Google user info remains accessible

Google Inc. has changed the default privacy setting of Google Groups, its on-line mail sharing service, so that only members in the same group can read e-mails, but the new setting applies only to new users, leaving information of many users easily available to the public, it was learned Saturday.

Google's decision to change the default setting came after it was revealed a month ago that a large amount of official information from central government entities was freely accessible through Google Groups.

The initial default privacy setting of Google Groups was "Public", which allows all users to view e-mails. Many users kept using the service without realising what the default setting was, unwittingly disclosing internal information and personal information intended only for the eyes of group members.

Google recently changed the default setting worldwide from "Public" to "All members of the group". To make information available to anyone, users need to switch this setting. But because this change in the initial setting only applies to new users, those who are already using the service with the initial setting unchanged may still be leaving internal information freely accessible to anyone.

"I was surprised that personal information about me is being circulated like this," a 30-year-old company employee in Sapporo said. Personal information about the man, including name, address and telephone number, was disclosed on Google Groups after he ordered a mannequin. A mannequin rental company in the Kansai region was sharing order information on Google Groups among its employees but inadvertently kept the default privacy setting that enabled anyone to access the confidential information.

"I wanted to rent it [a mannequin] for entertainment at my wedding," the man said, puzzled.

The mannequin rental company closed its Google group on Aug 9 after The Yomiuri Shimbun told the company about the information exposure. Beginning in early June, personal information of about 50 customers was left freely accessible. The exposure of sensitive information on Google Groups was reported on July 10, but the company said it did not hear about the report.

In another incident, Waseda University inadvertently made personal information such as names and e-mail addresses of about 800 researchers, students and alumni freely accessible beginning in April. The university shut down its Google group on Aug. 9 after The Yomiuri Shimbun told it about the information leakage.

At Kobe University, a faculty member made provisional grades of five students visible to the public online, and Keio Corp, which operates the Keio Line, unwittingly disclosed information related to part-time station employees' attendance records. Both Waseda University and Keio closed their Google groups recently.

There are many other cases of sensitive information being exposed on Google Groups, including customer information of an interior finishing work company in Nagoya, requests for quotations of a house renovation company in Saitama Prefecture and business records of a computer system development company in Okinawa.

Information exposure on Google Groups became an issue after information related to the Environment Ministry's negotiations over an international treaty and patient information held by medical institutions were found to be freely accessible. The Environment Ministry issued reprimands and strong warnings to four senior and other officials. Confidential information was also found to have been disclosed at other central government bodies. The Reconstruction Agency issued strong warnings to its officials while the Land, Infrastructure, Transport and Tourism Ministry and the Agriculture, Forestry and Fisheries Ministry did not punish its officials.

After the revelation of information exposure cases involving central government entities, the government decided in principle to ban national civil servants from using free online services such as Google Groups.

An official of Google Japan Inc., said, "We changed the setting at the request of our users, but we will not comment on when or why we made the change."