Gmail scanning may violate federal wiretapping laws, judge finds(pcworld.com)
pcworld.com
Gmail scanning may violate federal wiretapping laws, judge finds
http://www.pcworld.com/article/2050080/googles-gmail-scanning-unclear-to-users-judge-finds.html
70 comments
The decisions are based on the purpose for which the interception was done.
Using the contents of people's email to support an arbitrary business model is too broad according to the judge.
If we allow advertising as a legitimate reason to allow machines to read your email, why not also allow Google to offer credit scores, insurance ratings, HR evaluations, and services to private detectives?
Using the contents of people's email to support an arbitrary business model is too broad according to the judge.
If we allow advertising as a legitimate reason to allow machines to read your email, why not also allow Google to offer credit scores, insurance ratings, HR evaluations, and services to private detectives?
I said-
"I would submit, that if it is just code reading the email that was intentionally sent to the system the code is running on, it is not really being intercepted."
None of your examples meet that criteria.
Why does Judge Koh seem to have it in for Google?
I'm more comfortable with Google scanning my mails than the NSA or my government...
Google is just using it for ads, but the government can construct whatever paranoid stuff from my mails.
Google is just using it for ads, but the government can construct whatever paranoid stuff from my mails.
It really seems like a stretch to call Google's scanning a wiretap, but part of me hopes they lose. If they do, it might be harder for the government to access our online data without a warrant:
https://www.eff.org/deeplinks/2012/10/governments-attack-clo...
"And now the government is trying to use standard contractual language to argue that any user of a cloud computing service has, at best, "severely limited" ownership rights in their property."
https://www.eff.org/deeplinks/2012/10/governments-attack-clo...
"And now the government is trying to use standard contractual language to argue that any user of a cloud computing service has, at best, "severely limited" ownership rights in their property."
I feel exactly the opposite way. Companies are always looking for ways to screw with ordinary people. Governments are mostly just interested in radicals and terrorists.
The difference is that when Google screws you over, you see...advertisements, maybe embarrassing ones, and maybe your personal data is given to some other company. When your government screws you over you get a hand in your rectum when you try to fly, or thrown in a prison cell, or have your home invaded by a team of soldiers. Which scares you more?
Why must you compare, and get in a game of "but they're worse than the other"?
Both are bad. That said, I think the threat of civil liberties being taken away by companies like Facebook and Google is very understated and very underestimated.
And if I can give you a piece of my mind for a moment here, I am actually fine with someone sticking a hand in my rectum in isolated instances. I think I would actually be more bothered when Facebook decides to sell my private info to credit card companies and insurance companies and I end up paying more for insurance or whatever because of this.
Both are bad. That said, I think the threat of civil liberties being taken away by companies like Facebook and Google is very understated and very underestimated.
And if I can give you a piece of my mind for a moment here, I am actually fine with someone sticking a hand in my rectum in isolated instances. I think I would actually be more bothered when Facebook decides to sell my private info to credit card companies and insurance companies and I end up paying more for insurance or whatever because of this.
> Why must you compare, and get in a game of "but they're worse than the other"?
Because betterunix was disagreeing with rayiner, who made the original comparison.
Because betterunix was disagreeing with rayiner, who made the original comparison.
How about medical information from your doctor or legal information from your doctor or financial information from your bank?
Google also can compile information about the sender or receiver of an email even if they are not on gmail. Can they retarget ads based on that information?
Google also can compile information about the sender or receiver of an email even if they are not on gmail. Can they retarget ads based on that information?
They basically already do on loose terms.
Do this experiment: make a sock Facebook account, communicate dozens of messages with keywords like "fat", "weight", "exercise", "weight loss", include similar keywords in your likes. Then sit back and watch... you'll be targeted with weight loss pills and all that.
But here's the kicker though... the weight loss pills they are advertising are almost always bad. They're scam businesses. The pills they're selling will almost certainly adversely affect your health. But they're going to penetrate the psyche of a person who's having weight issues, they know how to advertise their pills to them. People are going to buy those pills.
And yes, when the floodgates that are guarding medical information open up, it's going to be a mess. And it's going to have deleterious effects on our society.
Do this experiment: make a sock Facebook account, communicate dozens of messages with keywords like "fat", "weight", "exercise", "weight loss", include similar keywords in your likes. Then sit back and watch... you'll be targeted with weight loss pills and all that.
But here's the kicker though... the weight loss pills they are advertising are almost always bad. They're scam businesses. The pills they're selling will almost certainly adversely affect your health. But they're going to penetrate the psyche of a person who's having weight issues, they know how to advertise their pills to them. People are going to buy those pills.
And yes, when the floodgates that are guarding medical information open up, it's going to be a mess. And it's going to have deleterious effects on our society.
LOL. If I write "my girl was like a bomb yesterday", Google may only show a penis-enlargement ad the next couple of days.
One of our stupid government filters may think either me or my girlfriend is a terrorist because I wrote "bomb" and place me on a no-fly list. Has happened...
One of our stupid government filters may think either me or my girlfriend is a terrorist because I wrote "bomb" and place me on a no-fly list. Has happened...
This is naive, tho. Google collecting your info is one-stop-shop for the Feds. Your risk rises proportionately with the information density collected by anyone about you. While it may be true that google is more ethical than the NSA (arguendo), it doesn't matter.
Google didn't kill a hundred million of its own customers in the last century alone. It took governments to do that.
So as long as they don't kill people, whatever they do is ok?
We're comparing worst-case scenarios here, no?
We're comparing actual scenarios that are happening today. You seem to be arguing that it's ok for Google wiretap people, but not ok for the government to do so, because the government has killed people whereas Google has not.
(Shrug) We live in a world of shades of gray. We only have history to guide us. Take your eye off the corporations, and you get spam, collusion, the occasional oil spill, and maybe a Bhopal or a Fukushima every few decades. Take your eye off the government, and the consequences are measured in megadeaths.
Your privilege is showing. The government has a long history of abusing the impoverished, minorities, and patriots.
Look up Tuskehee siphylus or J Edgar Hoover or American Indian.
What do you think "radical" means? The word was invented to describe "people who aren't doing anything wrong (else they would be criminals or terrorists) but who the people government don't like .
Look up Tuskehee siphylus or J Edgar Hoover or American Indian.
What do you think "radical" means? The word was invented to describe "people who aren't doing anything wrong (else they would be criminals or terrorists) but who the people government don't like .
This is absurd. How is Google 'intercepting' emails when Gmail is the service from which they originate? Furthermore, Google's TOS seems pretty straightforward.
An outside party (e.g. a customer of an ISP) sending an e-mail to a company which uses Google Apps Mail or a forward to a GMail account because the ISP email interface sucks may not know at all that Google is involved.
So, the third party has no chance to be aware of Google's ToS...
So, the third party has no chance to be aware of Google's ToS...
So that means that no third-party services should be allowed?
When I send an email to a company that uses third-party customer support software to consume, parse, and host the email; I don't agree to the TOS of the customer support vendor.
When I send an email to a company that uses third-party software to parse and archive email for legal purposes; I don't agree to the TOS of that email parsing and archiving company.
It would be ridiculous and impossible to expect that I would agree to the TOS of each and all pieces of software used in the processing of my communications with a company.
When I send an email to a company that uses third-party customer support software to consume, parse, and host the email; I don't agree to the TOS of the customer support vendor.
When I send an email to a company that uses third-party software to parse and archive email for legal purposes; I don't agree to the TOS of that email parsing and archiving company.
It would be ridiculous and impossible to expect that I would agree to the TOS of each and all pieces of software used in the processing of my communications with a company.
Those vendors aren't using the content of your email to further their own interests other than the expected function of delivering the mail reliably.
> Those vendors aren't using the content of your email to further their own interests other than the expected function of delivering the mail reliably.
And? The intent is irrelevant
And? The intent is irrelevant
You say this, but it's not actually true in law.
I don't see anything about intent or reason for the "intercept" making a difference in the law http://www.law.cornell.edu/uscode/text/18/2511
> You say this, but it's not actually true in law
Can you post a link to those laws
Can you post a link to those laws
The person they're sending it to could also publish it on the front page of the New York Times.
This issue is about what the receiver wants to do with the email, so by using gmail, or forwarding to gmail, the receiver is opting to have all his or her mails scanned by Google for ad placement.
This issue is about what the receiver wants to do with the email, so by using gmail, or forwarding to gmail, the receiver is opting to have all his or her mails scanned by Google for ad placement.
Isn't the sender then also potentially a target for ad re targeting even though they were never on gmail at all?
Assuming the sender is not also on Gmail, how does Gmail manage to show her ads?
You have the sender's email. Combine your information with information via other sources such as any other website.
It is, as a sender, my responsibility to not send information to people I can't trust. So if I think the recipient may post a picture of my wiener on the NYT front page, I should not do this.
However, if I do not know that the recipient uses Google Mail, it is not okay that Google scans and potentially indexes my wiener...
However, if I do not know that the recipient uses Google Mail, it is not okay that Google scans and potentially indexes my wiener...
Where is it alleged that Google is doing that?
Did you find a picture of your wiener on Google Images? What search terms did you use? Or did you take a quick snap and drop it on the camera icon in the Google Image Search box?
I've not done the wiener experiment, but I do know that Google's ad placement algorithms are fairly simple-minded. For instance, our CFO sent me a request for a dump of some accounts off the accounting server. What ads did I see? Dumpster rentals and local trash haulers!
Did you find a picture of your wiener on Google Images? What search terms did you use? Or did you take a quick snap and drop it on the camera icon in the Google Image Search box?
I've not done the wiener experiment, but I do know that Google's ad placement algorithms are fairly simple-minded. For instance, our CFO sent me a request for a dump of some accounts off the accounting server. What ads did I see? Dumpster rentals and local trash haulers!
I see no fundamental difference.
recipient had forwarded email to google, by setting their MX record to google's server.
Even if a third party sending an e-mail to a Gmail address is aware of Google's ToS, it's farfetched to think that they're somehow bound by Google's ToS, which they never agreed to. Yet Google claimed that these senders did, somehow consent:
Koh also rejected Google's contention that non-Gmail users gave their implied consent to scanning of their communications.
"Google has cited no case that stands for the proposition that users who send emails impliedly consent to interceptions and use of their communications by third parties other than the intended recipient of the email," Koh wrote.
Koh also rejected Google's contention that non-Gmail users gave their implied consent to scanning of their communications.
"Google has cited no case that stands for the proposition that users who send emails impliedly consent to interceptions and use of their communications by third parties other than the intended recipient of the email," Koh wrote.
In general, you just have to trust your email correspondents not to show your mail to parties that should not see it.
If, for you, such parties include Google's servers, then don't send mail to Gmail users. And make sure your non-Gmail correspondents do likewise.
If, for you, such parties include Google's servers, then don't send mail to Gmail users. And make sure your non-Gmail correspondents do likewise.
The problem is that most correspondents don't know what their email is being reviewed by Google.
it is absurd because every mail server and email virus checker, and firewall, and depp packet inspector ever also scans those emails.
They do that only for the purpose of delivering the mail safely. Not to further their own arbitrary business interests.
> They do that only for the purpose of delivering the mail safely. Not to further their own arbitrary business interests.
Intent is irrelevant, if one is wiretapping then the other is also wiretapping
Intent is irrelevant, if one is wiretapping then the other is also wiretapping
Where do you get the idea that intent is irrelevant? That's certainly not a general legal principle.
what? no, almost everything I mentioned do it to further their own business interests.
Mostly by offering value to their customers in the form of added services.
Google do it to allow themselves to provide a free email service.
Without the scanning of email done by google, everyone would have to pay for their email services.
You may or may not like the trade off, but apparently MANY people would prefer to have a free email service that provides advertising over a paid for email service that does not.
Mostly by offering value to their customers in the form of added services.
Google do it to allow themselves to provide a free email service.
Without the scanning of email done by google, everyone would have to pay for their email services.
You may or may not like the trade off, but apparently MANY people would prefer to have a free email service that provides advertising over a paid for email service that does not.
> Without the scanning of email done by google, everyone would have to pay for their email services.
On reflection I think that would be a good thing.
At present > 95% of Google's revenue comes from advertising. Thousands of staff are involved in designing and implementing 'improved' advertising systems. Millions of hours are consumed by this every year.
If Google was forced to transition to a subscription service for Gmail it might force a general shift in their revenue model. I contend all that brain power could be redeployed to doing amazing things, rather than refining AdWords .
On reflection I think that would be a good thing.
At present > 95% of Google's revenue comes from advertising. Thousands of staff are involved in designing and implementing 'improved' advertising systems. Millions of hours are consumed by this every year.
If Google was forced to transition to a subscription service for Gmail it might force a general shift in their revenue model. I contend all that brain power could be redeployed to doing amazing things, rather than refining AdWords .
maybe, but whether or not their business model is good for mankind, is really not the topic of discussion here...
If you read the article, you will learn that the issue is that users were not made aware of the tradeoff.
This argument has already been rejected by the judge. Wiretappimg doesn't suddenly become permissible just because it permits an arbitrary business model that happens to pay for the service.
If we say analyzing your communication is ok as long as it makes money for the service provider and the service is free, we open a Pandora's box. Google (and anyone operating an SMTP server) would be able to sell HR reports to recruiters, insurability scores to insurers, predictions of criminality to police departments, infidelity scores to private detectives, etc. Advertising is not a specially protected business model.
If we say analyzing your communication is ok as long as it makes money for the service provider and the service is free, we open a Pandora's box. Google (and anyone operating an SMTP server) would be able to sell HR reports to recruiters, insurability scores to insurers, predictions of criminality to police departments, infidelity scores to private detectives, etc. Advertising is not a specially protected business model.
if we say it is not ok, then it is not possible to have technology that looks at the content of email for delivery purposes.
thus virus checkers, deep packet inspection and firewalls instantly become unavailable.
Most of the messages that pass through Gmail do not originate there.
This seems like an interesting philosophical question -- after all, the sender never agreed to let Google read her emails, right? But I think the resolution is that the receiver did agree to let Google read both emails she sends and emails she receives. Once the receiver "receives" the email, Google has permission to read it regardless of how the sender feels about it (if the sender didn't want them read, she shouldn't have given them to a receiver who would agree to this).
But Google wasn't using that argument apparently; rather they were claiming that the sender gave "implicit" consent -- not sure if this seems obviously true to me....
But Google wasn't using that argument apparently; rather they were claiming that the sender gave "implicit" consent -- not sure if this seems obviously true to me....
IANAL, but wouldn't Google be acting as the recipient's chosen agent to help him communicate via email?
E.g., what if the recipient has a paid human assistant who screens his email, wherever hosted. Further assume the sender knows nothing about said assistant, but would be mortified if she did?
Google is the recipient's assistant and is compensated by being allowed to show the recipient ads based on an automated analysis of his email's content. How is an automated assistant materially different from a human one?
I don't see the problem.
E.g., what if the recipient has a paid human assistant who screens his email, wherever hosted. Further assume the sender knows nothing about said assistant, but would be mortified if she did?
Google is the recipient's assistant and is compensated by being allowed to show the recipient ads based on an automated analysis of his email's content. How is an automated assistant materially different from a human one?
I don't see the problem.
Part of the argument is that the assistant doesn't actually have the consent to use the contents of the email to show the recipient ads.
> But I think the resolution is that the receiver did agree to let Google read both emails.
“Google’s alleged interceptions are neither instrumental to the provision of email services, nor are they an incidental effect of providing these services. The Court therefore finds that Plaintiffs have plausibly alleged that the interceptions fall outside Google’s ordinary course of business...”
“Google’s alleged interceptions are neither instrumental to the provision of email services, nor are they an incidental effect of providing these services. The Court therefore finds that Plaintiffs have plausibly alleged that the interceptions fall outside Google’s ordinary course of business...”
The judge has rejected the argument that the receiver has given permission in general even for their own messages to be intercepted.
Hmm, seems like Google is being burned by their recent "unified" policy and wanting to put everything under a single banner --- their gmail TOS just seems to redirect to the general one. That has a section about "content you submit", but that doesn't seem to apply to email (you don't "submit" your email, do you? If it does apply to email, then it says Google has a license to publish and publicly distribute your email). The Privacy Policy has a section about "Information We Collect", but again email doesn't seem to be covered (nor docs for that matter).
https://mail.google.com/mail/help/intl/en/terms_of_use.html
https://mail.google.com/mail/help/intl/en/terms_of_use.html
The fact that it is "wiretapping laws" that are relevant seems a little odd, along with the idea of Google "intercepting" emails. As far as "intercepting" goes, is there really a line between "store in a database and display on screen when a user requests it" and "analyse (without human interaction) the contents to show adverts related to it"? Both are just a computer reading and writing the content of the email.
Not to mention that most gmail users would probably be a little upset if gmail search stopped working because google was no longer 'intercepting' their emails to index the contents.
Consider how it would be if the NSA passed our email through a system that uses machine learning to generate a list of suspects, but no human analyst read the body text of any message.
Somehow I don't think we'd say that they haven't intercepted the email.
Somehow I don't think we'd say that they haven't intercepted the email.
Of course not. And they are doubtless doing something like that, because human analysts could not possibly keep up. The idea is to build a huge haystack, then go searching for needles in it, using as much automation as possible.
And, like any Gmail user, you did agree to their TOS? Well? Didn't you?
And, like any Gmail user, you did agree to their TOS? Well? Didn't you?
Where does the TOS mention indexing email to build an ad profile?
I'm not a gmail user, so no, I didn't agree to their TOS, and I don't know which of my emails are intercepted by google because I don't know who redirects their email there.
Also, the judge has already decided that even Gmail users are generally unlikely to understand that their emails are being intercepted for Google's business purposes.
Also, the judge has already decided that even Gmail users are generally unlikely to understand that their emails are being intercepted for Google's business purposes.
Have you been following the Snowden case? That is exactly what the NSA is claiming.
Apparently the NSA should get into the ad serving business to fund themselves because they are the only ones legally authorized by congress and the president to read and store everyone's content.
Well decided. Gmail is very deceptive about how advertising works, which juxtaposes against the claims in court about how wonderful it is. If scanning is so wonderful, don't try to to conceal it from users.
Let's get the NSA before this judge next.
Let's get the NSA before this judge next.
I hope the judge in this case realises that Google necessarily has to receive, store, and parse all the emails sent through it in order to function as an email service. I'm not clear on what exactly the article means by "scan" in this case, but a mail service simply isn't a mail service if it doesn't examine and process the contents of emails.
Whether or not Google should be allowed to perform additional processing of the emails in order to choose appropriate advertising is a separate issue. I'm concerned that a lot of articles are missing this critical distinction. The focus of the debate needs to be whether they can deliver advertising which is based wholly or partially on the content of your emails; they fundamentally have to (electronically) read your emails in order to deliver them to recipients.
Whether or not Google should be allowed to perform additional processing of the emails in order to choose appropriate advertising is a separate issue. I'm concerned that a lot of articles are missing this critical distinction. The focus of the debate needs to be whether they can deliver advertising which is based wholly or partially on the content of your emails; they fundamentally have to (electronically) read your emails in order to deliver them to recipients.
The phone company obviously has a right to transmit your calls, that doesn't give them carte blanche to listen in.
Can you define "listen in"?
There is software and hardware involved in encoding/decoding the analogue signal, and compressing it for transmission across a digital network. That involves automated processing, without which the system can't function.
I'm very much opposed to surveillance and other forms of privacy invasion, but I think the discussion needs to be based on a clear understanding of the nature of the processing involved, and the debate to be around which forms of automatic processing fall into the "acceptable" and "unacceptable" category.
Examples of the latter, in my view, would include storing a copy of your content for longer than necessary to transmit the call, doing speech-to-text analysis and using the extracted words to build up a profile on the caller/callee, and making the recorded information available to government agencies for surveillance purposes or corporate entities for advertising purposes.
"Listening in" is an insufficiently-defined term, which doesn't provide enough information for us to have a proper debate about exactly what's going on.
There is software and hardware involved in encoding/decoding the analogue signal, and compressing it for transmission across a digital network. That involves automated processing, without which the system can't function.
I'm very much opposed to surveillance and other forms of privacy invasion, but I think the discussion needs to be based on a clear understanding of the nature of the processing involved, and the debate to be around which forms of automatic processing fall into the "acceptable" and "unacceptable" category.
Examples of the latter, in my view, would include storing a copy of your content for longer than necessary to transmit the call, doing speech-to-text analysis and using the extracted words to build up a profile on the caller/callee, and making the recorded information available to government agencies for surveillance purposes or corporate entities for advertising purposes.
"Listening in" is an insufficiently-defined term, which doesn't provide enough information for us to have a proper debate about exactly what's going on.
Right, that's why I said "carte blanche". There are limits, not a simple 1-bit binary distinction.
Why one of these things constitutes an "intercept" and not the others don't is ridiculous- whether the action is in the "normal order of business". The definition of intercept as the "acquisition of the contents of any wire, electronic, or oral communication" simply can't apply to just one of these things.
By the Plaintiffs' arguments, any system on the internet that forwards an SMTP packet is an unlawful intercept, because it has to acquire the contents to copy them from one channel to another.
All of the decisions on this seem to be based on the scenario where an intercept involves a person listening to a phone call. I would submit, that if it is just code reading the email that was intentionally sent to the system the code is running on, it is not really being intercepted.