Google Accused of Wiretapping in Gmail Scans
nytimes.com
nytimes.com
This person never agreed to have its email scanned. Never agreed that its email address would become an index key on a profile to serve ads. Never agreed that its writing/attachments, commercial or not, would be part on how Google makes its money.
I've heard about people manipulating HTML forms to submit lower prices when shopping online. What happens if I send a poem that I wrote to a gmail account and append a Terms of Service to it, basically saying if Google scans this email with commercial intent they must pay me money? Is something like this even possible?
Can someone explain where this right to privacy in email came from? When did it become law that emails have to be protected the same way usps mail is? Or did people just start assuming that? If your email isn't encrypted then it's transmitted in plain text, one of my bosses once said "we're sending it through the public internet, that's like shouting it to on the street corner!"
A domain and an email address don't imply anything by itself and it's impossible to know without significant research whose and what policies are in effect. You could arguably require one or more lawyers just to decipher what exactly you're subject to when you factor in different countries, company locations, server locations etc.
Phones and web/desktop mail clients have made email addresses virtually invisible in lieu of our contacts' names, and the factors I mentioned in my other post make it impossible to ultimately know what inbox an email really ends up in anyway.
Are we agreeing, or acknowledging, a telco's terms and conditions when we dial a number?
Like sending a postal letter, the paper is no longer yours. You've given it away to the recipient. Along with the rights to open it.
Alexander the Geek will still get to add your metadata to his haystack, but, FWIW, the body of your email will remain in a long, long decryption work queue.
The mail recipient chose Google to handle his email. He could also have chosen some random human to assist him with handling his email. There is no difference.
If you wish to correspond with such a user, you must trust him not to show your email to parties you find obnoxious. If he betrays you in that regard, your beef, such as it is, is with him, not the parties he hired to handle his email.
In such a case, we would certainly blame the assistant.
To filter spam, you need to make enough sense of the email to identify it as spammy, according to some algorithm. To serve an ad, you need to make enough sense of the email to indicate it's about something one or more of your advertisers cares about. I can't think of a way to distinguish between the spam robot's access vs the ad robot's.
Google also scans e-mails in paid Google Apps accounts.
Edit: correction to myself. Whilst paid Google Apps accounts still show ads and Web Clips, Google now have this statement:
If you are using Google Apps (free edition), email is scanned so we can display contextually relevant advertising in some circumstances.
http://support.google.com/a/bin/answer.py?hl=en&answer=60762
the implication being that the paid accounts are scanned only for virus, spam and Priority Inbox processing.
Sorry, I was wrong.
And also because such an interpretation would allow any business model based on exploiting the contents of the users email for profit, which is clearly not the intent of the wiretapping statute.
However, spam filtering (for sure) and prioritization (maybe) improve the user experience, thus drawing in more clients and retaining the existing base.
Spam filtering, etc., make the service more attractive, boosting the user base, which makes it possible to charge more for the opportunity to show ads to the customer base, which, of course, is how Google gets paid.
Spam filtering, etc., are no different than improving the Search Engine. Both attract more eyeballs and, thus, more ad revenue!
So, as a Gmail user, you have a choice. Free, but you get to see dumpster ads because the email was about dumping some stuff off a database. Or on your credit card, because you don't want silicon being any more aware of your email bits than absolutely necessary to show them to you.
It should be up to you, the user, not Judge Koh!
†https://www.fastmail.fm/signup/personal.html
I'm sticking with Gmail.
I'm sticking with Gmail.
whatever happens with the case appeal after appeal time will tell, but a group of users sued Google for the things mentioned in the lawsuit. So the judge didn't wake up one day and pick on Gmail for no reason, there was a lawsuit by users--not all Gmail users share your opinions--and the judge had to decide on a few things.
My guess is that most users don't know what happens to their email (scan and advertising profiles based on the content of emails) because Google isn't exactly publicizing this for obvious reasons. So that will play a role and they are way of testing this via scientific surveys and polls. As long as people know and consent to this, Google will have no problem. For example, you can record a conversation as long as the other person consent to it. Who and how they consented if the did, is the $64k question.
The allegation is that many users have been duped.
The email scanning just makes extra profits for google and their advertisers at the expense of people's privacy.
Automated scanning is inherent in allowing gmail to be free. You submit to this when singing up for the service. 3rd party users emailing a plaintext email across the internet also have no expectation of privacy, just like mailing a postcard to someone across the world.
The Gmail user gets a free email account with a large storage allowance, an effective search engine, and a dynamite spam filter. Google gets to collect revenue in excess of cost (Google is very good at server farms) for the opportunity to show said user relevant ads.
Thus, Google's access to the content of the user's email benefits both Google and the user!
If this business model is allowed, imagine all the other kinds of profile that communications providers would be able to sell about you based on the contents of your email.
Assume this is true for a second. I'm not aware of any legal caselaw that has ever drawn such a distinction for the acts in play here. So I guess i don't get while people keep saying this like it should or would matter.
(I can't really opine on the case itself for obvious reasons)
Law is always a distant second to morality. Sometimes it catches up, sometimes it doesn't. But to define what is right by a lack of previously established law is astoundingly naive, bordering on self-serving. Even when there is precedent, it doesn't necessarily define the morality of a situation, e.g. slavery, driving under the influence and women's suffrage among many thousands of examples.
That's why people keep mentioning it.
Most other circuits (except two I believe) have explicitly held it to be okay for things like behavioral advertising.
See, for example, Kirch v. Embarq Management Co (10th circuit)
Given ECPA does not define "ordinary course of business" in any way, and the accompanying senate reports do not say anything about the exception being related to "for the benefit of the end user" (and instead talks entirely about the need/desires of the ISPS using the communications) , I would guess the opinion will have some trouble at the appellate level, but i guess we'll see!
(Though any pair of cases where an appeals court has said they are different would be fine!)
From the e-mail case, but this logic would generate the relevant distinction. Their initial legal positioning seems open to question, but only time will tell.
To summarize, they scan for spam filtering to make email usable, advertising to make it free, and indexing for searching.
I don't see how web based email can function without scanning it. And frankly, I don't see how high quality spam filtering can be done without scanning and sharing data across users in general, not specific to web mail.
Targeted advertising is creepy to humans, because there is some notion that the computer "understands" what you are sending and builds up a profile about you. But, if you take a sober technical point of view, it's hard to accuse Google of anything. Maybe Google should educate it's users more how those ads are generated?
It isn't a good thing for Google to try to make loss of privacy seem like business as usual.
But what about a non-Gmail-using party who sends emails to one or more Gmail users? Is Google building a dossier on them based on their return address? Are they associating that person's email with other tracking mechanisms Google employs?
I don't know if Google does these things, but if they did, would it be OK?
If some or all of the collected raw data is at most a 'probably foreign' request away for military spies, is it OK to scan and store every bit of data that would be permissible in a mutual-trust-based civil society?
You signed up for Gmail knowing how your email service is being paid for.
As for National Security, well, the hell with it! No role for a nation or security unless I get to define the parameters of my privacy!
Snowden 2020! (When he'll be over 35 ;)).
that's not the question here. google scans the text of email so they can deliver relevant ads. they freely admit to that, have never tried to hide it, and have been doing it for 10 years with little to no public concern about it. The only question to be decided here is whether scanning your emails for the purposes of advertising counts as wiretapping.
If Google can win the argument that the way they're using their interception and reading of messages in serving personalized ads is a part of their everyday business activities, it seems to completely undermine the purpose of the law. Google, with G+, is trying to itself be a single unified product with all of these features. Social networking is a feature, videos are a feature, websites, blogs, instant messaging and email and targeted advertising. If Google can say that displaying targeted ads is a part of their normal business activities, then what activity does the law against wiretapping actually protect against?
If Google can read your email for the purpose of enabling a tangential feature of displaying targeted advertising to you, how does that same logic not apply to me if I claim my normal business activities are delivering your mail while opening it, reading it, and selling useful information I find inside of it? I could say it was essential to my business, because I actually deliver for free and just pay my bills with the info I sell.
and regarding your last paragraph, you have to remember that this is all consented to by the user. it's not akin to somebody reading and selling your mail before they deliver it to you, it's akin to somebody doing that because you hired them to.
And I don't follow why you think once you have a reason to use data for one purpose, you automatically have the right to use it for any purpose.
If you follow Google's notion of implicit consent to such practices, then any traffic online can be lawfully intercepted and profiled. When you send data over a third party router, you give permission to spy on yourself. I don't think so.
I disagree. Google is not intercepting traffic willy nilly: you _sent_ the traffic to Google, when you emailed john.smith@google.com. Comparing Google reading traffic that was transmitted to it with a wholesale "any traffic online and be lawfully intercepted and profiled" is exaggerating the scope of what is going on here.
Also, what is the prosecution hoping to gain here? If they win, and Google can't serve relevant ads… are we out of a good email service? (I suppose Google could still try to serve ads, but they just would be in the dark w.r.t. the email content.)
How about when you emailed @guardian.co.uk? @specsavers.com?
Under the covers they're using Postini + Gmail. Did you consent to sending that traffic to Google?
Wat about people living in LA, who have no option but to send their traffic to Google when they e-mail their local Government at @lacity.org?
NOAA, State of Wyoming.. the list goes on.
http://www.google.com/intx/en_uk/enterprise/apps/business/cu...
This whole debate about the appropriateness of a content-driven ad-supported business model has been front and center all along.
It should be sorted out in the marketplace, not the court room.
2. Does Implicit consent argument make sense?
3. Perhaps scanning for spam can be done without looking at content? Or looking at content at the client side instead of server side?
Lets for a moment assume that this is perfectly valid business model. Then what stops Windows from sending MS keywords, pictures and everything else from your home computer. Or sensor information from android/iphone to the parent companies.
Not to mention every car/house that was made by now should be sending everything you speak inside the car to GM/Ford/Builders?
Something does not sound right to me. A TOS should not allow a company to do whatever it wants with data.