[microtonal]

Or googles snooping in your data and selling your profile to everyone who pays.

You should really read Google's privacy policy:

http://www.google.com/policies/privacy/

So, no, they don't sell your profile.

I do agree with your point: if you don't want advertisements. Pay for the service. E.g. Google Apps for domains allows you to disable adds in Google apps. And since you can bring your own domain, you can move to some other service if you are not happy with them.

[belorn]

An non-binding policy, how quaint!

http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...

Even if you trusted such things, google will still do targeted ads. If DEA want to find drug users, all they have to do is ask google and they will use users emails to locate them.

[Filligree]

Yes, Google will comply with law enforcement.

Uh... what would you prefer they do instead?

[kefka]

There is a big difference between:

1. Here is a lawful search warrant signed affidavit and approved by a judge _or_

2. Here you go, the data on kefka. Thanks for asking.

[chii]

> 2. Here you go, the data on kefka. Thanks for asking.

is this really happening? can you give some evidence that google is willy nilly giving private data away like that?

[dotBen]

Actually, the Snowden files show that is happening for non-US Citizens/US-persons.

The NSA only has the legal obligation to obtain warrents for US Citizens not for anyone else. The NSA is unlikely to get involved in civil legal disputes but yes, it can go in and ask for Kafka's data from Google if he is living in, say, Germany.

[mpyne]

Even for that there is a due process requirement, contained in E.O. 12333. Obviously the requirements are far lower but even there a random NSA analyst can't simply ask for the data, they'd have to get a supervisor within NSA to approve sending that request outside the agency.

But on the other hand I've not seen evidence that Google simply sells information on specific individuals or otherwise gives it away without that legal mandate.

[ahassan]

No, he's saying that Google is doing the first point, not this one.

[kefka]

Actually, I was referencing the AT&T "go ahead, it's AT&T's data and we can do whatever we want with it". That was so bad that Congress passed an ex post facto law relieving them of any criminal or civil wrongdoing.

The problem here is that Google's data on us belongs to Google. They can do anything they want to that data: take a crap on it, process it for better ad targeting, analyze social media trends and figure out who we associate with, and/or give it to people like the FBI/CIA/NSA.

Or, Google was hacked. That's also well within the realm of possibility as well. But I think governmental "persuasion techniques" like http://xkcd.com/538/ work much better.

Just look at the stories of Qwest former CEO. He said no.

[belorn]

Complying with lawful search warrants is one thing, doing targeting ads based on users behavior for money is something else.

Targeted ads can be anything from a DEA honeypot that advertise cheap drugs, to quick guide for easy tax evasion made by the IRS. It might be ads targeted at people with specific sexual preferences. Any search-able trait imaginable that Google can target is exploitable, and the policy document is an official intent to do so.

[PavlovsCat]

Avoid collecting such information in the first place, which of course would require a different business model, which brings us back to the initial point.

[microtonal]

Well, except that many users want full indexing of e-mails, including attachments, such that they can use an AJAX web interface to quickly search them.

So, storing all e-mails encrypted is not really feasible if you want to have such features as well [1]. It's a trade-off - convenience or security (I am sure someone will site Benjamin Franklin now ;)).

[1] Yes, I know that there is work on indexing encrypted data.

[PavlovsCat]

There is still a difference between storing the emails unencrypted and using them to profile users for ad targeting.

But anyway, what you are talking about could still be optional: if you wanted to search and be somewhat private you'd have to download the emails with a local client via IMAP - and if you really need search via web interface, you would toggle the option to store the emails unencrypted for that purpose.

[microtonal]

There is still a difference between storing the emails unencrypted and using them to profile users for ad targeting.

You can disable interest-based ads:

https://www.google.com/settings/u/0/ads

Also, if you have a paid Google Apps account, you can disable ads in Google apps.

Personally, I'd like to see targeted ads more than 'random' ads. Of course, I don't like to be profiled. So, I use Ghostery, an ad blocker, and paid e-mail.

[mironathetin]

"So, no, they don't sell your profile."

sorry, my mistake. They use it themselves (or let it slip accidentally to foreign secret services) :o).