Yesterday morning I was reading through the logs of my exim-based
mailserver and noticed _how_ many messages were delivered to
Google/Gmail. This is mostly related to the various mailing lists that
I'm hosting at lists.{gnumonks,osmocom}.org.
Now if those lists were general-purpose mailing lists for let's say a
group of environmentalists or a local model train club, I wouldn't be
surprised. But almost all of those lists are about very
technical projects, where the only subscriber base should be people from
either the IT security community, or the Free Software community. The
former is typically extremely security and privacy aware, whereas the
latter is at least to some extent in favor of what I would describe as
'being a producer rather than just a consumer of technology.
So why is there such a high degree of Gmail usage among those groups? I
really don't get it. Let me illustrate why this is a surprise:
-
you give away control over your personal data
Control over your own data means you own it, you have it on your hard
disk, it is not on somebody else's storage medium. Control over your
data also means that somebody needs a search warrant to your home in
order to get to it. It also means that you decide when or how to shut
it down, not a large corporation in a foreign country.
-
you put your personal data within the U.S. jurisdiction
Depending on where you are, this may or may not be an improvement.
I don't want to start a political debate here, but you have to be aware
what this means specifically, especially in terms of government
authorities or private companies getting access to your mails. I myself
would not even say that I understand enough about the US legal system to
determine the full outcome of this. Also, in case there was a subpoena
or other legal action in the US, how would I defend myself? That's so
much easier in my home country, where I know the laws and regulations.
-
you give Google not only the social web information who mails whom,
but also the full content of that communication
Now Google may have privacy policies and other rules that this data is
not to be mined for whatever purposes they deem fit. But first of all,
what guarantees do you have on it? Definitely less than if you ran your
own mail server on your own hardware. Secondly, whatever Google
promises is always within the scope of the US jurisdiction. In the
10-year aftermath of 9/11 there have been a number of alarming
developments including wiretaps to phone lines without court
review/order, etc.
Now I don't want this to be a bashing of Google. The same applies more
or less to any email hosting company. I also don't want it to be a
bashing about the US. The above is meant as an example only. In Europe
we have our own problems with regard to data retention of e-mail related
data (who is mailing whom). But those only apply to companies that
offer telecommunications services. If you host your own mail server,
you are not providing services to anyone else and thus are not required
to retain any data.
There's also what I would call the combination effect, i.e. millions of
millions of people all using the same service. This leads to a large
concentration of information. Such concentrations are ideal for data
mining and to get a global 'who is who'. This information is much more
interesting to e.g. intelligence communities than the actual content, as
it is much easier analyzed automatically. It also doesn't help to
encrypt your messages, as the headers (From, To, ...) are still
unencrypted.
Furthermore, this concentration leads to single points of failure. I'm
not speaking physically, as Google and other web-hosters of course know
how to replicate their services using a large-scale distributed system.
But all is under control by the same company, maintained by the same
staff, subject to the same jurisdiction/laws, etc.
There was a time when the Internet was about a heterogeneous network,
de-centralized, without a single point of failure. Why are all people
running to a very few number of companies? The same question goes for
sites like sourceforge. All the code hosted there subject to the good
will of the hosting company. Subject to their financial stability,
their intentions and their admin staff. They've had security
breaches, as did apparently Google. Sure, self-hosted machines also
have security breaches, but only the breakage of a very small set of
accounts, not the breakage of thousands, hundred thousands or millions
of users simultaneously.
Now hosting your own mailserver on your own machine might be a bit too
much effort in terms of money or work for some people. I understand
that. But then, there are several other options:
- You team up with some friends, people you know and trust, and you
share the administrative and financial effort
- You look out for NGOs, societies, cooperatives or other
non-for-profit groups that offer email and other services to their
members. At least in Germany we traditionally have many of these.
- You use a local, small Internet service company rather than one of
the big entities.
While you still give up some control with those alternatives, you keep
your data within your jurisdiction, and you still keep the spirit of
de-centralization rather than those large concentrated single point of
failures.
