Another Google Privacy Disaster Brewing: Google Calendar

Google got a lot of bad press for trying to manage your social life by fiddling with gmail. Many of the thousands who use gmail extensively for work and play were frightened and outraged by what they considered an intrusive invasion of privacy. Google had appeared to decide, using crude algorithms, who their friends were, and exposed information to those “friends” without the users knowledge or consent. Regardless of the fact that these outraged users seemed, in many if not most cases, to have brought the problems upon themselves through careless use of web services, this became a real scandal.

This disaster is playing itself out again, this time in Google Calendar. Users are finding that, on occasion and unpredictably, Google is emailing random people with spurious invitations to their appointments or false cancellation messages. The emails contain information about the user’s appointments that was not intended to be shared, and have led to embarrassment and damage to reputations. In at least one case someone was granted access to a calendar that was not supposed to be shared.

Below is a small sample of recent messages from the official Google Calendar support forum:

I keep getting email notifications from Google calendar that different people accept invitations to events that have already passed and sometimes they were not even invited to.

We do not use invitations, and suddenly people have to accept (while they are NOT invited).

I entered an event in my Calendar that included someone’s email address (reminding me to contact that person that day). As soon as I hit submit/enter, I noticed that the email address had disappeared – because Calendar thought I wanted to invite that person to an event and had emailed them!!!

it also wants to make it an event and ask me if I’m going, and suggest I invite other people. I’ve tried editing the event and can not how to figure out how to make this a non-invitational.

I was invited to an event along with roughly 30 others via email over a week ago. Today, guests of that meeting notified me that they had received an email from me reading, “Cancelled: EVENT XYZ.” […] What troubles me the most is they have also told me that they can now view my entire calendar for the month of March. My calendar is set to private. Two hours later, I was again told that another email had been sent out. […]
Guests that are receiving these emails include faculty of my University, including the Dean.

Recently, when I place an appointment on MY main calendar, it automatically sends an invite to my son’s calendar. He is NOT showing up as a guest, so I don’t have the option of deleting him from the list (which scares me because I don’t know who else may be receiving invites). The only way I know he’s getting an invite is that I check his emails periodically. Otherwise, I would never know about it just by looking at my calendar. […] He definitely does not need to have MY work appointments sent to him as he is not invited to them! How can I make this stop??

I copied the event and pasted it into my Google calendar, so then it emailed everyone an invite to this event, as if I were the event organizer!

Calendar Invites sent to wrong address[: …] When creating new calendar events and adding external recipients as I type the external contact’s name their email addresses (multiple for the contact) display. I select the “work” email address, click save and am prompted if I want to send an invite to the external user (their correct work address) is displayed. However the user does not receive the invitation on their work account, instead they receive the invitation email to their “home” @gmail.com account. Looking at the event details in calendar still shows their proper work email listed.

These bugs seem to be related somehow to another Calendar bug that appeared this month, where sometimes if you create an event in a calendar other than your default calendar, that calendar itself will be listed as a guest that has been invited to the event. Google has admitted, through the support forum, that this is a bug and not an attempt at a new feature, and although complainers to the forum are pretty hysterical about this as well, I’ve found, at least in my case, that all you have to do is uninvite the phantom guest and all is good.

However, the fact the the program seems to be sending out email, and sometimes granting access to calendars, on its own, without user interaction, certainly worries me, and should sound the alarms for anyone who uses this. Unless all these people are hallucinating (and it must be said that this population seems fairly computer-naïve and mostly uses Windows), Google is sending emails on the users’ behalf to people they are somehow connected to, email that is false, misleading, and exposes private information. In some cases the users don’t know these emails are being transmitted, but they appear to the recipient to have been sent by the user. Imagine that you place a reminder in your private calendar about your boss’ birthday party: “4 pm: party for that jerk, Fred Jones,” and Google helpfully sends an email to Mr. Jones, whose address was found in your gmail correspondence, with the title of the event. It’s that bad.

Just as strange is the fact that, although these urgent messages started to appear in Google’s official forum on about the 18th of March, there are no answers from anyone at Google, and the behavior seems to persist. Did they remove the beta label prematurely?