Google shutting down Google+ after exposing data of up to 500000 users

By the end of next August, Google+ will be a goner.
Stephen Shankland/CNET

A vulnerability in the Google+ social network exposed the personal data of up to 500,000 people using the site between 2015 and March 2018, the search giant acknowledged Monday.

Google said it found no evidence of data misuse. Still, as part of the response to the incident, Google plans to shut down the social network permanently.

The company didn't disclose the vulnerability when it fixed the problem in March because it didn't want to invite regulatory scrutiny from lawmakers, according to a report Monday by The Wall Street Journal. Google CEO Sundar Pichai was briefed on the decision to not disclose the finding, after an internal committee had already decided the plan, the Journal said.

Google said it found the bug as part of an internal review called Project Strobe, an audit started earlier this year that examines access to user data from Google accounts by third-party software developers. The bug gave apps access to information on a person's Google+ profile that can be marked as private. That includes details like email addresses, gender, age, images, relationship statuses, places lived and occupations. Up to 438 applications on Google+ had access to this API, though Google said it has no evidence any developers were aware of the vulnerability.

"The review did highlight the significant challenges in creating and maintaining a successful Google+ that meets consumers' expectations," Ben Smith, vice president of engineering, said Monday in a blog post. "Given these challenges and the very low usage of the consumer version of Google+, we decided to sunset the consumer version of Google+."

Now playing: Watch this: Google bug exposed data of 500,000 Google+ users

1:35

The news comes as Silicon Valley companies have been increasingly scrutinized for their data collection practices. Facebook brought the issue to the forefront in March after its Cambridge Analytica scandal, in which a UK-based digital consultancy harvested data on 87 million Facebook users without their permission.

Google has already drawn controversy over its data collection practices. In July, the company was criticized after reports that employees for third-party email apps could read your email if you integrated those apps with your Gmail account. Google was hammered again a month later, when the Associated Press revealed the company was tracking users' locations even after they'd turned off their phones' location history setting.

Last month, Google Chief Privacy Officer Keith Enright -- alongside representatives from other tech and telecom giants including Apple, Amazon and AT&T -- testified before the Senate on privacy practices in Silicon Valley. Google CEO Sundar Pichai reportedly is expected to take the hot seat in another congressional hearing after the US midterm elections in November.

Google+ launched with much fanfare in 2011, positioned as the search giant's answer to Facebook. But the social network never gained traction among consumers. Google eventually peeled away some of the services' most popular features, including Hangout chats and its photo capabilities, and put them into standalone apps. On Monday, Google said 90 percent of Google+ sessions today last less than five seconds.

The search giant said it'll shut down Google+ by the end of August 2019 to give people a chance to migrate their information and get used to the transition. After Google announced the social network's shutdown, even people who helped launch the product said the time had come to end it.

"As a tech lead and an original founding member of Google+, my only thought on Google sunsetting it is... FINALLY," tweeted David Byttow, a former Google engineer.

As a tech lead and an original founding member of Google+, my only thought on Google sunsetting it is... FINALLY.
— David Byttow (@davidbyttow) October 8, 2018

Specifically, the issue disclosed Monday came through one of the Google+ "People" APIs, a developer tool available to third-party app developers. Still, outside app makers weren't supposed to have access to private profile information. The API was designed to only keep logs for two-week periods. Even in that short amount of time, Google's audit found that nearly half a million Google+ accounts could have been affected in just 14 days' worth of analysis.

The company said it often notifies users when there are security issues and flaws and user data is affected, but its privacy and data protection office said the bug didn't meet the threshold. The office looks at what data was taken, if affected users need to be informed, if there was any evidence of data abuse, and whether users could effectively respond.

Ireland's data protection regulation group said Tuesday that it will seek more information from Google about the security vulnerability, according to Reuters.

"The Data Protection Commission was not aware of this issue and we now need to better understand the details of the breach, including the nature, impact and risk to individuals and we will be seeking information on these issues from Google," the commission said.

Google doesn't have a lead supervisory authority for the breach because it occurred before the European Union's General Data Protection Regulation (GDPR) privacy law went into effect in May, Reuters noted.

First published Oct. 8 at 10:12 a.m. PT.
Update, Oct. 9 at 7:10 a.m. PT: Adds Irish data protection regulator's statement and GDPR detail.

The Smartest Stuff: Innovators are thinking up new ways to make you, and the things around you, smarter.

Special Reports: CNET's in-depth features in one place.

Let's block ads! (Why?)