Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs.

It did raise a fascinating question about where the physical tap was and how the take was routed back.

You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery.

You do the tap in the middle of nowhere, and how do you get the data stream back?

I'd guess they went rural and just leased physically adjacent dark fiber to route out on.