Slashdot Mirror
Privacy Advocates Slam Google Drive's Privacy Policies
DJRumpy writes "Privacy advocates voiced strong concerns this week over how data stored on Google Drive may be used during and after customers are actively engaged in using the cloud service. While the TOS for Dropbox and Microsoft both state they will use your data only as far as is necessary to provide the service you have requested, Google goes a bit farther: 'Google's terms of use say: "You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours. When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content."'
Google's motivation, in all that it does, is to index your data an sell you to advertisers. Advertisers are the customers, and you are the product. Android, Gmail, the search engine, Google Drive, Google+, and so on--they all exist solely to index people's data and serve them ads. 96% of Google's revenue comes from advertising. It is their core business.
In fact, that's not actually bad in and of itself, up to the point where it crosses into creepy territory, like in this case. Just by uploading your personal files, you are licensing them to Google to do whatever they want with them. And not just Google--note the parenthetical "(and those we work with)". So you don't even know who is going to be using your personal data. I mean, these policies actually give Google and other strangers the right to publicly display and distribute your files. One wonders if that absolves them from any consequences from security intrusions too, since a hacker getting hold of your files that would count as publicly distributing them, even if accidentally.
I've never bought into the image of benevolence Google always presents to the public, and that's cost me Slashdot karma over the years, but I don't care. It will be very interesting to see who defends this. It would be difficult not to see them as sellouts of themselves, all too happy to trash their own privacy rights, eager to please the advertising megacorp and defend them from attack. Wake up!
"a close and careful reading reveals that Google's terms are pretty much the same as anyone else's, and slightly better in some cases"
http://www.theverge.com/2012/4/25/2973849/google-drive-terms-privacy-data-skydrive-dropbox-icloud
it's in my head
OK, well, not all that shocked.
Whoever doesn't realize by now that Google is a marketing agency who makes their money off selling their users' data, deserves to get screwed.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Conveniently left out of the summary and TFA is that this only applies to DATA YOU EXPLICITLY MAKE PUBLIC in your Google Drive.
Which is the same policy as Google Docs had, same as Picasa had, etc.
If you mark a document public then it can be searched for and found. (But in my tests, its rarely searchable - probably my stuff is too boring even for Google's spiders).
Foremost in Google's policy it states:
Information we share
We do not share personal information with companies, organizations and individuals outside of Google unless one of the following circumstances apply:
With your consent
We will share personal information with companies, organizations or individuals outside of Google when we have your consent to do so. We require opt-in consent for the sharing of any sensitive personal information.
So if you mark it private, it means its almost as private as it can be while still being in the cloud. Of course Google has to honor subpoenas, but your next great novel will not appear in someone's search results if mark it private.
If you want better privacy for your commercial cloud storage your best bet is SpiderOak which stores everything encrypted with an encryption key that even SpiderOak doesn't know. They use client-side decryption, and therefore couldn't hand over your stuff even at gunpoint.
Sig Battery depleted. Reverting to safe mode.
What a fluff piece from the Verge. It doesn't compare the exact wording of the policies. Instead, it justifies Google's policy by saying abuse is "unlikely" (which isn't the point) and explains that rival services need certain delivery permissions to run the service, but it doesn't cite any examples from the policies of those rivals that are equivalent to the content license that Google Drive grants.
The article also claims that "public" refers to the user and their actions regarding their own data. But that is NOT what Google Drive's policy states--it explicitly states that the content is licensed to Google as well as anyone Google works with.
Dropbox:
We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction. This includes product features visible to you, for example, image thumbnails or document previews. It also includes design choices we make to technically administer our Services, for example, how we redundantly backup data to keep it safe. You give us the permissions we need to do those things solely to provide the Services. This permission also extends to trusted third parties we work with to provide the Services, for example Amazon, which provides our storage space (again, only to provide the Services).
Skydrive:
If you share content in public areas of the service or in shared areas available to others you've chosen, then you agree that anyone you've shared content with may use that content. When you give others access to your content on the service, you grant them free, nonexclusive permission to use, reproduce, distribute, display, transmit, and communicate to the public the content solely in connection with the service and other products and services made available by Microsoft. If you don't want others to have those rights, don't use the service to share your content. You understand that Microsoft may need, and you hereby grant Microsoft the right, to use, modify, adapt, reproduce, distribute, and display content posted on the service solely to the extent necessary to provide the service.
Google Drive
You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours. When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones.
I have bolded the relevant bit that the biased summary failed to include. It is exactly the same as the Microsoft term above.
So here's my business idea:
I want to develop a home automation and integration service. There will be a wide variety of devices designed and built to make people's lives easier. It will vacuum your floors, track/inventory your pantry, refrigerator and freezer, order out of stock foods and supplies based on your rate of consumption and the discards in your waste collection units, organize your closets, manage your TV viewing, secure your home from invaders with our monitoring services. And it's ALL FREE!
All you have to do is allow us to use the information we collect in ways we don't care to detail or disclose.
How does that sound?
When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure you have the necessary rights to grant us this license for any content that you submit to our Services.
It is incredibly intellectually dishonest to quote only part of a paragraph, without noting the limitation that immediately follows. You can still have problems with the terms (the note on "promoting [and] developing new [services]", especially) Materially, Google's terms seem to be in the same vein as Dropbox's: they need to be able to actually, you know, host your data to be able to actually host your data. But if you want to actually discuss their policies, don't quote them partially out of context. That doesn't help.
I particularly love how people in that article subtly imply that Google is going to sell your data, without actually coming out and saying it (“You have to ask yourself, what’s the business model. If the business model is to make money from a service or money from advertising, that’s one thing. If it’s trying to make money off the sale of data, that’s another thing.” Implying evil behavior is much easier than coming out with an actual accusation: the former requires zero proof.) Google's terms make it pretty clear they can't do that ("You retain ownership of any intellectual property rights that you hold in that content"), and even if they change the terms later, they can still be sued for selling the data since it was uploaded under the existing terms. IANAL, of course, but Google is in enough hot water already that it would be practically suicidal (and extremely stupid) to do that.
Oh, and BTW the relevant quote is from their "Terms of Service". Their privacy policies are an entirely different page, so the headline is incorrect: this isn't about their privacy policies, it's about their terms of service. The privacy policies themselves aren't actually discussed in TFA, although they are referenced.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
A keyboard-smash 128 character password on an AES-encrypted zip file would be enough I'd think.
Though this also sounds like a good opportunity for someone to write a Dokan filesystem for it (maybe something which just does the above?). I already use OTR encryption with Gtalk - it's kind of funny going through my Gmail account and seeing all the encrypted conversations. Sad that pretty much no one can be convinced to use GPG for regular email though.
My take on it -- Google is being more explicit about what they are going to do with data that you mark public.
Example: you post a document. A friend in Germany wants to look at it, and asks Google to display the document (which you wrote in English) in her native German. This requires Google to make at least one intermediate copy, leading to a German translation, which would be considered a derivative work, which is then displayed.
Sounds like they've done an admirable job of covering the bases, to me, rather than the shorthand that others use.
Oh, it goes without saying that when you use/visit a website, if you can't find the product being sold, then you are the product being sold.
There's a difference between signing over your IP rights and giving someone a license. If I write a book and then bring it to the print shop to have it printed, I'm giving them a license, not handing over the copyright. The difference is that I'm free to (1) make further copies myself, and (2) grant licenses to others without limit.
If Google are actually saying this about your virtual hard drive content, it beggars belief.
They're not saying that. The summary is being incredibly disingenuous and cherry-picking things to quote, missing important context, on purpose. FUD.
Don't disappoint your bird dog. Go to the range.
The real problem is not that we have a fundamental concern about creating derivative works or in distribution, but in the intended purpose of such actions. Legal language is typically devoid of intent, since intent is a difficult thing to quantify effectively. As a result, legal documents focus on actions, regardless of whether they are good or bad. A derivative work could be, as stated above, creating a thumbnail of a picture (harmless and necessary for many functions, including showing you thumbnails in PicasaWeb, for example). It could also be something else, like taking your codebase in Google Code and just freely incorporating it into a product of their own (not harmless, and intellectual property theft). What I see is that as far as I can tell, Google has yet to commit any gross abuse of such things, nor have they seemed inclined to do so.
Google's next challenge is to find a way to delineate between the types of intent they have and the ones they do not have, in a way which is legally binding and thus will hold credibility with groups like EPIC. I do think EPIC is going a little overboard on their language. For example, Rotenberg says "After the unilateral changes on March 1, I don’t understand why users would trust Google to stand by its terms of service," which seems a bit odd to me. He's using the phrase "unilateral changes" as if there was any other way to change terms of service, or like it is a bad thing. What is he implying...that Google should have crowdsourced the ToS that protects their business, and given up control over what the ToS would end up as? That doesn't seem very realistic, and I'd think someone like Rotenberg would already understand how infeasible that is.
So one part of this is the fact that Google could abuse their users while remaining within the Terms of Service because legal verbiage is bad at distinguishing good intent from bad, and another part is that EPIC is fearmongering a bit. I don't see the real problem, myself, especially since it's possible for their Privacy Policy (which is also in effect) to constrain the actions in the ToS, reducing the amount they could do that's actually "bad".
For your security, this post has been encrypted with ROT-13, twice.
The really important part, in the context of Drive, is: "in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services."
The default setting in Drive is private-to-you-only.
The recognition of settings narrowing the scope of use in the ToS means that it is part of the offer of service that you can use settings that purport to limit the use of content to, in fact, limit the scope of Google's use of that content, and, in the context of Drive, that material you put in it with the default, private-to-you setting, will be used only to create copies (e.g., replicas on various servers, etc.), derivative works (e.g., transformation in different formats, which Drive has hooks to support), and distribution (e.g., over the "series of tubes" connecting your devices to Google's servers), etc., to support delivering that content and its derivative products to you.
Or to third-parties (e.g., apps) that you've explicitly approved for access to your private Drive content (as that's, again, within the scope of how the settings in Drive purport to restrict the use of your content.)
Usually has the required elements of mutual consideration, offer, and acceptance, so it probably is.
You may be confusing "binding" with "written", which is a mistake.
Under US Copyright law, a signed agreement is necessary for some copyright transactions, but not for most copyright licenses, including those to create derivative works.
Which would be relevant iff this were a situation where a written contract was generally required and the theory under which the agreement was binding was statutes making documents with attached "digital signatures" meeting certain requirements legally equivalent to written documents.
If Google does not require that license to your content, then how in gods name will they do simple things like display thumbnail previews of documents, which by NECESSITY is a derrivitive work? If anything, the fact that Microsoft and Dropbox *does not* have this in their agreement basically means they are violating their agreement constantly, just no one is calling them on it.
No. Thumbnails are not copyright infringement. That's been litigated and won. By Google. So they know better.
True privacy advocates will suggest the following: Do not put data you wish to keep private on a storage system accessible by someone else.
Yeah, not really getting the whole uproar here...
The terms quoted are pretty much necessary for any site that allows user submitted content. That's the way copyright law works. If they want to display something on a webpage, they need a license to do it. If they want to convert a word document into a .pdf, that's a derivitave work. Same with showing you a thumbnail of the image you uploaded. I guarantee that 95% of the sites out there have a similar clause in their terms of service. For instance: just take a look at slashdot's own terms of service. Click that terms button down at the bottom of the page and what do you get:
submitting user retains ownership of such Geeknet Public Content; with respect to publicly-available statistical content which is generated by the site to monitor and display content activity, such content is owned by Geeknet. In each such case, the submitting user grants Geeknet the royalty-free, perpetual, irrevocable, non-exclusive, transferable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform, and display such Content (in whole or part) worldwide and/or to incorporate it in other works in any form, media, or technology now known or later developed, all subject to the terms of any applicable license
Looks very similar, doesn't it...
If there's anything more important than my ego around, i want it caught and shot now.