You quote the Californian law:
The answer is not so simple. California Penal Code, Section 631 makes it a crime to "by means of any machine, instrument, or contrivance, or in any other manner, ... willfully and without the consent of all parties to the communication, ... learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or [to] use, or attempt to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained."
------------------------------------------------
A few thoughts:

The law is written for people to follow and be subject to. The law tells people what they can and cannot do (and can expect from others).

Thus, the law you quoted is stating that it is a crime for people to, "by any means of any machine ... willfully and without the consent of all parties to the communication, ... learn the contents or meaning of any message"

This seems to allow the situation where no *person* learns the contents or meaning of a message, as only the machine knows. Therefore, this privacy issue, regarding the knowledge of the messages, seems irrelevant.

However, the law also states it is a crime to:
"by means of any machine ... willfully and without the consent of all parties to the communication, ... use, or attempt to use ... any information so obtained"

This appears more relevant. Can a person use such information, without actually *learning* what the information is? I would have to say that yes, they can in this case. Gmail are making money through advertising (using the information) through automatic purposes, set in place by their actions, without ever actually *learning* the contents or meaning of the emails they are using. However, whether this power is abused by the current process or not is a different question, and I would suggest that it is not, as it is a well documented part of their policy, which the parties have consented to, as we shall see.

The law will allow such use of information providing there is the consent "of all parties to the communication", including the sender. I would suggest that by sending the email to the Gmail servers, the sender of the email has essentially consented for that email to be processed by the Gmail servers, by including Gmail as a new party to the communication. They may not know what this process is, but they have implicitly consented to it.

To put it another way, the user consents to Gmail policy through the sign up process, and the sender consents to the same policy through sending the email.

So, it appears that consent is given, privacy maintained, and as long as Gmail does not extend their power beyond the consented agreement with the user, no harm done.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/248/26865#26865