Google's Silence on Stalking is Reckless and Wrong
Google says it learned important lessons from David Barksdale, the engineer who spied on underage teenagers via company servers. And apparently one of those lessons is, "don't talk about engineers who spy on underage teenagers."
An anonymous Googler tells Search Engine Land's Danny Sullivan that the company has no plans to publicly disclose future incidents like the one involving Barksdale, who was fired after tapping into Google accounts belonging to at least four minors:
Officially, Google had no response about my idea of [publicly] logging future privacy violations by employees, if they should happen. However, my unofficial understanding from Google about that idea is that it sees these as so rare and isolated in terms of the users involved that there's no need to do so, especially given that it doesn't see other companies doing the same – and that internal personnel matters are involved.
When Google says these privacy breaches are "rare and isolated," what it means is that they have multiplied and worsened. Barksdale, remember, was the second engineer caught spying at Google. The prior case was more mild, in the sense that it didn't involve any children. Whatever lessons were learned from that first case, they weren't enough to prevent — or even to independently catch — the second, which was uncovered only because Barksdale was dumb enough to brag about it to his victims.
Google says it has "significantly increased" the monitoring of engineers to prevent a third spying case. Furthermore, Google has notified every individual who had his or her account spied on, an anonymous Googler tells Sullivan.
But that's not enough. All Google users have a right to understand how much risk they are assuming when storing private information — often vast amounts of personal data — on the company's servers, which now host voice mails, call logs, personal GPS coordinates, emails, pictures, private videos, status updates, chats, spreadsheets and documents regularly amounting to gigabytes and gigabytes per user. Every time a Google account is accessed without authorization from the inside, the company's services are revealed to be slightly less trustworthy, affecting the risk-to-reward calculation for all Google users.
In fairness, many users will decide a total of two incidents is not worrisome given the sheer number of Google's employees and users. A strong case can be made that, so far, spying by Googlers is "rare and isolated." But how are users to know it's still rare tomorrow, a month from now, a year from now, or in five years, as Google services and staff proliferate?
If it changed course and decided to communicate transparently about compromised accounts, Google would allow users to make informed choices while minimizing fear, uncertainty and doubt. Conversely, by staying mum about spying incidents, the company is encouraging people to assume more are happening all the time, and Google is thus stoking the most outlandish sort of extrapolation from the Barksdale incident and the prior spying case.
The standard for Google cannot be what "other companies" do. It's safe to say that Google has a deeper archive of information about a wider pool of people — one billion and counting — than any other tech company on the planet. No one else even comes close. Further, no other company has been as aggressive or successful in encouraging people to migrate their most personal data to "the cloud," i.e. to distant computer servers uniquely vulnerable to precisely the sort of tampering in which Barksdale engaged. Google is even encouraging federal officials to entrust secured U.S. government data to its system administrators.
Meanwhile, Google is preparing to push consumers to share even more personal data, to move their social networking, and their children's social networking, from Facebook's servers onto Google's servers. If Google is to have any hope in that high-stakes campaign, it will have to make the case it is a more trustworthy guardian of safety and privacy than Facebook has been. In that context, whispering to the press about how little it will communicate with its uniquely vulnerable users is a big step backward.
[Photo of Google CEO Eric Schmidt via Getty Images.]