Privacy Group to FTC: Investigate, Block Google Cloud Services
Privacy rights group EPIC (Electronic Privacy Information Center) has officially asked the FTC (Federal Trade Commission) to investigate the cloud computing services that Google has to offer, because the level of security and privacy offered by said services is not satisfactory. The roots of this request are to be found in a recent privacy breach that affected Google Docs users – their online documents were shared without their consent (details here).
“EPIC has formally asked the Federal Trade Commission to open an investigation into Google's Cloud Computing Services -- including Gmail, Google Docs, and Picasa -- to determine "the adequacy of the privacy and security safeguards." The petition follows the recent report of a breach of Google Docs. EPIC cited the growing dependence of American consumers, businesses, and federal agencies on cloud computing services, and urged the Commission to take "such measures as are necessary" to ensure the safety and security of information submitted to Google,” said the privacy rights watchdog on their web page.
At the time, the Mountain View search engine giant said that only a small subset of users were affected by the privacy breach (about 0.05% according to Google) and I pointed out that no specific number has been provided. The percentage may be a low one, but it all depends on how large the user base is. Come to think of it now, it doesn’t really matter how many people were affected – be it one, one dozen, or even one million. The number is irrelevant; what is relevant is that a breach occurred, exposing potentially sensitive data, and such a thing must not happen again in the future.
EPIC again: “Google's terms of service explicitly disavow any warranty or any liability for harm that might result from Google's negligence, recklessness, mal intent, or even purposeful disregard of existing legal obligations to protect the privacy and security of user data. Google's inadequate security practices, and the resultant Google Docs data breach, caused substantial injury to consumers, without any countervailing benefits.”
“What we did was we looked carefully at Google's statements and they sound very favorable, then you read their terms of service," EPIC President Marc Rotenberg explains in an easier to understand manner. "On one hand they are telling everyone cloud computing works great, but on the other hand in the terms of service they say if you run into trouble, you are on your own."
EPIC now wants the FTC to investigate Google’s cloud computing services. For the duration of the inquiry, Google is not to be allowed to provide access to any of the aforementioned services (that would be Gmail, Google Docs, Google Desktop, Picasa Web Albums and Google Calendar). According to Rotenberg, the FTC is very much interested in the case and they are currently considering the launch of an investigation. EPIC also wants the FTC to instruct Google that if any privacy or data loss related incidents happen in the future, then the company must disclose them.
What would make EPIC happy is if Google were to encrypt all the user data that is stored online (in the cloud). This would be a sign that Google respects the privacy of the user and provides him with “the ability to fully control and customize their online experience. Also, EPIC would like Google to donate $5 million to a public fund meant to support privacy enhancing technology research.
Google’s response to the issue has been provided by company spokesperson, Andrew Kovacs: “We have received a copy of the complaint but have not yet reviewed it in detail. Many providers of cloud-computing services, including Google, have extensive policies, procedures and technologies in place to ensure the highest levels of data protection. Indeed, cloud computing can be more secure than storing information on your own hard drive. We are highly aware of how important our users' data is to them and take our responsibility very seriously.”
If you would like to take a look at the document filed by EPIC with the FTC, you can do so here (PDF warning).
“EPIC has formally asked the Federal Trade Commission to open an investigation into Google's Cloud Computing Services -- including Gmail, Google Docs, and Picasa -- to determine "the adequacy of the privacy and security safeguards." The petition follows the recent report of a breach of Google Docs. EPIC cited the growing dependence of American consumers, businesses, and federal agencies on cloud computing services, and urged the Commission to take "such measures as are necessary" to ensure the safety and security of information submitted to Google,” said the privacy rights watchdog on their web page.
At the time, the Mountain View search engine giant said that only a small subset of users were affected by the privacy breach (about 0.05% according to Google) and I pointed out that no specific number has been provided. The percentage may be a low one, but it all depends on how large the user base is. Come to think of it now, it doesn’t really matter how many people were affected – be it one, one dozen, or even one million. The number is irrelevant; what is relevant is that a breach occurred, exposing potentially sensitive data, and such a thing must not happen again in the future.
EPIC again: “Google's terms of service explicitly disavow any warranty or any liability for harm that might result from Google's negligence, recklessness, mal intent, or even purposeful disregard of existing legal obligations to protect the privacy and security of user data. Google's inadequate security practices, and the resultant Google Docs data breach, caused substantial injury to consumers, without any countervailing benefits.”
“What we did was we looked carefully at Google's statements and they sound very favorable, then you read their terms of service," EPIC President Marc Rotenberg explains in an easier to understand manner. "On one hand they are telling everyone cloud computing works great, but on the other hand in the terms of service they say if you run into trouble, you are on your own."
EPIC now wants the FTC to investigate Google’s cloud computing services. For the duration of the inquiry, Google is not to be allowed to provide access to any of the aforementioned services (that would be Gmail, Google Docs, Google Desktop, Picasa Web Albums and Google Calendar). According to Rotenberg, the FTC is very much interested in the case and they are currently considering the launch of an investigation. EPIC also wants the FTC to instruct Google that if any privacy or data loss related incidents happen in the future, then the company must disclose them.
What would make EPIC happy is if Google were to encrypt all the user data that is stored online (in the cloud). This would be a sign that Google respects the privacy of the user and provides him with “the ability to fully control and customize their online experience. Also, EPIC would like Google to donate $5 million to a public fund meant to support privacy enhancing technology research.
Google’s response to the issue has been provided by company spokesperson, Andrew Kovacs: “We have received a copy of the complaint but have not yet reviewed it in detail. Many providers of cloud-computing services, including Google, have extensive policies, procedures and technologies in place to ensure the highest levels of data protection. Indeed, cloud computing can be more secure than storing information on your own hard drive. We are highly aware of how important our users' data is to them and take our responsibility very seriously.”
If you would like to take a look at the document filed by EPIC with the FTC, you can do so here (PDF warning).
