Google removes Khosrow Zarefarid’s blog

On Thursday last, while I was traveling home from Infosecurity Europe, Khosrow Zarefarid (the Iranian software engineer who tried to get better protection for Iranian card details held by the banks) contacted me:

Whay my weblog was stoped from google site? Can you help me to solve this problem? I had about 1000000 viewer.

Believe me, his English is infinitely better than my Arabic (which doesn’t exist).

Not what you want to wake up to...

I couldn’t respond immediately because I was just about to board a peak-time train, and had neither elbow room nor a signal. It wasn’t until Monday that I managed to talk (despite an appalling telephone line) with Google’s Ryan Brack, Manager, Global Communications & Public Affairs.

“Our policy is not to talk about individual cases when it comes to the sort of issue here, which is either a violation of policy, specific content on a blog, etcetera. We just don’t talk about specific cases; but I wanted to give you some sort of piece of information so that you can be clear what Google’s policy is…” He then kindly gave me step by step instructions on how to navigate to the Google policy page, and particularly pointed me to the paragraph:

Personal and confidential information: It’s not ok to publish another person’s personal and confidential information. For example, don’t post someone else’s credit card numbers, Social Security numbers, unlisted phone numbers and driver’s licence numbers. Also, please bear in mind that in most cases, information that is already available elsewhere on the Internet or in public records is not considered to be private or confidential under our policies.

That was it. The line dropped again, almost certainly due to problems at my end (thanks again TalkTalk) and I gave up attempting further voice contact. I emailed:

Hi Ryan

My apologies – I’m having serious line problems ATM. The point I wanted to make is the [that] Zarefarid posted only part of the credit card numbers – enough for the user to recognize that he had them, but nor [not] enough for anyone to make use of them.

This was a clear case of whistleblowing. He had attempted to report the issue through the official channels but was ignored. So he chose this way, but without actually endangering anyone’s personal information (or card numbers).

That was more than 24 hours ago. No response whatsoever.

I don’t believe that Khosrow Zarefarid breached Google’s policy, although he clearly went up to the line. In this instance he was trying to prevent ‘personal and confidential information’ from ending up on the internet. I also believe that under such circumstances Google has a duty to warn the blog owner and provide means by which the blog content can be retrieved by the owner (this may have happened without me knowing about it – but I doubt it).

Google claims, in the same ‘content policy’:

Blogger is a free service for communication, self-expression and freedom of speech. We believe that Blogger increases the availability of information, encourages healthy debate and makes possible new connections between people.

We respect our users’ ownership of and responsibility for the content they choose to share. It is our belief that censoring this content is contrary to a service that bases itself on freedom of expression.

In this instance it did not live up to this ideal. In this instance, Google fell far short – and I appeal to Google to reverse this decision and come to some arrangement with Khosrow Zarefarid.