Google Drive Security Gaps in Forensic Visibility

**Executive Summary:** The advisory describes a forensic deficiency in Google Workspace where users without paid licenses (e.g., Cloud Identity Free) can copy and download files from private/shared drives without producing the normal audit logs (notably missing "copy" and download events), enabling undetected data exfiltration; the report outlines exploitation scenarios (compromised accounts, license revoke/reassign, and offboarding), notes limited admin-visible events (USER_LICENSE_ASSIGNMENT/REVOKE), and recommends monitoring license changes and "source_copy" events as compensating detections.