See (at Least Some) of the Data Google Collects About You
September 10, 2019
This SGT Report headline may not be strictly true, but the write-up is interesting nevertheless. They claim, “Google’s File on You is 10 Times Bigger than Facebook’s—Here’s How to View It.” Keep in mind that SGT Report can publish some interesting and often difficult to verify information.
The article extrapolates its figure from the experience of one developer:
“Curious about just how much of his data Google had, web developer Dylan Curran says he downloaded his Google data file, which is offered by the company in a hub called ‘My Account.’ This hub was created in 2015, along with a tool called ‘My Activity.’ The report issued is similar to the one Facebook delivers to its users upon request. Whether or not these reports are comprehensive is still up in the air, but Curran says his was 5.5 GB, which is almost ten times larger than the one Facebook offered him. The amount and type of data in his file, Mr. Curran says, suggests Google is not only constantly tracking our online movements but may also be monitoring our physical locations.
We noted:
“Curran’s Google report contained an incredible amount documentation on his web activity, going back over a decade. But perhaps more importantly, Google had also been tracking his real-life movements via his smartphone device or tablet. This included fairly random places he’d frequented, many of the foreign countries and cities he visited, the bars and restaurants he went to while in these countries, the amount of time he spent there, and even the path he took to get there and back.”
Though we cannot tell whether this much Google-gathered data is typical, it is true big tech companies gobble up a lot of user data. It is also clear that one should take the promises of Chrome’s “incognito mode” with a grain of salt. Concerned readers may want to navigate to the links the article shares for taking some control over this data: Here Google account holders can turn off location tracking and other features of Google apps; at this link you can set advertising preferences; and this is how to download that Google data file like Curran did.
We are not sure Google is really collecting 10 times more data than Facebook, but how one’s personal data is being collected and used online does warrant attention.
Cynthia Murrell, September 10, 2019
Interesting Google Items
September 9, 2019
Waiting for a flight. Noted three interesting Google items.
The first is “Apple Criticizes Google for Creating False impression about the Scale of iPhone Hack.” The points seems to be that Google presented information that focused attention on Apple. We noted this assertion:
In a statement, Apple spokesman Fred Sainz said that the sophisticated attack on iPhones was “narrowly focused” and was not “a broad-based exploit of iPhones”, as described by Google Project Zero security researchers. Sainz also claimed that the attacks affected fewer than a dozen websites that provided content about the Uighur people living in China.
The write up added this fascinating factoid:
Last week, some reports also suggested that the hacked websites targeted Android and Windows users as well, but Google didn’t provide any details about that aspect of the attacks. Google claimed that it had not been aware that Android was affected in the attacks.
Is Google weaponizing information to discredit Apple? DarkCyber does not know.
Second, we spotted “Google Finally Confirms Security Problem For 1.5 Billion Gmail And Calendar Users.” The idea is that Google allegedly reacted to the security problem news this way:
A Google spokesperson responded to my story by insisting that “Google’s Terms of Service and product policies prohibit the spreading of malicious content on our services, and we work diligently to prevent and proactively address abuse.” That statement went on to say that Google offers “security protections for users by warning them of known malicious URLs via Google Chrome’s Safe Browsing filters.” Now, it seems, Google is finally taking this security problem somewhat more seriously.
And I spotted “Google Woes: Antitrust Concerns, YouTube Fine, and Corporate Culture Clashes Keep Tech Giant on the Hot Seat.” Google has a lot of billions to prevent serious burns.
Net net: These items create an impression that lovable Google may not be in touch with its inner flow. On the other hand, maybe these examples are Google.
Stephen E Arnold, September 9, 2019
Google: A Friday Get Together in the Shadow of Dorian
September 7, 2019
When I worked in Sillycon Valley, Friday was a big deal. I am not sure why. Once or twice a month, I would trek to some local joint and hang out with others who worked at our whiz bang technology and cyber data company. In general, the mood was upbeat. We were making money. We did not have vulture capitals roosting on our shiny vehicles. We were not responding to US government mandated document collection tasks.
If the information in Mr. Jeff Bezos’s Washington Post is correct, the Googlers must have concluded that Dorian was pummeling them with rain, high winds, and untethered plastic pool floats. The story is titled “Google Receives Demand for Documents from Justice Dept., Acknowledging Federal Antitrust Scrutiny.” (I was able to read it after wading through the begging-for-dollars pop ups. Really, Mr. Bezos?)
I noted this statement, which may or may not be affected by someone who is breathing the fumes from the Bezos bulldozer idling in front of the Washington Post’s headquarters.
the Justice Department has requested records related to its prior antitrust investigations, marking the tech giant’s first major acknowledgment that it’s a subject of a federal competition probe. The civil-investigative demand — acknowledged in a securities filing and a blog post — comes weeks after Justice Department officials said they would open a broad review of big tech, including search.
Records requests are interesting. On the surface, the request is simple: Gather up the information from “past investigations.” On the other hand, fast-moving, high-tech companies are not really into archiving. Sure, there are document management systems, files on Google Drive, data tucked into USB sticks, paper stored in file cabinets (although some Googlers may not be familiar with actual records management conventions), and maybe –– just maybe — data in a Google social media system.
The unknown, as I understand the document landscape, is to comply with this simple government request.
But — and there is often a but — associated with a simple government request. The content Google provides will be compared with information that the investigators, lawyers, and analysts have.
Anomalies are, in general, not desirable. For example, if the government document reviewers have a document NOT in the Google collection delivered in compliance with the request, an int4eresting question can be raised:
Why did you Google not provide the same information you delivered in the prior antitrust matters? (Translation: We have info in our files from our previous look at you and you a leaving stuff out.)
Now let’s assume that there is information in the government’s file (usually maintained in accordance with assorted guidelines and regulations about US government document retention). Here’s the question:
Why did you provide a document pertinent to a prior antitrust matter that you previously did NOT provide? (Translation: The trove of documents you Google have just delivered includes information we have not seen before. Why?)
You can generate quite a string of questions from this type of matching exercise. Neither question trigger unencumbered joy of pre-demand Friday staff get togethers. (Did you know that Google owns the Sports Page in Mountain View?)
Worth monitoring for two reasons:
- Is Google’s record keeping up to snuff?
- Are the data provided congruent with what the lawyers, analysts, and investigators have in their files both paper and digital?
A digital Dorian in Mountain View?
Stephen E Arnold, September 7, 2019
Brave Is Brave: Google Allegations
September 5, 2019
I read “Brave Uncovers Google’s GDPR Workaround.” The main point of the write up seems to be that Googlers have allegedly engineered a way to work around the GDPR privacy protections. The write up asserts:
New evidence gathered by Brave gives the Irish DPC concrete proof that Google’s ad system did broadcast personal data about Dr Ryan, which infringed the GDPR. In addition, Brave has uncovered what appears to be a GDPR workaround that circumvents Google’s own publicly stated GDPR data safeguards.
“Dr. Ryan” is Brave’s chief policy and industry relations officer. This individual allegedly stated:
“The evidence we have submitted to the Irish Data Protection Commission proves that Google leaked my protected data to an unknown number of companies. One cannot know what these companies then did with it, because Google loses control over my data once it was sent. Its policies are no protection.”
What did Google allegedly do?
First, Google allegedly used DoubleClick components. (Note: DoubleClick patents are quite interesting. You can get started on the path to grasping the nature of the systems and methods Google acquired in 2007 for about $3 billion at this link.)
We learned:
Google allowed not only one additional party, but many, to match with Google identifiers. The evidence further reveals that Google allowed multiple parties to match their identifiers for the data subject with each other.
We noted:
Google Push Pages are served from a Google domain (https://pagead2.googlesyndication.com) and all have the same name, “cookie_push.html”. Each Push Page is made distinctive by a code of almost two thousand characters, which Google adds at the end to uniquely identify the person that Google is sharing information about. This, combined with other cookies supplied by Google, allows companies to pseudonymously identify the person in circumstances where this would not otherwise be possible. All companies that Google invites to access a Push Page receive the same identifier for the person being profiled. This “google_push” identifier allows them to cross-reference their profiles of the person, and they can then trade profile data with each other.
The write up argues:
Brave’s evidence shows that Google’s Push Page mechanism undermines Google’s purported data protection measures. They are also vulnerable to abuse by other parties. We are aware that companies other than Google have used the Push Page mechanism to establish their own Push Pages to share data with their own business partners. This appears to happen without Google’s knowledge. The loss of control over personal data in Google’s RTB system is again evident, and it is clear that Google’s policies have provided no protection.
Let’s assume Brave’s data are accurate. Furthermore, let’s assume that the Irish Data Protection Commission integrates these data into its deliberations. What’s the outcome?
DarkCyber believes that Google’s credibility would take another hit. Fines are unlikely to apply friction to the alleged behavior. Understanding the nuances of what it means when Google operates in a way that is not easily understood by anyone other than specialists is a type of digital circumvallation. It worked for Caesar, and it seems to be working for Google. Of course, if Brave’s data are inaccurate, then Google is just another simple online outfit selling ads. Simple. Efficient. Business as usual.
Stephen E Arnold, September 5, 2019
Quote to Note: Google HR on Exec-Staff Relationships
September 4, 2019
I read “#MeToo Is Going After Top Black Google Executive Over Alleged Work Affairs And ‘Little Google Baby’.” The write up reviews an interaction between a senior Google executive and a Google professional. DarkCyber has zero knowledge of the alleged incident, although it appears that a “baby” exists. Thus, there is some data suggesting that an interaction did take place. What struck DarkCyber as interesting was this statement from the article:
Stacy Sullivan, then-head of human resources and now chief culture officer, told Blakely that Google discouraged managers from having relationships with subordinates.
Interesting. I found the word “discouraged” quite revealing.
Stephen E Arnold, September 4, 2019
Incognito Mode Update Hinders Publisher Paywalls
September 3, 2019
Google’s effort to bolster the privacies of Chrome’s Incognito Mode does not sit well with one writer at BetaNews. Randall C. Kennedy insists, “Google Declares War on Private Property.” The headline seems to conflate the term “private” with “proprietary,” but never mind. The point is the fix makes it easier for dishonest readers to avoid paywalls, and that is a cause for concern. The write-up explains:
“Google has announced that it is closing a loophole that allowed website operators to detect whether someone was viewing their content under the browser’s Incognito Mode. This detection had become an important part of enforcing paywall restrictions since even tech-unsavvy visitors had learned to bypass the free per-month trial article counts at sites like nytimes.com by visiting them with Incognito Mode active (and thus disabling the sites’ ability to track how many free articles the user read via a cookie.) The content publishing community’s response to this blatant theft of property has been to simply block users from visiting their sites under Incognito Mode. And the way they detect if the mode is active is by monitoring the Chrome FileSystem API and looking for signs of private browsing. Now, with version 76, Google has closed this API ‘loophole’ and is promising to continue thwarting any future workarounds that seek to identify Incognito Mode browsing activity.”
Google says the change is to protect those who would circumvent censorship in repressive nations. However, in doing so, it thwarts publishers who desperately need, and deserve, to get paid for their work. Kennedy suspects Google’s real motivation is its own profits—if content creators cannot enforce paywalls, he reasons, their only recourse will be to display Google’s ads alongside their content. Perhaps.
Cynthia Murrell, September 3, 2019
Google and College Information
September 2, 2019
Google has been expanding its search functionality in some useful ways. Beginning in 2017, it was about supporting job searches, and as of last year the platform gives prospective college students a helping hand. Google Search now supplies a user-friendly list of statistics about any university alongside the results of a search for that institution’s name. The tool pulls this information from the U.S. Department of Education’s College Scorecard and data from the National Center for Education Statistics. Unfortunately, there is one problem–AEIdeas tells us about “Google’s College Search Bias.” Reporters Jason D. Delisle and Cody Christensen write:
“Google’s college search has a major blind spot that its champions have either failed to notice or aren’t willing to call out: it only covers traditional four-year colleges. Even worse, community colleges appear like any other business rather than institutions of higher education. For-profit colleges are also given short shrift. In other words, Google’s search-display magic is reserved for students interested in just one part of our higher education sector — the one that mostly caters to traditional, full-time students seeking academic credentials who are often from upper-income households.”
The writers give some examples of this uneven treatment, so navigate to the write-up for those details. (Or just experiment with your own searches, if so inclined.) The article observes that the College Scorecard includes community colleges and for-profit colleges, so why doesn’t Google do the same? Delisle and Christensen ponder:
“Maybe Google didn’t realize there are many types of higher education pathways. Or on a more cynical note, perhaps Google believes that prospective community college and for-profit college students don’t care about this type of information. Ironically, these students could potentially benefit the most from additional information, since community colleges and for-profit colleges have some of the weakest student outcomes. Fortunately there’s an easy fix. Google already has access to all of the information it needs to include two-year and for-profit schools in its search display. The company simply needs to add it.”
DarkCyber hypothesizes that Google wants college search traffic. The firm’s data driven approach may lack some of the old razzle dazzle of the paper-centric Peterson’s guides. Do you know what an “inclusion” is? Yep, college guides used to sell ads and maybe still do. Ah, advertising.
Cynthia Murrell, September 2, 2019
Google and Unions: What? Unions!
August 31, 2019
DarkCyber noted “Google Contractors Are Unionizing with a Steel Workers Union.” The main idea is that people who take money from Google want protection or influence or maybe a voice. The write up states:
66 percent of the eligible contractors at a company called HCL America Inc., signed cards seeking union representation, according to the United Steel Workers union. With the help of the Pittsburgh Association of Technical Professions (PATP), they’re asking the National Labor Relations Board (NLRB) for a vote on union representation. The PATP is a project sponsored by the union aimed at “helping Pittsburgh and Southwestern Pennsylvania workers in high-tech fields organize and bargain collectively.”
Google does not seem to be eager to do much more than be Googley. If the unionization effort succeeds, DarkCyber believes that those representing the contractors will not be impressed with Googley.
There are quite a few issues which this union thing embraces.
We noted this statement:
In some instances, contractors do the same work as employees but are paid less and get fewer benefits. In other scenarios, the contractors are doing “ghost work” because they’re erased entirely as their labor is presented as the product of “artificial intelligence.”
Does this mean that Google is misrepresenting its technology?
DarkCyber thinks that the GOOG may do some efficiency analysis and terminate the workers and move the contracted work to more hospitable locations. Occam that at your next rally, semi Googlers. And if there’s a better, higher paying job, take it. DarkCyber knows that Pittsburgh is a technical hot spot with Carnegie Mellon for engineering and Duquesne University for accessing the epistemology of ethical behavior.
Stephen E Arnold, August 31, 2019
MAGA: Making Android Great Again?
August 30, 2019
My feeds were stuffed with references to Google’s announcement that Apple’s iPhone security sucks. Here’s a sampling of the headlines I spotted:
Google reveals years-long ‘indiscriminate’ iPhone hack. Most of the vulnerabilities targeted were found in the iPhone’s default Safari web browser. Source: The National
Google discovered ‘sustained attacks’ over at least two years against iPhone users. Source: Neowin.net
Google says hacked websites were attacking iPhones for years. Now-fixed exploits were used to install monitoring implants. Source: TechSpot
And there are more. The Guardian, Inquirer, PocketLint, MIT Technology Review, and others.
DarkCyber does not want to think negative thoughts about Google’s discovery. Apple addressed the issue promptly. On the plus side of the ledger, Google could have made the announcement after the US holiday weekend. Why now?
DarkCyber wants to point out that another article, this one about Google Chrome, offered this headline: “A major Google Chrome bug could let criminals attack your PC remotely.”
Not too much coverage of this item compared with the damning revelation that iPhones. Are. Insecure!
DarkCyber suggests that the information presented at CVE Details may be of interest. This site presents a possibly accurate list of Google Android security issues.
DarkCyber wants to point out:
- If a device is any place other than a Faraday cage, unplugged, and behind a security perimeter, that device may be vulnerable
- Mass market devices are compromisable because users have “interesting behaviors.” Curious about that to which DarkCyber refers? Check out this link.
- Hardened devices which are “black” are not popular because they are [a] expensive to produce and keep up to date, [b] more difficult to use than a consumer phone, [c] expensive, and [d] also vulnerable.
Security exposés capture headlines. Vendors of cyber security services and products make these types of revelations part of their standard operating procedure.
Capturing headlines informs bad actors that there are vulnerabilities to be discovered. “Hey, why not check out this method” publicity is an interesting approach. Is Google grandstanding?
Plus, Google may introduce its own MAGA hat. A “Make Android Great Again” chapeau could knock the famous Google flashing lapel pin off its top spot in the Google collectible hall of fame.
Stephen E Arnold, August 30, 2019
Google Country Faves?
August 30, 2019
Google, according to the Intercept the search engine has returned to Egypt in “Google Is Deepening Its Involvement With Egypt’s Repressive Government.” Google abandoned its Cairo office in 2014 when a military coup placed Abdel Fattah el-Sisi in the presidency. The Sisi government is notorious for silencing political activists and dissidents, while using the Internet to form a Big Brother surveillance system. It gets worse, because Sisi’s administration is also censoring Web sites, news, and violating human rights.
Google will soon hire full time staff under Google executive Limo Cattaruzzi. The company will also work with the Egyptian government to expand its “Skills From Google” program that provides digital training for entrepreneurs. Unfortunately, the Sisi government is involved with this endeavor.
Google faced some eyebrow raising for working with the Chinese government on Project Dragonfly. Advocacy groups. The US Congress asked questions. Some Google employees protested Dragonfly. In a bold move, Google backtracked.
Google will probably face similar backlash when it reopens its Cairo office in September:
“Rights groups are concerned that a more permanent presence in the country will expose Google to added pressure from the Egyptian government, which has a history of using data collection and monitoring to punish dissidents, journalists, and human rights advocates.
We noted:
‘Re-opening an office in Egypt when the government is aggressively asking other internet companies to provide disproportionate access to their data sounds alarming,’ said Katitza Rodriguez, the international rights director at the Electronic Frontier Foundation. Google has an obligation to respect human rights under international standards, Rodriguez added, and the company should disclose what steps it will take to safeguard them.”
Egyptian political dissidents have some history with Google. When the Egyptian government shut down the Internet in 2011, Google allegedly flipped on some digital lights during the blackout.
Will the Sisi government use its partnership with Google and other foreign companies to brand Egypt as a foreign investment haven?
Whitney Grace, August 30, 2019
-
- Subscribe to Beyond Search
Feature archive
News archive
-
