U.S. Sens. Jerry Moran (R-KS) and Roger Wicker (R-MS) last week requested that the CEO of Google Inc. explain the corporate actions taken to address an in-house vulnerability that presumably exposed the private profile information of some half a million users.
In March 2017, Google discovered a weakness in its Google+ social network platform that “potentially left the private profile information of nearly 500,000 users exposed to app developers since 2015,” the lawmakers wrote in an Oct. 11 letter sent to Google CEO Sundar Pichai in which they cited an Oct. 8 Wall Street Journal article.
“At the same time that Facebook was learning the important lesson that tech firms must be forthright with the public about privacy issues, Google apparently elected to withhold information about a relevant vulnerability for fear of public scrutiny,” wrote Sen. Moran, chairman of the U.S. Senate Commerce, Science, and Transportation Subcommittee on Consumer Protection, Product Safety, Insurance, and Data Security, and Sen. Wicker, chairman of the Subcommittee on Communications, Technology, Innovation, and the Internet.
“We are especially disappointed given that Google’s chief privacy officer testified before the Senate Commerce Committee on the issue of privacy on September 26, 2018 – just two weeks ago – and did not take the opportunity to provide information regarding this very relevant issue to the Committee,” the senators wrote.
U.S. Sen. John Thune (R-SD), chairman of the Senate Commerce, Science, and Transportation Committee, also signed the letter, in which the lawmakers requested a copy of an internal memo and answers to several questions regarding the supposed vulnerability.
The internal memo cited in the Wall Street Journal article reportedly said that “a factor in Google’s decision not to disclose the vulnerability was fear that doing so would draw ‘immediate regulatory interest’ and ‘almost [guarantee] Sundar will testify before Congress,’” according to the senators’ letter.
“As the Senate Commerce Committee works toward legislation that establishes a nationwide privacy framework to protect consumer data, improving transparency will be an essential pillar of the effort to restore Americans’ faith in the services they use,” the senators wrote. “It is for this reason that the reported contents of Google’s internal memo are so troubling.”
In their letter, Sens. Moran, Wicker and Thune want answers to several questions, including details about how and when Google became aware of the vulnerability and what actions the company took to remedy the situation.
Additionally, the lawmakers want to know if Google will promptly commit to informing the Commerce Committee, law enforcement, regulatory agencies, and affected users about any future breaches, and why the company didn’t disclose the vulnerability to the committee “or to the public, until many months after it was discovered,” they wrote.
And the senators want to know if similar incidents haven’t been publicly disclosed, among other questions.
The lawmakers requested that Google provide the memo and answers to their questions by Oct. 30.