Industry


Ads by TechWords

See your link here


Seth Weintraub's picture
Seth Weintraub

Apple versus Google

Google Docs sharing issue causes concern for cloud computing

Google today admitted to a potentially serious error in its Docs sharing system. While only .05% of all shared documents were affected, the potential for serious damage was significant for businesses.

The error amounted to wrongly sharing Google documents with someone "whom you, or a collaborator with sharing rights, had previously shared a document". The entire email from Google to Apps administrators is posted below.

It isn't hard to imagine how this could become a serious issue. For instance, it is common for people to share documents with their whole company. Imagine if you are writing a job description for someone who is going to be replaced soon. If the person to be replaced suddenly had access to and read that document, the company would be in deep trouble. Or what if the CFO has employee salaries and contracts in Docs (Google Spreadsheets weren't affected though some presentations were).

google docs sharing issue"The new guy is making double your salary?!"

It goes on from there.

Google took immediate action when it found out about the error by stripping all sharing privileges on the affected documents and sending an email to the affected users telling them that they would need to re-share the documents.

None of the companies I work for nor my personal documents were affected, however, and it seems that an extremely small percentage of users that were (1 out of 2000) affected. Even those that were affected probably didn't have their documents shared long enough for preying eyes to gleen any unintended information.

That doesn't mean this incident should be glossed over ... not by cloud customers and especially not by Google, Microsoft, Zoho, Zimbra or any of the other cloud vendors out there.

This is just one of many reasons businesses that are moving to cloud services should be wary of the issues that can come up that were'n't there before. While cloud computing does solve a lot of business IT issues, others can pop up without any warning.

No one ever said IT was easy.

The email from Google:

Dear Google Docs user,

We wanted to let you know about a recent issue with your Google Docs account. We’ve identified and fixed a bug which may have caused you to share some of your documents without your knowledge. This inadvertent sharing was limited to people with whom you, or a collaborator with sharing rights, had previously shared a document. The issue only occurred if you, or a collaborator with sharing rights, selected multiple documents and presentations from the documents list and changed the sharing permissions. This issue affected documents and presentations, but not spreadsheets.

To help remedy this issue, we have used an automated process to remove collaborators and viewers from the documents that we identified as being affected. Since the impacted documents are now accessible only to you, you will need to re-share the documents manually. For your reference, we’ve listed below the documents identified as being affected.

We apologize for the inconvenience that this issue may have caused. We want to assure you that we are treating this issue with the highest priority.

The Google Docs Team

Bonus: have a look at this episode of "To Tell the Truth" from 2001:

What People Are Saying

Protecting data at it source

I do think there is legitimate cause for concern here - not just at Google, but at all the other cloud services that are up and running. Mistakes happen, so does malicious hacking - the only way to reduce the risks of sensitive information getting 'leaked' is to encrypt it in a way such that even if it's exposed to the internet, it can't be accessed. This means encrpton, staggeringly scalable key management and a spitting of duties between the clouds providing collobaration and the keys to the encrypted data itself. The cloud service providers need to integrate these capabilities (which exist today) and consumers, business users, employees need to insist that their emails/documents/medical records are protected in the event of a filure/mistake/software glitch etc. The technology exists, now we just need to will to implement it.

Accuracy and Truthfulness in Reporting

Sorry Seth, but you've set yourself up for this little lecture and call for more adult oversight of your work at Computerworld. This headline and article are so antithetical to the actual email from Google that it approaches outright lying. Google "admitted" to exercising excruciating detail in finding and fixing things, not to an ongoing threat, as implied and described in the headline and post. Moreover, the original problem -- with such a low probability of impact -- was less significant a threat to information breaches than the baseline stupidity or maliciousness inside of any organization. Parenthetically, given the positive trend toward business transparency, it's probably good if people find out when a clique inside a company is firing people who's shoes they don't like so that they can hire a friend at twice the rate, right? The "hide the salaries" games that serve the old hierarchies are more and more coming to an end. In sum, this post would be perfectly acceptable as a fact-spinning rant on a personal opinion blog, but in this context, it's a black eye to the Computerworld brand, which most readers hold to a much higher standard of accuracy and truthfulness in reporting. We know you can do better. Please do.

Actually, you haven't proven

Actually, you haven't proven anything I said wrong, nor that I spun anything. Google messed up, there are consequences.

Really?

Ok. You're apparently the one with the degree and the credentials. Good luck with that.

Again, if you have issues

Again, if you have issues with any of the facts or implications specifically, list them so they can be addressed.

Please

Seth, it's better to just stop while you're behind. List? What are you talking about? There is nothing unclear about the original comment; however, there is now a false sense of interest in this post with five tit-for-tat comments. This too is below CW. I understand the emotional need to posture and position for the high ground, but it only makes things worse for you in cases like this. Let it go and do better next time.

no more secrets! i want my salary public. oh wait, I'm laid off!

3 cheers to google for improving transparency and solving all privacy and security technology issues once and for all by eliminating the root cause of all of these concerns -- SECRETS!

Yes folks, with one brilliant stroke -- no doubt gleaned from the 20% of free time that self-satisfied Googlers get to brag about (if they are engineers!) as they are driving past the soup kitchens in their WiFi-enabled short bus -- Google has solved the entire problem domain of security and privacy concerns by showing us the error of our ways.

As Mr. Silverton properly points out in his concise and accurate criticism of this article, Google has done us all a great service by sharing our private and potentially business-critical competitive information, including those useless powerpoints showing next years' strategic planning, or the document about the upcoming layoffs -- with anyone at that might be interested such as competitors and employees.

Yes, Google, thank you again for freeing the worlds' information from the pesky limitations of copyright and non-disclosure agreements, from so-called 'proprietary' knowledge and artifically constructed 'intellectual property' laws.

Just as long as those secrets don't include for example, the Adwords algorithms that may or may not secretly squelch competitors adwords from showing vs. google docs, or perhaps the board meeting minutes when Google abolished their "do no evil" mission statement.

Yes, information just WANTS to be free after all. Google is just giving our information the freedom that we ALL deserve.