP delegation, and the data pulled from it is made available to others. All this is extremely powerful and by design.

https://support.google.com/a/answer/2462365?hl=en

https://developers.google.com/gmail/imap/xoauth2-protocol#do...

Hi IT, we got a FOIA request for all of xyz’s drafts.

Why is this a revelation or surprise? Your employer provides you with equipment and applications not for their benefit, not yours, and I think this is perfectly reasonable. It'd be one thing if GMail cost money, but you can get _your own account_ for _free_. This is a complete non-issue.

Tangentially-related: I was an IT person in a past life and the extent to which some employees treated the company laptops and e-mail as their own was astounding. Light personal use via the browser is one thing, but I would get users asking why they couldn't play a personal DVD after-hours using their work machine, if I could allowlist a hobby-related mailing list to their work e-mail, why I took away their admin rights because their kids needed to install games, etc.

> Your employer provides you with equipment and applications not for their benefit, not yours

Usually employment is offered with the idea that it is mutually beneficial. Yes - you get paid and they keep the profits, but that doesn’t imply that work isn’t itself expected to benefit the worker in other ways.

We're talking about two different things... work itself is supposed to be mutually beneficial but using corporate assets for personal ends when you could just as easily use your own is silly and makes everybody's life more difficult. As I said, stuff like

> Light personal use via the browser is one thing

but using work e-mail with any expectation of privacy when you have an e-mail client in your pocket is ridiculous.

> but using work e-mail with any expectation of privacy when you have an e-mail client in your pocket is ridiculous.

It’s ridiculous to expect unsent draft emails to be private?

>Why is this a revelation or surprise? Your employer provides you with equipment and applications not for their benefit, not yours, and I think this is perfectly reasonable.

A draft is a window into what someone was thinking before they edited or censored their thoughts. Even when people have been notified they don't own the equipment and nothing is private, they generally rely on not being that closely monitored that they can be held responsible for a message they didn't send to anyone.

Google themselves got screwed in court in precisely that scenario, where there were autosaved drafts of some emails that showed what execs were thinking prior to the actual sending of a message. It was ruled valid to produce, but that doesn't mean that everyone has to agree that's fair.

If the top people at Google think that composing an email is private, I think that's a pretty good hint that it is typical on planet Earth, even if it's not actually true.

If you are going to avoid revealing your thoughts while composing a document, then you would have to do it on some other system and only transmit the final version. That's somewhere from cumbersome to infeasible, and people just don't do it.

It seems approximately equivalent to the expectation of privacy in the restroom at work, to me.

Can they read it only while it is in the drafts folder? If it is discarded is it still available? Or if it is edited-and-sent, can they see the original?

"A GSuite admin can view drafts in Gmail" seems like a better headline than answering an unasked question.

Reply on news.ycombinator.com