Patriot Act haunts Google service

http://www.theglobeandmail.com/servlet/story/RTGAM.20080324.wrgoogle24/BNStory/Technology/home

SIMON AVERY

From Monday's Globe and Mail

March 24, 2008 at 4:05 AM EDT

Google Inc. is a year into its ground-shifting strategy to change the way people communicate and work.

But the initiative to reinvent the way that people use software is running headlong into another new phenomenon of the information technology age: the unprecedented powers of security officials in the United States to conduct surveillance on communications.

Eighteen months ago, Lakehead University in Thunder Bay, Ont., had an outdated computer system that was crashing daily and in desperate need of an overhaul. A new installation would have cost more than $1-million and taken months to implement. Google's service, however, took just 30 days to set up, didn't cost the university a penny and gave nearly 8,000 students and faculty leading-edge software, said Michael Pawlowski, Lakehead's vice-president of administration and finance.

U.S.-based Google spotlighted the university as one of the first to adopt its software model of the future, and today Mr. Pawlowski boasts the move was the right thing for Lakehead, saving it hundreds of thousands of dollars in annual operating costs. But he notes one trade-off: The faculty was told not to transmit any private data over the system, including student marks.

The U.S. Patriot Act, passed in the weeks after the September, 2001, terrorist attacks in the United States, gives authorities the means to secretly view personal data held by U.S. organizations. It is at odds with Canada's privacy laws, which require organizations to protect private information and inform individuals when their data has been shared.

At Lakehead, the deal with Google sparked a backlash. "The [university] did this on the cheap. By getting this free from Google, they gave away our rights," said Tom Puk, past president of Lakehead's faculty association, which filed a grievance against Lakehead administration that's still in arbitration.

Professors say the Google deal broke terms of their collective agreement that guarantees members the right to private communications. Mr. Puk says teachers want an in-house system that doesn't let third parties see their e-mails.

Some other organizations are banning Google's innovative tools outright to avoid the prospect of U.S. spooks combing through their data. Security experts say many firms are only just starting to realize the risks they assume by embracing Web-based collaborative tools hosted by a U.S. company, a problem even more acute in Canada where federal privacy rules are at odds with U.S. security measures.

"You have to decide which law you are going to break," said Darren Meister, associate professor of information systems at the Richard Ivey School of Business, who specializes in how technology enhances organizational effectiveness. "If I were a business manager, I would want to be very careful about what kind of data I made accessible to U.S. law enforcement."

Using their new powers under the Patriot Act, U.S. intelligence officials can scan documents, pick out certain words and create profiles of the authors - a frightening challenge to academic freedom, Mr. Puk said.

For instance, a Lakehead researcher with a Middle Eastern name, researching anthrax or nuclear energy, might find himself denied entry to the United States without ever knowing why. "You would have no idea what they are up to with your information until, perhaps, it is too late," Mr. Puk said. "We don't want to be subject to laws of the Patriot Act."

Google's free Web tools are advertising-based and they automatically extract information from personal content to build a profile for advertisers. Lakehead professors also object to this feature, although Mr. Puk says Google has refrained from attaching ads until the grievance is settled.

The privacy issue goes far beyond academia. In Toronto, at SickKids Foundation, which has the largest endowment of any Canadian hospital, employees have been keen to use Google tools. But the foundation's IT department blocked access for two reasons.

"Wherever possible, we keep our donor and patient records in Canada, as trying to enforce privacy laws in other jurisdictions is complex and expensive," said Chris Woodill, director of IT and new media at SickKids Foundation. Second, free hosted software offers limited support and no formal legal contract, limiting an organization's ability to demand additional privacy or security measures, he said.

Google says it has a strong track record in regard to protecting customers' data. The firm cites a court case it fought in 2006 against attempts by the U.S. Justice Department to subpoena customer search records. "We will continue to be strong advocates on behalf of protecting our users' data," said Peter Fleischer, Google's global privacy counsel.

But the Mountain View, Calif.-based company will not discuss how often government agencies demand access to its customers' information or whether content on its new Web-based collaborative tools has been the subject of any reviews under the Patriot Act.

Montreal security strategist Jeffrey Posluns says Google's software suite may suit some small businesses because cost savings are significant. But he warns that the deciding factor should be the sensitivity of the organization's information.