Outsourcing to Google: A Bad Deal for York Academic Staff

1. Outsourcing to Google:A Bad Deal for York Academic Staff • James L. Turk • York University • February 5, 2013

2. Outsourcing to Google:Problems • Outsourcing to Google exposes academic staff to two sets of dangers that result from: • • Application of American law • • Provisions in the Google contract

3. Application of American law

4. Current situation (email through York) • All internal and international communication, except that to or from the United States, does not necessarily pass in its entirety through a server located in the United States nor is accessible by a U.S. linked corporation. • As a result, U.S. intelligence and law enforcement authorities will not readily have access, except with the cooperation and under the laws of Canada.

5. If outsourced to Google • All your email –- content, transaction data, attachments and all linked information -- become subject to American law with its especially troubling provisions brought in through the USA Patriot Act following 9/11 and the US Foreign Intelligence Surveillance Amendment Act (2008).

6. Outsourcing & U.S. Law • U.S. law confers express statutory authority for prospective content surveillance of law-abiding individual, with neither probable cause, nor a warrant, nor any suspicion of criminality. • Under U.S. laws, an investigation requiring disclosure of email information can be based on an individual’s political viewpoint, religious activity, or exercise of academic freedom.

7. Application of US Law • Under US law, when police and security agencies request email or other records to which U.S.-linked corporations have access, the corporation: • must comply with the request, and • is prohibited from advising the individual that their records have been requested.

8. Ottawa Citizen February 2, 2013 • “In a report commissioned by the European Parliament, former Microsoft chief privacy adviser Caspar Bowden reveals, “it is lawful in the U.S. to conduct purely political surveillance on foreigners’ data accessible in U.S. clouds,” operated by U.S. firms such as Google, Microsoft, Apple, IBM and others… • “While other contentious U.S. post-9/11 laws, such as the Patriot Act, significantly lifted restrictions on government surveillance, Bowden says the foreign surveillance law, “for the first time (has) created a power of mass-surveillance specifically targeted at the data of non-U.S. persons located outside the U.S., which applies to cloud computing.” • http://www.ottawacitizen.com/technology/Cloud+computing+puts+Canadian+users+risk+snooping+American+spies/7907562/story.html

9. Provisions in the Google contract

10. Terms in Google Apps for Education Contracts • The “Customer” is the university. • “You” refers to the university. • “End users” means the individuals that the “Customer” permits to use the Services. • “Customer data” means data, including email, provided, generated, transmitted or displayed via the Services by Customer or End Users. • Google Apps for Education Agreementhttp://www.google.com/apps/intl/en/terms/education_terms.html

11. Problems with the Contract: Privacy • Access by University: • “2.4 End User Consent. Customer’s Administrators may have the ability to access, monitor, use, or disclose data available to End Users within the End User Accounts. Customer will obtain and maintain all required consents from End Users to allow: (i) Customer’s access, monitoring, use and disclosure of this data and Google providing Customer with the ability to do so and (ii) Google to provide the Services.” • Google Apps for Education Agreementhttp://www.google.com/apps/intl/en/terms/education_terms.html

12. Problems with the Contract: Academic Freedom • “2.2 Compliance. Customer will use the Services in accordance with the Acceptable Use Policy.” • “You agree not to, and not to allow third parties or Your End Users, to use the Services… • for any unlawful, invasive, infringing, defamatory, or fraudulent purpose; • to violate, or encourage the violation of, the legal rights of others”http://www.google.ca/apps/intl/en/terms/use_policy.html

13. Problems with the Contract: Intellectual Property • “6.1 Intellectual Property Rights. Except as expressly set forth herein, this Agreement does not grant either party any rights, implied or otherwise, to the other’s content or any of the other’s intellectual property. As between the parties, Customer owns all Intellectual Property Rights in Customer Data, and Google owns all Intellectual Property Rights in the Services.” • Google Apps for Education Agreement http://www.google.com/apps/intl/en/terms/education_terms.html

14. Problems with the Contract: Intellectual Property • “6.1 Intellectual Property Rights. Except as expressly set forth herein, this Agreement does not grant either party any rights, implied or otherwise, to the other’s content or any of the other’s intellectual property. As between the parties, Customer owns all Intellectual Property Rights in Customer Data, and Google owns all Intellectual Property Rights in the Services.” • Google Apps for Education Agreement http://www.google.com/apps/intl/en/terms/education_terms.html

15. Problems with the Contract: Storage of Data • “1.1 … Google may transfer, store and process Customer Data in the United States or any other country in which Google or its agents maintain facilities. By using the Services, Customer consents to this transfer, processing and storage of Customer Data.” • Google Apps for Education Agreementhttp://www.google.com/apps/intl/en/terms/education_terms.html

16. Problems with the Contract: Liability • “12. Limitation of Liability. • 12.1 Limitation on Indirect Liability. NEITHER PARTY WILL BE LIABLE UNDER THIS AGREEMENT FOR LOST REVENUES OR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, EVEN IF THE PARTY KNEW OR SHOULD HAVE KNOWN THAT SUCH DAMAGES WERE POSSIBLE AND EVEN IF DIRECT DAMAGES DO NOT SATISFY A REMEDY. • 12.2 Limitation on Amount of Liability. NEITHER PARTY MAY BE HELD LIABLE UNDER THIS AGREEMENT FOR MORE THAN THE AMOUNT PAID BY CUSTOMER TO GOOGLE DURING THE TWELVE MONTHS PRIOR TO THE EVENT GIVING RISE TO LIABILITY. • 12.3 Exceptions to Limitations. These limitations of liability apply to the fullest extent permitted by applicable law, but do not apply to breaches of confidentiality obligations, violations of a party’s Intellectual Property Rights by the other party, or indemnification obligations.” • http://www.google.com/apps/intl/en/terms/education_terms.html

17. Problems with the Contract: “Governing Law” • “13.10 Governing Law. • b. For All other Entities [except State and City Government Entities]: • This Agreement is governed by California law, excluding that state’s choice of law rules. FOR ANY DISPUTE ARISING OUT OF OR RELATING TO THIS AGREEMENT, THE PARTIES CONSENT TO PERSONAL JURISDICTION IN, AND THE EXCLUSIVE VENUE OF, THE COURTS IN SANTA CLARA COUNTY, CALIFORNIA.” • The Google Apps for Education Agreement http://www.google.com/apps/intl/en/terms/education_terms.html

18. Problems with the Contract: Fees • “9.1 Term. This Agreement will remain in effect for the Term.” • “9.3 No Fees. During the Initial Term, Google will not charge Customer fees for the Services. Upon the parties’ mutual written agreement, (a) Google may charge Customer fees for the Services after the Initial Term and (b) Google may charge Customer fees for a premium version of the Services or for optional functionality or enhancements that may be added to the Services by Google.” • The Google Apps for Education Agreement http://www.google.com/apps/intl/en/terms/education_terms.html

19. Final note • Decisions about technological services for academic staff should not primarily be about money nor about access to the latest technological niceties. • They should be about the University adopting a means for facilitating communication for its academic staff so as to enhance their ability to do their academic work in a way that protects their rights, including intellectual property, privacy and academic freedom. • Outsourcing to Google endangers each of these.

20. References • European Parliament Directorate-General for Internal “Policies, Fighting cyber crime and protecting privacy in the cloud. European Union, 2012.http://www.europarl.europa.eu/committees/en/studiesdownload.html?languageDocument=EN&file=79050 • W Kuan Hon and Christopher Millard, Cloud Computing vs. Traditional Outsourcing – Key Differences, Queen Mary School of Law Legal Studies, Computers & Law, Vol. 23, Issue 4, October/November 2012 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2200592 • Simon Bradshaw et al., Contracts for Clouds: Comparison and Analysis of the Terms and Conditions of Cloud Computing Services. Queen Mary School of Law Legal Studies Research Paper No. 63/2010 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1662374

21. References • Neil Robinson et al, The Cloud: Understanding the Security, Privacy and Trust Challenges. Rand Corporation. 2011 http://www.rand.org/content/dam/rand/pubs/technical_reports/2011/RAND_TR933.pdf • Bernice Karn, Data Security: The Case Against Cloud Computing. Canadian Privacy Law Review.Vol 8 (No 6), May 2011http://www.casselsbrock.com/files/file/B%20Karn%20Cloud%20Computing%20May%202011.pdf