4 ms·

A question I've always wondered -- If Google, or an employee at Google, used ML (or just classic techniques) to analyze the enormous, enormous troves of trojan

A question I've always wondered -- If Google, or an employee at Google, used ML (or just classic techniques) to analyze the enormous, enormous troves of trojan horse data they have on the employees of virtually every organization across the globe, would it be illegal if they traded on that data? They could surely accurately call virtually any trend before anyone. They could see when morale at a firm drops, when hours drop, when employees start trying to get jobs elsewhere, etc. It is simply shocking the amount of data they have coalesced. And while I generally have a good opinion on them, a product like this just seems like a step too far and risks threatening the trust users have in them.

mseebach 9y ago
IANAL, but I think they would possibly be in breach of their own privacy policy: > How we use information we collect > We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones, and to protect Google and our users. We also use this information to offer you tailored content – like giving you more relevant search results and ads. [...] > We will ask for your consent before using information for a purpose other than those that are set out in this Privacy Policy. I don't think trading for profit on information a user would reasonably expect to be private (search history, browsing history, email) could reasonably be construed to fall into any of those categories, however the definition of "services" in "develop new [services]" is a bit of a joker. Google Hedge Fund anyone?
- linkregister 9y ago
  It sounds like the kind of thing that would cause an existential crisis to the G Suite unit ($1B+ annual revenue) when discovered or leaked. This would have follow-on effects to other Google brands. Also massive liability for breach of contract or even perhaps fraud. In the G Suite contract, do customers indemnify Google from damages above a certain amount for privacy breaches? I haven't seen the T&Cs, just the privacy policy.
  - mseebach 9y ago
    That's basically my rationale for trusting Google with my data: They have both the means (lots of well paid smart people) and the interest (a substantial leak/misuse of my data could well be a fatal event for Google) to take care of it. > In the G Suite contract, do customers indemnify Google from damages above a certain amount for privacy breaches? I don't see how they wouldn't.
  - eitally 9y ago
    There is a standard indemnification clause that is sometimes negotiated slightly one way or another by individual customers.
- s73ver 9y ago
  Right. But as a nefarious employee, that's Google's problem. By the time it comes to light, I'm already off laying on a beach in a country without an extradition treaty.
  - mseebach 9y ago
    I suspect very few individual Google employees have the unsupervised access required to pull off something like this.
    - eitally 9y ago
      And the ones who do still have every action logged.
EGreg 9y ago
Not just trading, but I wonder if they could take other actions based on that. For example, if your company uses Google Apps, they may not be able to read your individual email but where does it say they can't use aggregate data to figure out if you're up to something?
Eridrus 9y ago
I don't think it would be illegal due to insider trading laws; there are plenty of finance companies that seek non-public information to trade on, as long as it didn't come from someone with a requirement to safeguard that (i.e. an insider), it seems to be fine. It would probably be illegal for an employee to do this though without Google's consent; wasn't there a case of a few Chase(?) employees trading on credit card data and being fired and prosecuted?
- TheCoelacanth 9y ago
  It could be insider trading under Rule 10b5-2 if an insider gave Google the information with the reasonable expectation that they would keep it confidential. That would apply to some of the information Google has, but wouldn't apply to other information. If a company used Google Apps for their business email and someone at Google found out about a merger by reading about it in an email that they got from the CEO's email, that would be insider trading because the CEO is an insider and would have had a reasonable expectation that Google would keep their email confidential. On the other hand, if the CEO by mistake sent an email about the merger to someone who used Gmail who was not an insider, that would not be insider trading because the person who had the expectation of confidentiality was not an insider.
halflings 9y ago
Google does not use corporate customer's data for any type of commercial use, it's only used for the customer's own use. As such, they do not have "enormous troves of trojan horse data" as they are not allowed (by their own terms) to use it for anything unrelated to the company itself.
- endorphone 9y ago
  I said nothing about corporate customers. I'm talking about individual accounts, and individual devices. Google knows where I go, who I talk to, how long I'm at places, how long I spend in the office, and on, and on, and on. And at an aggregate, they know how busy every shop is, the types of people that visit, etc. They're quite forthright about this. Through personal accounts -- which Google quite openly mines -- Google has an astronomical amount of data about every business. Google knows more about worker habits than employers. They know more about your city than your municipality. Etc. Etc.
  - eitally 9y ago
    It is in violation of Google's core principles and policies, and will never happen. Ever googler understands, and has it hammered into their brains repeatedly, that the worst thing the company could do is breach user trust by exposing or trading on user/customer data.
    - biztos 9y ago
      Perhaps, but I think it would be entirely within Google's principles to show me employment ads if some combination of my gmail and search usage indicated I might be looking for a new job. Do the principles and policies you know of have some kind of ethics angle, or is it just about the (quite real) risk of bad PR that could harm the magic cookies driving the ad business?
    - ruleabidinguser 9y ago
      Is it maybe bad for the economy at large that they keep all this to themselves and do not generate the corresponding profits?

mseebach 9y ago

IANAL, but I think they would possibly be in breach of their own privacy policy: > How we use information we collect > We use the information we collect from all of our services to provide, maintain, protect and improve them, to develop new ones, and to protect Google and our users. We also use this information to offer you tailored content – like giving you more relevant search results and ads. [...] > We will ask for your consent before using information for a purpose other than those that are set out in this Privacy Policy. I don't think trading for profit on information a user would reasonably expect to be private (search history, browsing history, email) could reasonably be construed to fall into any of those categories, however the definition of "services" in "develop new [services]" is a bit of a joker. Google Hedge Fund anyone?

linkregister 9y ago
It sounds like the kind of thing that would cause an existential crisis to the G Suite unit ($1B+ annual revenue) when discovered or leaked. This would have follow-on effects to other Google brands. Also massive liability for breach of contract or even perhaps fraud. In the G Suite contract, do customers indemnify Google from damages above a certain amount for privacy breaches? I haven't seen the T&Cs, just the privacy policy.
- mseebach 9y ago
  That's basically my rationale for trusting Google with my data: They have both the means (lots of well paid smart people) and the interest (a substantial leak/misuse of my data could well be a fatal event for Google) to take care of it. > In the G Suite contract, do customers indemnify Google from damages above a certain amount for privacy breaches? I don't see how they wouldn't.
- eitally 9y ago
  There is a standard indemnification clause that is sometimes negotiated slightly one way or another by individual customers.
s73ver 9y ago
Right. But as a nefarious employee, that's Google's problem. By the time it comes to light, I'm already off laying on a beach in a country without an extradition treaty.
- mseebach 9y ago
  I suspect very few individual Google employees have the unsupervised access required to pull off something like this.
  - eitally 9y ago
    And the ones who do still have every action logged.

EGreg 9y ago

Not just trading, but I wonder if they could take other actions based on that. For example, if your company uses Google Apps, they may not be able to read your individual email but where does it say they can't use aggregate data to figure out if you're up to something?

Eridrus 9y ago

I don't think it would be illegal due to insider trading laws; there are plenty of finance companies that seek non-public information to trade on, as long as it didn't come from someone with a requirement to safeguard that (i.e. an insider), it seems to be fine. It would probably be illegal for an employee to do this though without Google's consent; wasn't there a case of a few Chase(?) employees trading on credit card data and being fired and prosecuted?

TheCoelacanth 9y ago
It could be insider trading under Rule 10b5-2 if an insider gave Google the information with the reasonable expectation that they would keep it confidential. That would apply to some of the information Google has, but wouldn't apply to other information. If a company used Google Apps for their business email and someone at Google found out about a merger by reading about it in an email that they got from the CEO's email, that would be insider trading because the CEO is an insider and would have had a reasonable expectation that Google would keep their email confidential. On the other hand, if the CEO by mistake sent an email about the merger to someone who used Gmail who was not an insider, that would not be insider trading because the person who had the expectation of confidentiality was not an insider.

halflings 9y ago

Google does not use corporate customer's data for any type of commercial use, it's only used for the customer's own use. As such, they do not have "enormous troves of trojan horse data" as they are not allowed (by their own terms) to use it for anything unrelated to the company itself.

endorphone 9y ago
I said nothing about corporate customers. I'm talking about individual accounts, and individual devices. Google knows where I go, who I talk to, how long I'm at places, how long I spend in the office, and on, and on, and on. And at an aggregate, they know how busy every shop is, the types of people that visit, etc. They're quite forthright about this. Through personal accounts -- which Google quite openly mines -- Google has an astronomical amount of data about every business. Google knows more about worker habits than employers. They know more about your city than your municipality. Etc. Etc.
- eitally 9y ago
  It is in violation of Google's core principles and policies, and will never happen. Ever googler understands, and has it hammered into their brains repeatedly, that the worst thing the company could do is breach user trust by exposing or trading on user/customer data.
  - biztos 9y ago
    Perhaps, but I think it would be entirely within Google's principles to show me employment ads if some combination of my gmail and search usage indicated I might be looking for a new job. Do the principles and policies you know of have some kind of ethics angle, or is it just about the (quite real) risk of bad PR that could harm the magic cookies driving the ad business?
  - ruleabidinguser 9y ago
    Is it maybe bad for the economy at large that they keep all this to themselves and do not generate the corresponding profits?