Google for years has said that it takes privacy very seriously, but the company's recent $22.5 million settlement with the Federal Trade Commission for breaking privacy promises and its commitment last year to endure 20 years of FTC privacy audits following "deceptive privacy practices" is pushing the company to take privacy with new, improved seriousness.
After confessing to being "mortified" in 2010 over revelations that its Street View cars had been vacuuming data cast blithely into the air by people running open WiFi access points, Google appointed Alma Whitten to be its director of privacy, added an information security awareness program for employees, and began requiring engineering product managers to keep a privacy design document for every project.
Now, Google is formalizing internal processes to test product privacy with the formation of a "red team," a group that attempts to challenge an organization's defenses in order to make those defenses more effective. In the security world, this often takes the form of penetration testing. Financial institutions, for example, often hire hackers to try to break into their systems and then implement improvements as needed.
"As a Data Privacy Engineer at Google you will help ensure that our products are designed to the highest standards and are operated in a manner that protects the privacy of our users," the job posting says. "Specifically, you will work as member of our Privacy Red Team to independently identify, research, and help resolve potential privacy risks across all of our products, services, and business processes in place today."
Google declined to comment beyond this statement: "We are always on the lookout for talented people in a variety of roles," a company spokeswoman said in an email.
In 2006, as it was developing and deploying its Web productivity apps, Google made its concern about security more visible with support for organizations like StopBadware.org. Google subsequently launched a security blog in May, 2007. The security process for Web apps at the time just wasn't as formalized as what Microsoft was doing for desktop app security.
The existence of a "red team" inside Google is likely to be seen as a sign that the company is taking privacy seriously. But increasingly, what's going on outside Google is shaping the privacy debate.
Privacy has become a point of competitive differentiation. Google's chief rivals, Apple and Microsoft, have realized that Google can only take privacy so far before it starves itself of the personal data it needs to maximize revenue from the ads it serves. And Mozilla, caught off-guard by Google's introduction of Chrome in 2008, has had to reinvent itself, even as it continues to collect millions from Google every year for making Google the default search engine in Firefox.
So it is that all the major browser vendors except Google--Apple, Microsoft, Mozilla, and Opera--have implemented support for Do Not Track, a technical mechanism by which browser users can communicate the desire not to be tracked for targeted advertising.
Google emphasizes the significance of this last position because whoever fills it will influence the company's advertising business practices. "For many users, advertising is where the rubber hits the road, because misuse of user information for advertising purposes creates a strongly negative user experience," the job posting says.