Slashdot Mirror
Google Exposed Private Data of Hundreds of Thousands of Google+ Users and Then Opted Not To Disclose, Report Says (wsj.com)
Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, WSJ reported Monday, citing people briefed on the incident and documents. From the report: As part of its response to the incident, the Alphabet unit plans to announce a sweeping set of data privacy measures that include permanently shutting down all consumer functionality of Google+, the people said. The move effectively puts the final nail in the coffin of a product that was launched in 2011 to challenge Facebook and is widely seen as one of Google's biggest failures.
A software glitch in the social site gave outside developers potential access to private Google+ profile data between 2015 and March 2018, [Editor's note: the link may be paywalled; alternative source] when internal investigators discovered and fixed the issue, according to the documents and people briefed on the incident. A memo reviewed by the Journal prepared by Google's legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger "immediate regulatory interest" and invite comparisons to Facebook's leak of user information to data firm Cambridge Analytica. Update: In an announcement Monday, Google said it was shutting down Google+ for consumers: We are shutting down Google+ for consumers. Over the years we've received feedback that people want to better understand how to control the data they choose to share with apps on Google+. So as part of Project Strobe, one of our first priorities was to closely review all the APIs associated with Google+. This review crystallized what we've known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds. Google+ still receives north of 200 million page views every month on the web, according to SimilarWeb, a third-party web analytics firm.
A software glitch in the social site gave outside developers potential access to private Google+ profile data between 2015 and March 2018, [Editor's note: the link may be paywalled; alternative source] when internal investigators discovered and fixed the issue, according to the documents and people briefed on the incident. A memo reviewed by the Journal prepared by Google's legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger "immediate regulatory interest" and invite comparisons to Facebook's leak of user information to data firm Cambridge Analytica. Update: In an announcement Monday, Google said it was shutting down Google+ for consumers: We are shutting down Google+ for consumers. Over the years we've received feedback that people want to better understand how to control the data they choose to share with apps on Google+. So as part of Project Strobe, one of our first priorities was to closely review all the APIs associated with Google+. This review crystallized what we've known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds. Google+ still receives north of 200 million page views every month on the web, according to SimilarWeb, a third-party web analytics firm.
Google + never had hundreds of thousands of users.
It's the same thing that happened with Facebook. It's almost like building these massive siphons of personal data inherently leads to massive personal data leaks...
"When information is power, privacy is freedom" - Jah-Wren Ryel
Google is closing in on having the Racketeer Influenced and Corrupt Organizations Act applied to them.
A journalist wrote this. So it must fit into a continuing narrative that follows on from Facebook's Cambridge Analytica problem. Thus parallels will be drawn and details filled into establish this equivalence. We see exactly this in TFA. This is what journalists do. Take a (probably complex or subtle) technical problem and fit it into an existing mental model.
It's called lying.
Something in tech happened. It's probably not good. The Wall Street Journal is not the publication to tell you about it. They will tell you a story instead.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
The move effectively puts the final nail in the coffin of a product that was launched in 2011 to challenge Facebook and is widely seen as one of Google's biggest failures.
Google,
Exposing the private data of hundreds of thousands of Google+ users and then choosing not to disclose the issue is a bigger failure than Google+ could ever be.
You're very evil,
AC
opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny
Aren't they required by law to disclose data breaches/exposure? How does a coverup help when your company is large enough that *someone* will blab?
How dare they not uphold a completely informal motto that was never legally-binding in any way! This is my shocked face.
Google+ dies, Google's long term prospects are not good, no one is going to trust using your products because you might just kill it.
WTF is this not posted by slashdot itself?!
Report no evil
Consumers? Wouldn't at some point a technology company think of referring to people as "users" or "customers"?
"Consumers" implies what we should all already know, of course... but I still found it notable.
Hire a Linux system administrator, systems engineer,
If Google is closing down Google+, can we have the "+' operator back in the Google Search syntax? It used to indicate a required search term.
Just you wait until something like this happens to all the data people, companies, schoolchildren, etc are shoveling into the G-suite without an apparent care in the world about who now controls their data.
It's gonna be spectacular.
More garbage forced on end-users with no way to disable - it's almost as if they failed to learn anything from Buzz. Looking forward to the impending death of Hangouts in whatever rebadged form it takes next. Google should really just stick to the basics - and I say this as a long-time Google Apps for Your Domain customer, where it is at least possible to shut most of these semi-aborted features off.
What actually happened is they got 80% of the way to a complete and well executed disclosure and then stopped.
Yes.
However, there was no breach of security. There was an issue that was discovered that COULD have exposed user data, but it was determined it was never independently discovered or exploited actually steal user data.
I "could" hit you is very different from "I did" hit you.
While I agree that the google has become quite EVIL this is another case of EVIL having no relation to the price of tea in China. I arrived at your comment early in my searches for humor or insight. I don't spend (= waste) much time searching for such on Slashdot these days. The wells have run dry over here...
But here are my initial thoughts on this topic, and then I'll rummage around a bit more to see if anyone shares them. Even better if someone has improved upon the ideas. Rarely happens lately, but hope dies slow.
(1) The googlers were glad to get an excuse to kill that turkey.
(2) The real reason Google+ failed was because they never figured out how to encourage mass migration from Facebook. The relatively easy part would have been harvesting a user's data from Facebook (with "relatively easy" based on the google earning the users' trust (even though the trendline is in the opposite direction)), but the migration steps got much harder after that and the EVIL powers that be today's google never saw the justification for the large investment in such complexities as remapping Facebook's data to a Google+ format or even providing a more Facebook-like interface for people who preferred such. Flexible user interfaces have actually become anathema to the google. Talk about your profit stiflers! (The google actually tried a flank attack, but without much sincerity. It would have taken some extremely large incentives to persuade Facebook to agree to the google-proposed standards for personal data storage (and portability).)
(3) The monopolistic advantage of the first mover makes the proposed solution of "other search engines and webmail providers" too weak.
(4) An actual solution approach would call for a pro-freedom anti-greedom economic system, while America is increasingly dedicated to the opposite.
(5) The main reason I write such things is to help me collect a list of key terms to search for since the Slashdot moderation system is so badly broken.
(6) I wish the owners of the Barney Google trademark would sue the google and take the name away from them.
Time's up, but I bid you ADSAuPR, atAJG.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
While we’re discussing this, I just wanted to apologize for typo that has appeared in our corporate motto since the company’s foundation. Our motto was supposed to be “Don’t openly do evil” but it seems that the secretary taking the board minutes accidentally wrote down “Don’t do evil” and it’s just stuck with us throughout the years. Many apologies. — Larry Page
"... our engineering teams have put a lot of effort and dedication into building Google+ over the years,"
That's nice, but what they really did was what they do always. They asked themselves, what would Apple do? So they made something where it isn't clear what the timeline is, because posts are all over the page. Where you can't tel; what came when, because they did they same thing they do in GMail, which is something cute like "2 weeks ago", rather than the date itself. To Facebook's credit, they put everything on the page, you may have to look for a setting, but it's all there and it's usually obvious where to go for the commonly-used functions.
Everybody has privacy issues, but Google tells you what they think is important for you and takes away the rest. Then they muck is all up with a pretty-looking but half useful UI.
Now, bring back Latitude on Google Maps.
When Latitude was shut down, we were told to do Google+ instead. It's fun it's easy etc etc. In actuality, as we all found out, it was a wasteland of (1) a few people who wanted to be on a social network that wasn't Facebook, (2) people who will join anything, and (3) people who had a use for the Latitude functionality.
Ok, so the first group is screwed. Nothing to be done for that. The second group probably won't even notice. Now is the time to do the right thing for the third group and re-enable Latitude in Maps, where it should have been all this time.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Of course. People use Google+ to sign in to things. They've created accounts on other websites with their Google+ account as the oauth sign in.
Killing Google+ will kill those accounts. Dick move Google.
Wow! An insightful mod that actually seems justified.
There is a solution here, and it could even begin with Slashdot. Isn't there a song about "Let it begin with me"?
What if there was a system to accumulate and display the characteristics of sources? In your comment, the key dimensions would be those related to trust. Low for a PR shill and high for a good journalist. In theory, there are still some trustworthy people in the government, and such a system would help distinguish them from the others...
The simplest way I can imagine to implement it would be with a second avatar icon. Slashdot doesn't use graphic avatars, but user names, so if Slashdot can't be enhanced in that way (and any enhancement to Slashdot seems less likely over time), it could be done with a second text link.
However, it's more clear to describe the idea in terms of avatar images, so that's how I'll describe it. Imagine the left avatar is however you want to represent yourself and it links to whatever profile information you want to share. Actually you don't need to imagine it because that's pretty much the standard approach on many websites.
So now imagine the second avatar image as a standardized representation of your public reputation based on how people have reacted to your public behaviors (such as comments and Likes). The version I like best would be a little radar diagram that shows how that person is seen on several key dimensions. Your [alvinrod's] comment was focused on trust, and something like "trustworthiness" or "honesty" would qualify as a key dimension to display.
With such a reputation avatar, you would be able to see at a glance just how much you should trust the comment (or link or whatever) in question. Or not trust it or even not see it. I admit that I would actually prefer to use such a system to save my limited time by rendering a LOT of time-wasting people invisible. I'll gladly wait to see them until AFTER they have improved their reputations.
Actually just a shadow of a much more complicated idea. For example, I didn't say anything about where the reputation avatar link would take you or how you should be able to weight the dimensions that matter to you...
By the way, I'm sure that the google and Facebook and other corporate cancers already do this. They collect our information and create highly detailed analyses of each of us. They just use those analyses for their own secretive purposes and don't share any of the information with the suckers who provided it. Par for the course in today's anti-freedom pro-greedom economy.
But too much time already, so I bid you ADSAuPR, atAJG.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
It means multiple facebook accounts so that your satanic ritual orgy posts don't accidentally get seen by your mom.
Has to do ads over any product.
The users are the product.
Domestic spying is now "Benign Information Gathering"
Where can I now have good old fashioned discussions with people about stuff?
Google plus discussions seemed to be as varied as I could imagine. There was not an apparent filter bubble. I discussed things with people that I would see as left wing and even people from the USA that considered themselves conservatives.
Where am I going to get this wide a discussion area? The last I heard, there were no newsgroups anymore. Are the commentators that have told me for ?a decade? going to fix facebook?
I'll see your Constitution and raise you a Queen.
In related news, Google has promptly re-enabled the use of the + sign as a quick way to mark a search term as required.
Ha ha ha ha ha! Charlie Brown.
But no, even thought their karma will never quite overcome the + expropriation event, I doubt they will ever reverse this spectacularly arrogant syntactic earmark.