A privacy advocacy group has asked the US Federal Trade Commission to pull the plug on Gmail, Google Docs, Google Calendar and the company's other web apps until government-approved "safeguards are verifiably established".
If the FTC grants the request, hundreds of millions of internet users would be unable to access their email or documents until the agency's lawyers in Washington, DC, became satisfied with the revised applications. The outage would extend to businesses that pay for access to Google Apps.
The Electronic Privacy Information Center (Epic) submitted the far-reaching request to the FTC in a letter from its director, Marc Rotenberg, on Tuesday. It argues that a formal legal injunction halting all Google cloud-computing services pending formal government approval is necessary to "adequately safeguard the confidential information" of users.
"If we were talking about a child safety seat that could not be securely attached to a car passenger seat, the commission in that instance would say to the company, 'Look, you've got to fix that problem'," Rotenberg, a lawyer and adjunct law professor, said on Tuesday. "Consumers are at risk when that product is in the marketplace. We have a similar view of cloud computing at this point: people are at risk."
Epic sent the letter a week after a bug in Google Docs exposed a small fraction of word-processing and presentation documents. Google said the problem affected only 0.05 percent of documents stored at the site, that affected Google Docs users had been notified, and it affected only people with whom users had already shared documents.
Epic also wants Google to be forced to pay $5m (£3.6m) into a "public fund", from which Epic and like-minded advocacy groups could financially benefit.
For its part, Google said it was reviewing Epic's letter and provided ZDNet UK's sister site, CNET News.com, with this statement: "Many providers of cloud-computing services, including Google, have extensive policies, procedures and technologies in place to ensure the highest levels of data protection. Indeed, cloud computing can be more secure than storing information on your own hard drive. We are highly aware of how important our users' data is to them and take our responsibility very seriously."
Paragraph 57 of Epic's letter asks the FTC to "enjoin Google from offering cloud-computing services until safeguards are verifiably established".
Microsoft and Yahoo declined to comment on Tuesday.
Epic regularly sends letters to the FTC asking for action against technology companies. It sent one last year targeting Ask.com, which had already discontinued the practice in question. In 2000, the group targeted DoubleClick; it also questioned Microsoft's Passport authentication system, which yielded a settlement in August 2002.
The complaints invoke the FTC's legal authority to file civil lawsuits against "unfair or deceptive acts or practices". In this case, Epic claims Google is violating that law because of its "inadequate security practices".
"One of the powers of the FTC is to say if you can't provide a safe product, we can take it from the marketplace," Rotenberg said. He acknowledged having the FTC attempt to pull the plug on Google Apps until privacy fixes were done was a long shot, but said the broader goal was to raise awareness of the privacy and security risks of cloud computing. (Epic previously claimed Gmail was illegal and attempted to have it shut down.)
Jim Harper, director of information policy studies at the free-market Cato Institute, said that nothing Google has done is unfair or deceptive.
"Epic is unable to persuade the public of a problem, so it goes to a very willing government agency that has nothing else to do but machinate about these kinds of issues," Harper said. He added, referring to the $5m fund Epic wants Google to set up: "This is a new fundraising tool."
CNET New.com's Stephanie Condon contributed to this report.
(Disclosure: Declan McCullagh is married to a Google employee.)
