Security Concerns with Google Desktop

Search Across Computers with Google Desktop

Google Desktop v3 has a new feature called "Search Across Computers" that has raised serious security and privacy issues. This new feature stores files on Google's servers and allows users to search through them from any other computer. The files that Google stores include web history files (from Internet Explorer, Firefox, Netscape, and Mozilla), Word documents, Excel spreadsheets, PowerPoint presentations, PDF files, and text files in the "My Documents" folder. If Google Desktop V. 3 is not properly configured (i.e., if defaults are used), there is the potential for others to access information from an individual's computer.

University Computers with Confidential Data

Employees of the University (whether student, regular staff or faculty) who have confidential data on their work or home computers should not enable this feature. There are both privacy laws and University policies that could be violated through the installation of this feature; for example SB 1386, Health Insurance Portability and Accountability Act (HIPAA), Family Educational Rights and Privacy Act (FERPA) and the Gramm-Leach-Bliley Act (GLBA).

Questions or Concerns

While some of the features of Google Desktop 3 are enticing, it is important to understand how information is collected, stored, and shared through this application, and the potential privacy and confidentiality risks.

If you have questions about Google Desktop v3, please talk to your Computing Support Coordinator. CSCs can contact the NACS Security staff via email to security@uci.edu for more information.

Please review and share this information widely. See the references below for more information on Google Desktop 3 and the security and privacy issues with it.

Helpful References:

UC IS-3 Electronic Information Security
http://www.ucop.edu/ucophome/policies/bfb/is3.pdf

UCI Keeping your data safe
http://www.security.uci.edu/data/

Google Source:
http://desktop.google.com/features.html#searchremote

For a good summary of the privacy concerns related to Google Desktop V.3, see:

Electronic Frontier Foundation:
http://www.eff.org/news/archives/2006_02.php#004400

Technical White Paper from University of Michigan's IT Security group
(Recommended reading for CSCs and Help Desk Personnel):
http://safecomputing.umich.edu/tools/download/gd_security.pdf

ZDNet UK - Google admits Desktop security risk
http://news.zdnet.co.uk/internet/security/0,39020375,39253447,00.htm

Mike Iglesias
Network & Academic Computing Services