A number of companies are raising concerns about what Google says it can do with documents
stored on the new Google Drive online storage service.
On Tuesday, Google Drive began offering 5 gigabytes of free storage of documents, pictures,
video, and other digital goodies. Google executives said that customers could avail themselves
of built-in Google technologies like character recognition, visually based image search and
video encoding for multiple formats, including Google’s YouTube.
Critics pointed out that Drive, like any Google product, would fall under Google’s terms of service,
which let Google scan and use its consumers’ content for Google’s own purposes.
Load a sensitive corporate document onto Drive and Google would be within its rights to read it.
The Verge Web site pulled out language from the service agreements of Dropbox and Microsoft’s Skydrive
service that were considerably more sensitive to concerns over privacy and intellectual property rights.
For example, one section of Google’s terms of service agreement says:
When you upload or otherwise submit content to our services, you give Google (and those we work with)
a worldwide license to use, host, store, reproduce, modify, create derivative works
(such as those resulting from translations, adaptations or other changes we make so that your
content works better with our services), communicate, publish, publicly perform, publicly display
and distribute such content.
Companies, The New York Times among them, advised employees not to use Drive or Gmail for
company content until Google clarified how its policies might affect corporate information.
Kent Walker, Google’s general counsel said, “People shouldn’t come to the conclusion that we’re
doing nefarious things. We, Facebook and Microsoft are all trying to do similar things.
The terms of service are trying to cover what is inherent in Web-based services.”
Google executives seemed puzzled by the concern, saying that the same policies had applied to
services like Gmail for years, and actually did not differ much from those of competitors.
“It’s not very different from policies at Dropbox, Box.Net, or Microsoft,” said Jill Hazelbaker,
a Google spokeswoman. The company also said that the terms of service in Google’s Apps
for Business service prevent it from developing products from scanning corporate content.
Policies at all these companies, as well as Facebook and others, allow companies to scan personal data
and use it to improve products or build new ones. Dropbox says personal information may be used
“to provide and improve our service” and “to personalize and improve your experience.”
Microsoft and Facebook also talk about using personal data to build their products.
Having confidence and trust in Google is important to Google’s strategy of convincing corporations
to buy Google products to process documents and store them. At a security conference last month
at Stanford University, Joe Sullivan, Facebook’s chief security officer, said that
“owners of data in the cloud are going to start insisting on more control,” adding that
“Google Docs is a great collaborative tool. It works well. But if you’re Facebook do you want all
your documents sitting on one of your biggest competitor’s servers?”
Every online e-mail and storage service, at minimum, scans for viruses and makes backup copies of
user data. The scale at which Google operates, however, and the number of features it offers,
may affect how it is seen. The prospect of fresh petabytes of data inside Google, where Google has
broad license to experiment, may provide renewed scrutiny about what Google does with data.
The content of e-mails that people write in Gmail is machine scanned to place ads, for example,
but it is not broadly understood that so also are e-mails sent into a Gmail account from
other service providers.
Google executives say that the ability to look at people’s stuff is precisely how they are able
to create many of the products on which people rely. “We don’t take personal information and use it in
a way that we don’t represent to the user,” said Sundar Pichai, senior vice president for
Chrome and Apps at Google, who headed the release of Drive.
Mr. Pichai noted that Google services like language translation, spell check and others depend
on scanning large amounts of content, including what people load into Google’s servers.
“This is all read by machines,” Mr. Pichai said. “Spell check identifies patterns across many languages;
it doesn’t say, ‘this person likes to spell things this way.’”
At least one privacy advocate called Google’s terms of service standard. “Every time a company updates
heir terms of service– or posts a new one– users end up being shocked by the language that describes
a company’s right to use your information,” said Jules Polonetsky, director at the Future of Privacy Forum.
“But it does not appear that Google claims ownership of your data. This is just the annual,
fire alarm when users actually look at the legalese needed to describe a company’s right to
host your data for you.”
Even at that, these terms have long made some executives uncomfortable about corporate uses
of Google Apps for Business, which includes Gmail. “Consumers can make individual choices.
Businesses have a different view of the content they are distributing,” said Zach Nelson,
chief executive at NetSuite, an online provider of business software.
Mr. Nelson said, “we have contracts with customers about protecting the information they give us,
and Google would scan that content. You can’t be sure about the point at which the machine is using
that information.” In addition, he noted, as a public company there was some concern by some lawyers
about NetSuite’s financial information being scanned for content, not just viruses, on Google’s servers.
“If companies want to use the cloud, I don’t think we are doing anything we don’t see others doing,”
said Mr. Pichai. “When we walk into a company to talk about Google Apps for Business this is not an
issue we have.”