Hacker News Reader

Comment by rapnie | Hacker News Reader

It always completely astounded me how countless professional businesses are casually and mindlessly handing over their most private internal communication and metrics to Google on a platter. And aren't Google's privacy policies and ToS's stating that all collected information can be used to "improve their own services" or something along those lines? Does that include 'extract business advantage' from your data? I don't know and IANAL, but I'd prefer some separation from such an ad-tech giant with my corporate intelligence.

View on HN

(Not a Google engineer)

Google's engineers are notoriously loose-lipped (which is a good thing!!!). There's no way they would be able to keep a secret like this. Anytime a customer's private data gets accessed, you either a) need approval by someone or b) "break the glass", which is only reserved for oncall fires. Either way, it gets audited.

The only way I would believe something like this is if an executive/higher up requests data access, gets it, and the person auditing looks the other way.

The last case of ad bidding proves that while not everyone at Google knows whats going on, they are abusing the data they are sitting on.

Which case is that?

That's assuming that there isn't another back channel to access that data.

And even if they don't access file or email content, metadata like access data like Play Store performance, Google searches for competing products, and Google Analytics data, might seem like fair game.

How does Google respond to secret FISA orders which by law cannot be audited or known by anyone but the direct receiver and one pre-screened attorney?

Most businesses on Google Workspace don’t see the US government as an adversary. If they do, they encrypt things or don’t use Workspace.

This. If US government on your things to worry about list, you host in Russia Cloud or China Cloud. Or roll your own data center in some non US allied country.

The whole point of the thread is that a shady executive could use the same backdoor processes to get whatever he wants in an untraceable fashion, the same way that our trustworthy and noble government does

That's not my point. My point is by law Google must have secret and extremely challenging to audit processes for accessing user data, which can be abused for corporate espionage.

Google employs a huge number of engineers. It can assemble a very tight lipped group of people if it wants to.

So Google has all the "checks&balances" in place, and corporate managed to turn them into a flawless and perfect system?

And the source for that claim is not even a Google engineer, but apparently somebody who heard how Google engineers are "notoriously loose-lipped".

From which loose-lipped Google engineer did you get that information about "needing approval", "breaking glass" and "audits"?

> The only way I would believe something like this is if an executive/higher up requests data access, gets it, and the person auditing looks the other way.

It's much easier to believe once you remember how Google actually makes its money [0].

In that context it not only becomes believable, but it actually fits perfectly into their MO [1].

[0] https://www.eff.org/deeplinks/2020/03/google-says-it-doesnt-...

[1] https://www.theregister.com/2016/03/09/google_ventures_yield...

[I work at Google]

Your first link explains how Google doesn't actually give your data to anyone else. Your second link is about a company that Google Ventures invested in. The equivalent would be that some company claims a YC-backed startup stole some of their IP, and that somehow YC is at fault, which is silly. Google isn't even a party to the lawsuit (further, it's not clear that the company who sued even won and to an extent it looks like they might be a patent troll).

> From which loose-lipped Google engineer did you get that information about "needing approval", "breaking glass" and "audits"?

A bunch of it is public: https://cloud.google.com/access-transparency. Access Transparency provides the access logs to the customer, and Access Approvals allows a cloud customer to prevent Google from accessing their data without approval from the company. But yes, you could also go searching HN for discussion of these topics and probably find quite a lot from people.

> Your first link explains how Google doesn't actually give your data to anyone else.

Nobody said Google "gives data away", the article explains how Google monetizes the data.

> Access Approvals allows a cloud customer to prevent Google from accessing their data without approval from the company

All Access Approval does is prevent individual Google employees from accessing the data, which is not the same as "Google as a whole". It also seems to have a long list of Google services were it does not apply as no AT logs are created or other exceptions apply.

And while that might be nice, it's neither special, nor does it change the nature of Google's business, it's just virtue signaling and building plausible deniability along the lines of "We really do care about privacy! At least in as so far as we don't want to get regulated!"

You know, just like claiming how Google "doesn't give data away", when in reality it very much sells all the useful insights, said data gives, to the highest bidder.

Who says Google doesn't have some secret group with security clearance, and only top management knows of its existence?

You missspelled Baidu and CCP there.

You can perform these analyses with 'anonymized' data to both observe the broad trends across a huge dataset, and still claim you haven't invaded privacy.

With the scale of surveillance data available to Google, this is how they have their cake and eat it too.

Once you know that note-taking apps (e.g.) are a hugely growing space, it's easy to use publicly available data to find the startups making a splash. Not once did Google's data tell them Startup X is an acquihire target. And yet, here they are at Startup X's door.

Sure, but that sounds much better than Google peaking into Startup X's emails and determining how much runway they have left, how management feels about their ability to succeed, etc.

"It's to fight terrorism, don't tell anyone"

I'm not sure that's true. For example the video about serving 5 petabytes of data took 11 years to come out: https://news.ycombinator.com/item?id=29082014

Infosec teams that are competent tend to push back on that.

If there's no infosec and it's just infra and developers and CTO's signing contracts with vendors, even Google, you have an issue.

Reply on news.ycombinator.com