[Cidan]

Googler here.

We have very strict and very well engineered data retention systems. When we say data is deleted, we mean it. Various levels of automation ensure the data is purged, and all data is tracked meticulously for violations across every datastore.

It's one of those systems I wish we talked about more -- it's a marvel to behold just how much work goes into retention policies and the automation that drives it.

[anonymousab]

> When we say data is deleted, we mean it.

So that includes all online and offline + offsite backup systems, presumably? And hopefully any such data is "de-trained" from all applicable ml models and systems, of course.

[shadowgovt]

Without going into too many details, yes. The trick is that you can key sensitive data, encrypt it, and delete it by throwing away the key.

I don't know if Google can do de-training (depends on how the training data is generated), but generally if the trained data can't be tagged for removal it also can't be reversed from the output of the training.

[im3w1l]

Have you considered the possibility that someone on the inside works for an intelligence agency (domestic or foreign) and is secretly exfiltrating the data for the purpose of obtaining blackmail material?

[IncRnd]

In the PRISM disclosure of 2013, the slide deck stated that the NSA had direct access to Google's systems. The deck claimed "collection directly from the servers". That, by its very design, goes around all the safeguards people are discussing here.

[shadowgovt]

It's definitely been considered because it has definitely happened before (explore the history of Google cutting ties with China for about a decade).

... in response, Google took measures to prevent that category of insider-knowledge attack. With audited builds, zero-trust internal model (xref BeyondCorp), and infrastructure cross-checked by multiple human beings to guard against hardware-level attacks, such an insider attack is infinitesimally probable now.

[pbhjpbhj]

I'm guessing you're speaking non-authoritatively.

The cloud documentation suggests a deletion period of 180 days; so for cloud data, at least, when it says it is "deleted" it seems to mean it will be [fully] deleted within half-a-year. https://cloud.google.com/docs/security/deletion

[mjg59]

Former google employee, no knowledge of current situation, not involved in any of this stuff even when I worked there: different types of data get handled differently. If material is important enough then it's going to be backed up onto tape for disaster recovery purposes. If a user then requests it be deleted, that's a huge pain - the easiest thing to do is just wait until that tape has rotated out of backup, which may take a while.

More sensitive user data is likely to be handled differently - both for privacy reasons and because it's honestly just not as important to keep hold of it (a user's cloud data gets lost? That's a big deal. A user's location history data gets lost? Meh), so it's unlikely to end up in long-term backup storage.

[deanCommie]

Why would the Google Cloud data deletion policy for 1/ paying 2/ enterprise customers deleting their own data that they 3/ opted in to store, and then 4/ opted in to delete have anything to do with the retention policy for Google Maps' 1/ free 2/ consumer customers having data deleted by Google that the customer 3/ did not choose to store, and then 4/ did not choose to delete?

At least 4 meaningfully different qualifiers about the situation for entirely separate parts of Google.

[pbhjpbhj]

Oh for sure, can you point me to some documentation closer to the specific services in question (free maps data)?

I was only suggesting that it might be indicative of the period deleted data ordinarily takes to leave the backup cycle.

[spoonjim]

Even the CEO of Google would not have a credible claim to know exactly what is being stored and by whom and when.

[Hizonner]

I note that the announcement is VERY VERY SPECIFIC about the data being gone from the opt-in "Location History" feature (with the capitals and everything).

It does NOT say that every copy Google has is deleted. It just says that the user-visible copy is gone.

What about, say, Sensorvault? Or whatever other internal systems I don't know about?

[sitkack]

This would run afoul with data retention laws, which Google strongly adheres to. So it can't be true. It might be true for some definition of it, but not materially when it comes to records access.

[sdoering]

How is Google by law required to retain data about my searches? Or specific locations I visit?

[CyberDildonics]

What specific data retention laws are you talking about and how do they apply to what is essentially involuntary telemetry?

[xyse53]

What data retention law are you referring to that requires search history retention?

[stjohnswarts]

so if I have myactivity.google.com set to delete and not track anything is it deleted?

[turdit]

“When we say data is deleted, we mean it.”

i guess we’ll take your word for it. after all, you have no motivation to lie.

[anigbrowl]

Let me ask you about an edge case: someone carries out an arson attack against a clinic providing abortion services and inadvertently leaks clues to their identity when gloating about it on social media, which information finds its way into the hands of law enforcement.

(to downvoters, that's something that happens and I have a specific and recent case in mind)

[shadowgovt]

I think the downvotes are because your description doesn't make any sense. Can you rephrase the scenario to better describe what you mean?

Are you saying "Someone carries out an arson attack, they (the attacker) leaks clues to their (the attacker's) identity when gloating about it on social media, and those gloat-posts find their way to law enforcement?"

How does that scenario relate to Google data retention? Google data retention has nothing to do with Twitter policies.

[anigbrowl]

You understood it correctly, yes.

It relates to Google data retention because law enforcement's next move might be to ask Google for geofenced location data from the 72 hours preceding the attack in hopes of confirming the arsonist's identity.

[SV_BubbleTime]

>We have very strict and very well engineered data retention systems. When we say data is deleted, we mean it. Various levels of automation ensure the data is purged, and all data is tracked meticulously for violations across every datastore.

Ok, how would you know that is true?

How many ways can you think of would there be for your statement to be false?

If someone "higher clearance" than you decided to make you believe the above, but actually retain it somewhere in someway you weren't allowed to see. Are the number of ways more than one? How valuable could deleted data be in the case of blackmail or espionage? Can you actually be confident that someone above or before you didn't write a false delete function?

I'm not implying, I'm suggesting that "things we know to be true" is a smaller list than people think.

You suspect WIPEOUT is real, but can't actually know, and you are inside. Why would I believe for even a second?

[davidgay]

Some of us actually work or worked on wipeout systems. And said systems are run by the team running the service that deals with the data.

Also all the source code (for all systems) is visible to all googlers.

This kind of conspiracy theory is really boring.

[belter]

Maybe the conspiracy theories are because some have a very long memory:

"NSA taps into Google, Yahoo clouds, can collect data 'at will,' says Post"

https://www.cnet.com/tech/tech-industry/nsa-taps-into-google...

"National Security Letters"

https://www.eff.org/issues/national-security-letters

There is a reason behind the usual in court phrase of "..tell the truth, the whole truth, and nothing but the truth...". So, if a third party would get copies of the data, it would be true Google deleted it...It just not be "the whole truth".

[leajkinUnk]

> How many ways can you think of would there be for your statement to be false?

Not as many as you might think.

The systems at Google may seem incredibly complicated--and they are--but when I worked there, the scenarios where somebody intercepts and exfiltrates data without your knowledge are extreme.

> If someone "higher clearance" than you decided to make you believe the above, but actually retain it somewhere in someway you weren't allowed to see.

The way this data is stored, it is designed so that access to the data is logged and the logs have various alerts / auditing procedures to catch exfiltration attempts. SREs will periodically create user data and try out clever ways of destroying or exfiltrating it to test that these controls work. The Snowden leaks also cast a long shadow over work at Google, and since then, basically, all the traffic and data in storage has been encrypted in ways that make it difficult for state level actors to surreptitiously intercept it. These systems are a bit nightmarish to design, because there are competing legal/compliance reasons why data must be retained or must be purged. For example, certain data must be retained for SOX compliance, data may be flagged as part of an ongoing investigation, data may be selected for deletion for GDPR compliance, etc.

Obviously, it is POSSIBLE that someone is still exfiltrating data, but you have hundreds or thousands of smart engineers who are trying to prevent "insider risk" and "state level actors". People within the company are a big part of the threat model, and agencies like the CIA, Mossad, KGB, etc. are also part of the threat model.

The stack may be complicated, but it's also designed with defense-in-depth to prevent people at lower levels in the stack from subverting controls at higher levels in the stack. For example, people who work on storage systems may be completely unable to decrypt the data that their storage systems contain.

If you're going to get pissy about it, it's obviously true that we are not 100% certain that data is destroyed when we say it is. But this invokes a standard for "knowing" that precludes knowing the truth of any statement which is not an analytic statement.

You don't have to believe, even for a second, if you didn't work with the wipeout systems. That's fine. I'm not trying to convince that wipeout works as intended, because I know that I can't provide the evidence to you.

However, you seem to be arguing that other people don't know that the wipeout systems work--that it's somehow impossible to know.

[SV_BubbleTime]

This is just Pascal's Wager.

I can't know, lots of people have opinions, so I should just side with the one (avoid Google) that gives me the highest likelyhood of happiness.

[leajkinUnk]

You don't know, that's fine. You were saying that specific other people don't know either, which is weird.