Response to EFF complaint about student data privacy

GAFE is really convenient in a lot of ways; the EFF is absolutely right to complain though that there are a lot of privacy issues baked into the whole thing by virtue of it being Google Services.

Outside of data collection, the issue is that GAFE admins are still at the mercy of Google changes. We may get advanced notices from Google about changes and certainly some are optional, but things like G+ integration, Photos, and so on are completely outside of our control.

My last workplace used GAFE for the University, and we had a lot of very basic privacy things that popped up as a result of GAFE and new gmail features pushed out. Our few privacy minded users (mostly older professors) would get really upset over how much data got sync'd between LDAP and G+ without our admin realizing it, students who had legitimate privacy concerns (harassment cases) were frustrated with the same issue, and so on.

I'd like to believe Google could just ease up the data collection from schools and businesses - it can't be that great compared to the public at large, and it would make GAFE absolutely perfect for schools. (Seriously, privacy aside, GAFE is otherwise perfect for a University set up. Unlimited space, great for student collaboration, and honestly many universities could do away with Office subscriptions at this point since the Google Office Suite is close enough for all intents and purposes.)

    LIZ FIGUEROA, (D) State Senator, CA, 1998-06: We walk into this room, and it’s myself
    and two of my staff— my chief of staff and one of my attorneys. And across from us
    was Larry, Sergey, and their attorney.

    All of a sudden, Sergey started talking to me. He said, “Senator, how would you feel
    if a robot went into your home and read your diary and read your financial records,
    read your love letters, read everything, but before leaving the house, it imploded?”
    And he said, “That’s not violating privacy.”

    I immediately said, “Of course it is. Yes, it is.” And he said, “No, it isn’t.
    Nothing’s kept. Nobody knows about it.” I said, “That robot has read everything.
    Does that robot know if I’m sad or if I’m feeling fear, or what’s happening?”
    And he looked at me and he said, “Oh, no. That robot knows a lot more than that.”

> Nobody knows about it.

This idea that no person knows about it is suspiciously similar to the word games the NSA plays with their claims of only needing a warrant once a human searches for something they already captured and stored.

However, your objection to the use of proprietary software seems completely misguided to me and reeks of overzealous naivety. The software you describe are tools for educating and conveying information. Why don't you object to your being forced to use other proprietary, non-software tools? Your teachers "force" you to use the textbook they select for the course because if every student used a different textbook, the teachers' jobs would become impossible. Why do you accept the "forced" textbook but not the forced software tool?

Your teachers force you to use a particular software tool because education would be hopelessly inefficient if every student were using different tools.

Let's say this whole pledge thing didn't exist and the only thing that GAFE promise is no ads. Now let's supposed Google is collecting and anonymizing usage data, like most sofwares do, is that a big deal? Since 99% of the people won't read the ToS and most people assume some level of usage data will be collected, what would be people's stand on that?

I think, Google's stand on the current issue is that they disagree their intent violate the pledge. They would argue data collection is anonymized, and like most software out there (Chrome, FireFox, etc) these are telemetry (and all sorts) collected. For Google the collection is for regular development purpose. Perhaps they will argue that they did not do a good job at making a "disable me" option, and that they didn't make that clear to their customers. I supposed EFF just doesn't trust Google handling the data in the first place, since Google can lie about not logging the individual user name in some server's log file.