Google’s EPIC fail: privacy group wants cloud computing safeguards

A privacy group has requested the US Federal Trade Commission shut down Google mail, docs, Picasa and other services because they don’t adequately safeguard the confidential information that they obtain. The stunning request was made by the Electronic Privacy Information Center (EPIC) and outlines the risks of Google’s cloud computing services. The request is far from frivolous and could have profound consequences for the industry in general, and Google in particular.

EPIC, who describe themselves as “a public interest research organization”, have requested the FTC open an investigation to determine the adequacy of the privacy and security safeguards. They also want them to assess Google’s claims about the service. In a letter to the government regulatory body, EPIC suggest they “enjoin
Google from offering such services until safeguards are verifiably established.”

According to Wikipedia, Cloud computing is where dynamically scalable and often virtualised resources are provided as a service over the Internet. As that rather dense definition shows this is not a simple concept to grasp. The word “cloud” acts as a diagrammatic metaphor for a complex computer network. Thankfully then, users of the services don’t need to have knowledge of or control over the technology infrastructure "in the cloud" that supports them. The problem from a privacy perspective is that the data is held by third party servers, which is managed by private firms who provide remote access.

Google currently provides an extensive array of Cloud Computing Services. These include unlimited free email (“Gmail”), online document storage and editing ("Google Docs"), an integrated desktop and internet search ("Google Desktop"), an online photo storage ("Picasa Web Albums") and a scheduling program (“Google Calendar”). And the number of people who use these services is growing. As of September 2008, 26 million people use Gmail.

While Google are quick to advertise the security safety of their products, EPIC say there are several known flaws with their cloud computing service. They noted a bug found in 2005 where Internet Explorer exposed web surfers' hard-drive data to malicious web sites. And as recently as last week, the Wall Street Journal disclosed Google had shared “a very small number” (0.05 per cent) of online documents with users who weren’t authorised to see them. The bug hit users who changed their sharing settings on multiple presentations and documents at once, causing Google to make those documents available to others whom the owner had shared a document before. The Journal says the bug shows systems for managing file access permissions can break down, causing documents to end up in the wrong hands.

IT Security expert Greg Conti says Google is a particularly vulnerable target because of the amount of data it has. However Conti qualifies his remarks by saying the problem is endemic. ”It almost impossible for you, your employer, and online companies to provide impervious protection against attack”, he says “therefore, your data is at risk.”

Therefore EPIC backs up its case by pointing to Google’s false advertising. It quotes the Federal Trade Commission Act which regulates unfair and deceptive trade practices. The act allows for three factors that support a finding of unfairness. The practice must cause substantial injury, not be outweighed by countervailing benefits and the harm is not reasonably avoidable. EPIC says Google’s inadequate security policy fails all three tests. They say Google's advertising is deception likely to mislead customers. EPIC also quote several test cases which it believes give precedence to act against Google.

EPIC says the popularity of Cloud Computing Services means that data breaches pose a heightened risk of identity theft. It says the FTC should hold purveyors accountable, “particularly when service providers make repeated, unequivocal promises to consumers regarding information security.” They want FCC to open an investigation. They also want Google to revise its terms of service, make their information security policies more transparent, take Cloud Computing off the market until safeguards are established, and contribute $5 million to support research on privacy enhancing technologies (I presume it's five million as the document talks about a strange number called “$5,000,0000”). Google has not reviewed the complaint in detail but says “it has policies in place to ensure data is protected”.

Private war: the media lines up against the lawyers over Privacy Laws

According to the Australian Law Reform Commission (ALRC), eighty percent of what they recommend becomes in time, Australian law. That makes them, by any reckoning, a powerful organisation and one that needs to be treated seriously when they come up new recommendations. As noted by Media Watch last night, they are currently engaged in a curious battle with a media coalition over the digital power that goes by the name of Privacy. Last week, the ARLC published its final 2,700 page report (pdf) on its exhaustive review of privacy laws in Australia. On their record, it is likely that over 2,000 of its pages will be actioned. The Government has promised to respond in the next “twelve to eighteen months”.

So what is changing? Australia already has some privacy laws. And privacy is well enough understand in the analogue sense even if the boundaries are not carefully patrolled. But it is in its digital meaning, where the real battle for legality lies. The debate is caught up in other competing concepts of freedom of information, defamation and copyright. Media organisations are on the warpath even though one seasoned media observer, Mark Day, says “the report proposes merely would make legally unacceptable what the great majority of the media today considers is unacceptable.”

The proposed new laws have seven major components. They are 1) obligations to report breaches 2) uniform principles across government and business 3) requirements for cross-border data flows 4) consistency across the states and territories to avoid forum shopping 5) remove exemptions 6) introduce the tort of privacy and 7) increase penalties. The media has couched their arguments against the sixth element in an attempt to avoid the seventh.

Privacy is already a common law offence but ARLC’s sixth element introduces a statutory cause of action for serious invasion of privacy. To succeed in a prosecution on these grounds, there would need to be a reasonable expectation of privacy and the act must be deemed highly offensive “to a reasonable person”. The plaintiff would also need to show proof of invasion, and perhaps most difficult to determine, must also show the individual’s privacy trumps the other matters of public interest.

The media claims the tort will hinder the free flow of Information. Richard Ackland worries how we will catch “scoundrels”. As in the existing tort of defamation, the offence will have a “chilling effect” on reporting the doings of important and famous people as only they will have the wherewithal to take their grievances to court. This claim is spurious as the ability is already there in common law. Ackland should rest easily knowing that just as few “scoundrels” will be caught with the new laws as that are currently exposed with the existing supposed more favourable laws to the media.

The fact is the mainstream Australian media do not deserve special treatment. Treatment of celebrities as news has seriously distorted news judgement in this country to a point that is far from hallowed notions of freedom of speech. Trivial items are constantly aired when journalists become besotted by the subject and no longer ask themselves whether the event they are covering has any intrinsic merit. In any case, many public figures actively court a media profile which can make for difficult ethical questions as what parts of their lives, and their families lives, can de deemed public property. While the test should be whether the private matter under scrutiny adversely affects the person’s ability to do the job the public has entrusted to them, many in the media believe they have a right to publish whatever they want about public figures.

Journalists prefer to see a free flow of information on the argument that it helps society to function more efficiently and because it enhances their ability to perform the surveillance function of the fourth estate. But their own code of ethics says they must also respect private grief and personal privacy. Crucially that point in the code goes on to say “journalists have the right to resist compulsion to intrude.” This right is aimed at the owners and managers of media who order their people to intrude “so they can get the story”.

There are three sometimes conflicting obligations when considering privacy. They are getting the news out, showing compassion, and educating society. The first is the obligation they owe their employer, the second is the obligation they owe their sources and the third is the function of the fourth estate. But while they may have a legitimate desire to expose unfair, illegal or corrupt use of data, they must also respect the privacy of individuals. They must also be alert to new dangers involved in data matching. Data matching means finding new uses and correlations from the combination of seemingly unrelated data.

Astute journalists may be able to use such digital forms as Computer Assisted Reporting to make remarkably cogent conclusions from diverse data sources. The government’s own media release for the proposed new laws is deliberately aimed at the “information age”. It said the existing Privacy Act has worked well enough to date, but it now needs a makeover “to help us navigate the Information Superhighway”. Report author Professor David Weisbrot, said that although the old federal act is only 20 years old, “it was introduced before the advent of supercomputers, the Internet, mobile phones, digital cameras, e-commerce, sophisticated surveillance devices and social networking websites, all of which challenge our capacity to safeguard our sensitive personal information.”

If the language of “information superhighway” seems curiously dated, it should perhaps be compared to a 1994 report about the problems and the promise of the digital universe. In that year the Grateful Dead’s drummer wrote the most passionate defence yet for the freedom of ideas. But John Perry Barlow also noted how digital technology detached information from the physical plane, where property law has always found definition. But even digital hippie Barlow conceded “serious privacy issues would arise if everyone's computer were packed with digital spies”.

This is not dreamland. New technology has already made invasions of privacy relatively simple. Illicit listening devices, normally the province of real spies have been found outside the Sydney home of Nicole Kidman. This is hardly surprising given the lucrative coin for the minutiae of Ms Kidman’s life. But what is changing is that the ease of digital transfer has made so much private information very portable. How the law deals with Barlow’s digital spies will define the success of the new tort of privacy.