EPIC: Google may have broken wiretap law
 
Posted: Wednesday, February 17 2010 at 06:00 am CT by Bob Sullivan

If Google wanted to create a quick buzz around its new social networking service, it's certainly accomplished that. Last week, when the Web giant automatically signed up millions of Gmail users for its new Buzz social network, much of the Internet was sent into a privacy tizzy.

Google announced serious modifications to the service later in the week, but that wasnt enough for the Electronic Privacy Information Center (EPIC). On Tuesday, it filed a formal complaint with the Federal Trade Commission, asking the regulator to order more changes. EPIC also accused Google of violating federal consumer protection law and suggested the firm may have broken wiretap laws, too.

While the details of the Buzz privacy dispute can seem esoteric, the main thrust of EPIC's complaint is simple: Google should never have pushed all 37 million U.S. Gmail users into a social networking service without asking, said EPIC Executive Director Marc Rotenberg.

"E-mail is one area on the Internet where we have a well-understood expectation of privacy," Rotenberg said. "E-mail is for private messages. You sign up for social networking to communicate publicly with people, Google tried to turn e-mail into social networking, and that's where they ran into trouble."

The complaint lays out a series of alleged Google missteps that EPIC says constitute unfair or deceptive trade practices that violate the Federal Trade Commission Act. For starters, it says, all users who checked their Gmail account last week were suddenly signed up for Buzz. While Google offered users a chance to "check out" the service, it didn't give them the option to avoid it.

"Regardless of whether a user clicked the button labeled 'Sweet! Check out Buzz' or Nah, go to my inbox, Google Buzz was activated," the complaint says.

Gmail account holders who then began using Buzz found their first public posting was essentially a list of their most frequent e-mail contacts. Buzz decided for itself who users e-mailed most often, then put those users on a list as "followers" and made that list public. Quickly, nightmare hypothetical scenarios were published -- workers who had recently e-mailed about job interviews had their job hunt exposed, for example. Cheating lovers or spouses were outed.

"Gmail contact lists routinely include deeply personal information, including the names and email addresses of estranged spouses, current lovers, attorneys and doctors," the EPIC complaint said. "Users were not explicitly warned that their lists would be automatically visible to the public. ... Anyone looking at a newly activated Buzz users following list would know that the list indicated which people that user communicated with most often."

In addition to causing potential embarrassment -- or worse Google may have broken the law by disclosing e-mail contacts, EPIC said.

"Improper disclosure of even a limited amount of subscriber information by an e-mail service provider can be a violation of both state and federal law," it said. "An attempt by an e-mail service provider to attempt to convert the personal information of all of its customers into a separate service raises far-reaching concerns."

Google has already gone through two rounds of revisions with its service, and Buzz now tells new users that frequent e-mail partners will be followers unless the user prevents that. New users now see a list of potential followers -- checked by default -- when they sign up for the service.

New_Buzz_startup

Google's revised start-up doesn't go far enough, EPIC says

But on Tuesday, Rotenberg said that Google still hadn't gone far enough to address privacy concerns. Buzz still ropes in Gmail users and their e-mail contacts by default, which can lead to unintended disclosure of personal information, he says.

Rotenberg said Buzz users should have to actively opt in before Buzz is activated, rather than opt out.

"It's always about the defaults," he said.

EPIC has called on the FTC to force Google to:

*make Buzz a fully opt-in service.
* force Google to cease using Gmail users private address book contacts to compile social networking lists.
*give Buzz users more control over their information.

For a company that has already dealt with plenty of privacy related issues, Google's misreading of public reaction to Buzz is a surprise, said Larry Ponemon, a privacy researcher who runs The Ponemon Institute.

"It is astonishing to me that a decision was made to release a product that the average person would see as a potential privacy snafu," he said. "Things like this seem to happen because people making decisions just aren't thinking about privacy. Sometimes companies don't when they are about to release something they think is really cool."

HerbboxPonemon did say that he was impressed with Google's quick response to the controversy, taking only a few days to make changes to the service.

"They did take it seriously, you could tell they had all hands on deck," he said.

Rotenberg said Google was more worried about stiff competition in the social media world than privacy.

Google tried to take advantage of its market position" by dragging all Gmail users into Buzz overnight, he said, thereby giving the service a running start in the uphill battle to catch Facebook and Twitter in the social networking space.

That's why he wants the FTC to be more proactively involved in privacy policy.

"The FTC has had a hands-off policy, leading to some bad business practices," he said.

Google said in an e-mail statement to msnbc.com that it was working hard to make adjustments to its service based on user feedback, and will keep "user transparency and control top of mind.

We also welcome dialogue with EPIC and appreciate hearing directly from them about their concerns," the statement continued. "Our door is always open to organizations with suggestions about our products and services.

This whole Microsoft vs. the Forces of Good debate never ceases to amaze me.

Know some history, integrate the information, and see the big picture.

I was at Microsoft early on. At that time, Microsoft played second fiddle to Lotus, Wordperfect and Novell, and there was a nascent war brewing with IBM over next generation operating systems (NT vs OS/2).

People don't realize that Microsoft has as much and more cred as any company in this industry, and it's run and staffed by good people. It is not an Evil Empire.

In 1988, I had a poster on my (Ivy League)college dorm wall from Microsoft (before they hit a billion in sales) that was all about "hard core software." Microsoft built itself by attracting the best talent to the Seattle area to build personal computer operating systems and applications. Apple was really the only competitor. Otherwise, you were going to end up at IBM, Sun, DEC, Apple, Oracle or Andersen consulting (et al). If you really wanted to Change the World by creating Great Software for People at that time, your only real choices were Apple or Microsoft.

Important thing to realize: at this time, there were probably less than 1000 people in the world who were smart enough to write an OS. Those people were divided between Microsoft, Apple, Sun, DEC and IBM. The company with the most talent was going to win.

Fast forward. Apple hires John Sculley from Pepsi. Sculley's claim to fame will be that he dumbed down perfectly good fast food chains like Pizza Hut and Taco Bell in an effort to market his crappy second-rate Cola.

Sculley ousted Jobs, and spent a decade beating off, trying to market computers as if they were sugar water, and pissing away Apple's commanding lead in the personal computer OS space.

Steve Jobs started Next, which would have trounced everyone if he could understand the difference between a hardware and software company, which he still can't. (I shouldn't say that. He has a hard-on for great hardware, and more power to him. But it's really hobbled Apple's potential as a software company).

Jobs took pretty much all of Apple's top-tier software talent with him to Next.

Jean-Louis Gassee took pretty much all of Apple's 2nd tier talent with him to Be.

(I know I'm generalizing here, and I'm really, really sorry if I offend individuals who lived through it. I hope you can see the fundamental truths I'm trying to express.)

This basically left Apple's QA staff to build the operating systems. An outside observer could see it happening. It was like the original Mac ROMs built by Wozniak were the magic crystals that none of the apprentice wizards dared touch. Sculley turned a beautiful thing into a decade(++)-long clu5t3r f**k by driving talent out of the company.

At some point during those times, Apple employees learned on NPR on the way to work that Apple and IBM had formed an alliance to build a next generation operating system (Bing: Taligent). My friend in Microsoft HR that day said "our fax machine runneth over." (With Apple resumes). That day marked the ignominious end of Apple's hapless struggle to deliver quality software, which sinking ship only righted upon Jobs' triumphant return.

Meanwhile in the applications space... Lotus 123 owns spreadsheets. WordPerfect owns word processing. Novell owns networking. Note that Novell and WordPerfect are both from Utah, represented by Senator Orin Hatch. IBM owns the overall PC space, though they've made a critical error outsourcing their OS to Microsoft with no exclusivity. They failed to anticipate "clean room" BIOS implementations. Much to their dismay.

Microsoft releases Excel for Windows 1.1, and also Mac. Excel on Mac propels Apple's adoption in the business world. One can actually make a fairly reasonable argument that Apple would not exist without Microsoft Excel / Office applications for Mac.

Microsoft Word is second to WordPerfect. Excel is second to Lotus 123. Peer networking for PCs is expensive and in its infancy, and Novell is the leader.

Things begin to change with the release of Windows 3.1, which has pretty good peer networking, and runs Excel and Word.

Meanwhile, strong public / private key encryption is becoming feasible on personal computers. The US and other governments regard this technology as a "munition" with national security implications since it hampers the ability of intelligence agencies to intercept communications. They still do, though they seem to have given up enforcement. (Bing: RSA munitions t-shirt).

The Clinton Adminstration (who I know lots of modern Firefox / Open Source types probably idolize, but whatever) is all about "key escrow" and other schemes which would enable the government to have a back door into encrypted systems. (Bing: Clipper Chip; CDA) Clinton was not your friend.

The spooks approached Microsoft during this time with the idea that Windows should implement features to make it easy for the government to come in through the back door. They were (and still are; see recent news regarding standard fees for government agencies seeking "private" information) accustomed to communications providers playing ball.

You know, For the Children. Because it Takes a Village. In a Village, everybody knows everybody's business. Right? Bill and Hillary are your friends and neighbors. You've nothing to fear. If you need that much privacy, maybe you should not be doing whatever you're doing.

Microsoft, being a bunch of libertarian capitalists with an eye for international sales, basically told them to go to hell. How do you sell your new OS into international markets when the US government has a back door key? Best not to go there.

The government has a problem now. How do you bring a company in Seattle, which seems to be staffed and run by a bunch of surprisingly wealthy, libertarian, dope-smoking geeks (real geeks, not California hippie posers), to heel?

Fast forward. Excel is trouncing 123. Word is trouncing WordPerfect (Utah). Windows for Workgroups is trouncing Novell (Utah). IBM spends billions on a crash program to build and ship OS/2 Warp. Nobody can install the damned thing. Denver's Stapleton airport baggage handling system is the poster child for Warp, and it pretty much crashes and burns. Epic Fail. NT wins.

Orin Hatch, Senator from Utah, sics the FTC on Microsoft for antitrust. After much deliberation FTC comes down on the side of Microsoft. Bill Clinton wins the presidency. There's a bit of hoopla about his support amongst young Bay Area tech entrepreners (prominent is Jim Barksdale of Netscape, the progenitor of y'alls beloved Mozilla / Firefox). Clinton appoints Janet Reno. One of her first moves it to re-open the Microsoft antitrust investigation under the auspices of the Justice Department. This is unprecedented. Orin Hatch (R, Utah) is right there cheering her on.

Payback for political support? You be the judge.

The Clinton Administration spent most of the 90's trying to break Microsoft into an applications and (more easily controllable) operating systems company. Maybe I'm a wild-eyed, tin-hat-wearing conpiracy theorist, but I suspect that back doors, encryption, and political payola had more than a little to do with that.

I really believe there was a concerted effort to paint Microsoft as the "Evil Empire" at this time, and it has stuck amongst people who regard themselves as intelligentsia, and it has no merit. If you think Microsoft is the Evil Empire, you are the dupe of a much larger propaganda campaign aimed squarely at your privacy, and driven by the fact that Microsoft is one of the only companies in this industry who has ever given two shakes for your privacy.

Fast Forward to present day. Eric Schmidt goes on record stating that maybe your personal privacy ain't that important, and maybe if you don't have anything to hide you have nothing to worry about. Everybody who cares about the relationship between government and citizen should understand that statements like this strike at the very core of liberty.

Eric Schmidt, CEO of Google has been around the block a couple of times:

From April 1997 to July 2001, Schmidt served as the Chief Executive Officer and Chairman of the Board of Novell Inc

You think he doesn't know the score? You think he would roll over before he'd be on the receiving end of a government inquisition? I think so.

Microsoft has been there and survived intact. They understand a few things. They know the parameters, and they also know the value of privacy to the consumer.

Can you trust Microsoft? Can you trust Google?

I know two things.

Microsoft is in business to make money, and they understand that they must provide a good product and win my trust. I can relate to that, and I know where I stand.

I also know not to turn my back on anyone who takes extra time to tell me about how good they are. As in, "don't be evil." If you feel the need to say that to me, I'm going to watch you like a hawk.

Also, Bing is easier to type. Which will save many millions of person-hours over the long haul, and probably save the planet from global warming.
Posted by: Anonymous | December 11, 2009 4:55 AM

Interesting you should say that. I found the following posting  online by an Anonymous who claims to have been a former employee of Microsoft. He gives an intriguing defense of Microsoft's business practices. Obviously, I can't verify anything this guy says, since he's anonymous and merely posting a comment on a Mozilla-related blog.