Evil let loose after Google breaches email privacy
The launch of a networking site has backfired badly
LAST TUESDAY Eva Hibnick, a Harvard law student, opened her Gmail account and saw an offer for Buzz, a new service from Gmail’s owner, Google.
She wasn’t interested. “I just clicked ‘No, go to my inbox’,” she said. Within hours she and millions of others realised that sometimes no means yes.
Now Hibnick is taking Google to court, and the search giant is left fighting a rearguard action in the latest skirmish over privacy on the internet.
Hibnick, 24, is the lead plaintiff in a class-action lawsuit filed against Google over the launch of Buzz, a social networking service that lets people bring their online connections together to share status updates, videos and photos. With 146m users, the sheer size of Gmail instantly catapulted Buzz into the top ranks of social networking sites alongside Facebook and Twitter.
As Gmail users were quick to point out, though, they chose to join those networks, while Buzz’s new army was conscripted. The service raided a Gmail user’s contacts book to set up the social network.
The people we contact most frequently are not necessarily those with whom we have the closest relationship. Within hours of the Buzz launch, angry tales were being told of people’s contact details and other information being passed on to the “psychotic” and “abusive ex-husbands”.
Actress Felicia Day, Vi in Buffy the Vampire Slayer, found herself deluged with messages from strangers after posting one message on Buzz. “Buzz things turn up as a message in your inbox? Disabling now. Heart attack,” she wrote. Before Google changed Buzz, some fans would also have been able to see who Day emailed most frequently.
Hibnick and her lawyer claim that information she had a right to consider private had been shared among her Gmail contacts. “I signed up for a private email account, not for a social networking site. They can’t just opt you in,” she said.
“Basically all my email contacts were accessible. Everyone is so shocked that Google would do this.”
Fellow Harvard law student Benjamin Osborn, who is assisting on the case, said the initial problem was that it was not clear what information was being shared and with whom.
Hibnick’s lawyer said Google could face statutory damages of $1,000 per occurrence — a potentially huge sum given Gmail’s size. But he added that the real aim was to force Google to put better checks and balances in place over privacy.
The Electronic Privacy Information Center, the watchdog based in Washington DC, has now asked the Federal Trade Commission to investigate whether consumers were harmed and has asked the commission to demand that Google ask Gmail users to sign up for Buzz instead of enrolling them automatically.
Google moved swiftly to contain the crisis last week, dropping the automatic sign-up and offering clearer instructions on how to opt out of the service and keep messages private.
“We made some mistakes and we accept that,” said Peter Barron, Google’s head of communications. “But if you look at the way we responded, I hope people will see that we reacted quickly to those criticisms and made significant improvements.
“These days everyone leaves a data trail, whether it’s from shopping online, using your mobile phone or doing a search. When you use a credit card you are exposing far more about yourself than in an online search but people generally trust credit-card companies not to misuse their data. At Google, users’ trust is all we have. We take privacy very seriously and build privacy features into all our products based on the principles of transparency, choice and user control.
“Those features were and are present in Buzz, but we accept they could have been clearer. Buzz is not about making private information public unless you choose to.”
Don Cruse, a Houston-based lawyer, said that what disturbed him most about Buzz was that it was automatic. In a blog he warned clients, and journalists, that they could end up sharing confidential contacts if they used the service. He said Google was “repurposing old data in a way that flouts our expectations of privacy”.
“People have an expectation of privacy with email. There are lots of famous examples of emails making it to people they shouldn’t have reached. But this was not an accident, it was a deliberate change in structure,” he said.
“The big story is that they wanted to set up a social network, something they have failed to do well in the past. The downside is that they have hurt the Gmail brand.”
The Buzz controversy is unlikely to end in epic fines for Google. Last year Facebook paid $9.5m (£6.2m) to settle a similar class-action lawsuit over Beacon, an advertising system that tracked Facebook users’ online activity outside the site and told other users what they had been up to.
Perhaps more damaging is the damage Buzz has done to Google’s image. John Quelch, a Harvard Business School professor, said it faces two problems in any new venture. “First, Google is a hostage to its publicly stated aim to ‘Do no evil’. That definition of evil is open to considerable interpretation. They have to be very careful that this aim isn’t viewed with cynicism rather than respect.”
Second, Quelch said the execution of Google’s search business is so far ahead of its rivals that people had high expectations of any new service. “They rather missed it on Buzz,” he said.