Privacy activist asks FTC to halt Google apps
File photo: EPIC director Marc Rotenberg at Stanford University talking about Google and privacy in 2007.
(Credit: Declan McCullagh/CNET)A privacy advocacy group has asked the Federal Trade Commission to pull the plug on Gmail, Google Docs, Google Calendar, and the company's other Web apps until government-approved "safeguards are verifiably established."
If the FTC grants the request, hundreds of millions of Internet users would be unable to access their e-mail or documents until the agency's formidable collection of lawyers in Washington, D.C., became satisfied with the revised applications. The outage would extend to businesses that pay for access to Google Apps.
The Electronic Privacy Information Center submitted the far-reaching request to the FTC in a letter from its director, Marc Rotenberg, on Tuesday. It argues that a formal legal injunction halting all Google cloud-computing services pending formal government approval is necessary to "adequately safeguard the confidential information" of users.
"If we were talking about a child safety seat that could not be securely attached to a car passenger seat, the commission in that instance would say to the company, 'Look, you've got to fix that problem,'" Rotenberg, a lawyer and adjunct law professor, said in a telephone interview on Tuesday. "Consumers are at risk when that product is in the marketplace. We have a similar view of cloud computing at this point: people are at risk."
EPIC sent the letter a week after a bug in Google Docs exposed a small fraction of word-processing and presentation documents. Google said the problem affected only 0.05 percent of documents stored at the site, that affected Google Docs users had been notified, and it affected only people with whom users had already shared documents.
As an additional punishment, EPIC wants Google to be forced to pay $5 million into a "public fund" that it and like-minded advocacy groups could financially benefit from.
For its part, Google said it was reviewing EPIC's letter and provided CNET with this statement: "Many providers of cloud computing services, including Google, have extensive policies, procedures and technologies in place to ensure the highest levels of data protection. Indeed, cloud computing can be more secure than storing information on your own hard drive. We are highly aware of how important our users' data is to them and take our responsibility very seriously."
Paragraph 57 of EPIC's letter asks the FTC to "enjoin Google from offering cloud computing services until safeguards are verifiably established."
Microsoft and Yahoo declined to comment on Tuesday.
EPIC regularly sends letters to the FTC asking for action against technology companies. It sent one last year targeting Ask.com, which had already discontinued the practice in question. In 2000, the group targeted DoubleClick; it also questioned Microsoft's Passport authentication system, which yielded a settlement in August 2002.
The complaints invoke the FTC's legal authority to file civil lawsuits against "unfair or deceptive acts or practices." In this case, EPIC claims that Google is violating that law because of its "inadequate security practices."
"One of the powers of the FTC is to say if you can't provide a safe product, we can take it from the marketplace," Rotenberg said. He acknowledged having the FTC attempt to pull the plug on Google Apps until privacy fixes were done was a long shot, but said the broader goal was to raise awareness of the privacy and security risks of cloud computing. (EPIC previously claimed Gmail was illegal and attempted to have it shut down.)
Jim Harper, director of information policy studies at the free-market Cato Institute, said that nothing Google has done is unfair or deceptive.
"EPIC is unable to persuade the public of a problem, so it goes to a very willing government agency that has nothing else to do but machinate about these kinds of issues," Harper said. He added, referring to the $5 million fund EPIC wants Google to set up: "This is a new fundraising tool."
CNET's Stephanie Condon contributed to this report
(Disclosure: Declan McCullagh is married to a Google employee.)
Declan McCullagh, CNET News' chief political correspondent, chronicles the intersection of politics and technology. He has covered politics, technology, and Washington, D.C., for more than a decade, which has turned him into an iconoclast and a skeptic of anyone who says, "We oughta have a new federal law against this." E-mail Declan. 
Which is precisely why the FTC would not even consider granting such a request. This is just a publicity stunt by yet another advocacy group seeking attention from the press. It's a non story.
Something is rotten in the state of Denmark.
The request was apparently stimulated by Google's recent bug where a small portion of Docs users accidentally had some documents mistakenly shared with others. In their letter to the FTC, EPIC builds their case by citing other previous security issues with Google in the past. Should the FTC grant EPIC's request, then Gmail, Google Calendar and Google Apps could effectively be shut down pending a review by the FTC to ensure that Google does in fact comply with the safety and privacy policies advertised. The topping on the cake is that EPIC is also seeking a $5 Million payment from Google into a public fund to be used by EPIC and similar privacy watchdog groups.
This is at best, a publicity stunt on the part of EPIC, and at worst, an irresponsible move that seeks ONLY to further EPIC's goals, at the cost of millions of users' inconvenience and loss of business.
Here's the reality of things: Privacy is never 100% guaranteed. Not in your home, your basement, on your computer, nor in the cloud. **** happens, and when it does, you can be sure there will an organization like EPIC ready to capitalize on the situation and find someone to blame, all in order to keep their incompetence afloat.
I'm not against privacy, but there is a reasonable limit to how much one can expect, which is what this all comes down to. Does Google take reasonable precautions in protecting your data? Common sense says "Yes". Google Apps employs 256 bit encryption for SSL connections (your bank probably uses 64 or 128 bit). The reports of bugs in their systems are usually blown out of proportion (then later, the inflated reports are referenced as 'fact') - for example, the two prior cases of Google vulnerabilities cited in EPIC's letter were not 'bugs' in the sense that your coworkers might accidentally get into your account, but bugs in the sense that hackers could find a way into the system. With the growth of new tools at anyone's disposal, there can't be a reasonable expectation that a system will ALWAYS be hacker proof.
At the end of the day, we have to ask ourselves - what's more secure? A Google server, or your laptop? A world class hacker might get to your data in Google's servers (technically, this has yet to happen), but your laptop, should you accidentally leave it on the subway will reveal its contents to an average user. Perhaps, EPIC should ask the FTC to halt all laptop manufacturers until they can ensure better privacy by legislating that all hard drives be encrypted.
I am not a Google employee, nor am I affiliated with Google in any manner.
I am a simple user who can't stand self serving 'public advocacy groups' who could care less of the repercussions of their actions (Shutting down Google Apps would bring thousands of a businesses around the world to a halt, but this isn't their problem apparently)
The request was apparently stimulated by Google's recent bug where a small portion of Docs users accidentally had some documents mistakenly shared with others. In their letter to the FTC, EPIC builds their case by citing other previous security issues with Google in the past. Should the FTC grant EPIC's request, then Gmail, Google Calendar and Google Apps could effectively be shut down pending a review by the FTC to ensure that Google does in fact comply with the safety and privacy policies advertised. The topping on the cake is that EPIC is also seeking a $5 Million payment from Google into a public fund to be used by EPIC and similar privacy watchdog groups.
This is at best, a publicity stunt on the part of EPIC, and at worst, an irresponsible move that seeks ONLY to further EPIC's goals, at the cost of millions of users' inconvenience and loss of business.
Here's the reality of things: Privacy is never 100% guaranteed. Not in your home, your basement, on your computer, nor in the cloud. **** happens, and when it does, you can be sure there will an organization like EPIC ready to capitalize on the situation and find someone to blame, all in order to keep their incompetence afloat.
I'm not against privacy, but there is a reasonable limit to how much one can expect, which is what this all comes down to. Does Google take reasonable precautions in protecting your data? Common sense says "Yes". Google Apps employs 256 bit encryption for SSL connections (your bank probably uses 64 or 128 bit). The reports of bugs in their systems are usually blown out of proportion (then later, the inflated reports are referenced as 'fact') - for example, the two prior cases of Google vulnerabilities cited in EPIC's letter were not 'bugs' in the sense that your coworkers might accidentally get into your account, but bugs in the sense that hackers could find a way into the system. With the growth of new tools at anyone's disposal, there can't be a reasonable expectation that a system will ALWAYS be hacker proof.
At the end of the day, we have to ask ourselves - what's more secure? A Google server, or your laptop? A world class hacker might get to your data in Google's servers (technically, this has yet to happen), but your laptop, should you accidentally leave it on the subway will reveal its contents to an average user. Perhaps, EPIC should ask the FTC to halt all laptop manufacturers until they can ensure better privacy by legislating that all hard drives be encrypted.
I am not a Google employee, nor am I affiliated with Google in any manner.
I am a simple user who can't stand self serving 'public advocacy groups' who could care less of the repercussions of their actions (Shutting down Google Apps would bring thousands of a businesses around the world to a halt, but this isn't their problem apparently)
By the way, isn't there a law against filling frivolous lawsuits, like these?
Google, don't take the easy way out and pay the greedy b#&turds or they will just go after the next poor sucker.
I hate these kinds of low-life companys that produce nothing but lawsuits and loss.
Say no more :}
http://www.atelier-us.com/e-business-and-it/article/petition-served-to-ftc-to-investigate-google-cloud-services
- by digitalmoneylife October 4, 2009 10:57 AM PDT
- Talking about the wrong stuff. Why Google? There zillions other stuff that keep our privacy info. shut down those which aren't as useful as Gmail or G. app. What is going on with this world?
- Like this Reply to this comment
-
(22 Comments)