8 ms·

Yes, your boss can read your Gmail drafts

44 points by slowhand09 6y ago

easton 6y ago
Um, yeah, the administrators for your GSuite instance can read your drafts. Unless your boss is a GSuite administrator, they can't, so they'd have to go ask IT for your drafts which in any sane company would be met with "Why?". This is a standard feature in pretty much every email system as part of the compliance features.
- Koshkin 6y ago
  On the other hand, one can't expect much privacy at the workplace. Even the use of keyloggers could be legal and possibly is widespread.
  - notfromhere 6y ago
    That’s true but also doesn’t have to be that way
- btown 6y ago
  Outside of administrators, drafts may also be accessible if your boss was given access to relevant search terms as part of Google Vault, G Suite's e-discovery functionality. Or if an OAuth service account was created and given domain-wide IMAP delegation, and the data pulled from it is made available to others. All this is extremely powerful and by design. https://support.google.com/a/answer/2462365?hl=en https://support.google.com/a/answer/2462365?hl=en https://developers.google.com/gmail/imap/xoauth2-protocol#domain-wide_delegation_for https://developers.google.com/gmail/imap/xoauth2-protocol#do...
- Scoundreller 6y ago
  Hi IT, we got a FOIA request for all of xyz’s drafts.
eieiei 6y ago
MUCHO TEXTO
- eieiei 6y ago
  Tranquilo amigo, relajate
  - Koshkin 6y ago
    Necesitas ocho horas de sueño.
    - eieiei 6y ago
      Tu quien eres?? Tienes mucho karma amigo
alexjplant 6y ago
Why is this a revelation or surprise? Your employer provides you with equipment and applications not for their benefit, not yours, and I think this is perfectly reasonable. It'd be one thing if GMail cost money, but you can get _your own account_ for _free_. This is a complete non-issue. Tangentially-related: I was an IT person in a past life and the extent to which some employees treated the company laptops and e-mail as their own was astounding. Light personal use via the browser is one thing, but I would get users asking why they couldn't play a personal DVD after-hours using their work machine, if I could allowlist a hobby-related mailing list to their work e-mail, why I took away their admin rights because their kids needed to install games, etc.
- zepto 6y ago
  > Your employer provides you with equipment and applications not for their benefit, not yours Usually employment is offered with the idea that it is mutually beneficial. Yes - you get paid and they keep the profits, but that doesn’t imply that work isn’t itself expected to benefit the worker in other ways.
  - alexjplant 6y ago
    We're talking about two different things... work itself is supposed to be mutually beneficial but using corporate assets for personal ends when you could just as easily use your own is silly and makes everybody's life more difficult. As I said, stuff like > Light personal use via the browser is one thing but using work e-mail with any expectation of privacy when you have an e-mail client in your pocket is ridiculous.
    - zepto 6y ago
      > but using work e-mail with any expectation of privacy when you have an e-mail client in your pocket is ridiculous. It’s ridiculous to expect unsent draft emails to be private?
- perl4ever 6y ago
  >Why is this a revelation or surprise? Your employer provides you with equipment and applications not for their benefit, not yours, and I think this is perfectly reasonable. A draft is a window into what someone was thinking before they edited or censored their thoughts. Even when people have been notified they don't own the equipment and nothing is private, they generally rely on not being that closely monitored that they can be held responsible for a message they didn't send to anyone. Google themselves got screwed in court in precisely that scenario, where there were autosaved drafts of some emails that showed what execs were thinking prior to the actual sending of a message. It was ruled valid to produce, but that doesn't mean that everyone has to agree that's fair. If the top people at Google think that composing an email is private, I think that's a pretty good hint that it is typical on planet Earth, even if it's not actually true. If you are going to avoid revealing your thoughts while composing a document, then you would have to do it on some other system and only transmit the final version. That's somewhere from cumbersome to infeasible, and people just don't do it. It seems approximately equivalent to the expectation of privacy in the restroom at work, to me.
im3w1l 6y ago
Can they read it only while it is in the drafts folder? If it is discarded is it still available? Or if it is edited-and-sent, can they see the original?
coward76 6y ago
"A GSuite admin can view drafts in Gmail" seems like a better headline than answering an unasked question.
magwa101 6y ago
Email, your computer, your notes, everything you produce is owned by the company. It has been ever so.

44 points by slowhand09 6y ago

Um, yeah, the administrators for your GSuite instance can read your drafts. Unless your boss is a GSuite administrator, they can't, so they'd have to go ask IT for your drafts which in any sane company would be met with "Why?". This is a standard feature in pretty much every email system as part of the compliance features.

Koshkin 6y ago
On the other hand, one can't expect much privacy at the workplace. Even the use of keyloggers could be legal and possibly is widespread.
- notfromhere 6y ago
  That’s true but also doesn’t have to be that way
btown 6y ago
Outside of administrators, drafts may also be accessible if your boss was given access to relevant search terms as part of Google Vault, G Suite's e-discovery functionality. Or if an OAuth service account was created and given domain-wide IMAP delegation, and the data pulled from it is made available to others. All this is extremely powerful and by design. https://support.google.com/a/answer/2462365?hl=en https://support.google.com/a/answer/2462365?hl=en https://developers.google.com/gmail/imap/xoauth2-protocol#domain-wide_delegation_for https://developers.google.com/gmail/imap/xoauth2-protocol#do...
Scoundreller 6y ago
Hi IT, we got a FOIA request for all of xyz’s drafts.

eieiei 6y ago

MUCHO TEXTO

eieiei 6y ago
Tranquilo amigo, relajate
- Koshkin 6y ago
  Necesitas ocho horas de sueño.
  - eieiei 6y ago
    Tu quien eres?? Tienes mucho karma amigo

alexjplant 6y ago

Why is this a revelation or surprise? Your employer provides you with equipment and applications not for their benefit, not yours, and I think this is perfectly reasonable. It'd be one thing if GMail cost money, but you can get _your own account_ for _free_. This is a complete non-issue. Tangentially-related: I was an IT person in a past life and the extent to which some employees treated the company laptops and e-mail as their own was astounding. Light personal use via the browser is one thing, but I would get users asking why they couldn't play a personal DVD after-hours using their work machine, if I could allowlist a hobby-related mailing list to their work e-mail, why I took away their admin rights because their kids needed to install games, etc.

zepto 6y ago
> Your employer provides you with equipment and applications not for their benefit, not yours Usually employment is offered with the idea that it is mutually beneficial. Yes - you get paid and they keep the profits, but that doesn’t imply that work isn’t itself expected to benefit the worker in other ways.
- alexjplant 6y ago
  We're talking about two different things... work itself is supposed to be mutually beneficial but using corporate assets for personal ends when you could just as easily use your own is silly and makes everybody's life more difficult. As I said, stuff like > Light personal use via the browser is one thing but using work e-mail with any expectation of privacy when you have an e-mail client in your pocket is ridiculous.
  - zepto 6y ago
    > but using work e-mail with any expectation of privacy when you have an e-mail client in your pocket is ridiculous. It’s ridiculous to expect unsent draft emails to be private?
perl4ever 6y ago
>Why is this a revelation or surprise? Your employer provides you with equipment and applications not for their benefit, not yours, and I think this is perfectly reasonable. A draft is a window into what someone was thinking before they edited or censored their thoughts. Even when people have been notified they don't own the equipment and nothing is private, they generally rely on not being that closely monitored that they can be held responsible for a message they didn't send to anyone. Google themselves got screwed in court in precisely that scenario, where there were autosaved drafts of some emails that showed what execs were thinking prior to the actual sending of a message. It was ruled valid to produce, but that doesn't mean that everyone has to agree that's fair. If the top people at Google think that composing an email is private, I think that's a pretty good hint that it is typical on planet Earth, even if it's not actually true. If you are going to avoid revealing your thoughts while composing a document, then you would have to do it on some other system and only transmit the final version. That's somewhere from cumbersome to infeasible, and people just don't do it. It seems approximately equivalent to the expectation of privacy in the restroom at work, to me.

im3w1l 6y ago

Can they read it only while it is in the drafts folder? If it is discarded is it still available? Or if it is edited-and-sent, can they see the original?

coward76 6y ago

"A GSuite admin can view drafts in Gmail" seems like a better headline than answering an unasked question.

magwa101 6y ago

Email, your computer, your notes, everything you produce is owned by the company. It has been ever so.