News & Comment: Google Exposed User Data, Feared Repercussions of Disclosing to Public

Following news this morning from The Wall Street Journal that Google opted not to disclose to users its discovery of a bug that gave outside developers access to private data, privacy advocate Paul Bischoff with Comparitech, commented:

“In my view, Google is basically pleading ignorance in order to shield itself from legal ramifications. It has conveniently left out some crucial figures in its response that would give us a more clear picture of the scope of this incident. For example, Google says 438 applications had unauthorized access to Google+ profile data, but it doesn’t say how many of its users used those apps. And while Google says it performed a cursory investigation and found nothing suspicious, it also notes that it didn’t actually contact or audit any of the developers of those apps.

As popular and high-profile as Google is, and due to the fact that this vulnerability existed for the better part of three years, it would be reasonable to assume the number of occurrences in which Google+ data was obtained and misused is non-zero.

Although there’s no federal breach notification law in the US, every state now has its own breach notification law. However, these laws only apply when it’s clear that data was obtained by an unauthorized third party. By turning a blind eye as to whether this occurred and only acknowledging that a vulnerability existed, Google can plead ignorance.”