The first step to data privacy is admitting you have a problem, Google

One of the joys of academic research is that if you do it right, you can prove the truth. In the case of computer science professor Douglas Leith, this truth is that Google has been taking detailed notes of every telephone call and SMS message made and received on the default Android apps. It didn't tell us, it didn't give us …

[Anonymous Coward]

How often do we get to hear "Sorry"......

....only after egregious deeds are discovered?

....and this has been going on for a while now. Take this Google example from 2010 (yup....twelve years ago):

Link: https://www.wired.com/2012/05/google-wifi-fcc-investigation/

...now this!!

Personally, I don't believe a word of apology from any of them....Google, Facebook, Amazon, Microsoft, the NSA......

They are all responsible for the complete lack of privacy in the modern world.....responsible, maybe....BUT NOT ACCOUNTABLE!!!

When will the masses rise up and stop this charade?

[Dan 55]

Re: How often do we get to hear "Sorry"......

Now Google have the passwords for most APs in the world because Android syncs a backup copy, but it seems nobody cares about that.

[vtcodger]

Re: How often do we get to hear "Sorry"......

Simple answer maybe. Tax storage of non-anonymized data beyond a few hundred bytes of basic identifying information -- user name, contact info, password. Apply the tax to any digital storage on your country's citizens anywhere on the planet (No more "the information is stored in Ireland and you can't tax/examine/whatever it the US/EU/wherever). Make the tax high enough to discourage random data collection, but low enough that businesses can store data data on online transactions without increasing prices. Enact substantial fines for violating the spirit of the rules. Multiply the fines by 50 if the violation appears to be deliberate.

[veti]

Re: How often do we get to hear "Sorry"......

Make the tax high enough to discourage random data collection, but low enough that businesses can store data on online transactions without increasing prices

Umm. I'm finding it hard to imagine that sweet spot.

$1 per person per year? - Google would pay that cheerfully as a cost of doing business, the data is worth far more than that to them.

$1 per person per month? - at this point you've reached the level where (e.g.) your internet and electricity providers will be adding it to your bills, and it's still not clear it's enough to discourage Google.

What do you think would be "enough but not too much"?

[Bonegang]

Re: How often do we get to hear "Sorry"......

I recall that Microsoft once proposed a 'tax' on email of USD 0.00001 to stop bulk email (spam) abuse.

It made sense, but no-one could agree on how/who to collect the tax, so that idea died on the vine... unfortunately I see this idea going the same way.

(Pity the FCC in the US is so compromised under Ajit Pai)

[MachDiamond]

Re: How often do we get to hear "Sorry"......

"Simple answer maybe. Tax storage of non-anonymized data beyond a few hundred bytes of basic identifying information"

Mr Pai(d) is gone now. I expect he's got a very cushy job at some company he "helped" while in government "service".

[Jellied Eel]

Re: How often do we get to hear "Sorry"......

I don't think tax is the answer, cost would probably work better.

Mobiles still often have data quotas and overage charges, so there's a direct cost for data Google hoardes. Users have to create accounts, alongside any Google might create for users that try to avoid registering. So simply regulate a rate for that data of say 25c per KB to compensate users for the data Google consumes.

That could also be extended to ads. So the ad slingers charge per impression for ads delivered. They waste data and cost consumers. So ad slingers should also pay 25c per KB for ad delivery charges.

And then there's general data protection and privacy improvements. Currently we can request copies of data held on us by data controllers. That might cost £10 per SAR. Assuming you know there's a data controller surveilling you. There's also a legal requirement that data is accurate.

So that process could be improved and made more secure. Data controllers must send data subjects human and machine readable copies of all data held so subjects can confirm it's accurate and necessary. Legislate so that has to be done at least every quarter, and subjects consent must be granted prior to subjects data being shared with non-LEA entities.

Left to our own devices, big data seems to show no willingness to reduce the amount of personal data stolen, and since the introduction of privacy legislation like the DPA, the situation has clearly got worse, not better. So obviously there are regulatory failures to address.

[MachDiamond]

Re: How often do we get to hear "Sorry"......

"Simple answer maybe. Tax storage of non-anonymized data beyond a few hundred bytes of basic identifying information"

Make data leaks and misuse a criminal offense. Laws with big enough fangs to eat a large company in one bite. Not only that, but prison time (not Club Fed) for the big guy. If the C level executives are going to make big money, it should some with big responsibility. Not long sentences, but at least a year. If you are a person with a net worth in the hundreds of millions, a 6 month stint of a single wardrobe choice (orange jump suit) isn't something they would enjoy very much. It has to be a short enough sentence that judges will not reduce it down to a light probation period. Perhaps put in wording that it can't be reduced.

If your identity is stolen or even just your personal data is used to your detriment, it can cost you a lot of money and time. Forget stupid things like free credit monitoring. I'm stitched up with credit monitoring for life at this point. Multiply the damage done over all of the people one of these companies has violated and it's easily billions of dollars even when it's only a few hundred per person.

A friend of mine that's pretty bright got half scammed via a cable/phone/internet rouse. They had enough of her data to convince her that they were her provider and were upgrading top tier customers (those that pay their bills on-time). They were able to social engineer that one piece of information they didn't have and cause about 2 hours of problems to get sorted with the cable company. Now she knows that a data leak from somebody has a whole bunch of her info in a database somewhere. She won't be talking with anybody claiming to be from somebody she does business with unless she initiates the call. They'll have to send her physical mail which large companies will still do from time to time and scammers don't.

[fidodogbreath]

Re: How often do we get to hear "Sorry"......

As long as it keeps working.

[Tim99]

Re: How often do we get to hear "Sorry"......

It’s easier to ask forgiveness than to get permission (Apologies to Grace Hopper, and many others).

[MiguelC]

Re: How often do we get to hear "Sorry"......

They're only sorry they got caught.

They'll try harder next time... not to get caught.

[bombastic bob]

Re: How often do we get to hear "Sorry"......

"Sorry we got caught doing something egregious"

Happens often enough to wonder what they did NOT get caught doing...

[Anonymous Coward]

"Let's tackle that by assuming good faith"

That's the first mistake. There's no good faith. They hoard data because the want them to make more money. There will never be a "market self-regulation" - they will only bow, and not without fighting, lying and blackmailing - to laws that will make that behaviour a crime. And when I wrote "crime" I mean executive should get jail time for stealing user data - fees are no longer enough.

[oiseau]

Re: "Let's tackle that by assuming good faith"

... the first mistake.

The most important mistake, if it was ever one.

I have always had serious doubts about that.

There's no good faith.

There never was, from the very beginning.

... hoard data because ...

Because it is what they do to make money by the shitload by selling/sharing/using it a myriad of ways.

And, as professor Leith has discovered, their system to make good on their illegal activities is designed to be as opaque as possible if not practically invisible.

Kudos to Leith for his hard work, his works opens a tiny window on what is going on.

But unless Google is fined 15 or 20 billion (yesterday) and then split up in 100 different baby Googles, it will have been all for nought because it is probably/already too late.

It has to be dealt with as a foreign company belonging to the enemy in times of war.

It is easy:

"Google, you have done this far too many times. Now, your time is up."

But there's far too much money and far too much power in Google's hands and a great many others benefit from that, the first ones being the governments and other corporations who cozy up to them.

In short: we're all thoroughly fucked.

O.

[Terry 6]

Re: "Let's tackle that by assuming good faith"

I'd say the first, and most important, mistake was to start by accepting that customer data was there for the hosts to harvest. Yes Google's stuff is "free" so if we want it we have to accept that they will throw adverts at us. They exist to make money. But we allowed them to go three significant steps further straight away. To accumulate, store and aggregate the data.

So they don't just send us adverts to get money, or even identify the content we are seeking/sending and immediately send us relevant adverts (you mention socks you get a sock advert), but they were allowed to store that information and use it to build up a database on each of us and then sell us to advertisers as a package. It's the difference between using data and stealing data.

[NapTime ForTruth]

Re: "Let's tackle that by assuming good faith"

"...and then sell us to advertisers as a package..."

And to governments. What we do today may not be a crime, but when it becomes a crime in the future we will be exploited, hoist by our own, newly-christened data-petard.

[Falmari]

Re: "Let's tackle that by assuming good faith"

@Terry 6 “Yes Google's stuff is "free" so if we want it we have to accept that they will throw adverts at us.”

When it comes to phones that’s not the case. When someone* buys a phone, they are paying for a working phone, so with an OS. A phone without an OS is not a working phone.

Purchasers of say a Samsung phone are not doing it because they want a free OS (Android). To them it is not free just part of what they are paying for. It is not like they get a choice from Samsung :-

Phone £x

+ Android free or

+ Other OS £x

Phone manufacturers choose Android for their benefit, because it is free to them. But phone buyers are not making that choice, there is no want on their part, they don’t really see it as free.

*By someone I mean the average phone buyer, not the likes of Reg readers. I just bought my first Android phone as my 7yr old MS phone is not long for this world. I went out of my way and paid more to get one that has no Google on it at all.

[Updraft102]

Re: "Let's tackle that by assuming good faith"

If it has no Google on it, it is no longer an Android phone, but a degoogled AOSP phone. It's the Google bits on top of AOSP that make it Android.

[Falmari]

Re: "Let's tackle that by assuming good faith"

@Updraft102 "it is no longer an Android phone" you are right +1.

It was Android when I bought it just did not stay Android for long.

[Chet Mannly]

Re: "Let's tackle that by assuming good faith"

The A in AOSP stands for Android. Huawei phones have no Google stuff on them and their OS is still called Android.

I agree Google wants everyone to *think* that it's the Google parts that are most important and make Android what it is, but they aren't really.

[Chet Mannly]

Re: "Let's tackle that by assuming good faith"

Another assumption you are making is that everyone uses Google's services. Google surveils everyone, not just those who use their services.

[Paul Kinsler]

Re: "Let's tackle that by assuming good faith"

I think here the point of stating "by assuming good faith" is *not* because you actually believe there is good faith; it is rather to make it harder for the target to reject your arguments by characterising you as hostile.

Instead they have to actually engage in a discussion about how any claim to "good faith" they might make can be demonstrated; so, to an extent, *you* have set out the ground on which to debate the issue.

And if the target then tries to shift the focus of the debate away from "good faith", they can end up looking as if (or perhaps demonstrating that) they lack it.

[Anonymous Coward]

Re: "Let's tackle that by assuming good faith"

Google & C. must be now assumed to be "hostile" entities. They become so large and so rich exploiting data they are prepared to fight every inch to avoid their business model upended.

They are trying to make people believe this is the only business model and surrendering data is inevitable - "resistance is futile". There could be no discussion about that - they will try to hoard ore and more to see how far they can go before getting caught, and how far again before being stopped. And once there it will be very difficult to push them back.

The only ground on which to debate this issue is people's rights.

[veti]

Re: "Let's tackle that by assuming good faith"

No. You always assume good faith, for as long as there exists anyone who can say the words with a straight face.

Why? Because the alternative is straightforward adversarialism. As Cohen the Barbarian puts it, you don't want to get into an arse-kicking contest with a porcupine. And similarly, you don't want to fight Google on ground that amounts to "who's got the most money to spend?"

[Anonymous Coward]

"on ground that amounts to "who's got the most money to spend?"

There could be situations where all the money Google has or could spend may matter nothing.

Standard Oil money didn't help. It's just a matter of will.

[veti]

Re: "on ground that amounts to "who's got the most money to spend?"

Standard Oil didn't get to control what people were told when they asked "so what's this all about, then?"

You can't fight Google head on. Maybe the Chinese government could do it, I'm not sure, but you or me or everyone reading this plus everyone they've ever spoken to in their lives, put together? - no. The only way for us to influence them is by engaging on non-hostile terms. That can succeed, so long as you keep expectations modest.

[heyrick]

Re: "on ground that amounts to "who's got the most money to spend?"

"by engaging on non-hostile terms."

Such as? As time goes by, banks [*] and insurers and governments are requiring things be done using an "app". Which pretty much dictates that one should have some form of smartphone these days. Seems there are only two players in town, and it's not as if either are exactly trustworthy.

* - Due to new EU rules, my bank demands that I enter a special personal code into the app every ~90 days. If I don't, all online access is blocked, not just the app but the website too, plus payment authorisations. God knows how they handle people who don't have a smartphone...

[Terry 6]

Re: "on ground that amounts to "who's got the most money to spend?"

God knows how they handle people who don't have a smartphone...

Or aren't tech savvy/as young as they used to be (i.e. elderly).

[MachDiamond]

Re: "on ground that amounts to "who's got the most money to spend?"

"You can't fight Google head on. Maybe the Chinese government could do it,"

That's correct and why there are Trade Commissions to regulate commerce. The average person may not have enough money for an initial consultation with a blood sucking lawyer. The money to file a case and see it through is far beyond the means of most.

[Greybearded old scrote]

Time to ramp up enforcement

This is a clear breach of GDPR. Collecting and exporting data without informing us. Let alone allowing an opt-out.

Up until now the fines have been little warning nibbles, but now the courts should bite hard. What is 4% of Google's gross?

[Evil Scot]

Re: Time to ramp up enforcement

Can we multiply that 4% by 26/27?

[A.P. Veening]

Re: Time to ramp up enforcement

Can we multiply that 4% by 26/27?

Why would you want to make that fine smaller????

[Evil Scot]

Re: Time to ramp up enforcement

Correction for all you C++ devs. 26 | 27.

[Anonymous Coward]

Re: Time to ramp up enforcement

As long as the Irish Leprechauns are in charge for these violations, Google will put a pot full of gold at the end of the rainbow and get a slap on the wrist. I believe there should be a EU Privacy Special Unit in charge of the biggest transnational data hoarders. They are not different from Al Capone.

[Anonymous Coward]

Reality check

> isn't the action of a well company

Shareholders might disagree strongly... Sorry, but you're assuming an ethical, just and altruistic society where people strive to help their fellow (wo)man. Actually it's a shameless, pathologically egoistic society where you have to stick it to the others, even if it costs you. And Google is just a child of its time, just more shameless than the others.

As much as it pains me, Google isn't the problem, it's us, all of us. Google is just the brat we terminally spoiled. If those values we pretend we adhere to were anything more than empty catchwords, our politics would be clean and serving the nation, not themselves, and companies would try to make money while respecting the law and a strong ethical guideline. Yeah, snowball's chance in hell, but we should at least try (instead of ignoring the problem), shouldn't we? Instead of running around like headless chicken crying "Help! The house I've put on fire is burning!"

[b0llchit]

Re: Reality check

Google isn't the problem, it's us, all of us. Google is just the brat we terminally spoiled.

That is not exactly true. The drug-addict (user) is not the primary to blame. You should blame the drug-dealer (google) pushing the addicts.

Google has long known that it sells mobile addiction in exchange for the user's data. That means they are actively exploiting the users and reinforcing the user's addiction by any means possible. The same goes for all the other (big) players. They know how it works and don't care about the well-being of the users. They only care about the bottom line, just like any other drug-dealer.

[ThatOne]

Re: Reality check

> You should blame the drug-dealer (google) pushing the addicts.

I'm with the OP. First of all, there is an actual need for mobile phones and their OSes, so if it hadn't been Google it would had been someone else. And it happens OS makers are quite susceptible to raving megalomania (check Microsoft for a well-studied example)...

My point is, Google was initially satisfying a need, the need for a phone OS and attached services, but none of those require or excuse being a creepy Peeping Tom/Big Brother hybrid. That part is the result of a total and utter lack of ethics, something which apparently is very hip and desirable in today's corporate world.

[Charlie van Becelaere]

Re: Reality check

Indeed. Just as Tom Lehrer told us about that old dope peddlar, doing well by doing good.

https://youtu.be/ntMYHVvwn-Q

[NapTime ForTruth]

Re: Reality check

"Google is just the brat we terminally spoiled."

Yes, but once we find we've created this outcome, this brat, this bête noire, we still have an obligation to drown it in the pond out back.

[ThatOne]

Re: Reality check

And make sure it won't be replaced by just the same type of creeps!

As I said just above, OS making corporations are prone to raving megalomania, given that who controls the OS controls everything running on it.

I think OSes should be considered "vital infrastructure" and removed from the commercial circuit. It's not like they are in competition with each other anyway.

[Kane]

Let's tackle that by assuming good faith...

"...that the abuse isn't the product of evil intent but bad habits brought on by dataholic intoxication."

That's just it though, isn't it, one begets the other. The reason that dataholic intoxication exists (nice phrase, but I prefer "data fetishism" myself), not just in google but elsewhere, is because of the product of evil intent. I have no doubt that it would exist anyway but with everyone and their granny siphoning up as much data as they can, is anyone surprised?

[Evil Scot]

Re: Let's tackle that by assuming good faith...

They seem to forget Data Science 101.

Data + Context = Information.

All this data is without context is worthless.

[Phones Sheridan]

Re: Let's tackle that by assuming good faith...

Data Mining is the method of finding out what questions you haven’t been asking about your data all along. You’ve got the apocryphal story about how Walmart one day started selling beer on the same isle as diapers initially to everyone’s confusion. What the public didn’t know was data-mining had found a correlation between the 2 products. Purchases of baby’s nappies were accompanied with purchases of beer, so Walmart put the 2 together to nudge more people into buying the same.

[MachDiamond]

Re: Let's tackle that by assuming good faith...

"Purchases of baby’s nappies were accompanied with purchases of beer, so Walmart put the 2 together to nudge more people into buying the same."

I think there could be a strong correlation between alcohol consumption and babies. I expect that Wally World stocks the contraception on the other side of the store, in the basement, locked in a disused lavatory.

[Forget It]

Google Access Denied for your link to Douglas Leith report

But I found it here:

https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf

[Doctor Syntax]

Re: Google Access Denied for your link to Douglas Leith report

I'd quibble with one point in the paper. He complains that there's no way to opt-out of excessive data collection. This should, of course, say that it shouldn't happen without an opt-in.

[VoiceOfTruth]

Use the right word, please

-> Google's dataholic behavior may take more than promises to fix.

Google's diabolic behaviour...

If you use a Google phone, you are feeding the NSA with details about yourself.

[Anonymous Coward]

Re: Use the right word, please

You should fear Google much more than the NSA....

[A.P. Veening]

Re: Use the right word, please

You should fear Google much more than the NSA....

True, because there is No Such Agency

[Anonymous Coward]

Re: Use the right word, please

I really don't care about the NSA. I care slightly more about Google, but only slightly. Since they both take very good care of the data (and when was the last serious leak of non-anonymised, or de-anonymisable, data from either one of them?), what harm does it do me?

[john.w]

Re: Use the right word, please

Both are in a position to ensure you never hear of such leaks.

[DJV]

@AC "what harm does it do me"

With a response like that, it just shows that YOU are part of the problem.

[Phones Sheridan]

Re: @AC "what harm does it do me"

An AC saying he doesn’t care about privacy. Yes I see the deliberate irony there.

[Dinanziame]

"Google knows what every byte of that data is, and what it's used for"

I think that's very optimistic. In a lot of cases, Google has been hoovering up data without even having any idea whether it would ever be useful... Just in case.

[Mark #255]

Re: "Google knows what every byte of that data is, and what it's used for"

This statement again, assumes good faith (and as a post some distance above states, it's about setting the terms of the discussion).

Because, of course, the (hypothetically in-good-faith) data-hoovering behemoth has had teams of lawyers and technical experts plough through the various classes of data they collect, and has systematically categorised every data-point collected. Otherwise, they'd be breaking the law...

[Steve Davies 3]

Hey Google!

How about stopping the practice of slurping every bit of data on each and every one of us that you can. That is just wrong.

Start cleaning your own house Google.

[Altrux]

Re: Hey Google!

Listening not, they are.

[Sitaram Chamarty]

meanwhile...

...for those who would like an immediate solution, I suggest installing NetGuard and setting it to block these apps from being able to send/receive data. I recommend setting it to "whitelist" mode, and allowing only the few apps that *you* know absolutely need network access.

NetGuard is open source; you can get it from f-droid also if, like me, you avoid the plague-store.

[Anonymous Coward]

Re: meanwhile...

NetGuard sounds nice, I probably won't bother (but thanks for the info) because there are just too many hoops every day.

I do some basic stuff to reduce annoying ads (uBlock Origin, Pricacy Badger etc) on my PC and on my phone not using Chrome, there are a few adblocking browsers to choose from, but unless it's tackled at source I'm always going to be behind.

One thing I wish Google would sort out, and it would actually help them.

Using Chrome on a PC and searching for NetGuard, the top 2 results are for the Play Store. No surprise there.

I'm in the UK, they know that, so the first 2 links are:

https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en_GB&gl=US

https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en&gl=US

Both those have the 'Install' button 'greyed out' and it's not 'clickable'

Should I want to click I need to remove the '&gl=US' part of the URL, so

https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en_GB

https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en

This happens all the time, it's not unique to my NetGuard search results.

How come they can't get this right.

A bit off topic I know, sorry.

[T. F. M. Reader]

Re: meanwhile...

allowing only the few apps

I was under the impression that it was about phone calls and SMS messages - both are "apps" and default on Android are Google's, and I am not sure there are alternatives. So I guess one has to allow them, right? What am I missing?

[Chet Mannly]

Re: meanwhile...

There are definitely alternatives. I use Signal for SMS instead of google messenger - you just have to tick a box in settings and say yes make it the default. Works flawlessly.

There are dialer alternatives as well, but I haven't bothered as I don't make enough phone calls to be worth the trouble...

[StinkyMcStinkFace]

Google doesn't "HAVE" a problem. Google "IS" a problem.

We block their stuff at the firewall level.

Someone here said they exist to make money. No they don't, they exist to spy on people and harvest your data.

Teach your kids to stop using the term "google for something", it's a problem that is embedded in the fabric of society and they need to be stomped out.

[SImon Hobson]

Correction - they DO exist to make money. Hoovering up data and spying on people is how they make that money.

[Terry 6]

Correction- hoovering our data is how they make obscene amounts of money, beyond reasonable profitability.

[veti]

I don't know about you, but I've never paid Google a dime in direct money.

It follows that all the money they've made off of me has been by exploiting my data somehow.

How exactly do you propose they should make their legitimate, non-obscene amount of money, if there is such a thing?

[ThatOne]

As somebody else said further up, nobody chose Android because it's free. They chose an Android phone and paid good money for it, so the "free" part is a fallacy: Android is free for phone manufacturers, not phone users.

If it were free for us users, we would be able to download and install any version (or even OS) we wanted on our phones, wouldn't we. It happens you can do it, sometimes, if you've got the right phone, you're quite IT savvy, and ready to jump through numerous hoops.

[Pascal Monett]

"You have no privacy, get over it"

Sorry, we're not getting over it.

It's not because you have the means, that you have the right.

And if you can't understand that, let me come over with a cluebat and I will make you understand.

[Johnb89]

Google is a group of people (so is Facebook)

So we have to assume that the people at Google and Facebook (and others) get paid LOTS of money to leave their ethics at the door.

If you know someone that works there, try having a conversation with them about this. Push them a bit. See where it gets you (and tell us). Can they defend what they are doing? If so, how? Try to do it without starting the conversation with 'Look, arsehole...'

Put a camera up to film their house. Put a microphone in their lounge and car. Hell, put a camera in their bedroom. Or at least suggest that you think that would be fine. Tell us what they say.

[DishonestQuill]

Re: Google is a group of people (so is Facebook)

I've had the pleasure of trying that with a couple of my close friends and many, many acquaintances: they don't engage with that conversation, mostly because they don't care or view it as a good thing.

They must go through a shocking amount of kool-aid during induction.

[TimMaher]

Re: kool-aid

Is that their acid test?

[SImon Hobson]

On foot of this report Google say that they plan to make multiple changes to their Messages and Dialer apps.

And our first thought is that those changes will be to better hide what they are doing - not to stop it.

[marcellothearcane]

plan

On the backlog along with "pay proper taxes".

[Anonymous Coward]

How to block google

don't use their services or products.

I do, but when I do it's because I want them to see the 'profile' i want them to have on me.

[Anonymous Coward]

Ethics and business

Google, like every other for profit business, strives to make money. This is unethical in some Marxist philosophies but is ethical in Capitalist philosophies.

If Google is violating a law, they should be taken to task.

But many seem to question their basic business model of collecting and selling data, a model used to generate income throughout the internet.

The question is, how do people think Google is going to pay for Google Search without this revenue?

[Anonymous Coward]

"If Google is violating a law"

Google is violating the law, at least in EU.

"how do people think Google is going to pay for Google Search"

The real question is "how Brin and Page thought to pay for Google Search?"

"unethical in some Marxist philosophies"

Yet total surveillance wasn't, and isn't - just look at China...

[Anonymous Coward]

Re: "If Google is violating a law"

Google is violating the law, at least in EU.

They may be but I'm a American and not a lawyer so I used 'if' as a qualifier.

The real question is "how Brin and Page thought to pay for Google Search?"

They thought that they would pay for it by selling ads just like newspapers have for over a century. No ads, no Google Search. Unless you want the US/UK/EU to take its expenses over and run it ad free.

[ThatOne]

Re: "If Google is violating a law"

> pay for it by selling ads just like newspapers have for over a century

And that's precisely the problem! Nobody has ever had problems with ads "like newspapers had", for over a century indeed. Not intrusive, sometimes even interesting ads, which didn't try to overtake the content you had paid for, and definitely didn't spy on you.

Nobody has problems with those friendly, peaceful ads. What people have problems with is shrill, overbearing ads which slow everything down and try to record and categorize your every move (mostly erroneously). Those feral ads are the problem, nobody would mind the inert banner ads of yesteryear (unless they start taking over the content and become feral in their turn).

[doublelayer]

Re: Ethics and business

"The question is, how do people think Google is going to pay for Google Search without this revenue?"

That is not my problem. If they choose to violate the law in order to make enough money and they can't find a legal way to do it, then it's time for them to die. We never ask how the extortion gang can continue to afford their nice houses when their schemes get shut down, do we?

There are some things they could try, though. The first is ads. Not data collection to tailor the ads. Not identifying the user to advertisers who then send ads. Just ads, based on the search terms and not recorded afterward. Or they can ask for donations. Or they can charge for use. Lots of options. If none of them work, too bad for them and it's time to see if someone who isn't evil can make it work. There are places that have succeeded in making a profitable business without breaking the law.

[Twanky]

Re: Ethics and business

I agree with your points but I'll quibble over a couple of details:

We never ask how the extortion gang can continue to afford their nice houses when their schemes get shut down, do we?

A better analogy would be drugs gangs. How can they afford to supply the drugs if their operation gets busted?

Not identifying the user to advertisers who then send ads.

I'm pretty sure they're careful not to do this. They want to sell the same information about consumers over and over again.

[Terry 6]

Re: Ethics and business

Also, that is not the question. Google Search is a tiny corner of Google's empire. And...... It needs to show a profit. But not an obscene profit.

[Falmari]

Re: Ethics and business

@HildyJ "The question is, how do people think Google is going to pay for Google Search without this revenue?"

That is Google's problem no one asked them to provide search for free. But hey Google are giving search away for free so it is fine to collect and monetarize the data of everyone on the internet.

No it is not bloody fine, no one agreed to that, I certainly didn't agree that Google can have my data in exchange for search. I don't even use Googles search so why should I pay with my data.

If Google wants to make money from the services they provide then they should charge and their users pay.

[Terry 6]

Re: Ethics and business

And that is not "the question". Google making money through advertising is one thing. Making much much more money through surreptitiously sucking up their users' private data is another very different thing.

[iron]

The author's first mistake is assuming Google was collecting this dat aby accident. His second mistake is assuming Google want to correct the problem.

Google want all your data. They want it all and they want it now.

[Ace2]

This is what they do. They’ve always done it. Why is anyone surprised?

[TimMaher]

They want it all and they want it now.

Was Freddie Mercury on their board?

[Tony W]

T&C

When Google wanted to update their messaging app on my phone (not "my messaging app" as lazy speech has it) they told me they would collect and analyse my messages. I assumed that was new, because why did they need my consent if they already had it?

I didn't update and didn't get some functionality toys that I haven't missed.

I'm not assuming that my data isn't being collected despite this, but in most cases I suspect we've been warned. This doesn't excuse it but makes it harder to control and might need new legislation.

[John D'oh!]

Re: T&C

What happens when you get a new phone?

[jollyboyspecial]

Forgiveness v. Permission

It is deeply ingrained in the Google psyche that is it better to ask for forgiveness than permission.

Now that has long been a mantra in certain businesses for certain situations. For example take a common situation in various parts of the IT industry that you need to take down some services in order to fix an issue outside of the normal planned maintenance window. You could go cap in hand to all your customers saying you need to carry out this work and that it will take longer than the normal periodic maintenance windows agreed in contracts, but there will always be at least one hold out. One customer who says they simply can't cope with an extra half hour's downtime no matter what the consequences of not doing the work. Most companies are well aware of this and don't bother asking permission. They just extend the maintenance window, blame the extended downtime on unforseen circumstances and beg forgiveness. That is the normal an acceptable application of the forgiveness/permission mantra. One off relatively small impact situations.

Unfortunately businesses have now started using the same mantra to excuse absolutely anything they fancy doing.

Using that mantra to excuse long term criminal activity (and data theft is definitely criminal) is no more acceptable than using it to excuse sacking 800 employees without notice.

As long as the authorities treat each apology as isolated and sincere then the like of Google will continue to carry on like this. Hit them with a big enough fine just once and they will think twice. Some countries allow for unlimited fine for data protection breaches others have caps based on a percentage of annual turnover others have pathetically low caps. But if somebody hit Google with a fine of even 1% of their annual turnover they certainly wouldn't do it again and it would probably go a long way to sorting out most countries budget defecit too.

[TimMaher]

Re: Forgiveness v. Permission

Unless they are P&O.

Then they don't give a shit about either.

[John D'oh!]

If you ask me, Google's developers have to take some blame here too. As professionals, they have a personal responsibility to act in an ethical manner regardless of what their employer is asking them to do, or at least they should. Far too often these days it seems developers (and people in general) do things because they can and don't stop to consider whether they should.

[Paul Smith]

That's hooey

"Google knows what every byte of that data is, and what it's used for." Now that is hooey. They collect the data because it is there and can be collected. They have no idea what most of it means or how it can be used, but they are afraid that if they don't collect it they might miss out on something that later proves to be important.

[Paul Smith]

Science

"One of the joys of academic research is that if you do it right, you can prove the truth". Sorry, but that is not how science works.

One of the joys of science is that anyone can prove something is false, but nobody can prove it is true. We can say our theory for how we think something works and we can present loads of evidence supporting that theory, but if anybody, at any time, finds a single piece of evidence that our theory can not explain, then we have to go back to the drawing board. It doesn't mean the theory is no longer useful, but it is not the "whole truth" and it might be false. Newtons laws of motion are the perfect example. His theories provide a simple and complete explanation for how things move, and they cover every possible situation - unless they move very, very fast or are very, very small, when Newtons laws give the wrong answers and you need to use the theories of relativity or quantum mechanics to explain what is happening.

[Terry 6]

Re: Science

Exactly. The "Black Swan" explanation. i.e. It doesn't matter how many white swans you see you can't prove that all swans are white. Should you see one black swan, however...

[Julian Bradfield]

Re: Science

Not all academic research is Popperian science. This was computer science, and it's well known that any subject whose name is two words one of which is "science", isn't.

More seriously, there are many scientific statements that can be proved (beyond reasonable doubt, because after all we might be in a simulation). The existence of white swans, for example. What's difficult is proving universal statements. This article is about an existential statement.

[Terry 6]

Re: Science

Very simply ( and this predates Popper) anything else is merely an assumption. Given that in all observable states, so far, A--->B A can be assumed always to --->B. Until A fails to --->B

[aerogems]

The funny thing is

Internally, Google has gone full Apple-level paranoia. They've gone to great lengths to make sure that contract manufacturer's they work with get only the bare minimum info needed to build Google's stuff, they literally have signs hanging in their buildings saying how no non-employees are allowed past a certain point -- up to and including special interview rooms -- and they even come up with spec sheets that have only the barest minimum info necessary to get their hardware through customs in different countries. Yet they continue to hoover up any and all personal info they can get on customers.

[TReko]

A bigger problem?

Is it just the default Google dialer and SMS apps?

Or is it any dialer and messaging app that calls the Google Play Services API to make calls and send messages?

[Terry 6]

Re: A bigger problem?

I wondered that. I have a third party set of messaging/contact/dialler tools. Do they keep my data from Google, or just act as a front cover. Hmmm.

[ThatOne]

Re: A bigger problem?

Front cover, most likely.

I bought a calendar app for my phone, because I was uncomfortable giving Google my timetable to process and resell. It's only when I found all my data appearing in Google's calendar that I realized that what I had bought (not a free app!) was only a front end to Google's calendar, and all my data went straight to Google...

_{(BTW, if somebody knows about a calendar app which does not use Google underneath, I'm still looking for one. No problem paying for it.)}

[Chet Mannly]

Re: A bigger problem?

Yep, most of them are just different GUIs on the Google calendar.

The Proton Mail calendar isn't though, it's a completely separate app with no links to the built-in calendar. (usual no association beyond being a satisfied user disclaimer obviously).

Signal also does a good job of replacing the SMS app.

[ThatOne]

Re: A bigger problem?

> Proton Mail calendar

Thanks, but first thing it asked me, was to create an account with their cloudy service. It's only then I realized - "Proton Mail"... Yes, well of course.

Unfortunately I want a local PIM, something I (me, myself) can manage (copy, backup, lose). I'm sick and tired of all those "subscription" services, here today, gone tomorrow (and shamelessly spying on me or just losing my data).

I'm looking for an old-fashioned PIM "program" I can buy a license for, and then use at my own discretion, locally, for as long as I want. I don't care for shiny or hip, I don't need bulletproof encryption either, I'm not handling things which would interest nation-states or the police, I just want to be left alone. :-(

[ThatOne]

Re: A bigger problem?

^{(Too late to edit)}

PS: This place is full of programmers - I one of you is looking for a business opportunity, there definitely is one: PIM (Personal Information Management) programs for Linux and phone are rare for whoever doesn't buy into either MS Outlook or the Google Kool Aid. A small, dedicated, self-contained cloudless offer should sell like hot cakes, and it doesn't sound that difficult to code, it's just a small database after all, isn't it. Something an independent worker or a small work group of 2-8 persons could use on their phones and computers, without needing clouds, servers or hoops to jump through. I know I would gladly pay up to $40-50 for a lifelong, old-school license for one computer + one phone.

[Terry 6]

Re: A bigger problem?

Proton Mail highlights an interesting aspect of the free versus paid problem. And there are many similar examples.There's a free version, which is well.. free that I use for some mail, but not all and not the calendar. Because I want my emails and calendar aggregated and across my phone/laptop/main PC. For which I use Thunderbird. The free version of Protonmail won't let free users log in via email clients. The approx 50 quid a year for the paid version provides all sorts of extras I don't need or want and couldn't even use at a cost I can't justify to the household budget. It's not a lot of cash, but it still has to fit in with the normal budget planning.Especially since most of what it would be buying wouldn't be used.

If there was a Basic+ which does nothing else other than let me use it with TB for a tenner a year they can keep al the extra pro bits- and earn an extra tenner. I won't be sending 1000 messages a day. Probably not even a year. I can live without 5gb of storage, encrypted emails to the world and using my own (non-existent) email address domain, custom labels and what-have-you.

And there's lots of free software like that. A big jump from free and very basic to expensive all-singing-all-dancing versions.

It seems reasonable to me to think that mostly satisfied free users would be much more likely to buy a small extra bit of functionality at a small cost than a big jump in both.

Some do this well. A small improvement on the free version for a small fee. And I buy it. e.g. some of the Android simplemobiletools apps do this, or the Quickfilters extension for TB. Plenty of others Useful little refinements for a small cost.- I pay, happily. If they'd had a big (relatively) expensive version full of stuff I don't need I'd not even consider them.

[ThatOne]

Re: A bigger problem?

> A big jump from free and very basic to expensive all-singing-all-dancing versions.

Sure, but then again they want you to pay for the expensive option, and definitely not settle for a cheaper one which admittedly would cover the needs of 99.9% of their customers. Setting up that cheaper option would be commercially shooting themselves in the foot...

The free-but-inadequate version is just a trial, pushing you buy the full version.

[T. F. M. Reader]

"you want to find it before it bites you and your customers"

In the case of Google, how exactly does it bite their customers? It bites their users - not the same thing at all. The customers eat up the lie that the data are actually information.

[MachDiamond]

A cost to storing data

There should be a cost to storing personal data in the form of large fines and prison if it's compromised. Fines so large that they would have the chance of putting a company out of business and its executives behind bars. The fines that get handed out when companies cop to settlement where they admit no guilt is just seen as a cost of doing business for the big guys. If a company is in the business of aggregating data, they should be required to adhere to high security standards, be audited periodically and need to maintain a large liability policy to cover lawsuits. It makes what they need to charge for their services higher, but it also means that it isn't less than a penny per name for lists of detailed information on people. It might also be a good idea for those Big Data companies to be required to know who their customers are.