[Politech] EPIC letter compares Gmail to FBI's Carnivore, Total Information Awareness [priv]

From: Declan McCullagh (declan@private)
Date: Thu Apr 29 2004 - 21:11:52 PDT

  • Next message: Declan McCullagh: "[Politech] DOJ, FTC announce first CAN SPAM arrests [sp]"

    [Sure, a web-based email system that you voluntarily use is *exactly* 
    the same as FBI wiretapping and a mammoth government data-mining 
    project! Why didn't I think of that before... --Declan]
    
    
    
    http://www.epic.org/privacy/gmail/foirequest.html
    
    
    
         April 29, 2003
    
         David M. Hardy, Chief
         Record/Information Dissemination Section
         Records Management Division
         Federal Bureau of Investigation
         Department of Justice
         935 Pennsylvania Avenue N.W.
         Washington, DC 20535-001
    
             RE: Freedom of Information Act Request and Request for 
    Expedited Processing
    
         Dear Mr. Hardy:
    
         This letter constitutes an expedited request under the Freedom of 
    Information Act ("FOIA"), 5 U.S.C.  552, and is submitted on behalf of 
    the Electronic Privacy Information Center ("EPIC").
    
         We are seeking all records, including but not limited to 
    correspondence, memoranda, reports, presentations, and legal opinions, 
    concerning or involving communications between agency officials and 
    representatives of Google Inc. regarding use of Google search technology 
    for law enforcement and intelligence purposes, and particularly the 
    possible use of Google's Gmail service for law enforcement and 
    intelligence investigations.
    
         Request for Expedited Processing
    
         This request warrants expedited processing because it pertains to a 
    matter about which there is an "urgency to inform the public about an 
    actual or alleged federal government activity," and the request is made 
    by "a person primarily engaged in disseminating information." 6 C.F.R.  
    5.5(d)(1)(ii).
    
         Google Inc. is the developer of the largest search engine in the 
    world, with an index of more than 4 billion web pages.[1] On April 1, 
    2004, Google launched a test version of Gmail, "a free search-based web 
    mail service with a storage capacity of up to eight billion bits of 
    information, the equivalent of 500,000 pages of email. Per user."[2] In 
    addition to having immense storage capacity, Gmail is a unique service 
    because it indexes e-mail based on key terms contained within the 
    content of the message. Google has proposed one service that would allow 
    advertisers to target commercial ads to Internet users based on the key 
    terms contained within their private communications. We are interested 
    to know whether any federal agency has considered the use of the Gmail 
    service to further law enforcement investigations or intelligence 
    gathering activities by, for example, targeting advertising to Internet 
    users that could lead to the collection of evidence or intelligence by a 
    federal agency.
    
         In support of our claim for expedited processing, we point to the 
    pending release of the service and the extraordinary media media 
    attention that Gmail has generated. In fact, a Google News search for 
    "Gmail" from April 1, 2004, when Google announced the Gmail test phase 
    to the public, to April 29, 2004 returned 1,570 results (see first page 
    of search results, attached hereto).
    
         In further support of our request for expedited processing is that 
    fact that Gmail is capable of performing precisely the functions for law 
    enforcement and intelligence agencies that have been the subject of 
    Congressional action and widespread public debate. As journalist Stephen 
    H. Wildstrom explained:
    
             A . . . serious privacy concern is raised by the potential for 
    thousands of your messages, perhaps accumulated over years, being stored 
    on Google's servers, where you have little control over them. . . The 
    main federal law covering the privacy of e-mail, the Electronic 
    Communications Privacy Act, is 18 years old and full of flaws. Its 
    protections are loophole-ridden and, in particular, it allows 
    law-enforcement agencies to gain access to your messages on a mail 
    provider's system without your knowledge.[3]
    
         Wildstrom also noted that Gmail's search capability creates a 
    potential invasion of privacy that no other web-based email service 
    presents: "A privacy concern unique to Gmail is that Google could 
    combine information about a huge store of your mail with records of your 
    search activity into a detailed portrait of your life."[4]
    
         Gmail is capable of performing functions which law enforcement and 
    intelligence agencies have pursued before, drawing intense Congressional 
    and media interest. For instance, Gmail's capabilities are similar to 
    what the Defense Advanced Research Projects Agency (DARPA) hoped to 
    create in 2002 when it began developing the Total Information Awareness 
    Program. Joint Staff and Under Secretary of Defense for Acquisition, 
    Logistics and Technology Edward C. "Pete" Aldridge explained that TIA 
    was meant to perform data analysis to "determine links and patterns 
    indicative of terrorist activities[.]"[5] Office of Information 
    Awareness Director Admiral John Poindexter elaborated, "Certain agencies 
    and apologists talk about connecting the dots, but one of the problems 
    is to know which dots to connect. The relevant information extracted 
    from this data must be made available in large-scale repositories with 
    enhanced semantic content for easy analysis to accomplish this task."[6] 
    Congress eventually eliminated funding for the program[7] due in part to 
    concerns about the program's potentially grave impact on individuals' 
    privacy.[8]
    
         Because Gmail combines tremendous storage capacity with search 
    technology, the service could also analyze vast amounts of personal 
    information on every Internet user who subscribes to the Gmail service 
    or corresponds with a subscriber the Gmail service. As one editorial on 
    Gmail has noted, "it won't be long before law enforcement agencies say 
    they, too, want in. If that sounds paranoid, well, it's exactly the 
    argument that defenders of the Pentagon's Orwellian Total Information 
    Awareness program used: "If credit card companies can rifle through your 
    transactions, why not us?"[9]
    
         Further, Gmail performs automated searches of users' e-mail for 
    keywords upon which inferences are made. These inferences are then used 
    to draw specific inference about the activities and interests of 
    particular Internet users. This function is similar to that which the 
    FBI's Internet data interception tool DCS/1000, formerly known as 
    Carnivore, performs. The FBI's tool "is a software-based Internet 
    Protocol (IP) packet sniffer that can select and record a defined subset 
    of the traffic on the network to which it is attached . . . In limited 
    cases, packets can be selected based on their content."[10] Gmail has 
    the capability to perform a similar task for law enforcement or 
    intelligence agencies, eliminating the need actually to install 
    government software at Google for interception purposes.
    
         For these reasons, there is a particular urgency for the public to 
    obtain information about communications that agency officials have had 
    with Google representatives about actual or potential use of Google's 
    search technology and Gmail to pursue law enforcement and intelligence 
    investigations. The government activity at issue here -- cooperating 
    with one of the world's leading private purveyors of search technology 
    for law enforcement and intelligence investigatory purposes -- raises 
    serious privacy issues that will affect a significant portion of the public.
    
         The purpose of EPIC's request is to obtain information directly 
    relevant to the FBI's actual or potential use of Google technology, 
    particularly Gmail, to pursue law enforcement and intelligence 
    investigations. The records requested involve the manner and extent to 
    which the FBI is pursuing or utilizing Google technology for law 
    enforcement and intelligence ends, and clearly meet the standard for 
    expedited processing.
    
         Further, as I explain below in support of our request for "news 
    media" treatment, EPIC is "primarily engaged in disseminating information."
    
         Request for "News Media" Fee Status
    
         EPIC is a non-profit, educational organization that routinely and 
    systematically disseminates information to the public. This is 
    accomplished through several means. First, EPIC maintains a heavily 
    visited web site (www.epic.org) that highlights the "latest news" 
    concerning privacy and civil liberties issues. The site also features 
    scanned images of documents EPIC obtains under the FOIA. Second, EPIC 
    publishes a bi-weekly electronic newsletter that is distributed to over 
    15,000 readers, many of whom report on technology issues for major news 
    outlets. The newsletter reports on relevant policy developments of a 
    timely nature (hence the bi-weekly publication schedule). It has been 
    published continuously since 1996, and an archive of past issues is 
    available at our web site. Finally, EPIC publishes and distributes 
    printed books that address a broad range of privacy, civil liberties and 
    technology issues. A list of EPIC publications is available at our Web site.
    
         For the foregoing reasons, EPIC clearly fits the definition of 
    "representative of the news media" contained in the FOIA and the 
    Department of Justice regulations. Indeed, the U.S. District Court for 
    the District of Columbia has held that EPIC is a "news media" requester 
    under the FOIA. See Electronic Privacy Information Center v. Department 
    of Defense, 241 F. Supp. 2d 5 (D.D.C. 2003). Based on our status as a 
    "news media" requester, we are entitled to receive the requested records 
    with only duplication fees assessed. Further, because disclosure of this 
    information will "contribute significantly to public understanding of 
    the operations or activities of the government," as described above, any 
    duplication fees should be waived.
    
         Thank you for your consideration of this request. As applicable 
    Department regulations provide, I will anticipate your determination on 
    our request for expedited processing within ten (10) calendar days. 
    Should you have any questions about this request, please feel free to 
    call me at 202-483-1140 ext. 112.
    
         Under penalty of perjury, I hereby affirm that the foregoing is 
    true and correct to the best of my knowledge.
    
         Sincerely,
    
         Marcia Hofmann
         Staff Counsel
    
         [1] Google, Google Inc. Company Overview, at 
    http://www.google.com/press/overview.html (last accessed Apr. 27, 2004).
    
         [2] Press Release, Google Inc., Google Gets the Message, Launches 
    Gmail (Apr. 1, 2004) available at 
    http://www.google.com/press/pressrel/gmail.html.
    
         [3] Stephen H. Wildstrom, Google's Gmail is Great -- But Not For 
    Privacy, BusinessWeek Online, April 25, 2004, at 
    http://www.businessweek.com/magazine/
         content/04_18/b3881046.htm.
    
         [4] Id.
    
         [5] Department of Defense News Briefing (Nov. 20, 2002); see also 
    Congressional Research Service, Library of Congress, Privacy: Total 
    Information Awareness Programs and Related Information Access, 
    Collection and Protection Laws (March 21, 2003) 2.
    
         [6] John Poindexter, DARPATech 2002 Conference, Anaheim, CA (Aug. 
    2, 2002).
    
         [7] Department of Defense Appropriations Act, 2004, Pub. L. No. 
    108-87  8131 (2003).
    
         [8] See, e.g., Department of Defense Nominations: Hearing Before 
    the Senate Armed Services Committee, 108th Cong. (2003) (comment of Sen. 
    Carl Levin); Threats to U.S. Security: Hearing Before the Senate Select 
    Intelligence Committee, 108th Cong. (2003) (question of Sen. Ron Wyden).
    
         [9] Editorial, If Google Ogles Your E-Mail, Will Ashcroft Be Far 
    Behind?, San Jose Mercury News, Apr. 15, 2004, at B OP1.
    
         [10] IIT Research Institute, Independent Review of the Carnivore 
    System, Final Report (Dec. 2000) 1.
    
         EPIC Privacy Page | EPIC Home Page
    
         Last Updated: April 29, 2004
         Page URL: http://www.epic.org/privacy/gmail/foirequest.html
    _______________________________________________
    Politech mailing list
    Archived at http://www.politechbot.com/
    Moderated by Declan McCullagh (http://www.mccullagh.org/)
    



    This archive was generated by hypermail 2b30 : Thu Apr 29 2004 - 21:37:31 PDT