I work for a small Dutch company that uses Google Apps. This means that we can share documents with users within our domain (www.deondernemers.nl), as well as @gmail.com accounts or other Apps-domains. About three weeks ago, we discovered that some fifteen documents and spreadsheets were unintentionally shared with a lot of people, some of whom were outside of our domain. We found out that one of us had been wanting to share these documents with a colleague (within our domain). He selected the documents on the documents list and added one user. Google Docs then shared all these documents with everyone who had access to one of the selected documents.
Fortunately, we found this out fairly quickly and were able to revoke the unintentionally granted rights before any damage was done (we think). These documents weren't ultra-secret, but you can imagine what could go wrong. I decided to try and contact Google about this. At first I wasn't able to find out how to file bug report, so I posted on the support forum (read if you want more details on the bug). Someone pointed me to this 'unknown issues' page, so I filled out the form. This was February 22nd. On the 25th, I received an e-mail asking for more details and that I add a Google support-account as a contributor to a few affected documents. On March 3d, Google replied:
Thank you for taking the time to write. We were able to reproduce the issue based on the information you provided, and are actively working on a fix.
We'll announce the fix in the help forum when it's live.
Please accept our apologies for any inconvenience and thanks again for your patience and for taking the time to write.
On March 5th:
Thank you for your reply. This issue should now be resolved.
The root cause was a product issue that in some cases inadvertently shared collaborators between documents that a user selected from their Docs list. Our fix should prevent this issue from recurring.
This morning, Google apparently removed contributors from all suspect Google documents and sent e-mails to their owners:
We wanted to let you know about a recent issue with your Google Docs account. We've identified and fixed a bug which may have caused you to share some of your documents without your knowledge. This inadvertent sharing was limited to people with whom you, or a collaborator with sharing rights, had previously shared a document. The issue only occurred if you, or a collaborator with sharing rights, selected multiple documents and presentations from the documents list and changed the sharing permissions. This issue affected documents and presentations, but not spreadsheets.
To help remedy this issue, we have used an automated process to remove collaborators and viewers from the documents that we identified as being affected. Since the impacted documents are now accessible only to you, you will need to re-share the documents manually. For your reference, we've listed below the documents identified as being affected.
I think Google handled the issue admirably. It was solved within two weeks, they un-shared affected documents and notified their owners.
Of course, this (again) raises questions about cloud computing, as well as Google's eternal beta-status for a lot of their services. At my company, we double check with whom we share our stuff, but we'll keep on using Google Docs. The only (theoretically) safer option for sharing documents is software on our own server, but that won't be bugfree, either.