7 ms·

You're welcome to believe whatever you want, but a decent chunk of my day job is making sure that it's true.

by aiiane 7y ago

justcodebruh 7y ago
may i ask what your day job is?
- aiiane 7y ago
  Answered here while your comment was dead: https://news.ycombinator.com/item?id=19809515 https://news.ycombinator.com/item?id=19809515
aiiane 7y ago
'justcodebruh' your comment is marked as dead, but to answer your question I work on Google's privacy engineering team.
- dmitriid 7y ago
  Your team is doing a shitty job, to be completely honest. This comment and all the comments beliw it: https://news.ycombinator.com/item?id=19809168 https://news.ycombinator.com/item?id=19809168
  - halfmatthalfcat 7y ago
    LOL rather than applaud some modicum of privacy we may be getting back, you decide to denigrate. Should we all hold this cynical attitude and hope for no progress at all?
    - dmitriid 7y ago
      We should all hold companies accountable and not celebrate every “modicum of privacy”. Look at what companies do, not what they say they do. Yay, you can delete all your data... says the company which puts hidden microphones in consumer products, leaks copious amounts of user data across unrelated services, releases a browser which automatically logs you in to google services, lifted its ban on personally identifiable info in its ad service etc. etc.
      - joshuamorton 7y ago
        So are you claiming that you can't actually delete your data? Or are you saying that letting you delete your data isn't a thing? Because "letting you delete your data" seems to be a thing the company is doing. Which you say we should look at.
        dmitriid 7y ago
        No one can say for certain how, and when they delete the data. Even the person from the privacy team said as much. Moreover, this is a very, very, very small "modicum of privacy". A very small number of users will use that. It makes the company look good, for sure [1], but it will in no way, shape, or form affect what they are already doing, and will continue doing. Should we celebrate them for being so gracious as to let the users delete their own data? Well, it's literally the least they should do anyway (once again, [1]). [1] I wonder how much of this is related to GDPR, which requires Google to provide users with means to delete their data.
        joshuamorton 7y ago
        > No one can say for certain how, and when they delete the data. Even the person from the privacy team said as much. You and I read very different comments. Not being able to tell you, a random HN commented, the exact procedure by which a specific piece of data's lifetime is managed is different than not being able to, in the abstract, describe, monitor, and alert on the intended lifecycle of a piece of data. > I wonder how much of this is related to GDPR, Probably not at all: Google was already GDPR compliant (it was already possible to manually delete your data), this goes beyond the GDPR mandate, and allows you to set a ttl on your data, essentially. It's becoming more apparent to me that you, either intentionally or not, aren't clear on what the status quo was, or what this change changed. To be clear, deleting your location data has always been possible (or at least, has been possible for a long time). There's a UI for it. This is, in addition to being able to manually delete data, have Google automatically delete any data older than a certain time.
        7y ago
    - abugheratwork 7y ago
      He didn't tell everyone to hold the same attitude. He said they're doing a shitty job, and he provided a great example. Rude, but true, and I would argue helpful. Sorry you're not enjoying reading it.
  - qntty 7y ago
    People will be more likely to consider your criticism if you are specific. Can you recommend an incremental improvement that aiiane could push for?
    - dmitriid 7y ago
      Literally the very first sentence in the comment I linked: "they might do better to remove the requirement to have the Web/Location/App history enabled for apparently unrelated features." And then that comment, and the first comment below it, describe the ways this can be improved. And then comment upon comment upon comment: - I cant store my home location in Google Maps without turning on Web & App activity history. Why? - I cant share my current location (not historic, just my latest location - they only need to store one) with my partner unless I turn on Web and Location history. Why? - Google will still let you store your home address and they'll display it on the map, but if you have Location History turned off they'll refuse to list it as an autocomplete option when you search for addresses or directions. Why? - Google Home and Android Auto require all of these settings to be enabled. Why? - Can't subscribe to podcasts if web activity is disabled. Why? All the above are severe breaches of privacy, requiring the user to enable data collection by Google for features that have nothing to do with this data. But yay, hurray, they will graciously let us delete our data.
  - dang 7y ago
    Attacking another user like that will get you banned here. No matter how you feel about privacy or Google or anything, please follow the site guidelines, and please don't post here if you can't treat your fellow community members with respect. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- justcodebruh 7y ago
  thanks
hdfbdtbcdg 7y ago
At this point the big companies probably need to submit to some external audits to really get trust back.
- shereadsthenews 7y ago
  I've worked on wipeout compliance at Google and IMHO there's no possibility that an outside auditor would ever be able to understand those systems to such an extent that they would discover a flaw in them that wasn't previously known to the many engineers who work full-time on wipeout. The systems are just too complex. One does not simply `find -type f /google` to figure out what data is available.
  - hdfbdtbcdg 7y ago
    Part of the point of the audit would be to demonstrate that you take it as seriously as you say you do. Not so much to check the fine details.
    - shereadsthenews 7y ago
      I don't personally put any value in those kinds of audits but Google has those. For example they have outside auditors for SOC and ISO 27018 and whatnot. Some dipshit from Ernst and Young swears that Google has such internal controls and processes.
    - scarface74 7y ago
      In other words, it would be the same type of theater that most companies engage in. I know plenty of companies with "strict security standards" administered by the infrastructure department so they can pass an audit or some other type of security compliance. But most security breaches happen because of badly written software that the "compliance department" never reviews and they wouldn't know what to look for if they did. Developers could have: sql = "Select * from Foo Where FirstName = '" + firstname + "'"; All over their code and no one in "compliance" would be any the wiser.
ben_jones 7y ago
I value your contribution to this thread, can I ask some follow-ups? Does Google have multiple "Deletion policies" such that deleting data from i.e. your GCP bucket follows one policy, and the "scrubbing" described in this article follows an entirely different policy? If so, do different deletion policies have different processes and different audit trails such that the end "deleted" state is subjective and controlled by the engineering and managerial oversight of the engineering/leadership team of that given product(s)? From my (naive) opinion, it must be really, really, hard to for example, retrain every ML model that a now deleted datapoint ever touched. Its hard too to believe that, at some high level in Alphabet's org, there is no motivation to have the positive PR of feature(s) like this, but still at essence not delete the parts of the data trail that significantly drive Google's revenue. Do these datapoints significantly impact Google's revenue?
- aiiane 7y ago
  First let me say that I can't speak to whether anything "significantly impacts Google's revenue" - either I don't have any material information in that regard, or if I did the SEC probably wouldn't want me making statements about it. :) So with that caveat in mind, let me see what I can help answer. I'm not entirely sure what nuance you're implying when you say "different deletion policies" - while for instance Cloud might have a different timeline or set of triggers for when and what data is deleted, when it happens "deleted" still generally means "deleted". Some products like GSuite have the ability for administrators to say, disable accounts, which removes them from use but doesn't delete the account, but that's transparent to the domain administrator. It's definitely nontrivial to track data propagation within large systems, but standardizing infrastructure, having central documentation of data handling plans, and having comprehensive privacy reviews for any new functionality that launches helps keep people on the same page. Edit: oh, and regarding "retraining every model a data point touched" - the easiest way to do this is to just always be regenerating your models on a frequent basis. If you retrain your models once a day or once a week on a fresh snapshot of your data, they'll only ever be that stale.
  - ben_jones 7y ago
    Again, appreciate the reply. Myself and others post a lot of criticisms towards Google on HN, and though I feel much of it is deserved, its the commentary from actual Google employees that turns it into a much more substantial and informed conversation.
deleted 7y ago
[deleted]
hcnews 7y ago
To be fair, companies do say things which they don't do or takes years to do it in the way that was advertised. Asking for a third-party auditor isn't unexpected or unwelcome in most cases. I had a similar concern where I was unsure if Google deleted my data and then anonymized it for helping their models anyways. In my opinion, that would be materially different than deleting all of it.
- scarface74 7y ago
  I've beat up on Google a fair amount. But, companies can get in so much trouble for outright not telling the truth, I don't believe it would be worth it for them to do so. The only big tech company that has a history of outright lying and being provably shady is Facebook.
  - loudtieblahblah 7y ago
    IBM. Microsoft. Tons of companies lie all the time.
josefresco 7y ago
Curious, as a Google employee would you believe a Facebook employee, on HN making the same claim?
- shereadsthenews 7y ago
  No, because Facebook does not have a detailed written policy regarding user data deletion and retention, which Google does have.
  - josefresco 7y ago
    > detailed written policy Oh we're all good then!
    - lallysingh 7y ago
      I'm not sure if you're being sarcastic, but breaking a written policy is (AFAIK) fraud and has some teeth to it.
      - rchaud 7y ago
        Assuming that you, an individual, can prove not only that the policy was broken, but also broken at the time when the policy was in effect. T&Cs change often, and only major changes require notifying the user. The entire burden of proof would be on you, vs. a behemoth corp whose bottom line depends on maximizing data collection and retention. Go to court on your own dime, prove it, and yes, the penalty might have some teeth. Might.
        lallysingh 7y ago
        Usually AGs do that. They're slowly coming around to this being a major thing. https://www.law.com/therecorder/2018/12/19/facebook-is-being-sued-by-d-c-s-attorney-general-over-failure-to-protect-user-privacy/?slreturn=20190402155905 https://www.law.com/therecorder/2018/12/19/facebook-is-being...
  - 7y ago
soup10 7y ago
I believe you, but I also believe the NSA and others siphon that data and archive it so it's kind of a minor point if google keeps it or not, privacy is a relative term these days. We can be fairly confident since the Snowden revelations that data dragnet operations are continuing and expanding in scope.
- Sheep_McSheepy 7y ago
  Looking at all leaks coming from Google, including Dragonfly and Maven do you think that NSA could access data directly without any engineer noticing it and going to the media with it? I doubt it.
  - soup10 7y ago
    yes.. they split fiber pipes, if encrypted they use undisclosed zero days to steal encryption keys or try to break the encryption with super computers. these tactics are are all well known.
    - asdfasgasdgasdg 7y ago
      All Google internal traffic is encrypted, and I'd guess they use some sort of forward secrecy. I guess it's going to be basically impossible to use split fibers to sip at that data.
      - soup10 7y ago
        https://www.zdnet.com/article/prism-heres-how-the-nsa-wiretapped-the-internet/ https://www.zdnet.com/article/prism-heres-how-the-nsa-wireta... this is just naive
        asdfasgasdgasdg 7y ago
        The change was made exactly in response to PRISM. In fact, it was something that was already rolling out at the time, but the disclosure of that program caused the effort to be dramatically accelerated. At this point, and for quite some time, they've been using encryption for almost all traffic on the internal network. https://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html https://www.washingtonpost.com/business/technology/google-en...
Romanulus 7y ago
That's not a very good argument.
sixothree 7y ago
Literally nothing whatsoever in Google's history suggests what you are describing is true.
taneq 7y ago
Your comment here is the first direct indication I've had (at any level of trust) that Google does in fact delete things if you ask it to. Maybe it's dumb but I feel a tiny bit more inclined to trust these options now than I did before. Thanks for your contribution (to this thread and to deleting stuff). Edit: Stray somewhat-related question just in case you'd know, why is it that if I open YouTube in a private browsing window on a computer with freshly cleared cache, it asks me which of my two Gmail accounts I want to log in with? Is it just IP address based plus some browser fingerprinting?
loudtieblahblah 7y ago
yes - and these online discussions are never astroturfed by employees of these companies.

You're welcome to believe whatever you want, but a decent chunk of my day job is making sure that it's true.

by aiiane 7y ago

You're welcome to believe whatever you want, but a decent chunk of my day job is making sure that it's true.

justcodebruh 7y ago

may i ask what your day job is?

aiiane 7y ago
Answered here while your comment was dead: https://news.ycombinator.com/item?id=19809515 https://news.ycombinator.com/item?id=19809515

aiiane 7y ago

'justcodebruh' your comment is marked as dead, but to answer your question I work on Google's privacy engineering team.

dmitriid 7y ago
Your team is doing a shitty job, to be completely honest. This comment and all the comments beliw it: https://news.ycombinator.com/item?id=19809168 https://news.ycombinator.com/item?id=19809168
- halfmatthalfcat 7y ago
  LOL rather than applaud some modicum of privacy we may be getting back, you decide to denigrate. Should we all hold this cynical attitude and hope for no progress at all?
  - dmitriid 7y ago
    We should all hold companies accountable and not celebrate every “modicum of privacy”. Look at what companies do, not what they say they do. Yay, you can delete all your data... says the company which puts hidden microphones in consumer products, leaks copious amounts of user data across unrelated services, releases a browser which automatically logs you in to google services, lifted its ban on personally identifiable info in its ad service etc. etc.
    - joshuamorton 7y ago
      So are you claiming that you can't actually delete your data? Or are you saying that letting you delete your data isn't a thing? Because "letting you delete your data" seems to be a thing the company is doing. Which you say we should look at.
      - dmitriid 7y ago
        No one can say for certain how, and when they delete the data. Even the person from the privacy team said as much. Moreover, this is a very, very, very small "modicum of privacy". A very small number of users will use that. It makes the company look good, for sure [1], but it will in no way, shape, or form affect what they are already doing, and will continue doing. Should we celebrate them for being so gracious as to let the users delete their own data? Well, it's literally the least they should do anyway (once again, [1]). [1] I wonder how much of this is related to GDPR, which requires Google to provide users with means to delete their data.
        joshuamorton 7y ago
        > No one can say for certain how, and when they delete the data. Even the person from the privacy team said as much. You and I read very different comments. Not being able to tell you, a random HN commented, the exact procedure by which a specific piece of data's lifetime is managed is different than not being able to, in the abstract, describe, monitor, and alert on the intended lifecycle of a piece of data. > I wonder how much of this is related to GDPR, Probably not at all: Google was already GDPR compliant (it was already possible to manually delete your data), this goes beyond the GDPR mandate, and allows you to set a ttl on your data, essentially. It's becoming more apparent to me that you, either intentionally or not, aren't clear on what the status quo was, or what this change changed. To be clear, deleting your location data has always been possible (or at least, has been possible for a long time). There's a UI for it. This is, in addition to being able to manually delete data, have Google automatically delete any data older than a certain time.
        7y ago
  - abugheratwork 7y ago
    He didn't tell everyone to hold the same attitude. He said they're doing a shitty job, and he provided a great example. Rude, but true, and I would argue helpful. Sorry you're not enjoying reading it.
- qntty 7y ago
  People will be more likely to consider your criticism if you are specific. Can you recommend an incremental improvement that aiiane could push for?
  - dmitriid 7y ago
    Literally the very first sentence in the comment I linked: "they might do better to remove the requirement to have the Web/Location/App history enabled for apparently unrelated features." And then that comment, and the first comment below it, describe the ways this can be improved. And then comment upon comment upon comment: - I cant store my home location in Google Maps without turning on Web & App activity history. Why? - I cant share my current location (not historic, just my latest location - they only need to store one) with my partner unless I turn on Web and Location history. Why? - Google will still let you store your home address and they'll display it on the map, but if you have Location History turned off they'll refuse to list it as an autocomplete option when you search for addresses or directions. Why? - Google Home and Android Auto require all of these settings to be enabled. Why? - Can't subscribe to podcasts if web activity is disabled. Why? All the above are severe breaches of privacy, requiring the user to enable data collection by Google for features that have nothing to do with this data. But yay, hurray, they will graciously let us delete our data.
- dang 7y ago
  Attacking another user like that will get you banned here. No matter how you feel about privacy or Google or anything, please follow the site guidelines, and please don't post here if you can't treat your fellow community members with respect. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
justcodebruh 7y ago
thanks

hdfbdtbcdg 7y ago

At this point the big companies probably need to submit to some external audits to really get trust back.

shereadsthenews 7y ago
I've worked on wipeout compliance at Google and IMHO there's no possibility that an outside auditor would ever be able to understand those systems to such an extent that they would discover a flaw in them that wasn't previously known to the many engineers who work full-time on wipeout. The systems are just too complex. One does not simply `find -type f /google` to figure out what data is available.
- hdfbdtbcdg 7y ago
  Part of the point of the audit would be to demonstrate that you take it as seriously as you say you do. Not so much to check the fine details.
  - shereadsthenews 7y ago
    I don't personally put any value in those kinds of audits but Google has those. For example they have outside auditors for SOC and ISO 27018 and whatnot. Some dipshit from Ernst and Young swears that Google has such internal controls and processes.
  - scarface74 7y ago
    In other words, it would be the same type of theater that most companies engage in. I know plenty of companies with "strict security standards" administered by the infrastructure department so they can pass an audit or some other type of security compliance. But most security breaches happen because of badly written software that the "compliance department" never reviews and they wouldn't know what to look for if they did. Developers could have: sql = "Select * from Foo Where FirstName = '" + firstname + "'"; All over their code and no one in "compliance" would be any the wiser.

ben_jones 7y ago

I value your contribution to this thread, can I ask some follow-ups? Does Google have multiple "Deletion policies" such that deleting data from i.e. your GCP bucket follows one policy, and the "scrubbing" described in this article follows an entirely different policy? If so, do different deletion policies have different processes and different audit trails such that the end "deleted" state is subjective and controlled by the engineering and managerial oversight of the engineering/leadership team of that given product(s)? From my (naive) opinion, it must be really, really, hard to for example, retrain every ML model that a now deleted datapoint ever touched. Its hard too to believe that, at some high level in Alphabet's org, there is no motivation to have the positive PR of feature(s) like this, but still at essence not delete the parts of the data trail that significantly drive Google's revenue. Do these datapoints significantly impact Google's revenue?

aiiane 7y ago
First let me say that I can't speak to whether anything "significantly impacts Google's revenue" - either I don't have any material information in that regard, or if I did the SEC probably wouldn't want me making statements about it. :) So with that caveat in mind, let me see what I can help answer. I'm not entirely sure what nuance you're implying when you say "different deletion policies" - while for instance Cloud might have a different timeline or set of triggers for when and what data is deleted, when it happens "deleted" still generally means "deleted". Some products like GSuite have the ability for administrators to say, disable accounts, which removes them from use but doesn't delete the account, but that's transparent to the domain administrator. It's definitely nontrivial to track data propagation within large systems, but standardizing infrastructure, having central documentation of data handling plans, and having comprehensive privacy reviews for any new functionality that launches helps keep people on the same page. Edit: oh, and regarding "retraining every model a data point touched" - the easiest way to do this is to just always be regenerating your models on a frequent basis. If you retrain your models once a day or once a week on a fresh snapshot of your data, they'll only ever be that stale.
- ben_jones 7y ago
  Again, appreciate the reply. Myself and others post a lot of criticisms towards Google on HN, and though I feel much of it is deserved, its the commentary from actual Google employees that turns it into a much more substantial and informed conversation.

deleted 7y ago

[deleted]

hcnews 7y ago

To be fair, companies do say things which they don't do or takes years to do it in the way that was advertised. Asking for a third-party auditor isn't unexpected or unwelcome in most cases. I had a similar concern where I was unsure if Google deleted my data and then anonymized it for helping their models anyways. In my opinion, that would be materially different than deleting all of it.

scarface74 7y ago
I've beat up on Google a fair amount. But, companies can get in so much trouble for outright not telling the truth, I don't believe it would be worth it for them to do so. The only big tech company that has a history of outright lying and being provably shady is Facebook.
- loudtieblahblah 7y ago
  IBM. Microsoft. Tons of companies lie all the time.

josefresco 7y ago

Curious, as a Google employee would you believe a Facebook employee, on HN making the same claim?

shereadsthenews 7y ago
No, because Facebook does not have a detailed written policy regarding user data deletion and retention, which Google does have.
- josefresco 7y ago
  > detailed written policy Oh we're all good then!
  - lallysingh 7y ago
    I'm not sure if you're being sarcastic, but breaking a written policy is (AFAIK) fraud and has some teeth to it.
    - rchaud 7y ago
      Assuming that you, an individual, can prove not only that the policy was broken, but also broken at the time when the policy was in effect. T&Cs change often, and only major changes require notifying the user. The entire burden of proof would be on you, vs. a behemoth corp whose bottom line depends on maximizing data collection and retention. Go to court on your own dime, prove it, and yes, the penalty might have some teeth. Might.
      - lallysingh 7y ago
        Usually AGs do that. They're slowly coming around to this being a major thing. https://www.law.com/therecorder/2018/12/19/facebook-is-being-sued-by-d-c-s-attorney-general-over-failure-to-protect-user-privacy/?slreturn=20190402155905 https://www.law.com/therecorder/2018/12/19/facebook-is-being...
- 7y ago

soup10 7y ago

I believe you, but I also believe the NSA and others siphon that data and archive it so it's kind of a minor point if google keeps it or not, privacy is a relative term these days. We can be fairly confident since the Snowden revelations that data dragnet operations are continuing and expanding in scope.

Sheep_McSheepy 7y ago
Looking at all leaks coming from Google, including Dragonfly and Maven do you think that NSA could access data directly without any engineer noticing it and going to the media with it? I doubt it.
- soup10 7y ago
  yes.. they split fiber pipes, if encrypted they use undisclosed zero days to steal encryption keys or try to break the encryption with super computers. these tactics are are all well known.
  - asdfasgasdgasdg 7y ago
    All Google internal traffic is encrypted, and I'd guess they use some sort of forward secrecy. I guess it's going to be basically impossible to use split fibers to sip at that data.
    - soup10 7y ago
      https://www.zdnet.com/article/prism-heres-how-the-nsa-wiretapped-the-internet/ https://www.zdnet.com/article/prism-heres-how-the-nsa-wireta... this is just naive
      - asdfasgasdgasdg 7y ago
        The change was made exactly in response to PRISM. In fact, it was something that was already rolling out at the time, but the disclosure of that program caused the effort to be dramatically accelerated. At this point, and for quite some time, they've been using encryption for almost all traffic on the internal network. https://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html https://www.washingtonpost.com/business/technology/google-en...

Romanulus 7y ago

That's not a very good argument.

sixothree 7y ago

Literally nothing whatsoever in Google's history suggests what you are describing is true.

taneq 7y ago

Your comment here is the first direct indication I've had (at any level of trust) that Google does in fact delete things if you ask it to. Maybe it's dumb but I feel a tiny bit more inclined to trust these options now than I did before. Thanks for your contribution (to this thread and to deleting stuff). Edit: Stray somewhat-related question just in case you'd know, why is it that if I open YouTube in a private browsing window on a computer with freshly cleared cache, it asks me which of my two Gmail accounts I want to log in with? Is it just IP address based plus some browser fingerprinting?

loudtieblahblah 7y ago

yes - and these online discussions are never astroturfed by employees of these companies.