Free Web-Based E-mail Services Can Cost You Some Privacy
By Robertson Barrett
A new plan by Google to offer a free, Web-based e-mail service has raised the hackles of privacy advocates and consumer groups, largely because the company would match ads with the contents of personal messages.
But how private are the major free e-mail services that millions of Americans already use? According to Nielsen//NetRatings, a research firm that measures Web usage, the three biggest players – Yahoo, AOL and Microsoft (MSN and Hotmail) – have more than 100 million subscribers combined, and all support their services with some form of targeted advertising. To do that, they have to know something about you.
“The vast majority of online service providers give you a Web-based option,” says Beth Givens, executive director of the Privacy Rights Clearinghouse (www.privacyrights.org), an advocacy group based in San Diego. “People love the convenience and that it’s free. But there are some big privacy issues with Web-based e-mail that people don’t think about.”
Dave Adhicary has thought about it. A Consumer Reports WebWatch reader and television news producer in the Washington, D.C. area, Adhicary sought an easy way to check his e-mail from the road. Having worked at several TV networks, he also wanted a “portable” e-mail address that would stay with him as he changed jobs.
Adhicary solved both problems when he signed up for the free Web-based e-mail service from Netscape, the AOL subsidiary. But he didn’t like the fact that when he composed and sent messages, his Web browser often seemed to be communicating with DoubleClick, a company that provides the banner advertisements on the page.
“I’m a little ticked off that every time I e-mail a note to my girlfriend, I see at the bottom of the page … it says, ‘Sending data to DoubleClick,'” says Adhicary. “I don’t want it to be intercepted.”
Technically, DoubleClick wasn’t “intercepting” Adhicary’s personal messages. But, like other companies that serve online ads, it was building a record of his surfing habits to serve him certain ads on his Netscape Web pages. (If he frequently visits automobile sites, for example, he might see ads about cars while e-mailing.)
That’s still too close for comfort for many privacy groups.
“It’s not that they know what you’re talking about in your e-mails, but it’s very invasive because they can build a consumer profile of you,” says Pam Dixon, executive director of the non-profit World Privacy Forum (www.worldprivacyforum.org) in San Diego. “And if you’re using Hotmail and you get a DoubleClick banner ad in an e-mail, they can track the ad and find out when you’ve opened that e-mail.”
(DoubleClick spokesman David Franklin says e-mail tracking is limited to Web pages and some e-mail subscriber-based newsletters. Web users can avoid having a DoubleClick track record by changing privacy settings on their browser to turn off “cookies,” or by clicking on an icon at http://www.doubleclick.com/us/about_doubleclick/privacy/.)
But just because Netscape, MSN Hotmail, Yahoo and other free Web-based e-mail providers don’t snoop through the content of users’ e-mail for marketing purposes, privacy mavens say these services are a long way from being “secure.”
“With Web-based e-mail, you’re storing it on their computers,” says Givens of the Privacy Rights Clearinghouse. “If you’re in a legal case, going through a divorce or concerned about law enforcement, it can be subpoenaed in any court case if you keep it longer than six months. It’s just not as secure as storing it on your own computer.”
The Check Is In Gmail
Google’s announcement of its forthcoming free service, Gmail, sent a tremor through the privacy community early this month because the service would do precisely what Adhicary was afraid of: Scan the content of personal e-mail communications.
The lure is an eye-popping 1 gigabyte of e-mail storage space – 250 times the amount Yahoo offers, and enough for most users to store many years’ worth of e-mail in a convenient, searchable archive. The rub: When someone receives e-mail through Google’s service – or when a Gmail user receives e-mail from anyone else – the subject matter will call up an eerily relevant ad right along with it.
“It’s one thing for DoubleClick to know you went from CNN.com to FoxNews.com and then serve you an ad for MSNBC.com,” says Chris Hoofnagle, associate director of the Electronic Privacy Information Center (epic.org) in Washington, D.C. “It’s another thing when you e-mail me about dinner and say, ‘I’d like to try an Italian restaurant,’ and right next to that is an ad for an Italian restaurant. Breaking into the communication layer is a fundamental difference, and we think it’s a big no-no.”
On April 6, EPIC, the World Privacy Forum and 26 other privacy and consumer groups sent Google an open letter (http://www.worldprivacyforum.org/gmailrelease.pdf; Adobe’s pdf Reader is required to access the file. You can download it here:http://www.adobe.com/products/acrobat/readstep2.html) warning that “the Gmail system sets potentially dangerous precedents and establishes reduced expectations of privacy in e-mail communications” and asking it to suspend the e-mail service, which is now in a test run.
Google has responded to the outcry in part by pointing to its privacy policy, which says: “We serve highly relevant ads and other information as part of the service using our unique content-targeting technology. No human reads your e-mail to target ads or related information to you without your consent.” The company also says the programs that scour e-mail have built-in logic to avoid tasteless ad placements, such as those for funeral parlors in the case of family deaths.
Hoofnagle says Google’s e-mail-scanning may be open to legal challenges in the United States, where some states require explicit consent from users before private communications can be examined by third parties. The European Union requires approval from both sender and recipient for e-mail scanning – even if one of them does not subscribe to that particular e-mail service. “You could argue that the Gmail subscriber has consented,” he says. “But if I send e-mail to him, what about my consent?”
Undercover E-mail
For Web users like Adhicary who want to avoid e-mail services that gather information, there are ad-free e-mail accounts that come with paid Internet services, such as Earthlink’s. But privacy experts say these don’t offer meaningful protections against hackers, snoops or subpoenas from any lawyer who wants to drag e-mail into any case.
Instead, they suggest Web users take the extra time to explore “proxy” services (the same SSL or “https” technologies that commercial Web sites use to keep credit-card numbers secure) such as ZipLip (ZipLip.net), which offers a free service, and Mute-mail (mute-mail.com), which starts at $14.95 a month. These services can mask an e-mail-sender’s identity even from e-mail companies themselves.
As a further step, HushMail (hush.com) and S-Mail (www.s-mail.com) scramble e-mail if both the sender and recipient use the companies’ e-mail accounts, and they are compatible with PGP (“Pretty Good Privacy”), the experts’ preferred software for protection against hackers. Another free service, run by the non-profit CryptoMail (cryptomail.org), is an experts’ favorite but requires a software download and some reading.
Because most people will continue to use the major commercial free services, says the World Privacy Forum’s Dixon, they should at least take basic precautions.
“The Holy Grail of all of this is, you don’t want your actual legal name in your e-mail address, or it can be associated with your preferences and habits,” she says. “Use a nickname, an alternate of yours, or a couple of initials of your name. And above all, if you wouldn’t want something shouted over a broadcast speaker in your neighborhood, don’t e-mail it.”