Transparency report

Transcription

[MUSIC PLAYING] LOUIS GRAY: Welcome back to Google Developers Live. Louis Gray here from Mountain View Google headquarters here in California with my good friend, Brian Fitzpatrick, who's come down from Chicago for the third in a set of three shows that we're calling, "Fitz Week." Today-- you laugh. I like Fitz Week. Today we're talking about something that's actually near and dear to all of our users and everyone who wants to understand what's happening in the world of data. We're talking about the Transparency Report. So let's just start from the very beginning, Fitz, and talk about the Google Transparency Report, which anybody can find at google.com/transparencyreport. What is this all about? BRIAN FITZPATRICK: So the Transparency Report started as a way to-- you know, it's called Transparency Report, but it's almost like an accountability report. The original goal of it is to show how powerful entities are affecting the free flow of information on the internet. And it has continued to expand to cover more interesting things. And initially it was just governments, and now it's starting to show how things like a civil request like copyright takedowns are affecting the free flow of information, as well as things like malware and that kind of thing. LOUIS GRAY: And you mentioned copyright takedowns. The traffic report, I think, is the one that's the most visible in terms of possibly services being impacted. What are the specific pieces within the Transparency Report that are displayed? BRIAN FITZPATRICK: So starting with traffic, which is very, as you say, is the most visible. It's interesting, because you get these graphs. And what they are basically is graphs of traffic in near-real time, only a two minute delay of traffic from our products to various countries around the world, over 100 countries. So there's an aggregate all-products traffic which shows basically all the traffic we're seeing from any given country. And then there's-- we divide up by several of our bigger products-- YouTube, Blogger, Google Search, that sort of thing. And if you look at one of these graphs, let's say for the past couple weeks, it looks a little bit like a heart rate monitor, like an EKG. There's this sort of bump, a peak where peak traffic for the day. And then it goes down, and there's a smaller peak. And then there's a trough at night when people are-- late at night, or early in the morning when people are sleeping in that country. And so that's a normal pattern you see. We call it the heartbeat. And there are cases where internet service is interrupted, and that's when it goes flat. And we initially watched this to show when countries were cutting access to Google products. The popular thing was some countries cut off access to Blogger, because people were saying things on blogs they didn't like. Other countries were cutting access to YouTube, because they didn't like some of the things that YouTube was showing. And it wasn't until the Arab Spring happened in Egypt that a country completely cut off the internet. And suddenly, we realized that we were showing, basically, internet traffic to a country. And so we became a reporter on that. And at the time when that happened, initially we were delaying our graphs 35 hours, because it takes us about that long to verify and make sure that all of our data is correct. We actually did a lot of work, our team did a lot of work to get that down to under two minutes now. So we're sort of part of the story. So when somebody cuts their internet traffic, we show it rather quickly, in under a couple of minutes. LOUIS GRAY: And the Transparency Report shows not just government interruptions, but you mentioned like network interruptions via a cut cable somewhere, a data center that's been hit by a meteor, multiple data centers that were hit by meteors, or other things that impact the uptime of our own products. And that's also displayed there. BRIAN FITZPATRICK: Right. I mean, so the point around this is that this tends to be, when the internet's cut off, an extra-legal event. So it's done outside of typical law. It's sort of if somebody pulls the plug on the internet. Like the way Egypt worked is they literally shut down the breakers in the Ramses international telephone exchange in Cairo. But there are other-- cable cut is an example. We saw 50% decrease in traffic to Armenia, I believe it was, on a Sunday for five hours. And then it came back just like normal. And there was no unrest. There was nothing weird happening. We were completely confused until the next day. We saw that there was a woman had been stealing copper cables. And she cut through a fiber cable and looked at it and said, oh, this isn't copper, and then walked away. There's actually a picture of this woman holding a saw. It's pretty amazing. But what that means is that, despite the fact that the internet routes around failures, you've only got one or two ingress or egress points for your internet connection. That's a bad thing, basically. LOUIS GRAY: You know, you mentioned Arab Spring. You know, this is in, I think, 2011. There's a big explosion of activity in that area. And one of the weapons that the government had was to discontinue the information coming in and the communication going out. And I think it's really remarkable to think about being part of that story. Not just covering it, but actually legitimately having information being used as a weapon by a government against or for its own people. And so, as you start to take a look at that Transparency Report, it almost becomes a living history on its own. You see specific countries that have taken action-- be it China, be it Egypt, be it Syria-- and it starts to really tell a very interesting story. At what point did it become, for your team, something that evolved from just an informational perspective to recognizing it's like a living history that we can publish? BRIAN FITZPATRICK: I think it was after the Arab Spring hit that we realized-- because when we switched from a 35-hour delay to two minute delay, we were no longer reporting in the news. We were participating in the event, which is a really interesting place to be. But then, as we started to see these piling up, we thought, hey, we need a better way to show this, which led to what we call our disruption view. So you can sort of see disruptions that are ongoing, disruptions that happened last year, or the year before, et cetera. It gives you a feel for where outages are happening around the world. LOUIS GRAY: Well, we talked a little bit about the what, but I want to go back to the why. Like, why is this thing even here? There's really no legal guidance telling Google that we have to show this information. Is that right? BRIAN FITZPATRICK: No. LOUIS GRAY: So we don't have to. So why are we doing this in the first place? BRIAN FITZPATRICK: Well, it comes back to its in our business interest to show when access to our products are restricted, because if people can't get to Google products, we can't not only service people, but we don't make money. LOUIS GRAY: Are we turning the tables around a little bit, saying, hey, it's not our fault that you can't get to this. It's your government's fault. Or is this just something where we need to have people understand why they can't get something, or why we want other people to understand why a specific country can't get something. Is it kind of a comment on the world view? BRIAN FITZPATRICK: Well, It's not about really comprehension and understanding. We leave that to the press to describe what's going on and why. It's more about, hey, this is a simple, factual change that we've seen, and this is what's happening. I can't reach-- for example, Pakistan shut off YouTube last year, and it's an ongoing outage. And so-- LOUIS GRAY: You're saying Pakistan can't be watching this right now. BRIAN FITZPATRICK: Right. There's probably-- LOUIS GRAY: Maybe if they get that resolved, then in a couple years, they'll watch this and understand why it happened. BRIAN FITZPATRICK: Exactly. So there's that. And it's important, I think, for people to know what's going on. That's, I think, the core issue around transparency, is showing people what's going on. And then either research their own conclusions, draw their own conclusions, or in the case of the press, reporters writing up articles using other sources to verify what's going on and showing more information about the context of the outage. LOUIS GRAY: And I think you and I have talked about this before, the transparency, we call it a core value here at Google. It's part of who we are. And sometimes I get pushback from people don't believe that. You know, hey, you guys are just in it for the money or for the data. So why should users believe that transparency is part of what we do? Isn't it like a used car salesman saying, trust me, this is the best deal. BRIAN FITZPATRICK: Well, I'm kind of a believer in trust, but verify. I think the real issue is that it's not-- again, transparency is almost a little bit of a misnomer. It's about accountability. It's about showing this is the information that we have. Only we have all the information about access to our products. So I think it's in our benefit to show what's going on, because it makes it more obvious when something happens and this changes. LOUIS GRAY: You gave a couple of examples of products that are impacted. You started with Blogger. You mentioned YouTube as being two specific services that are impacted. Are there other services which are popular blocks? Are there things that Google sees most likely to be taken down? And why is it that those specific ones are targeted versus something like Google Search or Gmail? BRIAN FITZPATRICK: Well, I think that they're publishing platforms. I think that's why. I think that's why YouTube and Blogger are probably the biggest. In some places, photos are blocked as well. But it's platforms that people can use to publish. And if you're in a country that doesn't have a free press, or you have a press that's very much government-controlled, then you don't want this sort of free distribution platform out there. And I think it's perceived as a danger by a lot of people. LOUIS GRAY: Sure. And now, moving a little bit away from the traffic report, we do have a lot of transparency in terms of governments that are getting in the way of our services. There's also a lot of requests that come from governments on user data. BRIAN FITZPATRICK: Correct. LOUIS GRAY: Can you take me through that and help us understand what it is that we can share via the Transparency Report? Obviously, it's been very hot recently. BRIAN FITZPATRICK: Right. So there's data that we can share. So we get court orders. We get warrants for information, typically for criminal cases. Someone's done something bad. The government's looking for evidence in a case against them, and they send us a request. And there's a process that it goes through. Someone doesn't just call us up and say, hey, send us all the data on Louis Gray. And if they do that, we say come back with a warrant, basically. They come back with a warrant, and they say, send us, you know, everyone in the world who's searched for this thing. We would say, well, that's overly broad. Can you be more specific? And then they rewrite the warrant to say, we just want information on Louis Gray. Typically, it's something like subscriber information. They're going to want your name, your address, and IP addresses you've logged in from. And again, we're interested in helping with criminal cases. We want to help catch the bad guys. We just want to make sure that the requests are legal, that they're not overly broad, and that we are actually helping catch the bad guys and not just giving a bunch of data away. LOUIS GRAY: And there's a lot of requests that we actually can't talk about. I think that those have flared up in the press of late, and some things have been disclosed. To the best of our ability, what are we doing about that? BRIAN FITZPATRICK: Well, with NSL, National Security Letters, is a good one. If you look at the government request site, you'll see that we talked about-- we received so many requests from a government for information that affected this many users, and we complied with this percentage of the request, in full or part. And there's some things like the NSLs, National Security Letters, that up until May, we couldn't even acknowledged we got, because they came with a gag order. And that was a legal requirement that we couldn't acknowledge that we got these things. And we went back and forth with the government to say, hey, we think it's important to publicly state that we got these. LOUIS GRAY: And you're speaking specifically about the US government. BRIAN FITZPATRICK: US government, right, because we're a US company. So these national security letters, we finally got the ability to talk about the fact that we get them in magnitudes of 1,000. So last year, we had 1,000 of these National Security Letters. They affected, I think it was 0 to 1,000 users. So we get 0 to 1,000 letters affecting 0 to 1,000 or 1,000 or 2,000 or something like that. And so people say, we want more specifics. And again, we don't want to endanger any ongoing criminal investigations, but it would be great to have more specifics. But I think that the fact that we can admit we got these at all is a huge step forward. And I'm really happy about that. Now the thing that's come this summer is the FISA court, right? And we have filed, I believe, a suit against the FISA court to be able to disclose this information, if, in fact, we've gotten any requests from this court. We can't acknowledge if we have or if we haven't at this point. LOUIS GRAY: Right. And that's something, obviously, you kind of have to wait and see. The courts aren't the fastest things in the world by definition. I think when you talk about this, we are fighting for this with the expectation that we can deliver information for our users so they better understand that when they use our services that their data is in a safe place and that we're not going to do anything with malfeasance. BRIAN FITZPATRICK: The other thing that we're interested in is that this information shows government requests for user's data, a lot of this, in the United States at least, falls under the Electronic Communication Protection Act of 1986. Now this was a law written about technical issues back in 1986, when the world wide web didn't exist and there weren't things like web-based email, or that sort of thing. So some of this is that we want to show all the data so you can see what's going on. And then maybe the next law that affects this type of information might be a little different, might be a little more appropriate given the current state of affairs, where you're not keeping all your mail on a machine at your house. LOUIS GRAY: Sure. And I think, going back to that a little bit, that was a law that was written 25-plus years ago at this point. So Google can almost play a role in shaping the law or giving direction to knowing how much companies can share and should share, but possibly recommend how we have a new approach to user data or transparency as well. It sounds like we could possibly-- you know, lobbying goes on or do something about that. Is that right? BRIAN FITZPATRICK: Right. I mean, we've seen a lot of other companies putting this information out there, but I'd like to see the government themselves providing this information. LOUIS GRAY: Now, stepping to another tab. We've got a lot going on in the Transparency Report. BRIAN FITZPATRICK: Sure. LOUIS GRAY: One thing that often comes up is requests for removal, you know, be it individuals or legal agencies, they ask for data that's in Google Search index to be removed. Like, hey, stop showing sites from URL X. BRIAN FITZPATRICK: Right. LOUIS GRAY: Can you take us through that? I think there's really two parts, first of which is removing it from the index. And the second is someone saying, there's something on a Google service that I would like to have taken down. BRIAN FITZPATRICK: Right. It could be a blog post. It could be a YouTube video. It could be a photo. It could be a link in the search index. We get a lot of these removal requests, and there's two types of removal requests we get. The first one is like, as you said, government requests. And most of these are defamation, and then beyond that it's privacy and security issues that we were required to remove to basically conform to the law. And some of these are like, clearly, like public safety. Not public safety issues, but it might endanger something. For example, someone posts a picture and some information about a child. Like, clearly, this isn't information that should be publicly accessible. So that we have a process for requesting that that information be removed, and they have a process for taking it down. LOUIS GRAY: And in this case, when you get that kind of request, it's not Google who's making a decision whether it's defamation or not. You're basically taking an order from a court that says, do this. And we comply if it's legal and within the right scope. Is that-- BRIAN FITZPATRICK: That's correct. LOUIS GRAY: OK. So-- BRIAN FITZPATRICK: We don't want to be in the business of making these decisions. We think a court should be making these decision. LOUIS GRAY: Right. Absolutely. Now, one thing-- if I take a look at this report, if I go specifically to removal requests, the dramatic rise in the URLs expected to be removed from Search, it seems like it's up about 300% in the last year, year and a half. BRIAN FITZPATRICK: Well, you're talking about copyright requests now. So another kind of removal requests are DNC takedowns. And we publish all of our takedowns we get for web search. And we launched this product in May of 2012. And at the time we were getting about 1.5 million requests a month to remove URLs, 1.5 million URLs removed from our index every month. And as I checked this morning, I think we're up to 18 million a month. LOUIS GRAY: 18,047,340. BRIAN FITZPATRICK: Yeah, that's a lot. And we update that every day. But this is, again, to show-- so when you search for something on Google and don't find it, many people assume it doesn't exist on the internet. And our point is that it may be out there. We just have been required to remove a link to it. And we're not out to help people find potentially infringing information on the internet. But we do want to show that there's a sort of what we call a negative search space. And so this is a way of showing, here are the rights-holders sending us takedown requests. Here are the agencies representing them sending us the takedowns, in some cases. And lastly, the websites who are receiving the potentially infringing requests as well. So it's a way of showing these things because-- the reason I think it's important so this is websites, unlike someone who posts a YouTube video or writes a blog, we don't always have a way to contact these people. So we have no way of definitively letting you know, if you have a website on the internet, that we've received a takedown to pull you out of our index so that you can do a counter takedown request. LOUIS GRAY: This is something that's interesting. One of the things that I always assumed prior to working here is that Google has access to just about everything. Like, don't you have enough resources to do X or Y? But now that we're here, you take a look at something like 18 million URLs that have been requested to be removed. That's got to be an incredible processing process. How do you go ahead and do that? How do you set up that thing? But in addition to that, you take a look at this page, and we even have a list of recently submitted URLs where we did nothing. BRIAN FITZPATRICK: Right. LOUIS GRAY: And there's probably a reason for that, which you can take me through. But I assume that basically shows, here's our process. We don't accept every single one that was requested. That some get through. Some don't. BRIAN FITZPATRICK: We comply with a very large percentage. I don't know the exact number, but I would say we comply with most of them. But sometimes we get takedown requests that are invalid. Or sometimes they're mistaken. We get requests from a rights-holder to take down links to their own website in some cases. LOUIS GRAY: I've seen that. BRIAN FITZPATRICK: We get requests from individuals who have had, let's say, for example, some press on the web that they don't like. They send us takedown requests, which are invalid, because they don't own the copyright on that information. So this is just a way of showing a little bit, some of the things that are happening, because, while most of them are correct, there is always an opportunity, I think, for abuse. But there really isn't very much of it. LOUIS GRAY: So we talked about the vast number of copyright requests. We talked about governments who make specific requests to make these changes. We talked about which common Google services there are that have these interruptions. So if you have a product that actually is disrupted-- let's take a look at a specific geographic region. Does that mean absolutely nobody in that region can use it? Or is it like really slow dial-up speeds, and they might be able to get it, but it's not going to be a lot of fun? BRIAN FITZPATRICK: It means that-- it depends on what the disruption shows. Like because the graph can show a partial disruption or a full disruption. LOUIS GRAY: What's partial mean? BRIAN FITZPATRICK: Partial means that, like let's say a country has 10 ISPs, and they cut off six of them. So four ISPs in the country may still be serving traffic to their users. So it may be that a certain percentage of the country can't access their services. When it's all the way down to zero, that means that almost everyone can't. And there may be the odd person who's got a satellite connection or something, which are illegal in some places. Or they may be getting information through their cell phone. You don't know. There's always a few people that may be getting the information. It also may mean that our IP to Geo mapping is off. So there may be a corner case, somewhere that's getting something. There's no way to know for certain. LOUIS GRAY: There's one thing that you-- you actually introduced it this summer about safe browsing. I think most of us have used the internet, whether we use Chrome or Firefox or other browsers, sometimes you run into something on Google search where it says, hey, this website might be harmful to your computer. So let's talk about this. We looked at the numbers. And I'm really curious about the way that we would be able to handle 18 million URL requests. But I assume that the vast spidering and taking a look at all these URLs to find out, not only what content they have for search results, but to know that they're safe for you computer, it's got to be incredibly intensive. What do we display? How do we warn people about what's there and provide safe browsing? BRIAN FITZPATRICK: Well, first of all, we don't let them go straight to the website. So if you're in Google Search and you click on a site that has malware on it, we take you to an interstitial page that says, hey, this site may harm your computer. We don't make it easy for you to go there. But let me back up to what actually happens in a lot of these cases. Because a lot of times, these sites with harmful information aren't a scary site. It might be some new site you visit all the time. It might be someone's blog or something. What happens is that there are malware providers on the internet. They're hosting malware. They're trying to do bad things. They're trying to get control of your computer to send spam email, or do something not cool. LOUIS GRAY: Known bad actors. BRIAN FITZPATRICK: Known bad actors. Thank you. And so what they do in a lot of cases is they'll go and they will break into a website that's popular, and they will put malware on that website so that when you go to that website, your computer will download that malware. And then your computer suddenly is going to be controlled by them. LOUIS GRAY: In that case, you basically have a victim that is passing it on. They've been infected, and they want to infect you as well. BRIAN FITZPATRICK: Right. LOUIS GRAY: And they might not have done anything intentionally. But their site is definitely infected. BRIAN FITZPATRICK: And many times, they don't even know it. So that's another scary thing, is that if you're not paying attention going to your website, it might have been broken into. Malware may be hosted. You just don't know it. LOUIS GRAY: I think sometimes those people who run in the internet, you'll see a search result for a well-known blog or tech site you regularly read. And then the description of the site will be all about selling pharmaceutical drugs at low cost. BRIAN FITZPATRICK: Right. LOUIS GRAY: Which is one example of that. So first of all, let's talk about that, like-- not the pharmaceutical drugs. That's a different show. But to talk about making the web safer, first again, why is Google doing this? What is it that we're doing to accurately find out if a site is hosting malware or not? And then, what can we do to either protect the users or the site hosts themselves? BRIAN FITZPATRICK: Well, the reason we're doing this is because we do well if more people use the web. And if more people are using the web and having terrible things happen to them and their computers, fewer people are going to use the web. And so it's in our best interest to make sure that people are safe on the web using our products. If you know that you can go to Google Search and that we're going to protect you from malware wherever we can, I think that encourages you to come use us more often. If you came to Google and used Google Search to find a website and you clicked through-- even if it was a popular tech blog-- and then it gave you malware, I don't know that you'd necessarily-- you may blame Google. You may not. But still, I don't think you'd be happy. It's a bad experience for you overall, and we helped you get there. So I think it's in our best interest to do that. And we'll also try and notify webmasters through our Webmaster Tools, if you signed up with that, that your site is infected. So that's why it's a great-- if you have a website, Webmaster Tools is a great resource. It's free. It tells you a ton of information about your site, and it will keep you up to date if we find anything wrong with it. LOUIS GRAY: Now taking a look at these graphs in the Making the Web Safer category in the Transparency Report, again we see another rise in the total numbers. When you look at this, it says, "Upwards of 300 million users see browser warnings every single week." And that's significant. That's practically the entire population of the United States alone. And so I assume some of those are individuals seeing multiple warnings per week. Or is that one per? I don't know how it's done. But that's about triple where it was just 12 months ago. What do we think is causing that? Do we have any idea to understand why you have that kind of rise in malware tripping? BRIAN FITZPATRICK: I think there's an ebb and a flow to it. And we see people finding new vulnerabilities in websites that they can exploit and upload their malware. And so, we've had peaks in the past that have gone down as well. I'm not sure what the rise in that is attributable to, but what we've done in the malware report is we've divided up where the malware is hosted, in many cases by what we call autonomous network, so that you can see sort of like people who are responsible for a particular block of IP addresses on the web. So that you can see-- in some cases, if you look at the dashboard-- where some of this is hosted. And some places have more things than others. We're hoping that people will look at that as an opportunity to clean up their garden, so to speak, and keep their yard clean. LOUIS GRAY: Sure. So when we look at the Transparency Report, we've got multiple tabs here. We've got the Traffic report, Removal Requests report, User Data Requests, and Safe Browsing. BRIAN FITZPATRICK: A lot of stuff now. LOUIS GRAY: We talked a little bit about why we do it. Let's go back to the very beginning of launching this thing. How did you get that to happen? You know, I think-- interesting discussions that we've had in the last two days, talking about the Liberation Front, organization manipulation. It seems like you probably had to manipulate the organization a little bit to enable them to make this information available to our users. How did you go about championing that for Google? BRIAN FITZPATRICK: Well, the interesting thing about the Transparency Report, I didn't. The Transparency Report was started by a bunch of 20% people from the legal side-- LOUIS GRAY: What is 20%? BRIAN FITZPATRICK: The 20% is the ability to sometimes take up to 20% of your time to work on something else other than your main project that's in Google's interest. So don't go off and, like, practice your painting skills. But go off and work on another piece of software or another project that's-- LOUIS GRAY: So it's like a part-time project in addition to their full-time job? BRIAN FITZPATRICK: Yeah. It's like something you think's important or something you'd like to check out, that kind of thing. And so we had a lot of-- we had legal. We had PR. We had Policy and Engineering working on this and they initially launched the traffic in the government requests thing, and it was being maintained and run out of just a sort of ragtag band of 20% folks. And I talked to my friend, Matt, who's currently the tech lead for the Transparency Report. And when he sort of briefed me on what they were doing, I was floored that this wasn't a full-time team. And it seemed incredibly important. So I went and talked to a couple of our execs, and I said, look, this seems really important. I'd love to build a real, full-time engineering team to not only maintain this, but to improve it and continue to find more interesting data sets and interesting products that we can build to show people what's going on and how freedom of expression is being affected on the internet. And their response was, that sounds awesome. Go for it. And so then I basically-- I pulled Matt in as the tech lead, and hired a few more people, and we've got a fantastic team, just like Data Liberation. It's a small team of dedicated engineers who are really at the top of their game. And we poke around Google and see what kind of things we can't dig up and publish to not only show what's going on, but we often have a goal that we want to sort of make things a little better, right? We're publishing the traffic graphs. We hope that people realize that they're not going to get away with it. People are going to know very clearly that they're shutting out traffic. So maybe they'll think twice about it. LOUIS GRAY: Right. And I think one thing that people often talk about is the percentage of web traffic that's through Google's services. And as we start to be a significant portion of that, when you cut access to the web, we're going to see it. And since we have the Transparency Report, your users are going to see it. The press is going to see it. I think one of the adages that we've always learned from Eric Schmidt and Larry Page is, you don't fight against the web. The web always wins. I think this has been a very cool discussion, talking about the Transparency Report, and really how the web and its services are being used to push change, be it with governments that want to keep things a certain way and the status quo. But they are affecting the people on the ground who want to have that information, have that communication. BRIAN FITZPATRICK: My closing thought I'll give you is that, never before in the history of mankind has-- or humankind-- has there been a global distribution system that costs almost nothing. And that is what makes the internet so amazing. And I'm a big fan. LOUIS GRAY: I'm glad you're looking out for us, and looking out for users. So thanks again for coming in for all three parts of Fitz Week-- BRIAN FITZPATRICK: My pleasure. LOUIS GRAY: --Brian. It's been a lot of fun. For those of you watching, definitely take a look at google.com/transparencyreport. This has been Google Developers Live. I'm Louis Gray, and we'll see you back in the studio. [MUSIC PLAYING]