Understanding Google Apps for Education User Abuse Policy

Is it possible for your Google Apps domain to be disabled? Can your student and teacher accounts be suspended? We look at Google’s user abuse policy.

Early this week five students arrived the IT office complaining that their Google Apps accounts had been disabled. Checking their account in the Google Apps control panel confirmed that the five accounts had all been suspended.

When logging on the students received the following message:

Account has been disabled

In most cases, accounts are disabled if we believe you have violated either the Google Terms of Services, product-specific Terms of Service (available on the product page), or product-specific policies. Your account has not been deleted, your data is still intact, and it might be possible to regain access to your account.

The students involved were understandably concerned that they had been accused of abusing the system and that their work may be lost. The two sentences that caused the most concern were:

• “Your account has not been deleted, your data is still intact, and it might be possible to regain access to your account.”
• “Google reserves the right to…terminate your account at any time, for any reason, with or without notice.”

Both these sentences give a very different impression to the one given by Google when we were researching the use of Google Apps in our school. “It might be possible to regain access to your account” and “terminate your account at any time” suggest a serious issue with the account and that potentially documents could have been lost.

I checked the Google Apps Directory Sync logs and confirmed that the accounts had not been disabled due to a mismatched account or because they had been disabled in Active Directory. This lead me to spend several hours over the next few days speaking to Google support and digging through policy documents to get to the bottom of the issue. I wanted to know:

1. Can Google disable user accounts or domain accounts permanently?
2. Is it possible for data to be lost in this way?
3. What was the reason these five student accounts had been disabled?

Suspended or Disabled?

The first thing I came across was an inconsistency in the language displayed to the student compared to that shown in the Google Apps control panel. On the warning page shown to the students Google claimed that the accounts had been “disabled”, but in the control panel the account had been “suspended.” It’s a subtle difference, but the word “disabled” suggests permanency, while “suspended” suggests a temporary situation. This inconsistency can be seen throughout the policy documents, in emails sent from support, and on the administration site.

This is information I have collated from the Google Support telephone service, and online documents provided by Google. The assumptions here are based on my own interpretation.

The Difference Between Disabled and Suspended Google Apps Accounts

Google considers a “suspended” account one that can be enabled by the Google Apps domain administrator. A “disabled” account is one that can only be enabled by Google as part of an appeals process.

How a Google Apps Account Can be Suspended or Disabled

Google Apps for Education accounts can be disabled as a result of one of the following processes:

1. An automated scan by Google picking up activity or files which break the Google Apps Terms of Service.
2. As a result of a reported abuse from another user.

Reasons a Google Apps Account Can Be Suspended or Disabled

If Google App’s Terms of Service is broken an account may be suspended or disabled. Full details for Google Drive abuse policies can be found on the Google Apps support pages. From the Abuse Program Policies and Enforcement page (emphasis is mine):

Content policies listed below play an important role in maintaining a positive experience for everyone using Google products. We need to curb abuses that threaten our ability to provide these services, and we ask that everyone abide by the policies below to help us achieve this goal.

When applying these policies, we may make exceptions based on artistic, educational, documentary, or scientific considerations or where there are other substantial benefits to the public from not taking action on the content. Be sure to check back from time to time, as these policies may change. Please also refer to Google’s Terms of Service for more information.

Google Apps accounts can also be disabled for the following reasons, which are specific to GMail:

• Too many messages per day
• Too many recipients per message
• Too many external recipients per message
• Too many unique external recipients per day
• Too many unique recipients per day
• Too many auto forward filters
• Too many messages autoforwarded
• Too many messages marked as spam by third party recipients on the same day (the value of this limit is non publicly available due to security reason)

Finding Out Why a Google Account was Disabled

One of my main concerns is that there isn’t any way to get further detail about why an account has been disabled. In the Google Apps control panel a warning exclamation against the user account simply states, “This user has been suspended,” but this doesn’t give me any useful information that I can use to stop it happening again or better educate the students and teachers involved.

I contacted Google Support. I wanted to better understand Google’s account suspension policy, how they monitor Google Apps like Drive, and get more information about why these student accounts had been suspended.

After a telephone conversation it was clear that the support representative didn’t have the information to hand to answer my query so an email conversation began where we tried to clarify the problem. Most of the assistance I was given was simply links to the policy documents that I had already read.

I was able to confirm, however, that there is no log at all of the reasons an account may be disabled outside of the message shown above. The Google Support representative stated:

“Most of the suspensions are temporal, there are not logs for those. Our aim is to keep our systems healthy and your accounts safe. The purpose of this policy is also to protect our servers from being added to blacklists, as a significant portion of spam generated by Google Apps servers comes from smaller domains that have recently been created. I hope that you fully understand our concerns and evaluate the advantages of operating in “clean and healthy” web environment.

Whenever a user is suspended the reason of the suspension is available for the admin. I hope you understand as I mentioned before, we can’t disclose what our servers take in consideration to apply the policies. This is to prevent the people with bad intentions to create scripts and bypass the rules.”

The Google Apps Support Representative Was Uninformed

The support representative I spoke to was extremely helpful but uninformed. Before he carried out additional research I was given information which directly contradicts the Google Apps Terms of Service, and in some cases was simply misleading.

For example, I was told that:

“I can assure you that there are no situations where access to a user’s Google Drive account could be permanently disabled by Google. Access to Google Drive account can be disabled only if the service have been disabled”

Which is directly contradicted by this paragraph of the TOS…

“If Google identifies a Google Apps user who is violating these agreements, we reserve the right to immediately suspend the user. If the problem is domain-wide, we reserve the right to suspend the entire account and deny administrator access to all the Google Apps services. In such cases, we send a notification to the registered secondary email address for the domain administrator.”

…and this…

• “Google reserves the right to…terminate your account at any time, for any reason, with or without notice.”

The Outcome

I wanted to know the following things:

1. Can Google disable user accounts or domain accounts permanently?Yes, Google’s TOS allows them to disable a single account, multiple accounts, or an entire domain “at any time, for any reason, with or without notice.”The TOS also states: “If Google identifies a Google Apps user who is violating these agreements, we reserve the right to immediately suspend the user. If the problem is domain-wide, we reserve the right to suspend the entire account and deny administrator access to all the Google Apps services.” – https://support.google.com/a/answer/178266?hl=en
   
   
2. Is it possible for data to be lost in this way?This remains unclear. In the situation where an entire domain was disabled access to any stored data is entirely at Google’s discretion:”If the problem is domain-wide, we reserve the right to suspend the entire account and deny administrator access to all the Google Apps services.”The Google support representative stated that: “I can assure you that there are no situations where access to a user’s Google Drive account could be permanently disabled by Google.” However, this isn’t backed up anywhere in the TOS as far as I can see.
   
   
3. What was the reason these five student accounts had been disabled?I’ll probably never know. According to Google there is no log of this information anywhere. It’s likely that the accounts were automatically disabled as a result of a scan which picked up what appeared to be activity which broke the Google Apps Terms of Service.

My problem is that Google’s lack of information leaves me in a position where I cannot prevent this happening again or better inform the students about best practice. I have been unable to identify anything which might have been considered inappropriate activity on the accounts.

The message I have to give back to the students is, “Your accounts were disabled, but I don’t know why.” This isn’t a reassuring for either myself or the students involved and doesn’t encourage confidence in cloud services.

I would like Google to do two things:

1. Make the wording consistent between the publicly facing pages, the Google Apps control panel, and the policy documentation so that the difference between a disabled and suspended account is clear.
2. Clarify any situation where access to a user’s data could be lost.

Should this make you reconsider using Google Apps?

There is no example I can find in which a Google Apps for Education domain or even single user account has been permanently disabled and any data lost. Google’s Terms of Service are an attempt to cover all bases. In general Google are very lenient towards education customers, and the customer support is excellent and as open as they can be within the TOS.

Useful Information

Appealing a Google Apps violation

Google Apps Terms of Service 

Abuse program and enforcement