3 ms·

> Every year, we send millions of notifications to users about privacy and security bugs and issues. Whenever user data may have been affected, we go beyond our

> Every year, we send millions of notifications to users about privacy and security bugs and issues. Whenever user data may have been affected, we go beyond our legal requirements and apply several criteria focused on our users in determining whether to provide notice. > Our Privacy & Data Protection Office reviewed this issue, looking at the type of data involved, whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response. None of these thresholds were met in this instance. They didn't announce it, they followed their internal policies which told them NOT to announce it. This is what people are upset about. > The WSJ reports that the company chose not to report it because of fear of “immediate regulatory interest” that would lump Google in with Facebook, according to one source’s description of the incident. If this source is to be believed, the decision not to announce was less policy-driven than they are claiming. It sounds more like they were intentionally keeping the issue (and potential breach) secret, which naturally bit them in the ass when word eventually got out.

throwaway5752 8y ago
"They didn't announce it, they followed their internal policies which told them NOT to announce it. This is what people are upset about." You are reading - at this very second - a duplicate of a post linking to https://blog.google/technology/safety-security/project-strobe/ https://blog.google/technology/safety-security/project-strob... talking about this very security flaw. The announced it. Perhaps you think it should have been sooner? "Whenever user data may have been affected, we go beyond our legal requirements" Cool. So they usually do more than they're legally obligated to. This time they didn't, and various people/commentators are fetching their fainting salts. Regardless of whatever anonymous sources at the WSJ say, I really don't care about why they did it. They followed their legal obligations and - even more important to me - I have no ethical or professional issues with the way they managed the incident.
- excalibur 8y ago
  > The announced it. Perhaps you think it should have been sooner? Yes, they did. After it was investigated by the WSJ, 6+ months after the fact. I'm not a real stickler about disclosure timelines beyond "wait for the patch please", but "only after it leaks several months later" still rubs me the wrong way. > They followed their legal obligations and - even more important to me - I have no ethical or professional issues with the way they managed the incident. Ethical standards vary widely. Personally, in the category of "Things Google has done that raise ethical concerns", I don't think this incident is significant enough to bother mentioning. But I do think it sits in a bit of a moral gray area.

throwaway5752 8y ago

"They didn't announce it, they followed their internal policies which told them NOT to announce it. This is what people are upset about." You are reading - at this very second - a duplicate of a post linking to https://blog.google/technology/safety-security/project-strobe/ https://blog.google/technology/safety-security/project-strob... talking about this very security flaw. The announced it. Perhaps you think it should have been sooner? "Whenever user data may have been affected, we go beyond our legal requirements" Cool. So they usually do more than they're legally obligated to. This time they didn't, and various people/commentators are fetching their fainting salts. Regardless of whatever anonymous sources at the WSJ say, I really don't care about why they did it. They followed their legal obligations and - even more important to me - I have no ethical or professional issues with the way they managed the incident.

excalibur 8y ago
> The announced it. Perhaps you think it should have been sooner? Yes, they did. After it was investigated by the WSJ, 6+ months after the fact. I'm not a real stickler about disclosure timelines beyond "wait for the patch please", but "only after it leaks several months later" still rubs me the wrong way. > They followed their legal obligations and - even more important to me - I have no ethical or professional issues with the way they managed the incident. Ethical standards vary widely. Personally, in the category of "Things Google has done that raise ethical concerns", I don't think this incident is significant enough to bother mentioning. But I do think it sits in a bit of a moral gray area.