Google risks user trust with silence over data leak

People have become accustomed to the fact that the Internet is an insecure place, but for days now one alarm has followed the next. Facebook discovered that unknown attackers had full access to nearly 50 million profiles. Apple and Amazon had to deny a report about Chinese spy chips they allegedly found in their servers. The West accused Russia's military intelligence of being behind major hacking attacks. And now Google, where the sleepy online network Google Plus had profile data open to app developers for years.

Now, Google Plus has been nothing more than a footnote in Internet history for years, a quickly failed attempt to compete on equal footing with Facebook on the "social web". But it's likely that millions of profiles have been accumulated since its launch in 2011. And if users have shared their basic profile data, such as name, email address or age, with friends, app developers have also had uncontrolled access to it since 2015. As recently as this spring, Google found around 500,000 potentially affected profiles. Data on the past simply does not exist.

Identification not possible

The Internet company discovered and closed the data leak back in March - and then made a potentially momentous decision to keep the matter to itself. Google points out that it was not possible to identify the affected users, there were no indications of misuse, and consumers and app developers could not have done anything either.

But last March was also the worst possible time to discover a data leak: the Facebook scandal surrounding Cambridge Analytica had just started rolling. And the Wall Street Journal got its hands on an internal analysis by Google's legal and political experts that alludes to this. Making the incident public would have the effect of "putting us in the spotlight together with or even instead of Facebook, even though we have so far remained under the radar in the Cambridge Analytica scandal," they say. This would also virtually guarantee that Google CEO Sundar Pichai would have to testify before Congress, the experts warn.

The analysis was not a factor in the decision not to make the data leak public, an anonymous person involved assured the Wall Street Journal. But it reflected the differences of opinion on how to handle the case. Incidentally, Pichai was also subpoenaed in this way in Congress - together with Facebook CEO Sheryl Sandberg and Twitter CEO Jack Dorsey. But he surprisingly stayed away from the hearing on propaganda campaigns from Russia in the US election campaign a few weeks ago. Was it because he could have been guilty of perjury if the Google Plus data leak had gone unmentioned?

Project Zero

In recent years, Google in particular has distinguished itself as a clean player when it comes to cybersecurity with a zero-tolerance policy for vulnerabilities. "Project Zero," an in-house team of security researchers, also scours other people's software looking for loopholes - and then gives them 90 days to plug them before making the information public.

The approach is controversial - but "Project Zero" revealed serious vulnerabilities such as the "Heartbleed" gap in the widely used OpenSSL encryption. Google had thus built up trust as a reliable guardian of cybersecurity - which is now being scratched by the concealed data leak. And user trust is the basis for the success of Google's future projects such as the digital assistant, which is supposed to accompany people through everyday life. (SDA)