UC Berkeley students file lawsuit against Google alleging illegal scanning of emails

google infographic final

Related Posts

In March 2014, Google fell under fire for scanning emails in Apps for Education, a collection of online tools and services that include Google Drive and Google Mail.

Now, nearly two years later, four UC Berkeley students and alumni filed a lawsuit against Google Inc. on Wednesday, alleging that UC Berkeley emails were the target of such data mining between 2012 and 2014.

In 2014, nine plaintiffs in California accused Google of scanning emails — or collecting information on users for advertising purposes without permission. Similarly, the four UC Berkeley plaintiffs — Ryan Corley, William Dormann, Shannon Mehaffey and Teddey Xiao — involved in the current lawsuit allege they did not agree to have their emails intercepted and read by Google for advertising purposes.

The plaintiffs allege Google scanned emails and thus violated the Electronic Communications Privacy Act, a federal statute that protects electronic communications while in transit and in storage. Google has not released any information verifying whether the emails were scanned, although attorney Ray Gallo of Gallo, LLP, who is filing the lawsuit on behalf of UC Berkeley students and alumni, and the plaintiffs believe that a 2014 post by Google acknowledging that Apps for Education emails had been scanned prove it.

“The point is that you should be entitled to decide what information you share,” Gallo said. “In this particular case, people did not consent to Google having that information.”

According to Gallo, claims could be worth $10,000 per person in damages.

Google representative William Fitzgerald said in an email that the company does not comment on pending litigations.


Previous legal challenges

Google previously avoided charges by offering evidence that some Google Apps for Education users had consented and knew that Google was scanning emails. Judge Lucy Koh said in 2014 that it would be impossible to determine which email users consented to Google’s privacy policies so cases could not go through as a class action lawsuit, which means one plaintiff could not file the lawsuit on behalf of a large group of people.

This meant that small groups could mount a wiretapping challenge to Google’s services, said Chris Hoofnagle, campus law professor and faculty director of the Berkeley Center for Law and Technology, in an email.

“Of course we use Google on campus but we do not have a reliable answer about how Google is scanning student and faculty email,” Hoofnagle said in an email.

On April 30, 2014, the company announced that it had disabled ads scanning in Apps for Education.

“This means ads in Apps for Education services are turned off and administrators no longer have the option or ability to turn ads in these services on,” said Google for Education Director Bram Bout in the statement. “Google cannot collect or use student data in Apps for Education services for advertising purposes.”

Gallo said this meant Google acknowledged in April that it had been scanning Apps for Education users’ emails after all.

Nationwide, 30 million students, teachers and administrators used the free Google Apps for Education email accounts in 2014.

How does Google use email scanning for advertising purposes?

Data mining allows Google to develop user profiles to target ads more successfully. While most Gmail users may have authorized scanning by accepting some terms and conditions, Gallo said, Google Apps for Education users from UC Berkeley and many other schools may not have.

According to a statement from the campus, Google cannot scan emails under the contract it has with UC Berkeley.

“The agreement that UCB utilizes for our Google Apps for Education Service does not allow for Google’s use of our data for any purposes other than to fulfill its obligations to deliver the service to us under our agreement,” the statement reads. “UCB does not believe that scanning for the purpose of serving ads anywhere is an allowed use under the agreement.”

UC Berkeley is not involved in the lawsuits, Gallo said. The suit he filed alleges that other UC Berkeley Apps for Education users between 2012 and 2014 including faculty and staff would have also had their emails scanned, based on Google’s 2014 announcement.

According to the U.S. Department of Education, under the Family Educational Rights and Privacy Act, outside parties like school-sanctioned email services must adhere to conditions that govern students’ education records.

Outside parties can only use information such as that obtained in email data mining for the specific “legitimate educational interests” the disclosure was made, according to a statement from U.S. Department of Education.

After the initial lawsuits in 2014, Hoofnagle explained in a blog post that Google switched to a new technology in 2010 called a Content Onebox that allows the company to  intercept emails in transit from other email systems rather than scan those already stored in Google Mail.

At UC Berkeley, where students and faculty are privy to everything from confidential data and patient information to valuable research on new technologies, a system that scans emails is even more threatening, Hoofnagle said in the post.

“(The data mining) would allow Google to understand the meaning of all of our communications: the identities of the people with whom we collaborate, the compounds of drugs we are testing, the next big thing we are inventing,” Hoofnagle wrote. “Imagine the creative product of all of Berkeley combined, scanned by a single company’s ‘free’ email system.”

UC Berkeley senior Ryan Corley and a plaintiff in the current lawsuit against Google, said in an email that the alleged scanning of emails by Google would constitute an “invasion of (his) privacy.”

The scanning of potentially sensitive information is “creepy,” staff technologist at the Electronic Frontier Foundation Jeremy Gillula said. The Electronic Frontier Foundation filed a complaint December 2015 under the Federal Trade Commission for unfair and deceptive trade practices.

The complaint says Google scanned people’s emails while leading them to believe otherwise, which Gillula alleged is false advertising.

“A lot of these platforms are emails you have to use to participate in college,” Gillula said. “You’re forced to give up any sense of privacy in your communications to turn in your homework.”

In general, scanning of emails containing confidential health information is an example of data collection that is “potentially very dangerous” and should not be available to Google for targeting users for ads, Consumer Watchdog’s Privacy Project director John Simpson said.


Moving forward

Hoofnagle wrote in 2014 that Google would have a hard time defending its claim that users and campuses consented to the interception of their communications.

“Those campuses that negotiated a ‘no data mining’ provision are in the best position to argue that there was no consent, because they specifically rejected such data analysis,” Hoofnagle wrote. “And they are likely to have a claim because the placement of the content one box suggests that data mining is taking place over the entire stream of traffic.

As people become more aware of allegations of Google’s data mining, Gallo expects to file more cases on behalf of students from other schools using Apps for Education in addition to UC Berkeley.

“I think that people at a minimum should be entitled to not just the opportunity to consent, but a very prominent disclosure,” Gallo said.

Michelle Leung covers student life. Contact her at [email protected].

Please keep our community civil. Comments should remain on topic and be respectful.
Read our full comment policy
  • Paul Cho (推小嶋)

    I want to file lawsuit to Google too, their DMCA problem cause my web site and twitter down.

  • https://about.me/nicholasmeyler Nicholas Meyler

    What’s obvious is that the ball-less Presidency of Obama doesn’t have the intelligence, drive or tenacity to go after massive criminal corporations like Google with the DOJ. Obama’s ‘administration’ is pretty much a ‘free ride’ to criminals, terrorists, Communists and anyone with a subversive agenda (unless they are Christian, Conservative and Caucasian, of course). Loretta Lynch is clearly not up to the challenge, nor was Holder…

  • Scott LeBold

    I predict that Google will defend its actions as necessary to “fulfill its obligations to deliver the service to [UC] under [the] agreement.” which is a very big loophole and, in any case, we haven’t seen the contract. Maybe Google is scanning for spam, intellectual property theft, malware and other threats or policy violations (e.g., bullying), e.g. https://www.insidehighered.com/news/2016/02/01/u-california-faculty-members-object-new-email-monitoring

  • http://www.bookoflife.org Michael

    Google will eventually change name from Alphabet to GOD, as they believe they own it all.

  • ShadrachSmith

    Cool. You will be amazed at who is accessing your stuff. If you find out too much, they may kill you, but it’s nice to have a hobby.

  • Ray E. Gallo

    Students, faculty, and staff who care about privacy, money, or morality should join the case. Google wasn’t honest. The federal wiretap act applies and allows $10k or more in statutory damages. Go to http://www.emailprivacylit.com to learn more. UC Berkeley thought it had protected students’ privacy rights. Notably, users at Harvard, Yale (my alma mater), SDSU, SUNY Stony Brook, Bates, UWash, and other schools are in the same boat. (See the list at http://www.emailprivacylit.com.) See if you qualify at http://www.emailprivacylit.com. You can sign up there if you do. If you don’t pursue this, Google gets off free (because it beat class certification) and you walk away from a valuable claim. $10k is too much, and privacy to dear, not to sign up. I’d say the same thing to my child, my mom, or my sister. Pursue this. We’re representing everyone on contingency. The more folks who sign up, the greater our strength. Help yourselves, do the right thing, and pursue accountability for corporate america. (Oh, and by all means do your due diligence on our firm if you have any questions.) Ray E. Gallo (Gallo LLP).

    • John Smith

      Wow. Chase ambulances, much?

      Personally, if I had a claim, I’d pursue it but not with someone who begs for clients like this. Especially, a (supposed) attorney who slaughters the English language (“privacy to (sic) dear”).

      Alphabet’s lawyers are gonna have a field day with this clown.

      • Ray E. Gallo

        I suspect that if we’re good enough to be the lawyers of choice for CEO’s who run big companies, and the thousands of students we’ve helped (to tens of millions of dollars) in the past few years, we might even be good enough for the likes of you “John Smith.” See https://gallo-law.com/testimonials and otherwise do your due diligence before buying (or speaking foolishly).

  • http://Batmannananana.com/ Caesar Merlin

    UC made a mistake contracting with google. What did they think would happen outsourcing university email services.

  • Nunya Beeswax