[pervasivemon]

Yes, you probably should assume it is. The good news is that it's easily detectable. Your browser should refuse to connect to the proxy-spoofed gmail because it likely hasn't received the visited-corporation's local-spoofing-is-ok cert.

You might be encouraged by the local team -- "don't worry, just do this so you can access gmail again." It's too bad that this activity trains people to think updating your certificate store (based on directions given to you by some site in your web browser) is something that you should do to get past an error message.