Google is undoubtedly not having a good time these days. The company first had to face the fact that the AI built into their search engine, AI Overviews, was starting to talk nonsense, and soon after they were left with a headache because thousands of pages of internal documentation that gave insight into the operation of their search engine were leaking to them. The flood of bad luck is not over yet, A 404 media because
On Monday, it reported a newly released internal database containing six years of potential privacy and security incidents and providing insight into how one of today's most influential companies handled them.
The database was sent to the newspaper by an anonymous informant, and the data in it was also confirmed by Google. The company told 404 Media that all of its employees have the opportunity to report potential issues with their products, which can then be resolved by the relevant teams. In the database just published, there are such mentions before 2018, and according to its claim, they were all resolved at that time.
This paper didn't argue this either, writing that people working at Google could report all sorts of problems on the intranet. Nothing is off limits here, you can report things related to company products and data collection practices, employee mistakes and external services they use, from emails containing personal information to serious data leaks. Employees can also indicate how serious they think the matter is. The database contains data from 2013 to 2018, with a total of thousands of reports.
According to 404 Media, most of the individual incidents involved a small number of people and/or were resolved quickly, but since the data hasn't been published yet, it's still interesting to see how Google handles the vast amount of often sensitive personal data it needs. To manage. And of course, there are interesting things in the database that are worth mentioning in themselves and show that even a small error can have a huge impact on a company.
In 2016, for example, a flaw was discovered that caused Google's Street View systems, which are primarily used to write text that appears on streets, to record and store the content of license plates, so the company had a database for that against it, complete with location data. Geographic. It has not been revealed how this happened, although license plates are treated as an exception in the system, but the data was deleted based on the documents.
In another case, more than 1 million users of the student app Socratic, which Google acquired in 2018, had their email addresses publicly displayed. Socratic.org In its source code, their location and IP address may have been hacked. This issue was resolved when the acquisition was completed in 2019, but the data remained publicly available for more than a year. It also happened that they accidentally recorded the speech of nearly a thousand children for an hour, on one occasion
They mistakenly reclassified the client to their traditional cloud service instead of the version provided to government agencies that handle sensitive data, so they could no longer guarantee that the data would not leave the US.
Additionally, without claiming completeness, Waze's carpooling function reportedly leaked users' trips and addresses, and YouTube also made recommendations based on deleted viewing history — although this is expressly prohibited by its policy — and for a period of time on an allegedly private or unlisted YouTube videos can also appear publicly. 404 Media asked about 30 specific cases, and Google said all of them had been resolved by then, but data protection incidents involving millions of people still seemed to occur regularly at the company.
