Read My Mail, Please

The silly privacy fears about Google’s e-mail service.

Google co-founders Sergey Brin and Larry Page were the heroes of the Net from the moment they launched their better-than-the-rest search engine in 1998, right up until two weeks ago. On April 1, they announced plans for Gmail, a Googleized alternative to the free Web-based e-mail services offered by Hotmail, Yahoo!, and a slew of smaller companies. Depending on your take, Gmail is either too good to be true, or it’s the height of corporate arrogance, especially coming from a company whose house motto is “Don’t Be Evil.”

At first, Web hipsters dismissed Gmail as an April Fool’s hoax. But Google’s offer is real. Gmail will provide each user an entire gigabyte of free e-mail storage. That’s about 250 times the 4-megabyte limit of a basic Yahoo! Mail account and 10 times Hotmail’s 100-megabyte “super-user” package, which costs $60 a year. In return for all that inbox space, Google wants just one favor: to be allowed to scan the content of your incoming messages and serve content-targeted ads alongside them.

If you haven’t tried it, it sounds creepy. But after a week of testing the prerelease version of Gmail, I’m on the other side of the fence. Gmail isn’t an invasion of privacy, and its ads are preferable to the giant blinking banners for diets and dating services that are splashed across my other Web mail accounts.

Judging by the reaction of lots of people, Google might as well have asked for everyone’s ATM passwords. California state Sen. Liz Figueroa told Reuters she wasdrafting legislation that, if passed, would prohibit the scanning of e-mail in order to serve ads. In England, watchdog group Privacy International filed a complaint that Gmail would violate the European Union’s privacy laws. Silicon Valley’s paper of record,the San Jose Mercury News, fretted on its editorial page, “If Google ogles your mail, can Ashcroft be far behind?” The controversy bubbled all the way up to late night, where Conan O’Brien joked about Google inserting ads for 1984.

The outcry isn’t new, only the scale of it is. Ten years ago, some Web pioneers had a similarly squeamish reaction when the first search engines began crawling their sites and including them in searchable databases, along with ads matched to users’ queries. As a manager for HotBot, one of the first ad-carrying search engines in the mid-1990s, I heard from plenty of Webmasters who demanded that their pages be removed from the system. Today, their objections seem quaint.

Ten years from now, we’ll probably look back at the Gmail dust-up with similar befuddlement. Even now, most Google-bashers have one thing in common: They haven’t actually laid eyes on Gmail. Critics have falsely claimed that Google staff, rather than automated software, will read your e-mail, that ads will be inserted into e-mail message text, rather than alongside it in your browser window, and that Google will collect a log of which ads are served to your account. Most important, Gmail critics have ignored the fact that automated software already scans the contents of your incoming e-mail messages. Antispam and antivirus software at most ISPs and corporate firewalls comb through the personal contents of your e-mail all the time. Gmail is just a little more upfront about it.

Gmail’s ads are text-only, in the same spartan format used for the ads next to Google’s search engine results. In my tests, a mailing-list discussion about in-ear headphones was flanked by terse ads for headphones and audio stores. Press releases about developments in the Wi-Fi industry were accompanied not by ads, but by links to “related pages” from Google’s search engine. Social chit-chat, such as “let’s catch up” or “what are you doing Friday,” got no ads or links at all. I tried forcing Gmail’s hand with keywords like “Claritin” and “suicide,” but it ignored them.

Best of all, my outgoing messages are free of the appended shills tacked on by other services, such as “Yahoo! Tax Center—File online by April 15” or “FREE pop-up blocking with the new MSN Toolbar—get it now!” If you’ve ever found one of those at the bottom of an e-mail about a death in the family, Gmail’s ad strategy sounds appealing, not invasive.

But Gmail’s user-friendliness won’t quiet critics who fear that Google has implemented a tool akin to Carnivore, probably far more efficiently than the FBI did. I called Google co-founder Sergey Brin about this and got a half-encouraging response. Gmail’s ad server, he says, doesn’t collect any info on which ads it serves to which specific users, nor does it record users’ browser cookies or IP addresses. There’s a twofold benefit to that. Advertisers can’t get reports on who saw what, Brin says, and Google won’t have personal data about your ad viewing to hand over to the Man, should a subpoena or warrant be served.

The real threat of using Web mail—from Google or from anyone else—is having your mail itself subpoenaed or just plain leaked. Web mail accounts have been cracked despite the best efforts of their administrators. CNET cyber-rights advocate Declan McCullagh listed past security breaches at Yahoo! and Hotmail in a column this week, then slammed critics of Gmail’s ad plan on his Politech mailing list. “I’m starting to suspect that these pro-regulatory privacy folks who are so upset about Google are really just anti-advertising,” he wrote, because they haven’t raised similar cries over antispam software.

The most obvious way for Google to mollify Gmail critics would be to allow users a chance to opt out of the targeted ads, and hope that most won’t bother. Brin insists the company has no plans to do that, contrary to recent news reports, but he says it hasn’t been ruled out, either. In return for turning off the company’s ad targeting system, Google could offer, say, only 10 megabytes of disk space to those who opt out. It would still be a better deal than Hotmail and Yahoo! Mail, and skittish customers might reconsider the ads as they near their inbox quotas. Still, critics would demand that the ad-targeting system be opt-in instead of opt-out, even though they make no similar demand for spam-filtering software. What’s more, the opt-out solution wouldn’t assuage non-Gmail users who fear their missives to opted-in Gmailers will be handed over to advertisers, or worse, John Ashcroft.

Luckily, there’s a better option. Ten years ago, the privacy objections of people who didn’t want their Web sites crawled by search engines were put to rest with a simple fix: Webmasters could place a file named robots.txt on their sites as a “No Trespassing” marker, a sign that they didn’t want their site to be searched. Google needs to offer a robots.txt for e-mail, some kind of tag that any Web user can include in a message to indicate that it shouldn’t be scanned by Gmail software. Given that antispam and antivirus software will scan the e-mail anyway, this solution would be somewhat phony. But if McCullagh is right that Gmail-bashers are just opposed to helping advertisers, it will do the trick.

The Google guys need to implement this before the backlash gets out of hand. Otherwise, they may be forced to abandon the best Web mail system yet because of a few well-placed people who’ve never even tried it. That really would be evil.