10 ms·
Yes, if you choose to delete it, it will be deleted. (It takes nontrivial amounts of time to delete it across distributed service architecture but the deletions
by aiiane 7y ago
Yes, if you choose to delete it, it will be deleted. (It takes nontrivial amounts of time to delete it across distributed service architecture but the deletions do get propagated.)
- duxup 7y agoI guess for the writer of the blog it isn't something to point out, but it would have been nice if they explicitly said that. Maybe it is just just the writer's POV, but I do worry they didn't explicitly say it is deleted as far as Google's storing of such data...
- loudtieblahblah 7y agoI simply do not believe this. Unless they're audited by a source that can be trusted and have the findings made public, I will not believe it either.
- aiiane 7y agoYou're welcome to believe whatever you want, but a decent chunk of my day job is making sure that it's true.
- justcodebruh 7y agomay i ask what your day job is?
- aiiane 7y agoAnswered here while your comment was dead: https://news.ycombinator.com/item?id=19809515 https://news.ycombinator.com/item?id=19809515
- aiiane 7y ago'justcodebruh' your comment is marked as dead, but to answer your question I work on Google's privacy engineering team.
- dmitriid 7y agoYour team is doing a shitty job, to be completely honest. This comment and all the comments beliw it: https://news.ycombinator.com/item?id=19809168 https://news.ycombinator.com/item?id=19809168
- halfmatthalfcat 7y agoLOL rather than applaud some modicum of privacy we may be getting back, you decide to denigrate. Should we all hold this cynical attitude and hope for no progress at all?
- dmitriid 7y agoWe should all hold companies accountable and not celebrate every “modicum of privacy”. Look at what companies do, not what they say they do. Yay, you can delete all your data... says the company which puts hidden microphones in consumer products, leaks copious amounts of user data across unrelated services, releases a browser which automatically logs you in to google services, lifted its ban on personally identifiable info in its ad service etc. etc.
- joshuamorton 7y agoSo are you claiming that you can't actually delete your data? Or are you saying that letting you delete your data isn't a thing? Because "letting you delete your data" seems to be a thing the company is doing. Which you say we should look at.
- dmitriid 7y agoNo one can say for certain how, and when they delete the data. Even the person from the privacy team said as much. Moreover, this is a very, very, very small "modicum of privacy". A very small number of users will use that. It makes the company look good, for sure [1], but it will in no way, shape, or form affect what they are already doing, and will continue doing. Should we celebrate them for being so gracious as to let the users delete their own data? Well, it's literally the least they should do anyway (once again, [1]). [1] I wonder how much of this is related to GDPR, which requires Google to provide users with means to delete their data.
- hdfbdtbcdg 7y agoAt this point the big companies probably need to submit to some external audits to really get trust back.
- shereadsthenews 7y agoI've worked on wipeout compliance at Google and IMHO there's no possibility that an outside auditor would ever be able to understand those systems to such an extent that they would discover a flaw in them that wasn't previously known to the many engineers who work full-time on wipeout. The systems are just too complex. One does not simply `find -type f /google` to figure out what data is available.
- hdfbdtbcdg 7y agoPart of the point of the audit would be to demonstrate that you take it as seriously as you say you do. Not so much to check the fine details.
- shereadsthenews 7y agoI don't personally put any value in those kinds of audits but Google has those. For example they have outside auditors for SOC and ISO 27018 and whatnot. Some dipshit from Ernst and Young swears that Google has such internal controls and processes.
- scarface74 7y agoIn other words, it would be the same type of theater that most companies engage in. I know plenty of companies with "strict security standards" administered by the infrastructure department so they can pass an audit or some other type of security compliance. But most security breaches happen because of badly written software that the "compliance department" never reviews and they wouldn't know what to look for if they did. Developers could have: sql = "Select * from Foo Where FirstName = '" + firstname + "'"; All over their code and no one in "compliance" would be any the wiser.
- ben_jones 7y agoI value your contribution to this thread, can I ask some follow-ups? Does Google have multiple "Deletion policies" such that deleting data from i.e. your GCP bucket follows one policy, and the "scrubbing" described in this article follows an entirely different policy? If so, do different deletion policies have different processes and different audit trails such that the end "deleted" state is subjective and controlled by the engineering and managerial oversight of the engineering/leadership team of that given product(s)? From my (naive) opinion, it must be really, really, hard to for example, retrain every ML model that a now deleted datapoint ever touched. Its hard too to believe that, at some high level in Alphabet's org, there is no motivation to have the positive PR of feature(s) like this, but still at essence not delete the parts of the data trail that significantly drive Google's revenue. Do these datapoints significantly impact Google's revenue?
- aiiane 7y agoFirst let me say that I can't speak to whether anything "significantly impacts Google's revenue" - either I don't have any material information in that regard, or if I did the SEC probably wouldn't want me making statements about it. :) So with that caveat in mind, let me see what I can help answer. I'm not entirely sure what nuance you're implying when you say "different deletion policies" - while for instance Cloud might have a different timeline or set of triggers for when and what data is deleted, when it happens "deleted" still generally means "deleted". Some products like GSuite have the ability for administrators to say, disable accounts, which removes them from use but doesn't delete the account, but that's transparent to the domain administrator. It's definitely nontrivial to track data propagation within large systems, but standardizing infrastructure, having central documentation of data handling plans, and having comprehensive privacy reviews for any new functionality that launches helps keep people on the same page. Edit: oh, and regarding "retraining every model a data point touched" - the easiest way to do this is to just always be regenerating your models on a frequent basis. If you retrain your models once a day or once a week on a fresh snapshot of your data, they'll only ever be that stale.
- ben_jones 7y agoAgain, appreciate the reply. Myself and others post a lot of criticisms towards Google on HN, and though I feel much of it is deserved, its the commentary from actual Google employees that turns it into a much more substantial and informed conversation.
- deleted 7y ago[deleted]
- hcnews 7y agoTo be fair, companies do say things which they don't do or takes years to do it in the way that was advertised. Asking for a third-party auditor isn't unexpected or unwelcome in most cases. I had a similar concern where I was unsure if Google deleted my data and then anonymized it for helping their models anyways. In my opinion, that would be materially different than deleting all of it.
- scarface74 7y agoI've beat up on Google a fair amount. But, companies can get in so much trouble for outright not telling the truth, I don't believe it would be worth it for them to do so. The only big tech company that has a history of outright lying and being provably shady is Facebook.
- loudtieblahblah 7y agoIBM. Microsoft. Tons of companies lie all the time.
- josefresco 7y agoCurious, as a Google employee would you believe a Facebook employee, on HN making the same claim?
- shereadsthenews 7y agoNo, because Facebook does not have a detailed written policy regarding user data deletion and retention, which Google does have.
- josefresco 7y ago> detailed written policy Oh we're all good then!
- lallysingh 7y agoI'm not sure if you're being sarcastic, but breaking a written policy is (AFAIK) fraud and has some teeth to it.
- rchaud 7y agoAssuming that you, an individual, can prove not only that the policy was broken, but also broken at the time when the policy was in effect. T&Cs change often, and only major changes require notifying the user. The entire burden of proof would be on you, vs. a behemoth corp whose bottom line depends on maximizing data collection and retention. Go to court on your own dime, prove it, and yes, the penalty might have some teeth. Might.
- lallysingh 7y agoUsually AGs do that. They're slowly coming around to this being a major thing. https://www.law.com/therecorder/2018/12/19/facebook-is-being-sued-by-d-c-s-attorney-general-over-failure-to-protect-user-privacy/?slreturn=20190402155905 https://www.law.com/therecorder/2018/12/19/facebook-is-being...
- 7y ago
- soup10 7y agoI believe you, but I also believe the NSA and others siphon that data and archive it so it's kind of a minor point if google keeps it or not, privacy is a relative term these days. We can be fairly confident since the Snowden revelations that data dragnet operations are continuing and expanding in scope.
- Sheep_McSheepy 7y agoLooking at all leaks coming from Google, including Dragonfly and Maven do you think that NSA could access data directly without any engineer noticing it and going to the media with it? I doubt it.
- soup10 7y agoyes.. they split fiber pipes, if encrypted they use undisclosed zero days to steal encryption keys or try to break the encryption with super computers. these tactics are are all well known.
- asdfasgasdgasdg 7y agoAll Google internal traffic is encrypted, and I'd guess they use some sort of forward secrecy. I guess it's going to be basically impossible to use split fibers to sip at that data.
- soup10 7y agohttps://www.zdnet.com/article/prism-heres-how-the-nsa-wiretapped-the-internet/ https://www.zdnet.com/article/prism-heres-how-the-nsa-wireta... this is just naive
- asdfasgasdgasdg 7y agoThe change was made exactly in response to PRISM. In fact, it was something that was already rolling out at the time, but the disclosure of that program caused the effort to be dramatically accelerated. At this point, and for quite some time, they've been using encryption for almost all traffic on the internal network. https://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html https://www.washingtonpost.com/business/technology/google-en...
- Romanulus 7y agoThat's not a very good argument.
- sixothree 7y agoLiterally nothing whatsoever in Google's history suggests what you are describing is true.
- taneq 7y agoYour comment here is the first direct indication I've had (at any level of trust) that Google does in fact delete things if you ask it to. Maybe it's dumb but I feel a tiny bit more inclined to trust these options now than I did before. Thanks for your contribution (to this thread and to deleting stuff). Edit: Stray somewhat-related question just in case you'd know, why is it that if I open YouTube in a private browsing window on a computer with freshly cleared cache, it asks me which of my two Gmail accounts I want to log in with? Is it just IP address based plus some browser fingerprinting?
- loudtieblahblah 7y agoyes - and these online discussions are never astroturfed by employees of these companies.
- powera 7y agoGoogle's Sarbanes-Oxley compliance should verify that this works exactly as described. I don't expect those to be public.
- deleted 7y ago[deleted]
- shereadsthenews 7y agoYou're welcome to all the tinfoil you can fit on your head but this is a written policy Google markets to their paying customers. What you are saying is they are just committing overt fraud. https://cloud.google.com/security/deletion/ https://cloud.google.com/security/deletion/
- amelius 7y agoFraud for which they get slapped on the fingers.
- russdpale 7y agoBrother it's 2019, Im not sure if you noticed but fraud is in big time. Markets are at all time highs. Fraud penalties are just over head. Besides, for that document to work, the authors have to be trust worthy.. in this case the authors are not even close to trustworthy it might as well have been written by the hamburgler.
- puzzle 7y agoI'm an ex employee. There's actually a whole team whose sole job is making sure that all other teams have policies, measurements and alerting for deleting data. They'll chase you if any of the above doesn't hold. It's non-trivial work and slows down your development, if you believe in releasing early and fast. For everybody else, it makes total sense. I bet it's not free to run, but it's cheaper and easier than elsewhere, because Google's infrastructure is built in-house and mostly integrated. I don't envy other companies that want to do the same.
- ajross 7y ago> I simply do not believe this. If you're not willing to put even that must trust in your various cloud providers, you aren't the target market. Surely you aren't sharing this information with Google already, right? So the feature isn't for you.
- ArlenBales 7y agoI've never seen audit reports from a trusted source of personal data being confirmed deleted for Apple, Amazon, etc. So I'm not sure what makes Google unique.
- tgsovlerkhgsel 7y agoYou don't have to believe it, but it helps rationally thinking about incentives. What is worse: - losing some data of the 0.1% of users who actually care, or - the regulatory and PR nightmare that would happen if they don't and it is brought to light?
- jefftk 7y agoA subpoena for something someone deleted would be a good way to find out. My prediction is that for something deleted, say, six months ago, the subpoena would come back empty. (Disclosure: I work for Google, though not on anything like this. Speaking only for myself, not the company.)
- rifung 7y agoI work for Google, opinions are my own. I understand your skepticism but at least in this case, I think your incentives are aligned with Google's. If we don't delete it (within ~30 days I think?) then I'm pretty sure we'd be in violation of GDPR. Is that to say it's definitely deleted? I can't say that for sure since there bugs are always possible but at least I'm pretty confident the intention is to delete it.
- mbostleman 7y agoI also don't believe this. How do you know it will be hard deleted? Edit: Nm, I see you're a Google engineer in this domain.
- TheAceOfHearts 7y agoWhat about old backups (e.g. tape archives, which I think I've read Google uses), how do those get deleted? Do you store and encrypt the data with a user-specific key and then delete that key upon receiving a deletion request? Perhaps user data is never stored as part of tape backups? Perhaps you have a system which (very slowly) is able to load the appropriate tapes and purge the user's data?
- Sheep_McSheepy 7y agoCannot comment in too much detail as not sure how much information is public but tape backups are also in scope for wipeout and user data is removed from them.
- hcnews 7y agoIs any copy of data anonymized and still kept around in ml models etc.?
- Sheep_McSheepy 7y agoI'm not an expert in this area but from what I know, personalized ML models are rebuilt often from fresh data that is not anonymized so if you request your data to be removed, then it's gone from these models as well. That said, there's also data without PII (anonymized) that is not attached to any specific user, that of course is not subject to this data wipeout as Google wouldn't know what to delete. Such data can be used for general ml models. Not sure how it's done at Google but anonymization is tricky and it's easier to gather two forms of information from the start, one with PII and one without PII. I think most large companies are doing it like that. EDIT: Just remembered one thing. At Google, even when building general models data that is rare cannot be used because it could be used to identify specific people. For example: If search query is used by less than X people on a given day then these queries cannot be used for model building.
- hcnews 7y agoThanks for the detailed technical answer. It helps; much appreciated.
- vcxy 7y agoThanks for replying to so many questions. I hope you aren't too discouraged by the negative responses, your work is appreciated!
- weq 7y agoSo you delete the data from the training results of the services that ingested this meta? Yeh RIGHT! Google may disassociate your data from your account, but your data lives on.