3 ms·

I mean, of course the email admins can read your email? Maybe I have a skewed perspective as an old school sysadmin, but when I managed servers that had mail se

I mean, of course the email admins can read your email? Maybe I have a skewed perspective as an old school sysadmin, but when I managed servers that had mail services running on them obviously root can just read everything on disk and we even had spam filters that scanned the email content which is impossible if we couldn’t read all emails.

underwater 4y ago
An old (school sysasmin) or an (old school) admin? FWIW in a lot of SaaS companies having read access to production data for regular workflows is absolutely unthinkable. In my opinion the users who expect that their private communication is not read have it right.
- tallanvor 4y ago
  Of course it's unthinkable for people working for the provider to have access to production data except in very specific, highly audited situations. But it's absolutely understandable that an organization has administrators that are able to access data for legal or other compliance reasons, and Google provides those tools as part of the service they provide. There's nothing sketchy about this from Google's side. The Dutch order is more concerned with whether or not data regarding students is being transferred to the US and processed in ways that it shouldn't be. --Which there's no indication that this is happening, as far as I can tell.
  - twiss 4y ago
    Regarding the last point, there is some indication that that is happening, given that Google's response (from the article) is: > Google has indicated that it plans to fix the privacy concerns by August 2023 which means that they acknowledge that the current situation is insufficient. If the data was stored and processed only in Europe, they would likely say so. Although even that would not be sufficient, because > American authorities can access data stored in the European cloud (by American companies), due to the CLOUD act. So the privacy issues aren't that easy to solve, which might be why they expect it to take >1 year.
samus 4y ago
They were using Gmail though. Either the school could get privileged access since they presumably used organizational accounts, or they did TLS MITM with network proxies.
- Gareth321 4y ago
  OP said "this made me suspect that the admins could read our school email." Administrators can do this.
- LinuxBender 4y ago
  I do not have links handy but there are DLP solutions for enterprise tools like gmail, google docs, etc... They do not need to MiTM connections are the tool has administrative access to the corporate account. Many companies use these tools to check the box in their audits around data integrity and data exfiltration. This only works for corporate accounts. Most corporate enterprise cloud services have an API for DLP monitoring. Personal accounts would require a going through a process for lawful intercept. I have no idea how formal this process is today or if Google even ask for a copy of the warrant. When I set up monitoring for cell phone conversations in the cellular industry, not at google I always had a copy of the warrant.
- operator-name 4y ago
  Google workspace administrators can easily access mail via delegation or api: https://sites.google.com/jis.edu.bn/gam-commands/services/gmail https://sites.google.com/jis.edu.bn/gam-commands/services/gm... MX gateways are also a valid option.
raffraffraff 4y ago
A long long time ago I remember a sysadmin opened a senior director's email on his computer. He wasn't the type to do something like this, but he recently bought a house, and kids were the likely next step. The senior director in question would likely have been involved in layoff discussions. Unfortunately an email had a read receipt, so the sender got a messaging saying that "sysadmin read your email"... So he got the sack.
deleted 4y ago
[deleted]

underwater 4y ago

An old (school sysasmin) or an (old school) admin? FWIW in a lot of SaaS companies having read access to production data for regular workflows is absolutely unthinkable. In my opinion the users who expect that their private communication is not read have it right.

tallanvor 4y ago
Of course it's unthinkable for people working for the provider to have access to production data except in very specific, highly audited situations. But it's absolutely understandable that an organization has administrators that are able to access data for legal or other compliance reasons, and Google provides those tools as part of the service they provide. There's nothing sketchy about this from Google's side. The Dutch order is more concerned with whether or not data regarding students is being transferred to the US and processed in ways that it shouldn't be. --Which there's no indication that this is happening, as far as I can tell.
- twiss 4y ago
  Regarding the last point, there is some indication that that is happening, given that Google's response (from the article) is: > Google has indicated that it plans to fix the privacy concerns by August 2023 which means that they acknowledge that the current situation is insufficient. If the data was stored and processed only in Europe, they would likely say so. Although even that would not be sufficient, because > American authorities can access data stored in the European cloud (by American companies), due to the CLOUD act. So the privacy issues aren't that easy to solve, which might be why they expect it to take >1 year.

samus 4y ago

They were using Gmail though. Either the school could get privileged access since they presumably used organizational accounts, or they did TLS MITM with network proxies.

Gareth321 4y ago
OP said "this made me suspect that the admins could read our school email." Administrators can do this.
LinuxBender 4y ago
I do not have links handy but there are DLP solutions for enterprise tools like gmail, google docs, etc... They do not need to MiTM connections are the tool has administrative access to the corporate account. Many companies use these tools to check the box in their audits around data integrity and data exfiltration. This only works for corporate accounts. Most corporate enterprise cloud services have an API for DLP monitoring. Personal accounts would require a going through a process for lawful intercept. I have no idea how formal this process is today or if Google even ask for a copy of the warrant. When I set up monitoring for cell phone conversations in the cellular industry, not at google I always had a copy of the warrant.
operator-name 4y ago
Google workspace administrators can easily access mail via delegation or api: https://sites.google.com/jis.edu.bn/gam-commands/services/gmail https://sites.google.com/jis.edu.bn/gam-commands/services/gm... MX gateways are also a valid option.

raffraffraff 4y ago

A long long time ago I remember a sysadmin opened a senior director's email on his computer. He wasn't the type to do something like this, but he recently bought a house, and kids were the likely next step. The senior director in question would likely have been involved in layoff discussions. Unfortunately an email had a read receipt, so the sender got a messaging saying that "sysadmin read your email"... So he got the sack.

deleted 4y ago

[deleted]