As it stands, the argument against GMail could also be made against anti-virus, IDS, and any other signature-based system.

For one, wiretap law is known to be horrendously inadequate when dealing with cybercrime-related cases.

For two, the major difference between Fmr. Attorney General Reno's investigation, and GMail, is this. In the case of the AG's investigation(s), the ultimate destination of the intercepted data was a human. That is to say that a human reader could be subjected to privacy-violating material that a scanner (we'll assume, inaccurately) flags.

In the case of GMail, the computer mis-flagging a message results simply in the wrong ad being inserted. No human reader at Google will *EVER* read the contents of a message, except in otherwise legally-permissable circumstances. In Reno's case, it was clearly a legally inadmissable action to search the entire communications of Harvard's network, so Reno attempted to reduce the impact of the search by only allowing human readers to see pattern-matched packets.

The author should really focus more on the "effect of error" argument. In the AG's case, the effect-of-error of the scanner was to allow a human to read material that did not pertain to a court order (and presumably, to act upon that material). This is not legally admissable, and had the accuracy of the scanner been challenged by either Harvard or a potential suspect, likely would have been a loss for the administration. In Google's case, nobody reads the content of your messages, regardless of the scanner being right or wrong about said content.

Ironically, and perhaps sadly, this piece is more an indictment of the backward steps that digital privacy took during the Clinton Administration than an indictment of GMail.

Indeed, the author makes a legitamite point regarding the potential invasiveness of "targeted advertising" schemes. However, using past cases as examples seems to indicate that the line of privacy has already been crossed -- and it doesn't benefit the innocent consumer.

Regards,
Matthew Murphy

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/248/26838#26838