Google Scans of Student Emails Spur Privacy Concerns

More California schools are signing up for Google’s software as they scramble to install additional computers in classrooms. Under new state curriculum requirements known as Common Core, students must take computerized tests.

Randy Kolset, a technology coordinator at Orange County’s department of education, said many school districts in the county are in various stages of implementing Google’s software. Other districts, he said, “are testing the possibilities.”

“At some districts, every teacher and student has an account,” Kolset said.

The districts using Google’s software include Anaheim City, Anaheim Union High, Fullerton School District, Huntington Beach Union High, Tustin Unified and Saddleback Valley, he said. Not all of those districts are using the software’s email system, Kolset said.

Google says that 30 million students and teachers are using the software around the world. Besides email, the system includes calendar and document-creation tools as well as abundant Web-based storage.

In November, the Register hosted a conference for county educators where Google employees touted Chromebooks, a tablet computer developed by Google that runs on the software. Last year, the Register offered to donate a Chromebook to a subscriber’s choice of schools with the purchase of a subscription.

The company has wooed teachers by offering free training at what it calls the Google Teacher Academy. Those who become Google Certified Teachers get a special badge, access to a private online community, and opportunities to work closely with the company.

The privacy lawsuit was filed in U.S. District Court in San Jose on behalf of students across the country by Sean Rommel, a Texas lawyer. The case was initially filed on behalf of two college students. Scores of colleges and universities have also installed Google’s free software and email system.

In his legal filings, Rommel has tried to show the company’s mindset by including past comments by Eric Schmidt, Google’s executive chairman. Schmidt made some of those comments at a public forum organized by the Atlantic magazine in 2010.

“With your permission you give us more information about you, about your friends, and we can improve the quality of our searches,” Schmidt had said. “We don’t need you to type at all. We know where you are. We know where you’ve been. We can more or less know what you’re thinking about.”

In court, Google’s lawyers have argued that the public has long known it was scanning and indexing emails, and that Google users consent to this by agreeing to its terms of service.

Students must agree to a user agreement in order to create a Google account. That agreement links to the company’s lengthy privacy policy, which explains that Google collects information from its users, including their search queries, so that it can offer them more relevant information – and ads.

In documents filed in November, Google’s lawyers explained that the company partners with advertisers who select certain keywords. If those words appear in an email that a user sends or receives, it can trigger a small ad from that company. For example, the lawyers explained, if a user reads an email with the word pizza, an ad for pizza may appear.

Google ran into trouble with federal regulators in 2011 because of these keyword ads. The company forfeited $500 million to the government after investigators found it had knowingly targeted consumers for ads from “rogue” Canadian pharmacies in the United States. Prosecutors said Google was aware that some of those pharmacies did not require a prescription for narcotic painkillers and other drugs, but had continued to accept their money and even helped them make the ads more effective.

In the ongoing privacy case, Google’s lawyers explained that the company launched a new targeted ad system in 2011 that scans all emails, even if the user doesn’t open them. The compiled email information “helps create a more accurate user profile, based on the users’ interests and online habits,” the lawyers wrote.

Google has asked the court to keep many of the documents filed in the case secret. Last month, the company asked the judge to black out certain sections of a transcript of a public court hearing that occurred on Feb. 27. A group of news organizations is trying to convince the judge that the documents should be made public.

A Google spokeswoman, who wouldn’t allow her name to be used, told the Register last week that the company could not comment on details of the pending litigation.

She explained that the emails are scanned and indexed not just for advertising but for multiple purposes, including functions like spell check and spam protection. The students’ emails are processed on the same infrastructure as consumers’ Gmails, which helps ensure reliability and security, she said.

Google’s employees don’t actually read the emails, she said. The scanning of emails “is 100 percent automated and can’t be turned off,” she said.

The spokeswoman declined to answer specific questions, including how long Google stored the students’ emails and other personal information on its servers.

On its website, the company discloses that even if users delete certain information – like past search queries – from their Google accounts, the data remains in what it calls its “server logs.”

At Century High School in Santa Ana, students are told to sign into their Google accounts using their birth date as a password, according to the school’s website. The instructions explain, “Accept the Google account user agreement if you have not yet done this.”

Rommel, the lawyer who filed the privacy case, argues that minors cannot legally agree to have their emails intercepted.

David Haglund, deputy superintendent at Santa Ana Unified, said about half of the district’s 56,000 students have a Google account.

Haglund said the district’s teachers train students to be “good digital citizens.” For example, students are warned not to share phone numbers and other personal information in emails.

He added that the district does not allow ads on the Google software and that he hasn’t found any evidence of Google targeting students. “We make sure that doesn’t occur at school,” he said.

At Tustin Unified, all 24,000 students have email accounts, beginning in kindergarten, said Mark Eliot, a district spokesperson. No advertisements are allowed, he said, and the email address does not include the student’s full name. Students can send emails only internally, he said.

Saddleback Valley shared its agreement with Google. The contract says that the school district, and not Google, is required to get parents’ consent “concerning collection of students’ personal information.” A Saddleback spokesperson said administrators have not given students Google email accounts.

Bradley Shear, a digital privacy lawyer in Bethesda, Md., said he believes Google’s scanning of student emails violates myriad laws, including the federal Family Educational Rights and Privacy Act, which protects education records.

Shear said he believes Google intentionally misled students, parents and schools. The data collected by Google could follow students indefinitely, he said.

Shear said parents should imagine a case where a student sent emails to his teacher about his research paper looking into a cancer gene found in his family. The risk for the student, Shear said, is that such information could later be used against him as an adult when he applies for a job, health coverage or life insurance.

“I don’t think our children’s personal information should be put on sale to the highest bidder,” Shear said. “It’s an absolute breach of the public trust.”

Contact the writer: mpetersen@ocregister.com