4 ms·

Earlier this week there was a post regarding Google and its utilization of private health information. A number of Googlers came forward to describe how very se

Earlier this week there was a post regarding Google and its utilization of private health information. A number of Googlers came forward to describe how very seriously Google takes user privacy and keeping inappropriate data from being shared across silos. I got the overall impression of Googlers taking the position of “you guys don’t know how seriously we take peoples privacy.” If any of those Googlers would please comment on how to square those statements with the featured article, I’d appreciate it.

kevin_thibedeau 5y ago
Health care data is the only thing with regulations in the US. Everything else is fair game. That is how Google rakes in the billions. They aren't going to leave money on the table to satisfy an ethical code.
- tolbish 5y ago
  I wonder how much evil they could actually be getting away with if they wanted to. Imagine all of the trade secrets and national security secrets they could easily obtain by analyzing who is Googling what from where, or who is accessing their services from where.
- deleted 5y ago
  [deleted]
jeffbee 5y ago
Which specific factual aspect of this story do you believe contradicts those claims? I'm a Xoogler, not a Googler, but in my post-Google experience I haven't seen anything that was even in the same league as Google's privacy controls. In my personal privacy threat model I think Google scores 10/10. They protect my data against external attackers, which in my view is the main problem faced by personal data, and their protections against insider risk are also excellent. Other places where I've worked, that you've definitely heard of, have security and insider risk practices that are a complete f-ing joke. There's nobody at Google who is "the DBA" who can just covertly access your data, there's no ad-hoc logs access (every logs access flows through a proxy that ensures only limited access for pre-defined purposes), and there are software controls that trigger privacy incident response (by a 24x7 user privacy incident response team) whenever an insider attempts to access user data in excess of their authority. In protocol buffer definitions, every field has an annotation for whether it contains private, sensitive, or non-private information so that even in crash dumps and debug logs those fields are censored before being printed. I really think Google has a pretty strong privacy story, compared to virtually every other company (except Apple and Microsoft) who leave themselves highly exposed to both outside and insider attacks, software (and even hardware) supply-chain attacks, accidental leaks, leaks into debug systems, poor encryption practices, and generally wanton behavior.
- ocdtrekkie 5y ago
  How is Google ranking 10/10 on protecting user privacy if they considered people choosing to shut off their location tracking as a crisis worthy of pressuring OEMs to make it harder? The thing Googlers and Xooglers alike seem absolutely unable to grapple with is that Google itself is a major privacy threat, and we don't want Google itself to have this information. The fox is guarding the henhouse, and all the fox is doing is telling us it's protecting it from other foxes.
  - joshuamorton 5y ago
    Different people have different privacy threat models. Gp even mentioned as much.
    - ocdtrekkie 5y ago
      Again, that you want, good for you. But when Google let people choose, and people choose in a way they didn't like, they immediately reversed course, pressured OEMs to make that user choice harder.
      - joshuamorton 5y ago
        That's fine, but your comment makes no sense in response to someone who explicitly talked about their personal threat model. Of course they can grasp that other people have different ones, that's why they scoped the comment to their own.
        ocdtrekkie 5y ago
        Fair, though the comment above his was definitely asking in a more general sense.
        Twisell 5y ago
        I think it was pretty relevant nonetheless because by tweaking the UI and UX Google is actively harming their users abilities to implement the threat model they have chosen (no matter which one they choose).
tzs 5y ago
In many large companies with multiple divisions the divisions operate to a large extent like separate private companies even if the company as a whole is a public company. Is Google like that? If so, then it is easy to square things. The parts of Google that handle health stuff could have completely different policies about handling private information than the parts that deal with smartphones.
nullc 5y ago
Sometimes people confuse effort with security. You could build a fortress with eight foot thick reinforced concrete walls but it's not secure if you leave the back door open. No doubt google puts in heroic efforts to make sure that nothing that doesn't make them money gets access to your private data. The mere presence of heroic efforts isn't enough.
Drew_ 5y ago
I think its pretty straight forward that privacy protection for Google means protecting the data it has collected from their users. Not refraining or preventing itself from collecting user data. Google protects the privacy of your information from outsiders (and insiders) not from its own apps and services. That is what's meant when Google says they "take their user's privacy very seriously". And its obvious that this is true because this practice is effectively just protecting their business model.
- GoofballJones 5y ago
  "We take very seriously your privacy and we make sure no one can see what you do...because THAT'S OUR JOB! Hey, you want to know what our customers are doing, we're more than willing to sell you the data and telemetry we collect, but ya gotta go through us! We take that very seriously."
  - judge2020 5y ago
    > we're more than willing to sell you the data and telemetry we collect Except they don't, they sell access to targeting based on that data. Google's entire valuation is based on the data they have on users, if others could come in and scoop it up, they would have an instant competitor. I think calling it 'privacy' is the wrong word - Google takes data security and access control seriously, and only Legal and a dozen engineers can actually access data (and even then, it'd be logged and looked into if it was out of the ordinary). https://static.googleusercontent.com/media/gsuite.google.com/en//files/google-apps-security-and-compliance-whitepaper.pdf https://static.googleusercontent.com/media/gsuite.google.com...
- throwaway15593 5y ago
  Xoogler. Yes, Google goes to immense lengths to protect user data in all its forms. That is security. Privacy is orthogonal, and Google is well aware of the difference and how they complement each other. You are completely wrong about Google's treatment of privacy. There are plenty of companies that say they take privacy seriously. There are a handful that actually do. But smaller still is the number of those that have actually built what it takes to deliver on those promises, or re-engineered massive systems to deliver on privacy and transparency promises. I suggest you look at any of Google's public privacy statements. There's no need to read between the lines.
deleted 5y ago
[deleted]
oddthink 5y ago
As a Googler, this sounds a little over-sensationalized to me (mostly because of the choice of quotes), but I bet there was some unpleasant sausage-making going on as well. First of all, the quote from Jack Menzel about figuring out home and work locations sounds 1) about typical for him and 2) exactly correct. If Google is giving you directions and popping up traffic along your route between home and work every day, it's pretty clear what's going on. There's nothing weird or unexpected going on there. Second, the settings thing. I see this as two issues: one, multiple settings, and two, making the settings hard to find. For the first, both search and maps had their own settings (web whatever vs location/location history), and they didn't talk to each other. I'm sure the relevant VPs talked about relevant VP-things, which probably did not include the config page. Both were sure they had an option to turn location off (for their project), so that box was checked, and done. Yes, someone should have made sure there was a single button, not three, but the org chart was shipped instead. The hard-to-find thing is harder. I, as a regular schlub engineer, think that sounds pretty sleazy, but I have no idea how true it is. If someone's A/B test said, oh user engagement was down on this arm, I can see that happening. It'd be a failure, but I can see that happening. I guess at my level, it seems like all the people I'm working with take user privacy really seriously. If someone wants their data deleted, we go through a lot of hoops to make sure it's really gone. Any feature using user-data gets a privacy review and usually ends up requiring pretty strict differential privacy bounds. This is a little unfair and possibly just ignorant, but my impression is that Google is far better at protecting user location info than the telecoms, who have more complete data from cell-tower triangulation and who are generally willing to sell that data to whoever, and yet they get a lot less attention for it.

kevin_thibedeau 5y ago

Health care data is the only thing with regulations in the US. Everything else is fair game. That is how Google rakes in the billions. They aren't going to leave money on the table to satisfy an ethical code.

tolbish 5y ago
I wonder how much evil they could actually be getting away with if they wanted to. Imagine all of the trade secrets and national security secrets they could easily obtain by analyzing who is Googling what from where, or who is accessing their services from where.
deleted 5y ago
[deleted]

jeffbee 5y ago

Which specific factual aspect of this story do you believe contradicts those claims? I'm a Xoogler, not a Googler, but in my post-Google experience I haven't seen anything that was even in the same league as Google's privacy controls. In my personal privacy threat model I think Google scores 10/10. They protect my data against external attackers, which in my view is the main problem faced by personal data, and their protections against insider risk are also excellent. Other places where I've worked, that you've definitely heard of, have security and insider risk practices that are a complete f-ing joke. There's nobody at Google who is "the DBA" who can just covertly access your data, there's no ad-hoc logs access (every logs access flows through a proxy that ensures only limited access for pre-defined purposes), and there are software controls that trigger privacy incident response (by a 24x7 user privacy incident response team) whenever an insider attempts to access user data in excess of their authority. In protocol buffer definitions, every field has an annotation for whether it contains private, sensitive, or non-private information so that even in crash dumps and debug logs those fields are censored before being printed. I really think Google has a pretty strong privacy story, compared to virtually every other company (except Apple and Microsoft) who leave themselves highly exposed to both outside and insider attacks, software (and even hardware) supply-chain attacks, accidental leaks, leaks into debug systems, poor encryption practices, and generally wanton behavior.

ocdtrekkie 5y ago
How is Google ranking 10/10 on protecting user privacy if they considered people choosing to shut off their location tracking as a crisis worthy of pressuring OEMs to make it harder? The thing Googlers and Xooglers alike seem absolutely unable to grapple with is that Google itself is a major privacy threat, and we don't want Google itself to have this information. The fox is guarding the henhouse, and all the fox is doing is telling us it's protecting it from other foxes.
- joshuamorton 5y ago
  Different people have different privacy threat models. Gp even mentioned as much.
  - ocdtrekkie 5y ago
    Again, that you want, good for you. But when Google let people choose, and people choose in a way they didn't like, they immediately reversed course, pressured OEMs to make that user choice harder.
    - joshuamorton 5y ago
      That's fine, but your comment makes no sense in response to someone who explicitly talked about their personal threat model. Of course they can grasp that other people have different ones, that's why they scoped the comment to their own.
      - ocdtrekkie 5y ago
        Fair, though the comment above his was definitely asking in a more general sense.
        Twisell 5y ago
        I think it was pretty relevant nonetheless because by tweaking the UI and UX Google is actively harming their users abilities to implement the threat model they have chosen (no matter which one they choose).

tzs 5y ago

In many large companies with multiple divisions the divisions operate to a large extent like separate private companies even if the company as a whole is a public company. Is Google like that? If so, then it is easy to square things. The parts of Google that handle health stuff could have completely different policies about handling private information than the parts that deal with smartphones.

nullc 5y ago

Sometimes people confuse effort with security. You could build a fortress with eight foot thick reinforced concrete walls but it's not secure if you leave the back door open. No doubt google puts in heroic efforts to make sure that nothing that doesn't make them money gets access to your private data. The mere presence of heroic efforts isn't enough.

Drew_ 5y ago

I think its pretty straight forward that privacy protection for Google means protecting the data it has collected from their users. Not refraining or preventing itself from collecting user data. Google protects the privacy of your information from outsiders (and insiders) not from its own apps and services. That is what's meant when Google says they "take their user's privacy very seriously". And its obvious that this is true because this practice is effectively just protecting their business model.

GoofballJones 5y ago
"We take very seriously your privacy and we make sure no one can see what you do...because THAT'S OUR JOB! Hey, you want to know what our customers are doing, we're more than willing to sell you the data and telemetry we collect, but ya gotta go through us! We take that very seriously."
- judge2020 5y ago
  > we're more than willing to sell you the data and telemetry we collect Except they don't, they sell access to targeting based on that data. Google's entire valuation is based on the data they have on users, if others could come in and scoop it up, they would have an instant competitor. I think calling it 'privacy' is the wrong word - Google takes data security and access control seriously, and only Legal and a dozen engineers can actually access data (and even then, it'd be logged and looked into if it was out of the ordinary). https://static.googleusercontent.com/media/gsuite.google.com/en//files/google-apps-security-and-compliance-whitepaper.pdf https://static.googleusercontent.com/media/gsuite.google.com...
throwaway15593 5y ago
Xoogler. Yes, Google goes to immense lengths to protect user data in all its forms. That is security. Privacy is orthogonal, and Google is well aware of the difference and how they complement each other. You are completely wrong about Google's treatment of privacy. There are plenty of companies that say they take privacy seriously. There are a handful that actually do. But smaller still is the number of those that have actually built what it takes to deliver on those promises, or re-engineered massive systems to deliver on privacy and transparency promises. I suggest you look at any of Google's public privacy statements. There's no need to read between the lines.

deleted 5y ago

[deleted]

oddthink 5y ago

As a Googler, this sounds a little over-sensationalized to me (mostly because of the choice of quotes), but I bet there was some unpleasant sausage-making going on as well. First of all, the quote from Jack Menzel about figuring out home and work locations sounds 1) about typical for him and 2) exactly correct. If Google is giving you directions and popping up traffic along your route between home and work every day, it's pretty clear what's going on. There's nothing weird or unexpected going on there. Second, the settings thing. I see this as two issues: one, multiple settings, and two, making the settings hard to find. For the first, both search and maps had their own settings (web whatever vs location/location history), and they didn't talk to each other. I'm sure the relevant VPs talked about relevant VP-things, which probably did not include the config page. Both were sure they had an option to turn location off (for their project), so that box was checked, and done. Yes, someone should have made sure there was a single button, not three, but the org chart was shipped instead. The hard-to-find thing is harder. I, as a regular schlub engineer, think that sounds pretty sleazy, but I have no idea how true it is. If someone's A/B test said, oh user engagement was down on this arm, I can see that happening. It'd be a failure, but I can see that happening. I guess at my level, it seems like all the people I'm working with take user privacy really seriously. If someone wants their data deleted, we go through a lot of hoops to make sure it's really gone. Any feature using user-data gets a privacy review and usually ends up requiring pretty strict differential privacy bounds. This is a little unfair and possibly just ignorant, but my impression is that Google is far better at protecting user location info than the telecoms, who have more complete data from cell-tower triangulation and who are generally willing to sell that data to whoever, and yet they get a lot less attention for it.