澳门跑狗论坛

Includes updates and/or revisions.

As part of a potentially explosive lawsuit making its way through federal court, the giant online-services provider Google has acknowledged scanning the contents of millions of email messages sent and received by student users of the company鈥檚 Apps for Education tool suite for schools.

In the suit, the Mountain View, Calif.-based company also faces accusations from plaintiffs that it went further, crossing a 鈥渃reepy line鈥� by using information gleaned from the scans to build 鈥渟urreptitious鈥� profiles of Apps for Education users that could be used for such purposes as targeted advertising.

The U.S. District Court for the Northern District of California is currently hearing the complaint, which alleges that the data-mining practices behind Google鈥檚 Gmail electronic-messaging service violate federal and state wiretap and privacy laws. Gmail is a key feature of Google Apps for Education, which has 30 million users worldwide and is provided by the company for free to thousands of educational institutions in the United States.

A Google spokeswoman confirmed to 澳门跑狗论坛 that the company 鈥渟cans and indexes鈥� the emails of all Apps for Education users for a variety of purposes, including potential advertising, via automated processes that cannot be turned off鈥攅ven for Apps for Education customers who elect not to receive ads. The company would not say whether those email scans are used to help build profiles of students or other Apps for Education users, but said the results of its data mining are not used to actually target ads to Apps for Education users unless they choose to receive them.

Student-data-privacy experts contend that the latter claim is contradicted by Google鈥檚 own court filings in the California suit. They describe the case as highly troubling and likely to further inflame rising national concern that protection of children鈥檚 private educational information is too lax.

鈥淭his should draw the attention of the U.S. Department of Education, the Federal Trade Commission, and state legislatures,鈥� said Khaliah Barnes, a lawyer with the Electronic Privacy Information Center, or EPIC, a Washington-based advocacy group. 鈥淪tudent privacy is under attack.鈥�

In recent months, a broad cross section of public officials, industry leaders, and advocates has coalesced around the principle that students鈥� educational data should not be used for commercial purposes.

Regardless of whether the alleged data-mining practices of Google Apps for Education are found to constitute illegal wiretapping, such practices would constitute a direct violation of that principle, advocates say.

The questions swirling around Google Apps for Education also have major implications, observers say, for how the Family Educational Rights and Privacy Act, or FERPA, will be interpreted and enforced in the new era of digital technology and 鈥渂ig data鈥� in schools.

The Education Department鈥檚 recently issued guidance on student-data privacy appears to deem the alleged practices of Google Apps for Education as violating FERPA. Some experts, however, argue that the federal law is too antiquated to effectively address the complex privacy concerns raised by such high-tech data mining.

The confusion is contributing to a growing wariness of cloud-based education service providers, such as Google, among some K-12 officials.

The 210,000-student Houston Independent School District, for example, recently declined to adopt the popular Google Apps for Education tool suite as part of its high-profile 1-to-1 computing initiative. Chief Technology Officer Lenny Schad said that decision was due in large part to concerns over how Google would handle student information.

鈥淭he landscape of what districts are facing is changing at light speed,鈥� Mr. Schad said. 鈥淲e have to come together as educational entities and say to vendors that certain privacy protections are non-negotiable, and we won鈥檛 do business with you until they are in place.鈥�

Plaintiffs鈥� Arguments

In California, a total of nine plaintiffs are accusing Google of violating federal and state law. They had hoped to turn the case into a class action and to seek financial compensation for millions of Gmail users, as well as to force better disclosure by Google of its practices.

But Judge Lucy H. Koh, whose court is based in San Jose, denied the request for class-action status March 18 on the grounds that it would be impossible to determine which email users consented to Google鈥檚 privacy policies.

In September, Judge Koh denied a motion from Google to dismiss the case, Google Inc. Gmail Litigation, 13-md-02430, entirely.

While much of the California litigation is focused on consumer Gmail users, two of the plaintiffs鈥擱obert Fread, of the University of Hawaii, and Rafael Carrillo, of the University of the Pacific in Stockton, Calif.鈥攁re students who say they were required to use Gmail accounts when their institutions adopted Google Apps for Education.

Their universities are among the thousands of institutions of higher education and K-12 schools to adopt the 鈥渃loud productivity鈥� suite in recent years. (Google could not provide a current number of K-12 users in the United States.)

Proponents say Google Apps for Education contains powerful, easy-to-use free tools that allow users to perform a wide variety of basic digital functions, such as sending email and keeping a calendar; maintaining cloud-based storage of their information; and collaborating using word-processing, spreadsheet, and other software applications.

Apps for Education is also the foundation for the increasingly popular Chromebook, an inexpensive laptop computer that is now used by 22 percent of school districts in the United States, according to the company.

鈥淚 don鈥檛 think there鈥檚 another product on the market that provides the same level of power to its users, regardless of price,鈥� said Henry C. Thiele, the assistant superintendent for technology and learning for the 6,800-student Maine Township High School District 207 in Illinois.

Mr. Thiele said his district has used Google Apps for Education since 2008. Officials there have always been aware that the company does 鈥渂ack-end processing鈥� of students鈥� email messages, he said, but the district鈥檚 agreement with Google precludes such data from being used to serve ads to students or staff members.

As long as the company abides by those terms, Mr. Thiele said, 鈥淚 don鈥檛 have any problem with it.鈥�

In an emailed statement provided to 澳门跑狗论坛, Bram Bout, the director of Google Apps for Education, said that 鈥渁ds in Gmail are turned off by default for Google Apps for Education and we have no plans to change that in the future.鈥�

A company spokeswoman also noted that email scanning supports such features as virus protection, spelling checks, and Gmail鈥檚 鈥減riority inbox,鈥� and said that there is 鈥渘o processing of information鈥� stored in Google Drive, Docs, or other applications in the product.

But Mr. Carrillo and Mr. Fread say that doesn鈥檛 tell the whole story.

Those plaintiffs in the California lawsuit allege that Google treats Google Apps for Education email users virtually the same as it treats consumer Gmail users. That means not only mining students鈥� email messages for key words and other information, but also using resulting data鈥攊ncluding newly created derivative information, or 鈥渕etadata鈥濃�攆or 鈥渟ecret user profiling鈥� that could serve as the basis for such activities as delivering targeted ads in Google products other than Apps for Education, such as Google Search, Google+, and YouTube.

The plaintiffs allege that Google has employed such practices since around 2010, when it began using a new technology, known as Content Onebox, that allows the company to intercept and scan emails before they reach their intended recipients, rather than after messages are delivered to users鈥� inboxes, regardless of whether ads are turned off.

Mr. Fread and Mr. Carrillo say that neither they nor any other users of Google Apps for Education consented to such practices. They are seeking financial damages amounting to $100 per day of each day of violation for every individual who sent or received an email message using Google Apps for Education during a two-year period beginning in May 2011.

While the allegations by the plaintiffs are explosive, it鈥檚 the sworn declarations of Google representatives in response to their claims that have truly raised the eyebrows of observers and privacy experts.

Contrary to the company鈥檚 earlier public statements, Google representatives acknowledged in a September motion to dismiss the plaintiffs鈥� request for class certification that the company鈥檚 consumer-privacy policy applies to Apps for Education users. Thus, Google argues, it has students鈥� (and other Apps for Education users鈥�) consent to scan and process their emails.

In November, Kyle C. Wong, a lawyer representing Google, also argued in a formal declaration submitted to the court in opposition to the plaintiffs鈥� motion for class certification that the company鈥檚 data-mining practices are widely known, and that the plaintiffs鈥� complaints that the scanning and processing of their emails was done secretly are thus invalid. Mr. Wong cited extensive media coverage about Google鈥檚 data mining of Gmail consumer users鈥� messages, as well as the disclosures made by numerous universities to their students about how Google Apps for Education functions.

Mr. Wong鈥檚 inclusion of the following reference to the disclosure provided to students at the University of Alaska particularly caught the attention of privacy advocates:

The University of Alaska (鈥淯A鈥�) has a 鈥淕oogle Mail FAQs,鈥� which asks, 鈥淚 hear that Google reads my email. Is this true?鈥� The answer states, 鈥淭hey do not 鈥榬ead鈥� your email per se. For use in targeted advertising on their other sites, if your email is not encrypted, software (not a person) does scan your email and compile keywords for advertising. For example, if the software looks at 100 emails and identifies the word 鈥楧oritos鈥� or 鈥榗amping鈥� 50 times, they will use that data for advertising on their other sites.鈥�

鈥淭he fact that Google put this in their declaration means we take it as true,鈥� said Ms. Barnes of the privacy watchdog group EPIC. Google鈥檚 sworn court statements reveal that the company has violated student trust by using students鈥� education records for profit.鈥�

To illustrate the potential harm of Google鈥檚 alleged data-mining practices, Bradley S. Shear, a social-media and digital-privacy lawyer based in Bethesda, Md., posed a hypothetical situation in which a teacher using Google Apps for Education emails a parent with information related to a child鈥檚 disability status or mental health.

If the full range of allegations in the California suit is true, Mr. Shear said, the contents of such an email could be used by Google to build a digital-user profile that might follow that student indefinitely.

鈥淲ho knows what the hell Google is doing with that information, and who knows what problems it could cause for that child in the future,鈥� he said. 鈥淵ears ago, it might have been put in a filing cabinet, but it wouldn鈥檛 be tagged to the child forever.鈥�

鈥楳ajor FERPA Violations鈥�

Mr. Shear said he saw 鈥渕ajor FERPA violations鈥� in Google鈥檚 activities and suggested that the Education Department should investigate the company. The Federal Trade Commission, which is responsible for monitoring deceptive business practices, should also take note, he said.

The Family Educational Rights and Privacy Act was enacted in 1974 to protect the privacy of children鈥檚 educational records and to prevent unwarranted disclosure.

Last month, the Education Department issued guidance to schools and districts for how to interpret and apply the law in the new age of cloud-based educational services, massive collection of digital data, and increased outsourcing to ed-tech vendors.

One of the scenarios detailed in the guidance appears to closely describe the alleged data-mining practices of Google Apps for Education:

EXAMPLE 4: A district contracts under the school official exception with a provider for basic productivity applications to help educate students: email, calendaring, web-search, and document-collaboration software. The district sets up the user accounts, using basic enrollment information (name, grade, etc.) from student records. Under FERPA, the provider may not use data about individual student preferences gleaned from scanning student content to target ads to individual students for clothing or toys, because using the data for these purposes was not authorized by the district and does not constitute a legitimate educational interest as specified in the district鈥檚 annual notification of FERPA rights.

If a student, parent, or educator complains about a vendor potentially violating FERPA or other federal statutes, the department has the authority to investigate those claims and issue written findings back to the school in question and to the public.

Education Department spokeswoman Dorie Nolt said the department would be concerned if a vendor were using personally identifiable information from students鈥� educational records to target them with ads, but she would not comment on whether the department believes the alleged data-mining practices of Google Apps for Education violate federal law.

Joel R. Reidenberg, a law professor at Fordham University and the author of a much-discussed recent study of districts鈥� contracts with cloud-service providers such as Google, says that鈥檚 an open question, in part because the 40-year-old FERPA does not adequately define what constitutes an educational record in an era in which a previously unthinkable amount of digital data about students proliferates.

鈥淭he data-mining and data-processing activities involved in Google Apps for Education are very problematic for student privacy,鈥� Mr. Reidenberg said. 鈥淏ut the complexity of these arrangements exceeds what FERPA is really capable of addressing.鈥�

Greater Scrutiny Ahead

Some of Mr. Reidenberg鈥檚 recent work has been funded by Microsoft, the Redmond, Wash.-based computer and software corporation that has been competing with Google for business and challenging the younger company鈥檚 privacy policies and practices for years.

In an interview with 澳门跑狗论坛, Cameron Evans, Microsoft鈥檚 chief technology officer for education, called on Google to be more transparent.

鈥淚f they鈥檙e not doing anything wrong, they need to step up and say it and explain to people in unambiguous terms how they capture and use [students鈥橾 data,鈥� he said.

Mr. Bout of Google, in his statement to 澳门跑狗论坛, said the company is 鈥渃ommitted to protecting the privacy and security of our users鈥攁nd that includes students鈥攖o make sure their information is safe, secure, and always available to them.鈥�

Of course, the problem extends far beyond Google, Mr. Evans said. A growing number of companies rely on 鈥渇reemium鈥� business models in which they provide technology services to schools in exchange for access to an increasingly comprehensive body of information about students鈥攊ncluding 鈥渁mbient鈥� data about where they are located, what devices they are using, with whom they are interacting, and more.

As consumers grow savvier, lawsuits such as the one in California will become more frequent, Mr. Evans predicted, and pressure to modernize state and federal data-privacy laws will grow more intense.

The privacy policy for Microsoft鈥檚 Office 365, the company鈥檚 competitor product for Google Apps for Education, states 鈥淲e do not mine your data for advertising purposes. It is our policy to not use your data for purposes other than providing you productivity services.鈥�

That approach was appealing to Houston school officials, said Mr. Schad, the district鈥檚 CTO.

When seeking vendors as part of its new PowerUp technology initiative, the Houston district was aware of the 鈥渢housands of other districts using Google Apps for Education very successfully,鈥� said Mr. Schad, but ultimately elected to contract with Microsoft. Google鈥檚 data-mining practices were a red flag, he said, as was the company鈥檚 lack of responsiveness to Houston鈥檚 concerns about how student data would be handled.

鈥淔our years ago, data privacy was not on people鈥檚 radar screens,鈥� Mr. Schad said. 鈥淏ut this issue has legitimate legs, and big [cloud-based tool suites] like Google Apps for Education are going to be under greater scrutiny.鈥�