Hacker News Reader

Comment by 2OEH8eoCRo0 | Hacker News Reader

https://www.courtlistener.com/docket/18552824/512/1/united-s...

> The Federal Rules of Civil Procedure required Google to suspend its auto-delete practices in mid-2019, when the company reasonably anticipated this litigation. Google did not. Instead, as described above, Google abdicated its burden to individual custodians to preserve potentially relevant chats. Few, if any, document custodians did so. That is, few custodians, if any, manually changed, on a chat-by-chat basis, the history default from off to on. This means that for nearly four years, Google systematically destroyed an entire category of written communications every 24 hours.

> All this time, Google falsely told the United States that Google had “put a legal hold in place” that “suspends auto-deletion.”

zoinks

View on HN

Somebody at Google made the conscious decision that enacting this intentionally defective policy -- in doing so, attempting to foist liability for data custody upon individual employees -- and fighting the inevitable objections to it was a preferable course of action to actually preventing their employees from discussing anything that might be used against them in the suit. It's clever, but it doesn't reflect fondly on Google's underlying antitrust behavior, and I'd be pissed as an employee.

I don't think they were trying to shift liability, I think they were trying to make sure all the data was deleted, without themselves having to hit delete. It's their counsel's culpability that is being protected, i.e. the difference between being negligent or willful.

From the article, "The DOJ said in a court filing Thursday that Google trained employees on the benefits of using “off the record chats."

They were trying to avoid liability not transfer it.

When are regulators and enforcers going to wise up to this "clever" game of disguising malicious behavior as negligence? I've seen so many people strategically play dumb that at this point I don't believe whether or not a violation was accidental should have any weight on the punishment.

Nature doesn't care whether our immune systems accidentally slack off, or whether we accidentally didn't protect our cities from a flood. Why would we provide an incentive structure for people to act like they are stupid?

I think people being negligent legitimately happens quite a bit. I agree though that when it comes to corporate behaviour, negligence should just be treated as willful intent.

Absolutely. Ignorance of the law is not a defense, nor is “whoops!”

It's very difficult to do this without introducing ThoughtCrime. The set of things that you could potentially have thought about doing is infinite. There's almost inevitably something in hindsight that you could have done to get the results that the prosecutor/plaintiff desired. The problem is that ordinary people without the benefit of hindsight fail to notice these options all the time, for all sorts of mundane reasons. If you criminalize negligence you're going to sweep an awful lot of innocent people up in your dragnet.

Strategic stupidity is indistinguishable, from the outside, from actual stupidity. I'd bet the latter is significantly more common. Hanlon's Razor: "Never attribute to malice that which is adequately explained by stupidity."

Ignorance of the law doesn’t protect individuals from being prosecuted.

This is excusing a two-tier system.

I'm suggesting we abandon "ThoughtCrime". The way it is now, people analyze your intent and if they determine it is malicious you get punished. If you pretend to be ignorant you get let off the hook.

Trying to look into someone's head is bad. That's what I'm saying.

> Strategic stupidity is indistinguishable, from the outside, from actual stupidity

One answer is to punish it the same. in this circumstance, I don't think the facts work for google at all as they A) had the burden, and B) lied to the court saying that they complied. The court doesn't care about the individual workers at Google, it cares that Google lied to the court and also spoiled evidence.

> "Never attribute to malice that which is adequately explained by stupidity."

Okay, so we could dispose with a whole raft of individual crimes:

No-one should ever be prosecuted for theft, because Theft requires malice, I thought I was taking abandoned goods! No-one should be prosecuted for fraud, I just accidentally omitted the fact that the item I am selling does not work?

When are you going to wise up to the fact that, if you do the same things Google does, you will be convicted immediately.

The corporate structure allows them to avoid liability and deliberately create vagueness as to who's fault it is. This is 100% intentional. And they've done nothing to deserve this privilege.

Regulators? They are facing sanctions in a district court...

> When are regulators and enforcers going to wise up to this "clever" game of disguising malicious behavior as negligence?

Thankfully in finance many of them already have. In the UK there a number of “Prescribed Responsibility” roles which financial organisations are required to fill with a single individual. That individual is required to be competent, knowledgeable and aware of any company actions that fall within their area of responsibility. It’s a criminal offence for them to fail on any of those three points, and also criminal for a financial organisation to appoint someone who couldn’t reasonably be expected to meet those three points. The organisation is also required to make sure those roles are only held by senior executives with real decision making power.

As a consequence there is no space for wilful ignorance, or enacting policies to try and distribute decision making. Attempting those, and then having your company later found to be breaking the law, would result in personal criminal liability for the executive involved.

This is particularly funny because one way Google scams people to get them to buy more storage space is by moving deleted drive/Gmail items to the Drive Trash instead of deleting them. So when you try to clear space by deleting emails etc., it doesn't seem to help.

Furthermore, even if you clear your Trash, it can take hours to take effect (for Some Reason), making it seem like you need to just give up and buy more storage.

Apparently Google execs don't have the same problems deleting their own files.

Apples to oranges.

(... and the reason Google does Drive Trash is that destroying user data is a much worse user experience than letting the delete be lazy, even when the user has given signal they want the data destroyed. There's decades of UX research to back that assertion; it's why "trash cans" were created in the first place as a UI abstraction.

Internal to Google, if you want to blow your whole leg off and disrupt your career by deleting some critical info, that's on you. Outside Google, they try to provide a better experience for their users).

> Internal to Google, if you want to blow your whole leg off and disrupt your career by deleting some critical info, that's on you.

They should consistently apply the deletion policy, in fact, they should go even further and do what governments do to their own sensitive information: keep a deletion log that stores item IDs, authors and content types (but not the contents) that had been deleted along with the initiator and the date of deletion and the IP address of the machine that received the deletion. Something at Google's scale deserves ğovernment-level scrutiny.

Do you think users would want them to keep such a log?

My Gmail Trash folder auto deletes after 30 days. I have never made that as a change, its a default.

Hard delete without recourse is a horrible user experience for most.

When I click on trash it says "Items in trash are deleted forever after 30 days", so I don't really understand this complaint. Trash is a feature that most users have come to expect in file management systems.

Also, "turn off history" - which seems to be what this complaint is about - is just a public feature of the Chat app built into gmail.

Exactly.. But the funny thing is as an IT admin at hospital, I have seen people who literally were saving mail in their trash folder in hopes to "archive" then got mad when we did some house keeping in Exchange.

Hyrum's law strikes again! Perhaps users wouldn't have been surprised if the deletion policy had been applied consistently.

Yeah, but most non-technical people see that their gmail is full, try deleting a bunch of emails, see that it didn't help, and then have to buy more space. They're not aware there's a trash, they perhaps don't even use Drive at all. They just know that what they're doing isn't working.

> one way Google scams

If you see a sentence like this, you can be certain you don't have an interlocutor that is acting in good faith.

> That is, few custodians, if any, manually changed, on a chat-by-chat basis, the history default from off to on.

they cannot reasonably expect every day employees with no stakes or info into the confidential dealings would care about this. Al Alongside Google wouldn't care about them not caring.

It doesn't matter. "Every day employees" are not the ones who needed to do this.

They can be if the policy was that individual employees needed to self enforce retention on XYZ topics and employees were provided training to that effect. The Feds can not say a company must retain all records going forward, only that it make reasonable effort to retain relevant records and training employees to place items going forward in some sort of vault historically qualifies, especially when this training/retention has been vetted as being acceptable by corporate/insurance company legal teams. There is no mens rea element to having system constraints due to an existing IT infrastructure budget and the Feds don't get to just blow that budget up because 'they have concerns' or else they could use 'concerns' as a weapon to destroy companies.

Doesn't work like that. Done centrally.

See https://support.google.com/vault/answer/7664657

The issue seems to be around use of "off the record" chat settings which are not covered by Vault (somewhat surprisingly for this audience; quite desirably for the target audience it would seem).

I’m a bit surprised no major enterprise customer has demanded that Google fix that.

What major enterprise customer uses Google as a chat service?

like nearly every google workspace customer? ive been in two 30k+ orgs to use this.. its no different than teams?

Every job I've had used Google Workspace, and none of them have used its chat.

I doubt that nearly every google workspace customer uses google's chat. Having workspace just means that google's chat is available. The enterprises I work with, when asked, have said that they use or are moving to teams, and chatting is either outright banned or restricted. Other than that, Slack is used for non-scheduled chats.

I'm sure there are other programs that various enterprises use, but I've never met one that uses Google's chat.

Sure, but they need to ensure that their have training and audits/enforcement to ensure the policy works for everyone who isn't intentionally trying to cheat. If it was 1/a few employee(s) who didn't do the right thing, then that employee should probably go to prison for breaking the law. That is was most who didn't do the right thing suggests that the right thing was too hard to do, and it goes back to the company. (even if it is one employee they can make the case that they didn't understand the policy for some reason, which might put liability back on the company, but this is case by case)

> Feds don't get to just blow that budget up because 'they have concerns' or else they could use 'concerns' as a weapon to destroy companies.

Hello government, please leave my factory. Stop collecting evidence of the recent lethal safety incident, we need to mop up the blood and continue production. Yes, I know I am suspected of breaching the laws on workplace safety, but otherwise we'll blow the budget!

Hello government, I am sorry to say you won't be getting any of those emails you've subpoenaed that incriminate me, I had to delete them to save $5 on my outlook subscribtion, it was blowing my budget.

> They can be if the policy was that individual employees needed to self enforce retention on XYZ topics and employees were provided training to that effect.

Whatever the policy is, the company is obligated to preserve evidence. Internal policy does not change that.

> The Feds can not say a company must retain all records going forward

Not only can they, that's literally what the law (federal law for sure, and separately the law of every state, to the best of my knowledge), does require regarding evidence related to ongoing and reasonably anticipated litigation. There is an unconditional requirement to preserve evidence that is known, or reasonably should be known, to be relevant.

> There is no mens rea element to having system constraints due to an existing IT infrastructure budget

The legal requirement to retain evidence once litigation begins or is reasonably forseeable is not conditioned on “so long as that is easily doable within your pre-existing IT infrastructure budget”. If you don’t have a sufficient budget to meet your obligations when you become aware of them, you are obligate to take any steps reasonably necessary to meet those obligations, and if you fail to meet the obligations, there are legal remedies within the relevant litigation for simple failure without regard to mental state (though willful failures have more significant potential remedies within the case, up to and including instantly losing the case without trial.)

Mens rea also matters a lot for whether additional civil and criminal penalties beyond sanctions in the immediate case are available (such as criminal charges of destroying records or documents to obstruct a federal investigation under 18 U.S.C. Sec. 1519), though.

The company has the obligation and the liability if the obligation isn’t met. They should have enacted a system to ensure their obligations were met. It’s like saying “we knew we owed taxes but the employees responsible for remitting the taxes just didn’t. Oopsies”

Yep. Probably as a field in employee records API, DBMS, and/or business rules processor as a synthetic attribute called "legal_hold" to combine requirements of all legal cases and jurisdictions.

Every system and process that could potentially delete data needs to check "legal_hold".

One of many fun feature requirements of enterprise software that aren't necessarily needed at smaller scales.

There’s a big company called Google that, among other things, sells enterprise services, and they have a list of their apps that support litigation holds:

https://support.google.com/vault/answer/6127699?hl=en

And lo and behold, Chat supports it.

edit: as pointed out elsewhere, there is some documentation that “off-the-record” chats are exempt:

https://support.google.com/vault/answer/7664657

That seems odd to me. Off-the-record is essentially a retention rule set on a per-chat basis. A hold should override a retention policy.

If we used it, we would never allow OTR.

Heck, we don't even allow chats in third party apps like Zoom.

What's amusing is that it also automatically converts all the Google Doc files to word format, because Lawyers Use Word.

I presume you meant a refcount, not a Boolean?

Very much so. Leaving aside some of the other points made on this, there's also a "eh, it's obviously not -that- important if it's not being enforced by policy/admin..."

It sounds like there were disagreements between Google's lawyers and the DOJ lawyers on the scope of the hold and what constitutes "reasonable."

Don't change the goalposts. It's not about collectively agreeing on what is reasonable.

From the article: "Federal rules for litigation required Google to suspend deleting chats in mid-2019, when Google would have anticipated the antitrust lawsuit, the government said. But Google continued using “off the record chats” even after the lawsuit was filed, the DOJ’s attorneys wrote."

The consequences of being found to have destroyed evidence is one of the reasons why organizations generally treat litigation / potential litigation holds broadly. (Also, unless you know there is no possible way something could be beneficial, you never know what, touching on the broad issue of litigation, you might actually need yourself, e.g., to rebut an argument from the other side.)

From what I'm seeing they're seeking monetary fines against Google for this, and at their scale that's hardly a deterrent. It always works out to be a fraction of what they'd actually have to pay if they hadn't pulled whatever bullshit got them fined, and in the end won't impact them or their bottom line in the slightest. Until the fines are high enough to actually deter them, or they start pressing criminal charges for shit like this, nothing gonna change with these huge megacorps.

> From what I'm seeing they're seeking monetary fines against Google for this

This is false. They are seeking a finding that Google destroyed evidence, and a hearing to assess sanctions, and an order for Google to make additional evidence available before the hearing. [0]

While fines might be part of the sanctions, a very common sanction for destruction of evidence is adverse inference jury instructions in the litigation the evidence was relevant to.

[0] actual motion: https://storage.courtlistener.com/recap/gov.uscourts.dcd.223...

> It always works out to be a fraction of what they'd actually have to pay if they hadn't pulled whatever bullshit got them fined

An oft-repeated argument, but usually not backed by any evidence or math.

i.e., Google lawyers found a loophole, and through it all employee chats were funneled.

This is not some kind of lawyer golf. Google employees with functions far outside legal wrote things like:

> “Let’s not talk about markets and market share via email.”

> “[W]e should chat live so you can get the history; best to not put in email.”

> “Since it’s a sensitive topic, I prefer to discuss offline or over hangout.”

This is of course not, in fact, some cute way around legal custodial requirements, no matter what the people who passed leetcode preached in trainings.

> The Federal Rules of Civil Procedure required Google to suspend its auto-delete practices in mid-2019, when the company reasonably anticipated this litigation. Google did not.

How the hell is this a thing. I can understand if they did this post litigation being filed then it would be a problem.

How is a company supposed to anticipate when and where the government is going to file charges and keep records for them waiting.

If the government was concerned they should have filed the lawsuit sooner not in 2020

It's very much a thing. The question is whether Google in preparation for an upcoming court action decided to start throwing records away. People don't get away with that before a divorce, before selling a company, or in any other situation.

In October 2019 the DoJ served Google with a Civil Investigative Demand asking for documents relating to its ad tech business and various other subjects. A month earlier, in September 2019, attorneys general for 49 states announced an investigation into Google's ad tech business, led by Texas AG Ken Paxton.

Would it be reasonable for Google to have anticipated this litigation in 2019 after those events.

> How is a company supposed to anticipate when and where the government is going to file charges and keep records for them waiting.

It is not just the government, evidence preservations rules attach for any relevant documents at the point where litigation is either initiated, or is, or reasonably should be, anticipated, regardless of whether the government is a party to the regulation. In the specific case of government action, knowledge of existence and subject matter of a government investigation generally provides a basis on which litigation on the subject should be reasonably anticipated (ditto with, e.g., an explicit threat of litigation by a private party. This is well-established law.

If you and I have a private dispute, you sue, and I tell your lawyers I shredded everything related to the case because I routinely shred my papers at the end of each month, even if that's true, I'm probably going to settle for more than had I maintained records. (Assuming I wasn't blatantly lying.) The shred-it-all approach has its upsides. But it also comes with liability.

After you sue, if you shred then you are in trouble. How do you anticipate what documents you need and when a legal suit is going to be filed by an unrelated party

I user to work for an Automotive OEM, and I would get these emails with some frequency (sent to the whole company) that would instruct us to make sure we're not deleting or clearing materials related to some thing. I don't think the whole time I worked there any of it related to anything I was working on. We eventually had a training with counsel about keeping materials and why we didn't even want the appearance of anything suspicious.

Turning off dogfood? https://workspace.google.com/products/vault/

Google since 2012 still the kid playing soccer that's been told to run around and kick people in the shins except it's 18 now and it's not cute anymore, and now it's kicked a ref.

They are dogfooding, which is why trying to adopt their products has been a case study in getting screwed.

- GCal spam anyone, who hasn't been coming to unwanted meetings?

- How about 4-5 redundant messaging services?

When you have a corporate slogan that says "Don't Be Evil" it means there's a big internal desire to start cackling alone at night in contemplation of your own evil (Frank Herbert quote, there). Looks like they lost that struggle against temptation.

QQ: Was Google the only corporation required to suspend its auto-delete practices? Thanks!

No, some other big tech companies also had to do this.

Just for fun, below is taken verbatim from Google's Memo in Support of its Motion to Transfer Venue filed earlier this week in the latest antitrust case in the Eastern District of Virginia. After reading, take the quiz.

Google's lawyers first began anticipating litigation in

(a) 2020

(b) 2021

(d) 2023

(e) none of the above.

"In September 2019, the attorneys general of forty-eight States, the District of Columbia, and Puerto Rico announced an investigation into Googles ad tech business, led by Texas Attorney General Ken Paxton.1 At the same time, the DOJ opened its own antitrust investigation into Googles ad tech business.2 In October 2019, the DOJ issued a Civil Investigative Demand to Google calling for production of documents relating to Googles ad tech business, along with a host of other topics. These two investigations of the same Google ad tech business proceeded in parallel. The DOJ and Texas both made expansive requests for production of documents concerning Googles ad tech."

1 See Harper Neidig, 50 attorneys general launch antitrust investigation into Google, The Hill (Sept. 9, 2019),

    https://thehill.com/policy/technology/460550-states-launch-antitrustinvestigation-into-google/.

2 Sara Forden & David McLaughlin, DOJ Scrutinizes Google Advertising, Search in Antitrust Probe, Bloomberg Law (Aug. 8, 2019),

    https://www.bloomberglaw.com/bloomberglawnews/antitrust/XF6V15CS000000.

Source: https://ia601604.us.archive.org/11/items/gov.uscourts.vaed.5...

Individual custodians just means employees, right? What incentive was there for employees to do this? I know that if I was told to do that, I would ignore it because I have better things to do than fiddle with settings. The only way I would do it is if they said I’d be fired if I didn’t do it or they increased my salary and decreased my other responsibilities.

Yes, so when you get sent a “legal hold” notice, and you click on some kind of acceptance, you are basically acknowledging that you’ll get fired if you don’t preserve the data. That’s how this works. The incentive to compliance is that you don’t get fired by your general counsel.

I’m quite certain it will come out that nobody loses their jobs over this.

If someone is fired, then Upper management just used rank and file employees as a shield to escape legal liability.

But if no-one is fired, then what? Responsibility just disappears?

That a subordinate did not perform their duties does not absolve their superior of the consequences.

The responsibility still ultimately falls on Google Legal and up to the executive team. They can choose to fire people if it makes them feel better, I suppose, but it won't change the consequences they will now face in litigation.

I think "custodians" in this case means the administrators of the chat system. It was within their power to preserve this data, and they did not do so.

Though it says "chat-by-chat basis", which sounds like individual user action.

> Google did not. Instead, as described above, Google abdicated its burden to individual custodians to preserve potentially relevant chats.

Google didn't do it, it was those other individuals who defied the court order. Uh huh.

If true even a one or two day prison sentence for 5 or 6 Googlers would make sure this never happened again.

One assumes that if anyone had asked legal they would have been told they must switch off auto-delete. Lawyers aren't stupid they value their licence far more than their current job. I am highly doubtful there would be any written advice that said anything other than, if in doubt save.

even a one or two day prison sentence for 5 or 6 Googlers would make sure this never happened again.

Eh, utterly impractical but I still think there should be a way to "jail" corporations. Easy - "Your offices are closed for the duration of the sentence. Your systems are shut down for the duration. Automatic payments set up in advance can continue as long as there are funds in your bank accounts, but your staff will not be monitoring them. You can appoint someone external to the organization to take care of some obligations."

Survivable as a business for short enough sentences (effectively comparable to a devastating ransomware attack), but mighty painful and anyone involved will absolutely feel the wrath of ownership/shareholders.

This would be disproportionately used as a tool against extremely small corporations without the budget to fight the "sentence" or weather out even a short shutdown.

I believe the best penalty for a big company is really to be broken up. It doesn't penalize the people working on the company or its clients, since the business continue, but it does penalize the management and board of the company for their misbehavior.

Except if the broken up companies then start trimming staff because of the uncertainty of operating with corporate daddy any more. What was a stable company now becomes unstable and the ultimately, it is the employees that suffer

Would you rather have an unstable company or an unstable industry, or even an unstable society if certain abuses go unchecked for long enough? And being without a job is less painful when there are more companies competing with each other and incentivized to innovate and therefore grow.

I was just pointing out that at the end of the day, it is the employees that pay the price for the leadership being asshats.

I want people that dictate that a company does evil to pay the same price as if they were doing the same thing without the corporate shield. If felons lose the right to vote and are prevented from other rights afforded to other citizens, then corporate felons should also lose rights like never being able to lead a company, pay fines, as well as possibly being a guest of the state.

I would say: fire the C level executives, with no severance. At the same time halt all stock trading.

Have the top officers who remain put their division on the auction block to the highest bidder, on a sold twice system, best deal wins. That is the company as a whole is sold, in parallel all divisions are sold separately: then add up the different bids, and whoever paid more: whole company vs all the individual departments separate wins. Although there are conflicts of interests, I think the officers who remain should both be allowed to bid, and also consult to other bidders: but the consults must be in public as are their bids.

Shareholders are treated as if the company is bankrupt: government fines, remaining employees, banks, and then the lawyers all get paid. If there is money left over shareholders get it.

s/day/year/ and that might be believable.

> If true even a one or two day prison sentence for 5 or 6 Googlers would make sure this never happened again.

A default judgement in favor of the government on the underlying antitrust case would be far more effective, and is actually a potential (though extreme) remedy (requiring neither indictment, proof beyond a reasonable doubt, or involvement of a jury) if willful failure to preserve evidence is found.

That's not what that means. That's a pre-emptive argument in case Google tries to say that individual employees were responsible for preserving evidence.

> Google may argue that it relied on individual custodians to manually preserve history-off chats. But that argument should be rejected for two reasons.

> First, it is and was Google’s obligation to suspend auto-deletion policies; it is no defense to suggest that individual custodians—Google employees—owned that obligation. Samsung, 881 F. Supp. 2d at 1137 (“[I]t generally is recognized that when a company or organization has a document retention policy, it is obligated to suspend that policy . . . .”) (cleaned up) (italics added). Google designed the chat systems and document preservation policies at issue here.

> And Google elected to set the default to history off for many chats. Indeed, Google maintained the “off the record” default despite employee complaints that the default caused them to lose important conversations.19

> Second, Google cannot escape sanctions by shifting the blame to its custodians. For spoliation purposes, destruction of evidence by Google’s employees is attributable to the company. See, e.g., E.I. du Pont de Nemours & Co. v. Kolon Indus., Inc., 803 F. Supp. 2d 469, 506‒07 (E.D. Va. 2011) (“A party may be held responsible for the spoliation of relevant evidence done by its agents.”). Courts commonly sanction corporate litigants for the spoliation of their employees and executives. See, e.g., Borum, 332 F.R.D. at 42 (emails deleted by employee). Accordingly, Google violated its duty to preserve potentially relevant evidence on a daily basis from May 2019 through the present.

>>> Google did not. Instead, as described above, Google abdicated its burden to individual custodians to preserve potentially relevant chats.

>> Google didn't do it, it was those other individuals who defied the court order. Uh huh.

> That's not what that means.

It's exactly what I meant. In context, the meaning of the text is incidental. I was obviously pointing out a common tactic that companies employ.

This is done with “off the record conversations” between senior execs and the legal counsel”. This is how big boys operate!

Reply on news.ycombinator.com