The packets are routed over the public Internet, but if you're using HTTPS, they'll look like encrypted garbage to anyone who doesn't have Google's SSL private key.
(See: http://googleonlinesecurity.blogspot.com/2011/08/update-on-a...)
Seems to happen often enough.
(Then again, 2011 seems to have been something of an unlucky year for security professionals. Just ask RSA.)
The PKI is now totally broken.