19 ms·
Google Exposed User Data, Feared Repercussions of Disclosing to Public
- itissid 8y agoPerson 1: Google exposed the private data of hundreds of thousands of users of the Google+ social network. Person 2: What is Google+?
- minimaxir 8y agoThe buried lede is that Google is shutting down Google+. (EDIT: for consumers: Google is keeping it as an enterprise product)
- throwawaymath 8y agoTechnically it's shutting down all consumer functionality for Google+.
- Schlaefer 8y agoWhat does "consumer" mean in that context?
- ocdtrekkie 8y agoCorporate/internal use of Google+ for G Suite customers will probably continue. Google uses G+ internally, so it's unsurprising they intend to hang onto the corporate side of it for now, at least.
- scarmig 8y agoAnd from this day forth, Google+ will sit along with Google Reader as part of the pantheon of betrayals that HN commenters will bring up every single time Google announces a new product.
- DoreenMichele 8y agoSo, are you actually interested in seeing less hating on Google? Or just what? I did consider replying to the buried the lede comment that "I guess I can stop occasionally wondering if I should get familiar with Google+." Then decided to tweet it instead because that's insubstantive, or could be interpreted as such. I'm actually a fan of Google, but never got into Google+. I don't openly fangirl the company in part because it gets so much open hatred here.
- cronz 8y agoI doubt anybody cares about Google+, honestly. In fact I'm happy to see it die, after all the pain it's caused me (YouTube integration)
- minimaxir 8y agoThis is a fair clarification per Google's followup: https://www.blog.google/technology/safety-security/project-strobe/ https://www.blog.google/technology/safety-security/project-s... > At the same time, we have many enterprise customers who are finding great value in using Google+ within their companies. Our review showed that Google+ is better suited as an enterprise product where co-workers can engage in internal discussions on a secure corporate social network. Enterprise customers can set common access rules, and use central controls, for their entire organization. We’ve decided to focus on our enterprise efforts and will be launching new features purpose-built for businesses.
- rhizome 8y agoSo, pivot to Slack-alike. I'm sure it'll last.
- cxseven 8y agoWhat's the point, then? Google will (or should) spend just about as much effort keeping it live for enterprise users as it would for the rest of us. I don't use it often, but occasionally find useful communities there, especially concerning technical subjects. Now all of that is going to disappear. It's annoying that Google apparently prizes the opinion of enterprise customers enough to half-abort the plan to shut down Google+, while for some reason maintaining a stubborn insistence on removing its access for the rest of us. Yes, this will be another point to add on the list of reasons to never become invested in a new Google product.
- ForHackernews 8y agoIf a social network falls in the woods and no one's there to log out, did it really go down?
- EGreg 8y agoWhat happens to all the content and communities on it??
- ucaetano 8y agoCompany finds a security vulnerability caused by a bug. Logs show that it has never been used by anyone. It patches the vulnerability. [Honest question] Should the company announce it publicly? PS: Keeping in mind that this is part of the Murdoch vs. Google war going on for about 10 years: https://www.npr.org/sections/money/2009/11/murdoch_vs_google.html https://www.npr.org/sections/money/2009/11/murdoch_vs_google... https://www.thedrum.com/news/2017/03/28/timing-everything-rupert-murdoch-s-google-rebellion-returns-news-corp-eyes-more-ad https://www.thedrum.com/news/2017/03/28/timing-everything-ru... https://www.theverge.com/2018/1/22/16920254/news-corp-rupert-murdoch-carriage-fee-facebook-google-journalism-media https://www.theverge.com/2018/1/22/16920254/news-corp-rupert... [Edit: added the "Honest Question" tag] Edit 2: Related post by Google: https://blog.google/technology/safety-security/project-strobe/ https://blog.google/technology/safety-security/project-strob...
- hoos97 8y agoYes, because when you go public with the issue you are able to control the narrative. Bad judgement to assume that these issues will never reach the public eye. Especially knowing that a patched was successfully applied...instead Google looks like it is having trouble living up to it's Don't Be Evil motto.
- lostmsu 8y agoNo, they would have to issue like 10 reports a day. Bugs that are never exploited in web sites are rarely published for multiple reasons. Definitely not something to blame Google for.
- hoos97 8y agoIf it wasn't exploited makes it even better...shows that you are being aggressive in identifying issues and applying corrections. Take advantage of opportunities to show transparency in a good light as well as meet your commitments to be transparent when events have not gone your way. This shouldn't be about how many reports you have to issue. Google can afford the staff to make that happen.
- IBM 8y agoGDPR proving to be great once again. The case for a US equivalent gets stronger. And more importantly, all these fuck ups will ensure that whatever bill gets drafted isn't just what the Facebook/Google lobbyists find acceptable.
- wglb 8y agoWhat data was breached? If the answer is none, there is no GDPR action to be taken.
- IBM 8y agoI don't know, but Google doesn't either: >Because the company kept a limited set of activity logs, it was unable to determine which users were affected and what types of data may potentially have been improperly collected, the two people briefed on the matter said. The bug existed since 2015, and it is unclear whether a larger number of users may have been affected over that time.
- nashashmi 8y agoLooks like "we don't know if data was leaked" is now a standard language that accompanies every security bug disclosure to avoid GDPR fines.
- jtbayly 8y agoThen, to be clear, is your position that companies should be punished (fined) if there has ever been the possibility that user data was compromised? It's possible that a time-traveling quantum-powered encryption-breaking mind-reader from the future has seen your personal data. Should we fine everybody who knows anything about you? Reckless endangerment deals with the possibility of something bad happening, but notice that word "reckless."
- IBM 8y agoI didn't say GDPR would apply in this situation, and the WSJ story suggests it wouldn't because of when it was discovered. All I said was that GDPR was great (obviously we'd only see the benefits from it after it had gone into effect), and this latest scoop bodes well for the political movement to enact equivalent legislation in the US.
- spiderfarmer 8y agoWhat would the EU fine for Google be now GDPR is enforced? 2.2 billion dollars?
- wglb 8y agoGDPR enforcement would come into effect only if there was a breach and it was not handled. From what is in the story and from what we know, there has been no breach. As 'tptacek has noted, it is very unusual to announce a security bug without a resultant breach.
- TimothyBJacobs 8y agoWhat in the story indicates that there was no breach. The story says that they didn't keep a large enough set of activity logs to determine whether data was improperly accessed, not that there was no breach. > Because the company kept a limited set of activity logs, it was unable to determine which users were affected and what types of data may potentially have been improperly collected, the two people briefed on the matter said.
- TangoTrotFox 8y agoThis is not what the article says, "Because the company kept a limited set of activity logs, it was unable to determine which users were affected and what types of data may potentially have been improperly collected, the two people briefed on the matter said. The bug existed since 2015, and it is unclear whether a larger number of users may have been affected over that time. " 'We don't know who was affected and what data may have been collected' is way different than what you're saying. It also opens up lots of questions, such as why a company with the resources of Google would not persist security critical logs indefinitely.
- megous 8y agoA company in my country got fined recently for not protecting data of ~735k users (7% of the country's population) (leaked email, password, phone, full name ...) they failed to disclose properly to the regulator and the users. They got ~$60,000 fine. GDPR was part of the reasoning for the fine.
- monochromatic 8y agoNon-paywall link?
- testplzignore 8y agohttps://www.msn.com/en-us/news/technology/google-exposed-user-data-feared-repercussions-of-disclosing-to-public/ar-BBO7gaA https://www.msn.com/en-us/news/technology/google-exposed-use...
- jey 8y agohttps://outline.com/https://www.wsj.com/articles/google-exposed-user-data-feared-repercussions-of-disclosing-to-public-1539017194 https://outline.com/https://www.wsj.com/articles/google-expo... EDIT: fixed link. thanks timvisee
- timvisee 8y agoYou liked the wrong article. Fixed: http://outline.com/mNDfrH http://outline.com/mNDfrH
- Bucephalus355 8y agoYes they should have announced it no matter what the logs said. Depending on the logs is the worst idea ever in terms of breach determination. I don’t know how many times we’ve had 40 IoCs, but just because there isn’t a log file (often because no one splurged for the SIEM and the syslog collector broke beyond repair months ago) management acts like they’ve won the legal liability / cyber security lottery. Obviously it’s not as black and white as that, but the burden of proof should be on the companies to show that no malicious use happened right after they go public with a breach. Going public with this kind of information, even if nothing happened, could have driven much better behavior across the United States if not the world by setting the example. But Google chose the path of self-protection and short-term gain.
- amanaplanacanal 8y agoWait, was this a vulnerability or a breach? Because if every vulnerability is now a breach, there are millions more than we know about. Microsoft sends out monthly security patches. Each fix is in there is fixing a vulnerability. Every Windows server has multiple vulnerabilities fixed every month. Is every company that uses Windows now required to determine if any of those vulnerabilities were actually used? This seems like a bottomless hole.
- kerng 8y agoCompanies internally find and fix security bugs all the time and dont talk about it if no known breach occured. Is there a requirement to do this? Maybe there should be a requirement to document that due diligence occurred to understand if it was exploited?
- nitwit005 8y agoI don't see the benefit. We'd all just end up with a barrage of emails we don't really care about.
- 394549 8y agoThe notification don't need to be email. If there's no evidence of a breach, I think it would be reasonable for them to disclose into some kind of vulnerability database. Maybe someone could later determine if the vulnerability was exploited based on some data dump found on the dark web or something.
- stochastic_monk 8y agoI would think it should be required to report. Just because you don’t know if a vulnerability was exploited does not mean it was not.
- kerng 8y agoI assume cloud providers have hundreds of security issues that are found internally over the course of a year. Requiring reporting would certainly be a step forward and testing in production for software would maybe be seen as what it is, an engineering anomaly and failure to perform due diligence.
- UncleMeat 8y agoYou are going to be off by at least an of magnitude. You'd see multiple reports per day for a diligent company.
- 8y ago
- deleted 8y ago[deleted]
- dekhn 8y agoNow that G+ for consumers is going away, can we have Reader back?
- chris_mc 8y agoJust this weekend, I setup a domain name, setup email, and setup apps and accounts to replace Google with open-source software and servers I control, generally (I use some 3rd party services that I feel I can trust, like Fastmail and Namecheap). I then turned off and deleted all of my data from Google that I could without deleting my Google account (I need to forward this long-standing email to my new email and I don't want to lose my Google Music ratings and playlists right now). It wasn't hard, just about 5 hours of work and then a few hours to set everything up as I like it. I pay ~$5 per month for email/calendar/contacts through Fastmail, ~$10 per year for 2 domains (each), and ~$5 for an Android app to sync my CardDAV/CalDAV accounts with my Android phone. I have almost completely deleted/disabled Google apps on Android, although I'm not ready to run LineageOS quite yet. I even use an OSM-based maps app, which doesn't work as well as Google Maps, but it is sufficient; navigation sucks compared to Google Maps, but that's the price you pay for doing this sort of thing. I'm not super-paranoid about government surveillance and I didn't care about Google tailoring ads to me like most folks here, but after all of the data breaches and such, I decided that controlling my own data is worthwhile just to make me feel better. Now, I am able to do most of the stuff I could do before, maybe 70-80% as good as with Google for some things (like maps), but I have peace of mind.
- bpye 8y agoI've been working my way down this path. Fastmail for email and CalDAV/CardDAV, DavDroid to sync, K9 as my email client, OsmAnd for maps, Firefox instead of Chrome. I try and remember to use SkyTube not YouTube but it isn't flawless. I use KISS as my launcher on Android. I still haven't eliminated Google Photos, I do appreciate the free sync on my Pixel 2 XL for peace of mind, Google Translate is still super useful for offline translate and the camera translate feature and I haven't yet been able to replace Google Maps for transit instructions. I still use a Chromecast which I guess is next to go, maybe I'll actually setup a HTPC of sorts, or perhaps just use Kodi on my Xbox One S as that seems to work well enough.
- nashashmi 8y agoYour security is only guaranteed by your obscurity. The moment this becomes standard practice and people start using popular software to handle personal services, this version of security will become laughable again.
- ucaetano 8y agoRelevant post: https://blog.google/technology/safety-security/project-strobe/ https://blog.google/technology/safety-security/project-strob...
- deleted 8y ago[deleted]
- growt 8y agoSo the joke is finally true? Google+ hacked, data of all 20 users exposed.
- user111233 8y agoMaybe 20 actual users but google+ is filled with accounts from google users and automatically posted with content from other sites like comments on youtube.
- amirmasoudabdol 8y agoA few years ago, I had an Google account. My account got disabled because I’ve tried to buy an app from Android Store. Besides the fact that I never managed to get my account back something funny happened a few years after. I had teo Blogger blogs connected to the account and my Twitter was connected to my Blogger as well. I’ve lost those blogs too, and I couldn’t get them back. At some point, I’ve realized some suspicious tweets in my timeline and realized that they are from my blogs! So, Google freed my blogs but didn’t removed its connected accounts. Whoever got the account probably didn’t have any idea that these addresses are connected to a Twitter account as well! But the share to Twitter was on, and whatever she/he was positing were ending up in my twitter account! Point being, Google is leaking from strange places! Add Google+ to your Blogger and you’ll risk much more I guess!
- royce 8y agoNow that Google+ is going away, can we have the +string operator back in Google Search, to force inclusion of a single string (instead of having to use double quotes)?
- cstrat 8y agois that why that was changed???
- buboard 8y agoone can say it was used more
- royce 8y agoYep, that was exactly why (or at least, very strong circumstantial evidence): https://productforums.google.com/d/msg/websearch/H4XbbwWmtAY/Rj8lcMhcHUMJ https://productforums.google.com/d/msg/websearch/H4XbbwWmtAY... I don't think it was ever officially announced/admitted anywhere, though. But it was exactly around the time that Google+ was rolled out.
- lgats 8y agohttps://www.fullwsj.com/articles/google-exposed-user-data-feared-repercussions-of-disclosing-to-public-1539017194 https://www.fullwsj.com/articles/google-exposed-user-data-fe...
- neurotech1 8y agonon-paywall version: http://archive.is/rpuA1 http://archive.is/rpuA1
- JumpCrisscross 8y agoDoes anyone else get rubbed the wrong way by this sort of irreverent infringement? Even if you have zero concern for journalists’ copyrights, it puts this forum at risk.
- zukzuk 8y agoNope
- enraged_camel 8y agoNo I don’t, and no it doesn’t.
- waterhouse 8y agoWebsites like WSJ manage to get listed high in the Google rankings by presenting the actual article, instead of a paywall, to the Googlebot and to requests with Google in the Referer field (as I understand it). I gather that they do the same thing to the Archive scraper. As far as I'm concerned, that's a cheap trick the website performs, and using a cheap trick to get around it seems fine to me.
- deleted 8y ago[deleted]
- EpicEng 8y agoNot I
- freehunter 8y agoIf it put the forum at risk, they wouldn’t put the “web” link after the title of the post, which basically accomplishes the same thing. This kind of thing is officially sanctioned.
- dionna767675 8y agoSuccess is what you make it Internet marketing on the next level https://souniqueincome.com https://souniqueincome.com
- ydnaclementine 8y agoas not-exciting some of the 'business requirements' I've been developing at work have been, just remember you could have been working on google+ for the last 8 years
- hetspookjee 8y agoHuh why did this post get removed from the front page? It's less than 1 hour old, had acquired a lot of points + comments in the meantime. Yet I can't find it in the first 100 pages as of now.
- dang 8y agoIt was buried as a dupe of https://news.ycombinator.com/item?id=18169243 https://news.ycombinator.com/item?id=18169243. We're just trying to figure out which URL is the best one for this story. It's a bit harder than usual. In the meantime, I've restored the current thread.
- dang 8y agoRelated discussion here: https://news.ycombinator.com/item?id=18169243 https://news.ycombinator.com/item?id=18169243. Normally we'd treat these as dupes of each other (and initially we did that), but there seem to be two stories here: one about the data breach and one about Google+. So I guess we'll leave both of them up.
- Ajedi32 8y agoMaybe even three stories; there's another bit in that Google blog post about Google making their API permission prompts for Gmail, Drive, Calendar, and contacts more fine-grained and locking them down with policy measures.
- Alex3917 8y agoThis is extremely problematic for us. We're bootstrapped and now Google is suddenly asking for up to $75,000 (or more) for a security audit. This despite the fact that we've been publicly asking for more limited OAuth scopes for years (c.f. my HN posting history and my tickets on the Google issue tracker), and the fact that we've had zero security incidents in over three years. All to ensure that we're not risking exposing user data that we don't even have, have never accessed, and shouldn't need access to in the first place. https://cloud.google.com/blog/products/g-suite/elevating-user-trust-in-our-api-ecosystems https://cloud.google.com/blog/products/g-suite/elevating-use...
- kitx 8y agoAppears that (wording is somewhat vague) apps which only store user data on the device do not need to go through this external security assessment. Agree that this is Google pushing their security costs onto developers and effectively killing bootstrapped SAAS apps.
- wastedhours 8y agoDoes this limit things like Zapier integrations as well? Surely they can't confirm the end security of every usage?
- godelmachine 8y agoSee no evil, yeah?
- Bhilai 8y ago>We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. Wait, so they only keep two weeks worth of logs and within these logs they did not find anyone abusing this flaw. How can they be certain for any time period from two week prior ?
- ismail 8y agoWow. “We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks.” The wording of this is really pushing the boundary of plausibility. I fail to understand the logic of how this would protect privacy? Access logs with no profile data logged would not compromise privacy would it? Can anyone confirm the timing of the google blog post? It seems the WSJ article was posted at a similar time. This leads me to believe that the most likely reason we are hearing about this now is due to comment requests from the WSJ. WHEN Goog realised it was out they published. Goog is trying to avoid using the words Data breach as they may get into hot water in EU. Love how it is buried in the article. My guess is a similar thing has been happening with android permissions. Data has been leaking through that they have just not admitted to it.
- advisedwang 8y ago> Access logs with no profile data logged would not compromise privacy would it? True, but access logs without profile data would prevent you know _which_ profiles were accessed. This matches with the actual claim in the article that they would be "unable to determine which users were affected"
- mashlol 8y agoRight, but the only "profile data" they would need to add to the logs to know, would be a user ID. Not really any private info.
- deleted 8y ago[deleted]
- norseman 8y agoPeople use Google+ ?
- glenrivard 8y agoWow the Wall St. Journal and Murdoch really does not like Google. This article makes this sound like this is something that it appears to not be. Did this all start when Google fired Damore? Or does it date further back?
- gman83 8y agoGoes way back: http://allthingsd.com/20091124/whats-really-behind-the-rupe-a-dope-with-google-and-microsoft-here-are-five-possibilities/ http://allthingsd.com/20091124/whats-really-behind-the-rupe-...
- puzzle 8y agoNo mention of the Google-Murdoch spate is complete without a link to this classic: https://europe.googleblog.com/2014/09/dear-rupert_25.html https://europe.googleblog.com/2014/09/dear-rupert_25.html
- throwaway829 8y ago>We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. They only kept two weeks of logs, yet this bug was accessible over a three year window. So out of 156 weeks they can only rule out 2 weeks where data was not accessed. I think that's pretty pathetic for a company that stores your precise location, search history, photos, email, text messages, calendar, social network, date of birth, etc. This is a very big story. Hence why Google executives sat on it for six months.
- dirtylowprofile 8y agoI’m surprised Google’s own Project Zero did not caught this one.
- SamWhited 8y agoWhen your purview is as wide as theirs, you can't catch every single vulnerability; I'm sure there are plenty of things in openssl, linux, etc. that they (or anyone else) haven't caught yet too :)
- dirtylowprofile 8y agoYes but is it damn right that they should start in their own backyards.
- throw2016 8y agoGoogle's Project Zero is always taking others to task for security yet not a peep from them on this. Their front page today is focused on bugs in Safari, Linux and Windows. Perhaps they should focus on their own products. Its complete hypocrisy to affect commitment and then slink away when it comes to your own products. That raises questions about conflict of interest and credibility.
- SamWhited 8y agoThe Project Zero team is specifically supposed to find Zero Days in other products to make everyone more safe. Google has other security teams for finding bugs in their own products. This isn't Project Zero's fault, nor does it really have anything to do with them. Project Zero is one of the decent teams at google trying to do good by everyone; they can't find every single bug, and if they changed their mission to just focus on Google products we might not have found all sorts of big bugs (eg. heartbleed) for a lot longer. Probably best to leave them alone and let them get on with their business.
- SquareWheel 8y agoBecause they didn't find the bug. Why would they report it? They've reported plenty of Google/Chrome bugs in the past. Your claims of hypocrisy are very off base.
- SquareWheel 8y agoA lot of the time I feel Google gets a bad rep on HN as the comments are so often filled with hyperbole. In this case however Google did a very poor job of disclosing this leak in their sunsetting Google+ announcement post. I would have much preferred an incident report explaining what really happened, even if they couldn't find any examples of abuse.
- throwaway829 8y agoConveniently for them, they only kept 2 weeks of logs (this is a 3 year old bug). I might implement that at my company. Take two weeks to patch and test the security hole, then review my two weeks of logs for any evidence of a breach. Then tell customers we haven't found any evidence of illicit access.
- richsherwood 8y agoNot only that but does anyone actually believe they only kept two weeks of logs? I find it very suspect that the company known for amassing data only keeps some data for two weeks. How convienent for them.
- menacingly 8y agoThe cynic in me wonders how long the two week log policy has been in place
- honr 8y agoSo, I couldn't understand what "exposed" means in that article. Was any user's data obtained by someone not authorized to do so, or merely access to the data was possible?
- cxseven 8y agoJust possible. Similarly, the recent FB hack didn't actually penetrate 50 million accounts -- that was just an upper bound estimate based how many accounts were "exposed to the risk" of being compromised, probably because they were noted as being touched by the buggy "view as" function.
- cxseven 8y agoUpdate: It looks like on October 2nd, Facebook clarified that 50 million users actually had their login credentials stolen, and an additional 40 million were unconfirmed but known to have been touched by the buggy "view as" feature: https://newsroom.fb.com/news/2018/10/facebook-login-update/ https://newsroom.fb.com/news/2018/10/facebook-login-update/
- mkeyhani 8y agoThey don’t quite know: > We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused. https://www.blog.google/technology/safety-security/project-strobe/amp/ https://www.blog.google/technology/safety-security/project-s...
- Waterluvian 8y agoSo was Google+ basically just kind of dragging along as a zombie and this PR nightmare caused it to suddenly not be worth even keeping it around?
- euske 8y agoNowadays I tend to trust a company that had a security vulnerability or data breach once and handled it gracefully, rather than a company that says they had no security breach. Making a mistake is only human; Your true test is what you do after you found it.
- spatz 8y agoSo is this an example of a company handling it gracefully? They couldn't tell what the impact was but kept it a secret for 6 months.
- deleted 8y ago[deleted]
- mikob 8y agoPretty sure he is saying the opposite.
- IanSanders 8y agoIt would make a nice change, if majority did the same.
- starbugs 8y agoThis! It's not about the mistake that led to the breach. It's about what you do once you become aware of it as a company, as a team, and as an individual. I am quite confused about how poor this has been handled by Facebook recently and now Google follows suit.
- pmart123 8y agoI agree. I think it is more important when a company is forthright about a breach quickly than the history of breaches. Both Sony and Equifax had large security breaches prior to the large hacks.
- phyller 8y agoThis is the data that could potentially have been exposed for each person [1]. In their release about shutting down Google+ they made it seem like a lot less. [1] https://developers.google.com/+/web/api/rest/latest/people https://developers.google.com/+/web/api/rest/latest/people
- Bartweiss 8y agoThanks for this. I hadn't been able to track down a clear statement of what was exposed, which is an awfully important question in a case like this. It's frustrating that "someone on HN dug up the API" is the most reliable way to get information like this, and speaks ill of how this was handled even after it was disclosed.
- bogomipz 8y agoI think the these three passages really sum up where Google's moral compass is these days: >"A memo reviewed by the Journal prepared by Google’s legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger “immediate regulatory interest” and invite comparisons to Facebook’s leak of user information to data firm Cambridge Analytica." >"The document shows Google officials felt that disclosure could have serious ramifications. Revealing the incident would likely result “in us coming into the spotlight alongside or even instead of Facebook despite having stayed under the radar throughout the Cambridge Analytica scandal,” the memo said. It “almost guarantees Sundar will testify before Congress.”" >"Internal lawyers advised that Google wasn’t legally required to disclose the incident to the public, the people said. Because the company didn’t know what developers may have what data, the group also didn’t believe notifying users would give any actionable benefit to the end users, the people said." These statements and tactics seem to be taken from the same playbook that Big Pharma, Big Tobacco or any other soulless Mega Corp uses. As long as it it's legal they don't care if it's right. Did their arrogance prevent them from entertaining the idea that disclosure would have provided users with the "actionable benefit" of considering whether or not they wanted to delete their Google accounts?