Hacker News Reader

Comment by arkades | Hacker News Reader

Earlier this week there was a post regarding Google and its utilization of private health information. A number of Googlers came forward to describe how very seriously Google takes user privacy and keeping inappropriate data from being shared across silos. I got the overall impression of Googlers taking the position of “you guys don’t know how seriously we take peoples privacy.”

If any of those Googlers would please comment on how to square those statements with the featured article, I’d appreciate it.

View on HN

I think its pretty straight forward that privacy protection for Google means protecting the data it has collected from their users. Not refraining or preventing itself from collecting user data. Google protects the privacy of your information from outsiders (and insiders) not from its own apps and services. That is what's meant when Google says they "take their user's privacy very seriously". And its obvious that this is true because this practice is effectively just protecting their business model.

"We take very seriously your privacy and we make sure no one can see what you do...because THAT'S OUR JOB! Hey, you want to know what our customers are doing, we're more than willing to sell you the data and telemetry we collect, but ya gotta go through us! We take that very seriously."

> we're more than willing to sell you the data and telemetry we collect

Except they don't, they sell access to targeting based on that data. Google's entire valuation is based on the data they have on users, if others could come in and scoop it up, they would have an instant competitor. I think calling it 'privacy' is the wrong word - Google takes data security and access control seriously, and only Legal and a dozen engineers can actually access data (and even then, it'd be logged and looked into if it was out of the ordinary).

https://static.googleusercontent.com/media/gsuite.google.com...

Xoogler.

Yes, Google goes to immense lengths to protect user data in all its forms. That is security.

Privacy is orthogonal, and Google is well aware of the difference and how they complement each other.

You are completely wrong about Google's treatment of privacy.

There are plenty of companies that say they take privacy seriously. There are a handful that actually do. But smaller still is the number of those that have actually built what it takes to deliver on those promises, or re-engineered massive systems to deliver on privacy and transparency promises.

I suggest you look at any of Google's public privacy statements. There's no need to read between the lines.

Health care data is the only thing with regulations in the US. Everything else is fair game. That is how Google rakes in the billions. They aren't going to leave money on the table to satisfy an ethical code.

I wonder how much evil they could actually be getting away with if they wanted to. Imagine all of the trade secrets and national security secrets they could easily obtain by analyzing who is Googling what from where, or who is accessing their services from where.

Which specific factual aspect of this story do you believe contradicts those claims? I'm a Xoogler, not a Googler, but in my post-Google experience I haven't seen anything that was even in the same league as Google's privacy controls. In my personal privacy threat model I think Google scores 10/10. They protect my data against external attackers, which in my view is the main problem faced by personal data, and their protections against insider risk are also excellent. Other places where I've worked, that you've definitely heard of, have security and insider risk practices that are a complete f-ing joke. There's nobody at Google who is "the DBA" who can just covertly access your data, there's no ad-hoc logs access (every logs access flows through a proxy that ensures only limited access for pre-defined purposes), and there are software controls that trigger privacy incident response (by a 24x7 user privacy incident response team) whenever an insider attempts to access user data in excess of their authority. In protocol buffer definitions, every field has an annotation for whether it contains private, sensitive, or non-private information so that even in crash dumps and debug logs those fields are censored before being printed. I really think Google has a pretty strong privacy story, compared to virtually every other company (except Apple and Microsoft) who leave themselves highly exposed to both outside and insider attacks, software (and even hardware) supply-chain attacks, accidental leaks, leaks into debug systems, poor encryption practices, and generally wanton behavior.

How is Google ranking 10/10 on protecting user privacy if they considered people choosing to shut off their location tracking as a crisis worthy of pressuring OEMs to make it harder?

The thing Googlers and Xooglers alike seem absolutely unable to grapple with is that Google itself is a major privacy threat, and we don't want Google itself to have this information.

The fox is guarding the henhouse, and all the fox is doing is telling us it's protecting it from other foxes.

Different people have different privacy threat models. Gp even mentioned as much.

Again, that you want, good for you. But when Google let people choose, and people choose in a way they didn't like, they immediately reversed course, pressured OEMs to make that user choice harder.

That's fine, but your comment makes no sense in response to someone who explicitly talked about their personal threat model. Of course they can grasp that other people have different ones, that's why they scoped the comment to their own.

Fair, though the comment above his was definitely asking in a more general sense.

I think it was pretty relevant nonetheless because by tweaking the UI and UX Google is actively harming their users abilities to implement the threat model they have chosen (no matter which one they choose).

Whether or not this is true, it's far from the original question. OP's question (in my reading) presupposes permission to monitor healthcare data. If you believe the xoogler and googler responses in this thread, Google's data stewardship will be superior to that of other people doing healthcare ERP stuff. So the only question is if Google can do something without ads tracking, and the answer is yes. Gmail and Docs and Drive isn't used for ads purposes (granted gmail used to be, but even then it was siloed and only used within gmail). It's just a freemium model.

What you suggest shows that individuals within the Google organisation do not have blatant open access to personal information. What do you think about the access of personal information to the organisation Google itself? Today the data is safe from menial concerns such as a google employee looking over private information, but what about tomorrow when whole troughs of such private information are made available to other organisations, a la Cambridge Analytica and Facebook, for commercial or other nefarious purposes?

The article here talks about how google executives deliberately made privacy settings harder to find because the people were actually using them. The article also suggests, through court documents, that google coerced other manufacturers to do the same.

I’m suggesting that based on my experience google has better organizational defenses against individuals or even groups intentionally or accidentally setting a privacy-invasive agenda than other organizations with which I have first-hand experience.

The whole issue is google already has a business model that is a privacy-invasive agenda. The cat you describe has left the bag years ago.

Xoogler.

This is almost impossible by design. As mentioned before, every field on a protobuf is tagged for sensitivity, meaning right down to the bare disks there is privacy controls on data.

Engineers under orders to decrypt & copy data literally could not, without a delegated authority from senior people (some will be GDPR officers too), and there would need to be a staggering level of process failure just to get at the data for a few users.

Ultimately you have to decide if you trust Larry & Sergey, nobody else could make this happen. But insider risk just isn't going to happen from a company that treats user data like military treat classified documents.

In many large companies with multiple divisions the divisions operate to a large extent like separate private companies even if the company as a whole is a public company.

Is Google like that? If so, then it is easy to square things. The parts of Google that handle health stuff could have completely different policies about handling private information than the parts that deal with smartphones.

As a Googler, this sounds a little over-sensationalized to me (mostly because of the choice of quotes), but I bet there was some unpleasant sausage-making going on as well.

First of all, the quote from Jack Menzel about figuring out home and work locations sounds 1) about typical for him and 2) exactly correct. If Google is giving you directions and popping up traffic along your route between home and work every day, it's pretty clear what's going on. There's nothing weird or unexpected going on there.

Second, the settings thing. I see this as two issues: one, multiple settings, and two, making the settings hard to find. For the first, both search and maps had their own settings (web whatever vs location/location history), and they didn't talk to each other. I'm sure the relevant VPs talked about relevant VP-things, which probably did not include the config page. Both were sure they had an option to turn location off (for their project), so that box was checked, and done. Yes, someone should have made sure there was a single button, not three, but the org chart was shipped instead.

The hard-to-find thing is harder. I, as a regular schlub engineer, think that sounds pretty sleazy, but I have no idea how true it is. If someone's A/B test said, oh user engagement was down on this arm, I can see that happening. It'd be a failure, but I can see that happening.

I guess at my level, it seems like all the people I'm working with take user privacy really seriously. If someone wants their data deleted, we go through a lot of hoops to make sure it's really gone. Any feature using user-data gets a privacy review and usually ends up requiring pretty strict differential privacy bounds.

This is a little unfair and possibly just ignorant, but my impression is that Google is far better at protecting user location info than the telecoms, who have more complete data from cell-tower triangulation and who are generally willing to sell that data to whoever, and yet they get a lot less attention for it.

Sometimes people confuse effort with security. You could build a fortress with eight foot thick reinforced concrete walls but it's not secure if you leave the back door open.

No doubt google puts in heroic efforts to make sure that nothing that doesn't make them money gets access to your private data.

The mere presence of heroic efforts isn't enough.

Reply on news.ycombinator.com