EPIC letter compares Gmail to FBI's Carnivore, Total Information Awareness [priv]

[Declan McCullagh <declan () well com>]

[Sure, a web-based email system that you voluntarily use is *exactly* 
the same as FBI wiretapping and a mammoth government data-mining 
project! Why didn't I think of that before... --Declan]



http://www.epic.org/privacy/gmail/foirequest.html



    April 29, 2003

    David M. Hardy, Chief
    Record/Information Dissemination Section
    Records Management Division
    Federal Bureau of Investigation
    Department of Justice
    935 Pennsylvania Avenue N.W.
    Washington, DC 20535-001

        RE: Freedom of Information Act Request and Request for 
Expedited Processing

    Dear Mr. Hardy:

    This letter constitutes an expedited request under the Freedom of 
Information Act ("FOIA"), 5 U.S.C. § 552, and is submitted on behalf of 
the Electronic Privacy Information Center ("EPIC").

    We are seeking all records, including but not limited to 
correspondence, memoranda, reports, presentations, and legal opinions, 
concerning or involving communications between agency officials and 
representatives of Google Inc. regarding use of Google search technology 
for law enforcement and intelligence purposes, and particularly the 
possible use of Google's Gmail service for law enforcement and 
intelligence investigations.

    Request for Expedited Processing

    This request warrants expedited processing because it pertains to a 
matter about which there is an "urgency to inform the public about an 
actual or alleged federal government activity," and the request is made 
by "a person primarily engaged in disseminating information." 6 C.F.R. § 
5.5(d)(1)(ii).

    Google Inc. is the developer of the largest search engine in the 
world, with an index of more than 4 billion web pages.[1] On April 1, 
2004, Google launched a test version of Gmail, "a free search-based web 
mail service with a storage capacity of up to eight billion bits of 
information, the equivalent of 500,000 pages of email. Per user."[2] In 
addition to having immense storage capacity, Gmail is a unique service 
because it indexes e-mail based on key terms contained within the 
content of the message. Google has proposed one service that would allow 
advertisers to target commercial ads to Internet users based on the key 
terms contained within their private communications. We are interested 
to know whether any federal agency has considered the use of the Gmail 
service to further law enforcement investigations or intelligence 
gathering activities by, for example, targeting advertising to Internet 
users that could lead to the collection of evidence or intelligence by a 
federal agency.

    In support of our claim for expedited processing, we point to the 
pending release of the service and the extraordinary media media 
attention that Gmail has generated. In fact, a Google News search for 
"Gmail" from April 1, 2004, when Google announced the Gmail test phase 
to the public, to April 29, 2004 returned 1,570 results (see first page 
of search results, attached hereto).

    In further support of our request for expedited processing is that 
fact that Gmail is capable of performing precisely the functions for law 
enforcement and intelligence agencies that have been the subject of 
Congressional action and widespread public debate. As journalist Stephen 
H. Wildstrom explained:

        A . . . serious privacy concern is raised by the potential for 
thousands of your messages, perhaps accumulated over years, being stored 
on Google's servers, where you have little control over them. . . The 
main federal law covering the privacy of e-mail, the Electronic 
Communications Privacy Act, is 18 years old and full of flaws. Its 
protections are loophole-ridden and, in particular, it allows 
law-enforcement agencies to gain access to your messages on a mail 
provider's system without your knowledge.[3]

    Wildstrom also noted that Gmail's search capability creates a 
potential invasion of privacy that no other web-based email service 
presents: "A privacy concern unique to Gmail is that Google could 
combine information about a huge store of your mail with records of your 
search activity into a detailed portrait of your life."[4]

    Gmail is capable of performing functions which law enforcement and 
intelligence agencies have pursued before, drawing intense Congressional 
and media interest. For instance, Gmail's capabilities are similar to 
what the Defense Advanced Research Projects Agency (DARPA) hoped to 
create in 2002 when it began developing the Total Information Awareness 
Program. Joint Staff and Under Secretary of Defense for Acquisition, 
Logistics and Technology Edward C. "Pete" Aldridge explained that TIA 
was meant to perform data analysis to "determine links and patterns 
indicative of terrorist activities[.]"[5] Office of Information 
Awareness Director Admiral John Poindexter elaborated, "Certain agencies 
and apologists talk about connecting the dots, but one of the problems 
is to know which dots to connect. The relevant information extracted 
from this data must be made available in large-scale repositories with 
enhanced semantic content for easy analysis to accomplish this task."[6] 
Congress eventually eliminated funding for the program[7] due in part to 
concerns about the program's potentially grave impact on individuals' 
privacy.[8]

    Because Gmail combines tremendous storage capacity with search 
technology, the service could also analyze vast amounts of personal 
information on every Internet user who subscribes to the Gmail service 
or corresponds with a subscriber the Gmail service. As one editorial on 
Gmail has noted, "it won't be long before law enforcement agencies say 
they, too, want in. If that sounds paranoid, well, it's exactly the 
argument that defenders of the Pentagon's Orwellian Total Information 
Awareness program used: "If credit card companies can rifle through your 
transactions, why not us?"[9]

    Further, Gmail performs automated searches of users' e-mail for 
keywords upon which inferences are made. These inferences are then used 
to draw specific inference about the activities and interests of 
particular Internet users. This function is similar to that which the 
FBI's Internet data interception tool DCS/1000, formerly known as 
Carnivore, performs. The FBI's tool "is a software-based Internet 
Protocol (IP) packet sniffer that can select and record a defined subset 
of the traffic on the network to which it is attached . . . In limited 
cases, packets can be selected based on their content."[10] Gmail has 
the capability to perform a similar task for law enforcement or 
intelligence agencies, eliminating the need actually to install 
government software at Google for interception purposes.

    For these reasons, there is a particular urgency for the public to 
obtain information about communications that agency officials have had 
with Google representatives about actual or potential use of Google's 
search technology and Gmail to pursue law enforcement and intelligence 
investigations. The government activity at issue here -- cooperating 
with one of the world's leading private purveyors of search technology 
for law enforcement and intelligence investigatory purposes -- raises 
serious privacy issues that will affect a significant portion of the public.

    The purpose of EPIC's request is to obtain information directly 
relevant to the FBI's actual or potential use of Google technology, 
particularly Gmail, to pursue law enforcement and intelligence 
investigations. The records requested involve the manner and extent to 
which the FBI is pursuing or utilizing Google technology for law 
enforcement and intelligence ends, and clearly meet the standard for 
expedited processing.

    Further, as I explain below in support of our request for "news 
media" treatment, EPIC is "primarily engaged in disseminating information."

    Request for "News Media" Fee Status

    EPIC is a non-profit, educational organization that routinely and 
systematically disseminates information to the public. This is 
accomplished through several means. First, EPIC maintains a heavily 
visited web site (www.epic.org) that highlights the "latest news" 
concerning privacy and civil liberties issues. The site also features 
scanned images of documents EPIC obtains under the FOIA. Second, EPIC 
publishes a bi-weekly electronic newsletter that is distributed to over 
15,000 readers, many of whom report on technology issues for major news 
outlets. The newsletter reports on relevant policy developments of a 
timely nature (hence the bi-weekly publication schedule). It has been 
published continuously since 1996, and an archive of past issues is 
available at our web site. Finally, EPIC publishes and distributes 
printed books that address a broad range of privacy, civil liberties and 
technology issues. A list of EPIC publications is available at our Web site.

    For the foregoing reasons, EPIC clearly fits the definition of 
"representative of the news media" contained in the FOIA and the 
Department of Justice regulations. Indeed, the U.S. District Court for 
the District of Columbia has held that EPIC is a "news media" requester 
under the FOIA. See Electronic Privacy Information Center v. Department 
of Defense, 241 F. Supp. 2d 5 (D.D.C. 2003). Based on our status as a 
"news media" requester, we are entitled to receive the requested records 
with only duplication fees assessed. Further, because disclosure of this 
information will "contribute significantly to public understanding of 
the operations or activities of the government," as described above, any 
duplication fees should be waived.

    Thank you for your consideration of this request. As applicable 
Department regulations provide, I will anticipate your determination on 
our request for expedited processing within ten (10) calendar days. 
Should you have any questions about this request, please feel free to 
call me at 202-483-1140 ext. 112.

    Under penalty of perjury, I hereby affirm that the foregoing is 
true and correct to the best of my knowledge.

    Sincerely,

    Marcia Hofmann
    Staff Counsel

    [1] Google, Google Inc. Company Overview, at 
http://www.google.com/press/overview.html (last accessed Apr. 27, 2004).

    [2] Press Release, Google Inc., Google Gets the Message, Launches 
Gmail (Apr. 1, 2004) available at 
http://www.google.com/press/pressrel/gmail.html.

    [3] Stephen H. Wildstrom, Google's Gmail is Great -- But Not For 
Privacy, BusinessWeek Online, April 25, 2004, at 
http://www.businessweek.com/magazine/
    content/04_18/b3881046.htm.

    [4] Id.

    [5] Department of Defense News Briefing (Nov. 20, 2002); see also 
Congressional Research Service, Library of Congress, Privacy: Total 
Information Awareness Programs and Related Information Access, 
Collection and Protection Laws (March 21, 2003) 2.

    [6] John Poindexter, DARPATech 2002 Conference, Anaheim, CA (Aug. 
2, 2002).

    [7] Department of Defense Appropriations Act, 2004, Pub. L. No. 
108-87 § 8131 (2003).

    [8] See, e.g., Department of Defense Nominations: Hearing Before 
the Senate Armed Services Committee, 108th Cong. (2003) (comment of Sen. 
Carl Levin); Threats to U.S. Security: Hearing Before the Senate Select 
Intelligence Committee, 108th Cong. (2003) (question of Sen. Ron Wyden).

    [9] Editorial, If Google Ogles Your E-Mail, Will Ashcroft Be Far 
Behind?, San Jose Mercury News, Apr. 15, 2004, at B OP1.

    [10] IIT Research Institute, Independent Review of the Carnivore 
System, Final Report (Dec. 2000) 1.

    EPIC Privacy Page | EPIC Home Page

    Last Updated: April 29, 2004
    Page URL: http://www.epic.org/privacy/gmail/foirequest.html
_______________________________________________
Politech mailing list
Archived at http://www.politechbot.com/
Moderated by Declan McCullagh (http://www.mccullagh.org/)