Careless in the Cloud: Google Accidentally Shares Some Docs

In a privacy error that underscores some of the biggest problems surrounding cloud-based services, Google (GOOG) has sent a notice to a number of users of its Document and Spreadsheets products stating that it may have inadvertently shared some of their documents with contacts who were never granted access to them.

According to the notice, this sharing was limited to people “with whom you, or a collaborator with sharing rights, had previously shared a document” - a vague statement that sounds like it could add up to quite a few people. The notice states that only text documents and presentations are affected, not spreadsheets, and provides links to each of the user’s documents that may have been shared in error.

I contacted Google for confirmation and haven’t heard back, but this seems to be legit - our tipster says that he had previously shared the document listed in his notice, but now it has been reset to show 0 collaborators (one of the precautionary measures mentioned in the note).

Update: Google has confirmed that the note is real, and says that it was an isolated incident affecting less than .05% of all documents. The damage may not be widespread, but it’s still an unsettling lapse in security.

Here’s the letter in full:

Dear Google Docs user,

We wanted to let you know about a recent issue with your Google Docs account. We’ve identified and fixed a bug which may have caused you to share some of your documents without your knowledge. This inadvertent sharing was limited to people with whom you, or a collaborator with sharing rights, had previously shared a document. The issue only occurred if you, or a collaborator with sharing rights, selected multiple documents and presentations from the documents list and changed the sharing permissions. This issue affected documents and presentations, but not spreadsheets.

To help remedy this issue, we have used an automated process to remove collaborators and viewers from the documents that we identified as being affected. Since the impacted documents are now accessible only to you, you will need to re-share the documents manually. For your reference, we’ve listed below the documents identified as being affected.

We apologize for the inconvenience that this issue may have caused. We want to assure you that we are treating this issue with the highest priority.

The Google Docs Team

In short, this is a massive blunder on Google’s part. I fully appreciate the lengths Google has gone to to offer a wide array of helpful online services, many of which are free of charge. But this error highlights why cloud-based services scare many people. Regardless of what a site’s posted rules and policies are, a technical glitch is all it takes to expose your sensitive data.

Original post

Comments

[bigmoney:]

>> But this error highlights why cloud-based services scare many people.

Including me.

Mar 08 11:46 AM

[lucky lenny:]

Jason, don't u think your post is a bit misleading? Seems like the settings went back to an earlier date. Docs were not shared with others who didn't have sharing priveleges before.

Mar 08 01:32 PM

[lucky lenny:]

The data leakage seems pretty benign & hardly worth the news release. The risk of info being shared is very remote. Besides, it would have been with a former person w/ rights; not with a wider reader base.

Mar 08 01:37 PM

[Adrian D:]

Its unreasonable to expect that Google Docs is going to be absolutely free of problems.

Still its inherently far more secure than leaving your sensitive data on a work or home computer.

Mar 09 08:27 AM

[Patrick Garot:]

In 1990 my best friend at Andersen Consulting (Accenture) was sent to Florida to create cable Video-On-Demand. It took billions of investment and until roughly 3 years ago for VOD to actually start changing that game.

My point is while "The Cloud" is the future, it will take years - and billions - for it to deliver on its promise. Consider that Google's "oops" above about data security is even before hackers have begun to test its Cloud.

In this context, MSFT looks cheap right now.

Mar 09 03:57 PM