Slashdot Mirror
"Going Google" Exposes Students' Email
A ReadWriteWeb piece up on the NY Times site explores the recent glitch during the move of a number of colleges onto Google's email service that allowed a number of students to see each others' inboxes for a period of more than three days. Google would not give exact numbers, but the article concludes that about 10 schools were affected. "While the glitch itself was minor and was fixed in a few days, the real concern — at least at Brown — was with how Google handled the situation. Without communicating to the internal IT department, Google shut down the affected accounts, a decision which led to a heated conversation between school officials and the Google account representative. In the end, only 22 out of the 200 students were affected, but the fix was not put into place until Tuesday. ... The students had access to each other's email accounts for three solid days... before the accounts were suspended by Google. Oddly enough, this situation seems to be acceptable [to Brown's IT manager, who] 'praised Google for its prompt response.' (We don't know about you, but if someone else could read our email for three days, we wouldn't exactly call that 'prompt.')"
I bet most of us could read everyone else's email at school...
We don't know about you, but if someone else could read our email for three days, we wouldn't exactly call that 'prompt.'
Look, I think we can all agree that if there were some major security breach like this for which we were responsible and we sat around for 3 days before doing anything, then unilaterally suspended a bunch of accounts before finally fixing the problem, we'd be fired.
On the other hand, if I were the head of IT at some place and we've decided to migrate everything to some giant, well-liked third party with a reputation for excellence, it'd be really easy to say, "That's just how tech is, it's hard to do right even for Google, get used to it. Oh, and while you're looking for ways to prevent such a 'catastrophe' from ever happening again, consider boosting the IT budget, will ya?"
I'll bet that IT manager is pretty happy right now, student complaints aside.
Most people don't keep that on their email accounts...
Most people don't keep that *what* on their email accounts?
Private stuff?
Passwords?
User ids?
$25,000,000 money-making invitations?
Shakespeare quotes?
I know one fact about email which makes it an incredibly important security risk - the 'I forgot my password' link. Log on to a site you think the user uses, click that 'forgot' link, read his new password a few moments later. erm.. profit.
That said, this is google mail we're talking about, the one that bills itself as "store everything on us" we're safe and you'll never lose an email again thanks to our massive storage, indexing and searching facilities. So, for some people email is downloaded immediately and never stored on the server, for many many others, it stays right on the server.
I'd have cancelled the account, the way it was handled is not acceptable, even a free service has reasonable expectations of security. To let it linger for 3 days... that's simply not good enough.
I'm sorry, perhaps you missed the part where students could read each others emails.
Microsoft participation is not required in this case.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
What the FSCK! How lame is your college that it can't run an email system?
When you finally get out you might want to check and see if your diploma is signed.
"Why are you diverting a serious matter like this into smearing a company that most likely had nothing to do with it?"
Because Microsoft is running a big campaign in portraying Google as bad. Google is a really hard hit target right now for FUD. The fact that this was a big Microsoft Exchange customer before makes my radar tingle a bit extra for that reason.
"E-mail accounts can contain very sensitive data, ranging from bank papers to personal issues. And especially if people you know get access to this, it makes the problem more serious than ever. "
Yes, and the problem wasnt Google Apps in itself but getting mails out from exchange and into Google Mail to the right account. It was more a migration error than any security problem. Most times the problem with migrations lies in broken accounts in the source system.
"And the fact that it is free doesn't make it more acceptable. It's like saying that someone volunteering for a non-paid job can act whichever way he or she wants just because it's free. No, you still have to follow rules. "
The fact that its free does make it more acceptable. Where talking free market here, not soviet russia.
"Comments like this make me realize why there are so many extremists in this world."
Different view = extremist? Yay for talibans!
HTTP/1.1 400
Its conveniently devoid of detail regarding the timeline of things. I don't mean to be a google apologist, but the article seems full of conjecture.
11 % of users were affected during a migration. OK it could have been better, but a 3 day turnaround (over a weekend) of an outage during planned maintenance doesn't sound *that* bad to me. Is this still the gmail that you don't pay for btw?
The critical (missing) detail is how quickly did Google turn off access to other people's mail following notification. Yes it may be a contentious decision if it was made without approval, but in areas of privacy it might be a good idea to CYA first ask questions later.
Heated discussions are one thing, being taken to court over Data Protection is quite another.
I'm confused at the reaction from Brown, were they advocating leaving people's data out in the open whilst it was resolved?
Invaders must die
Who the hell uses their college e-mail account for anything important unless you're part of the staff? When I was in school I just forwarded my university address to my home account.
"I'm French and if my personal or professional email were to be made public, that would be one hell of unsatisfactory service."
Well, who do you think would want to read a Frenchman's mail, anyway?
More seriously, what does nationality have to do with privacy issues? You think that maybe a Ugandan needs more privacy than a Russian? Degrees of privacy are scaled from one nationality to another? Had you said something to the effect, "The Iranian government has grown really oppressive, so my mail being made public is a major threat to personal security", then your nationality and/or government might be a factor.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Not paying anything? Tuition at Brown is $35,584, and some of that goes to IT services; the fact that they've contracted student email service out to Google is irrelevant.
.sig withheld by request
The article does not give many details on what their email system was before they sold their soul to Google. It may very well have been (or perceived to have been) worse, and this is an improvement in the eyes of upper management.
Palm trees and 8
Also, have they already arrested/suspended/expelled the students that reported the problem?
Come play free flash games on Kongregate!
What privacy? Those are Google's emails. They were sent by your friends to Google. That they are about you and you are allowed to read them makes no difference to their ownership.
/sarcasm ...?
It isn't FREE, people.
Google advertises all over the place. They store your mail for an indeterminate period of time.
They link your gmail account cookie to your google account cookie, which is linked to various advertising streams.
Do you think TV is free? Really? Ever heard of commercials?
TV is a deployment method for commercial advertising. It's at breaks (standard commercials). It's during TV shows, with in show spots for products.. such as actors pumping various products. It's at the bottom of the screen, with dancing advertising logos and such, while you watch the show!
This is not free. This is an arrangement between two entities. You watch our shows, and we try to sell you things. Clearly your time has value, you watching has value, and that is why TV is on the air. It isn't on the air to be 'free'.
That is, unless you think that 'free' means 'no hard currency was exchanged'. If you do, then I suppose you help your friends move for 'free', and the beer and pizza after isn't compensation?
Gmail is not different. It isn't free. Google is making a PROFIT on this -- or if not, it will be. It will make money by examining the relationships between people that use gmail. It will make money by examining those relationships, and what you search for on the web. It will make the same money, by looking at those relationships, your financial data (Google finance), the places you search for on Google Maps, the apps you download with Andoird/Gphone, the people you call in your gphone, and on and on and on.
Google has become the largest depository of human interaction. They span more than email and searches. They know who you are in contact with, who you buy from, and the list goes on and on.
Further, they store this information for an indeterminate period of time.
Whether or not you like this, whether or not you approve, it is what you pay for using their service.
Free? Hell no!
A few mailboxes (20 out of 200) had the wrong mail migrated into them. We don't even know the source of this problem yet, but the university could very well have TOLD Google to put sally.smith's e-mail into sally.jones' new mail box.
This isn't a google apps security problem. Please RTFA and get off your high horse.
While you idea does work, I for one think legal and tax codes which incentivizes throwing-away working equipment rather than donating/selling it to someone that can use it indicates some deeper problems with modern society. It's a wasteful misuse of resources and it's causing unnecessary trash. And no, I don't care if it adds a few more dollars per year to some PC manufactures bottom-line. Economies exist to serve their societies, not the other way around!
No offense, but from a privacy perspective there is nothing "less bad" about seeing "just" the contents of old mailboxes.
If I have nude photos, love letters, an email from porn-porn-porn.com, or just something I don't want someone else to read in my old mailboxes, how is someone else being able to see them not horribly bad even if they are over 90 days, (or whatever), old?
Reading code is like reading the dictionary - you have to read half of it before you can go back and understand it.
Is this still the gmail that you don't pay for btw?
Regardless of whether or not the universities pay for the google mail service, incidents like this should not happen. What would happen if the same Blackberry organization, say, Rogers wireless, mixes up the accounts of executives from different companies?
If in the terms and conditions it states: we may mix up accounts from time to time, if you want this to NOT happen, please pay $20/month - everyone would pay the $20/month then.
These students may have had information about marks, papers, exams, etc, in their emails and I most certainly would rather have my CC number broadcast then my academic information, because at least I can call the CC company and get it cancelled.
Paid for or not, this shouldn't happen.
To my knowledge, Google email support doesn't work on sundays.
For Google's sake I hope that is conjecture on your part and not the reality of the situation. Any organization that is touting their software as "enterprise ready" better have tech support there and ready to take care of problems 24x7x365 for organizations willing to pay for it.