5 ms·

Wanna bet it's just "marked" as deleted, and actually stored forever, to be served in response to any subpoena?

by danuker 4y ago

jmole 4y ago
I'll take that bet - announcements like these aren't made just for fun
- kortilla 4y ago
  Not for fun, but definitely for marketing.
lotu 4y ago
I'll take that bet. Google has lots of flaws but it is still has lots of people who are genuinely trying to do the right thing. I just don't see the people at Google implementing a feature like this designed to make people feel safer about their personal medical data only to turn around and betray them to law enforcement.
- robonerd 4y ago
  They could have genuine intentions but still mess it up. Developers messing up secure and complete deletion of user data may be particularly likely since such deletions are not generally common practice (across the industry, not just at Google.)
  - jeffbee 4y ago
    That's not true at Google though. Google has a systematic user data removal architecture called Wipeout and Wipeout integration is a required checklist item for product launches. Wipeout compliance is systematically monitored by a central privacy group. I've worked at a bunch of companies and only Google has an organized, universal scheme for user data privacy. Everywhere else in my experience is just winging it and has basically no idea what's going on.
  - hn_throwaway_99 4y ago
    If there were one company who I trusted to delete shit correctly, it's Google. There are already loads of other laws that they need to comply with that require unrecoverable data deletion. Look, I agree Google has tons of flaws, but these types of conspiracy theory "bet they're not going to really delete it" missives don't even make sense if you consider Google's incentives. It would be a gigantic, massive blow to Google if they said they were deleting data and they didn't. There is literally 0 reason for Google to do this. When Snowden's revelations came out, Google was furious and they rearchitected basically all of their systems to encrypt everything at rest and in transit.
    - robonerd 4y ago
      "They might mess up" is not a 'conspiracy theory' in any conceivable sense of that used and abused term. I don't think the competency of any organization of people is ever assured and beyond reproach, but you're welcome to disagree.
      - hn_throwaway_99 4y ago
        You're correct, with that comment I was more referring to the original "Wanna bet it's just "marked" as deleted, and actually stored forever, to be served in response to any subpoena?" than your post. And while I agree that all organizations can make mistakes, I think it's more important to look at the structure and incentives of any company to see how reasonable those risks are: 1. Google knows they collect a ton of data on people, and they have giant, giant financial incentives to keep that data secure. 2. Google is profitable enough that they can have huge teams focused on data security and integrity (a smaller company may have the same financial incentives to keep data secure, but not the resources to back it up) 3. Google is large and established enough that they can ensure real rigor in their processes (again, as opposed to some rando company that did just enough to pass their SOC 2 audit). Again, mistakes can be made but we all pretty much take risks every day (banking, getting in a car, getting on a plane, getting in an elevator, etc. etc.), and I think the risk of Google fucking this up is lower than failure of a lot of those other systems.
    - Teever 4y ago
- notacoward 4y ago
  The people making the announcements, and even some of the engineers working on higher-level systems, might not even know whether the (multiple layers of the) underlying storage system actually deletes or just adds a "tombstone" that won't take effect until the next compaction or equivalent. They also might not know about copies left around in caches, during rebalancing, etc. Or whether "trimming" or overwriting data on a particular device - really anything short of a full device wipe - really makes the data go away. Secure deletion is a harder problem than most people think; I certainly wouldn't assume that Google or any other organization has really handled all the corner cases. Source: I've worked on many large storage systems, including the largest (by bytes at rest) at Facebook. They were subject to the exact same kinds of requirements as Google, and as the code continued to evolve gaps would still appear from time to time.
Cidan 4y ago
Googler here. We have very strict and very well engineered data retention systems. When we say data is deleted, we mean it. Various levels of automation ensure the data is purged, and all data is tracked meticulously for violations across every datastore. It's one of those systems I wish we talked about more -- it's a marvel to behold just how much work goes into retention policies and the automation that drives it.
- zanmat0 4y ago
- Hizonner 4y ago
  I note that the announcement is VERY VERY SPECIFIC about the data being gone from the opt-in "Location History" feature (with the capitals and everything). It does NOT say that every copy Google has is deleted. It just says that the user-visible copy is gone. What about, say, Sensorvault? Or whatever other internal systems I don't know about?
- im3w1l 4y ago
  Have you considered the possibility that someone on the inside works for an intelligence agency (domestic or foreign) and is secretly exfiltrating the data for the purpose of obtaining blackmail material?
  - shadowgovt 4y ago
    It's definitely been considered because it has definitely happened before (explore the history of Google cutting ties with China for about a decade). ... in response, Google took measures to prevent that category of insider-knowledge attack. With audited builds, zero-trust internal model (xref BeyondCorp), and infrastructure cross-checked by multiple human beings to guard against hardware-level attacks, such an insider attack is infinitesimally probable now.
  - IncRnd 4y ago
    In the PRISM disclosure of 2013, the slide deck stated that the NSA had direct access to Google's systems. The deck claimed "collection directly from the servers". That, by its very design, goes around all the safeguards people are discussing here.

Wanna bet it's just "marked" as deleted, and actually stored forever, to be served in response to any subpoena?

jmole 4y ago

I'll take that bet - announcements like these aren't made just for fun

kortilla 4y ago
Not for fun, but definitely for marketing.

lotu 4y ago

I'll take that bet. Google has lots of flaws but it is still has lots of people who are genuinely trying to do the right thing. I just don't see the people at Google implementing a feature like this designed to make people feel safer about their personal medical data only to turn around and betray them to law enforcement.

robonerd 4y ago
They could have genuine intentions but still mess it up. Developers messing up secure and complete deletion of user data may be particularly likely since such deletions are not generally common practice (across the industry, not just at Google.)
- jeffbee 4y ago
  That's not true at Google though. Google has a systematic user data removal architecture called Wipeout and Wipeout integration is a required checklist item for product launches. Wipeout compliance is systematically monitored by a central privacy group. I've worked at a bunch of companies and only Google has an organized, universal scheme for user data privacy. Everywhere else in my experience is just winging it and has basically no idea what's going on.
- hn_throwaway_99 4y ago
  If there were one company who I trusted to delete shit correctly, it's Google. There are already loads of other laws that they need to comply with that require unrecoverable data deletion. Look, I agree Google has tons of flaws, but these types of conspiracy theory "bet they're not going to really delete it" missives don't even make sense if you consider Google's incentives. It would be a gigantic, massive blow to Google if they said they were deleting data and they didn't. There is literally 0 reason for Google to do this. When Snowden's revelations came out, Google was furious and they rearchitected basically all of their systems to encrypt everything at rest and in transit.
  - robonerd 4y ago
    "They might mess up" is not a 'conspiracy theory' in any conceivable sense of that used and abused term. I don't think the competency of any organization of people is ever assured and beyond reproach, but you're welcome to disagree.
    - hn_throwaway_99 4y ago
      You're correct, with that comment I was more referring to the original "Wanna bet it's just "marked" as deleted, and actually stored forever, to be served in response to any subpoena?" than your post. And while I agree that all organizations can make mistakes, I think it's more important to look at the structure and incentives of any company to see how reasonable those risks are: 1. Google knows they collect a ton of data on people, and they have giant, giant financial incentives to keep that data secure. 2. Google is profitable enough that they can have huge teams focused on data security and integrity (a smaller company may have the same financial incentives to keep data secure, but not the resources to back it up) 3. Google is large and established enough that they can ensure real rigor in their processes (again, as opposed to some rando company that did just enough to pass their SOC 2 audit). Again, mistakes can be made but we all pretty much take risks every day (banking, getting in a car, getting on a plane, getting in an elevator, etc. etc.), and I think the risk of Google fucking this up is lower than failure of a lot of those other systems.
  - Teever 4y ago
notacoward 4y ago
The people making the announcements, and even some of the engineers working on higher-level systems, might not even know whether the (multiple layers of the) underlying storage system actually deletes or just adds a "tombstone" that won't take effect until the next compaction or equivalent. They also might not know about copies left around in caches, during rebalancing, etc. Or whether "trimming" or overwriting data on a particular device - really anything short of a full device wipe - really makes the data go away. Secure deletion is a harder problem than most people think; I certainly wouldn't assume that Google or any other organization has really handled all the corner cases. Source: I've worked on many large storage systems, including the largest (by bytes at rest) at Facebook. They were subject to the exact same kinds of requirements as Google, and as the code continued to evolve gaps would still appear from time to time.

Cidan 4y ago

Googler here. We have very strict and very well engineered data retention systems. When we say data is deleted, we mean it. Various levels of automation ensure the data is purged, and all data is tracked meticulously for violations across every datastore. It's one of those systems I wish we talked about more -- it's a marvel to behold just how much work goes into retention policies and the automation that drives it.

zanmat0 4y ago
Hizonner 4y ago
I note that the announcement is VERY VERY SPECIFIC about the data being gone from the opt-in "Location History" feature (with the capitals and everything). It does NOT say that every copy Google has is deleted. It just says that the user-visible copy is gone. What about, say, Sensorvault? Or whatever other internal systems I don't know about?
im3w1l 4y ago
Have you considered the possibility that someone on the inside works for an intelligence agency (domestic or foreign) and is secretly exfiltrating the data for the purpose of obtaining blackmail material?
- shadowgovt 4y ago
  It's definitely been considered because it has definitely happened before (explore the history of Google cutting ties with China for about a decade). ... in response, Google took measures to prevent that category of insider-knowledge attack. With audited builds, zero-trust internal model (xref BeyondCorp), and infrastructure cross-checked by multiple human beings to guard against hardware-level attacks, such an insider attack is infinitesimally probable now.
- IncRnd 4y ago
  In the PRISM disclosure of 2013, the slide deck stated that the NSA had direct access to Google's systems. The deck claimed "collection directly from the servers". That, by its very design, goes around all the safeguards people are discussing here.