Google accused of 'wiretapping' in Gmail scans

10/1/2013

SAN FRANCISCO — Wiretapping is typically the stuff of spy dramas and shady criminal escapades. But now, one of the world’s biggest Web companies, Google, must defend itself against accusations that it is illegally wiretapping in the course of its everyday business — gathering data about Internet users and showing them related ads.

The accusations, made over several years in various lawsuits that have been merged into two separate cases, ask whether Google went too far in collecting user data in Gmail and Street View, its mapping project. Two federal judges have ruled, over Google’s protests, that both cases can move forward.

The wiretapping rulings are the latest example of judges and regulators prodding Google over privacy violations. The company is on the defensive, struggling to convince overseers and its users that it protects consumer data, while arguing that the law is stuck in the past and has failed to keep up with new technologies.

“It’s been a bad month for Google,” said Alan Butler, a lawyer at the Electronic Privacy Information Center. “What’s at stake is a core digital privacy issue for consumers right now, which is the extent to which their digital communications are protected from use by third parties.” For the most part, Google has managed to avoid major privacy penalties. The Gmail case could have broad effects, though, because nearly half a billion people worldwide use the service, and because if it is, as expected, certified as a class action, the fines could be enormous. At the same time, the case could have long-term consequences for all email services — including those from Yahoo and Microsoft — and for the issue of how confidential is our online data.

“This ruling has the potential to really reshape the entire email industry,” said Eric Goldman, director of the High Tech Law Institute at Santa Clara University School of Law.

The Gmail case involves Google’s practice of automatically scanning email messages and showing ads based on the contents of the emails. The plaintiffs include voluntary Gmail users, people who have to use Gmail as part of an educational institution and non-Gmail users whose messages were received by a Gmail user. They say the scanning of the messages violates state and federal anti-wiretapping laws.

The case revives a short-lived uproar over Gmail ads when Google introduced them in 2004. Microsoft has recently tried to call attention to the practice as part of its Scroogled campaign, including a video that shows a so-called Gmail man reading people’s email. Google has continued to show new types of ads in Gmail, including ads that look like emails.

“Google uses Gmail as its own secret data-mining machine, which intercepts, warehouses and uses, without consent, the private thoughts and ideas of millions of unsuspecting Americans who transmit email messages through Gmail,” lawyers for the plaintiffs argued July 11, opposing Google’s motion to dismiss the case. On Thursday, Judge Lucy H. Koh of U.S. District Court denied Google’s motion in a 43-page order that fought the company at almost every turn.

Koh is highly respected in Silicon Valley, with a reputation for being fearless. During the Apple-Samsung patent trial, she made headlines for asking an Apple lawyer if he was “smoking crack.”

In this case, she came down hard on Google.

In the June 13 motion to dismiss the suit, Google said the plaintiffs were trying to “criminalize ordinary business practices.” It argued that the scanning of Gmail messages was automated, with no human review, and was no different from the processes it uses to detect spam or viruses, offer inbox searching or filter messages into folders. It said users had consented to it by agreeing to Google’s terms of service and privacy policy.

In a section of the motion that was widely noted, Google also argued that non-Gmail users had no expectation of privacy when corresponding with Gmail users.

“Just as a sender of a letter to a business colleague cannot be surprised that the recipient’s assistant opens the letter, people who use Web-based email today cannot be surprised if their communications are processed by the recipient’s” email provider, the lawyers wrote.

Federal wiretap law exempts interception of communication if it is necessary in a service provider’s “ordinary course of business,” which Google said included scanning email. That argument did not fly with Koh.

“In fact, Google’s alleged interception of email content is primarily used to create user profiles and to provide targeted advertising — neither of which is related to the transmission of emails,” she wrote in last week’s ruling.

Koh also dismissed Google’s argument that Gmail users consented to the interception and that non-Gmail users who communicated with Gmail users also knew that their messages could be read.

“Accepting Google’s theory of implied consent — that by merely sending emails to or receiving emails from a Gmail user, a non-Gmail user has consented to Google’s interception of such emails for any purposes — would eviscerate the rule against interception,” she wrote. A Google spokeswoman, Leslie Miller, and a lawyer for the company, Michael G. Rhodes of the law firm Cooley, declined to comment on the case beyond a company statement. “We’re disappointed in this decision and are considering our options,” it said. “Automated scanning lets us provide Gmail users with security and spam protection, as well as great features like Priority Inbox.”

Lawyers for the plaintiffs, Sean F. Rommel of Wyly Rommel and F. Jerome Tapley of Cory Watson, did not respond to requests for comment.

Also last week, Google asked the Court of Appeals for the 9th Circuit to reconsider a Sept. 10 ruling that a separate wiretapping lawsuit could proceed. That one involves Google Street View vehicles that secretly collected personal information from unencrypted home computer networks. The federal anti-wiretapping law at the heart of both cases is part of the Electronic Communications Privacy Act, a 1986 law that has been under fire for years for not taking into account modern-day technology like email.

“It’s not surprising we’re seeing courts struggle with applying the ECPA,” Goldman of Santa Clara said. “It’s a poorly drafted statute that has aged very poorly.”