Google said it will 'wind-down' the social network over the next 10 months

Google is pulling the plug on its flagship social network Google+ after data from up to 500,000 users was left exposed by a bug.

The tech giant said it would shut down the consumer version of the platform after it revealed users' data may have been exposed by a bug that was present for more than two years.

In a blog post, the company revealed it discovered the leak and patched it in March. It said it had no evidence that the data was misused or that any developer was aware of it or had exploited the leak.

A Google spokesperson said there were "significant challenges in creating and maintaining a successful Google+ that meets consumers' expectations".

They said the firm would now "sunset" the app, which failed to truly challenge market leader Facebook, citing "very low usage".

Advertisement

Google said it would "wind-down" the consumer version of the website over the next 10 months, with 90% of users accessing the site for less than five seconds.

However, it is planning to keep the platform alive for "enterprise users" in the workplace.

"Our review showed that Google+ is better suited as an enterprise product where co-workers can engage in internal discussions on a secure corporate social network," Google said.

"Enterprise customers can set common access rules, and use central controls, for their entire organisation. We've decided to focus on our enterprise efforts and will be launching new features purpose-built for businesses. We will share more information in the coming days."

Following the announcement, shares in Google's parent company Alphabet Inc were down 1.5% in response to the privacy issues.

According to The Wall Street Journal, Google had decided not to disclose the issue with its application programming interfaces (API) due to fears of increased regulatory scrutiny.

But the company said it reviewed the issue and looked at the type of data involved, if it could correctly identify the users affected to inform them, if there was any evidence of misuse, and if there was any action a user or developer could take.

"None of these thresholds were met in this instance," the firm said in its blog post. "We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any profile data was misused."

Companies have to inform a supervisory authority within 72 hours of a personal data breach under the EU's general data protection regulation (GDPR) - unless the breach is not likely to risk the rights and freedom of affected users.</s>The Google+ social network that Google introduced back in 2011 suffered a major data breach that Google opted not to disclose to the public, reports The Wall Street Journal A Google+ software glitch provided outside developers with the ability to access private Google+ profile data from 2015 to March 2018. In the spring of this year, internal investigators discovered the issue and fixed it.The problem was caused by a bug in a Google+ API designed to let app developers access profile and contact information about the people who signed up to use their apps. Google found that Google+ was also allowing developers to access the data of users who had their profiles set to private. Up to 438 apps had access to customer data.In an internal memo, Google's legal staff recommended against disclosing the bug because it would invite "immediate regulatory interest" and result in a comparison to Facebook's Cambridge Analytica scandal.Data from hundreds of thousands of users was potentially accessible, but Google did not discover misuse of the data by outside developers. Exposed data included names, email addresses, birth dates, gender, profile photos, places lived, occupation, and relationship status.Phone numbers, email messages, timeline posts, and direct messages were not accessible.As a result of the breach, Google today announced that it is shutting down Google+ for consumers and introducing new privacy measures. According to Google, it put together a privacy task force called Project Strobe at the beginning of the year to review the company's APIs.Buried in a long document describing all of the privacy changes being implemented, Google confirms that a Google+ bug made private Google+ content accessible to developers.Google explains that it did not opt to disclose information on the breach back in March because there was no evidence of misuse and no action a developer or user could take in response.Google is planning to shut down Google+ over a 10-month period, with the social network set to be sunset next August.In addition to shutting down Google+, Google is introducing several other privacy improvements. More granular controls will be provided for granting Google Account data to third-party apps, and Google is going to limit the number of apps that have access to consumer Gmail data.For Android users, Google will limit the apps able to access Call Log and SMS permissions on Android devices, and contact interaction data will no longer be available through the Android Contacts API.Google's full list of privacy changes can be found in its new Project Strobe blog post</s>Google CEO Sundar Pichai delivers the keynote address at the Google I/O 2018 Conference at Shoreline Amphitheater on May 8, 2018 in Mountain View, Calif.

Google is shutting down Google+ for consumers following a disclosure on Monday that the private data of hundreds of thousands of users on its disappointing social network were potentially exposed because of a bug the Alphabet-owned company kept quiet.

The glitch gave outside developers possible access to private profile data of Google+ users, though Google says that it found no evidence that any developers were even aware of the bug or that any profile data were misused.

The Wall Street Journal was the first to report the news.

According to Google, the bug was patched this past March and that profiles of up to 500,000 Google+ users were potentially affected. Google says that the data was limited to optional profile fields that included a person’s name, email address, occupation, gender and age. The company added that the breach did not impact any other data you may have posted or connected to Google+ or any other service, like Google+ posts, messages, Google account data, phone numbers or G Suite content.

More: First look: Facebook unveils Portal video calling devices for the home with Alexa

More: Amazon, AT&T, Google push Congress to pass online privacy bill to preempt stronger California law

More: Google promises more user control after Chrome browser privacy backlash

Google+ never came close to challenging rival Facebook for social network supremacy, with Google all but acknowledging that fact in the blog post announcing the service’s impending demise. Google vice president of engineering Ben Smith blogged that, “the consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds.” It will be shut down over the next 10 months.

In the blog, Smith wrote that Google discovered the bug as part of an effort it began earlier in the year called Project Strobe – "a root-and-branch review of third-party developer access to Google account and Android device data.”

The project examined privacy controls as well as “areas where developers may have been granted overly broad access, and other areas in which our policies should be tightened.”

Besides shuttering Google+, the company said it was launching more granular Google Account permissions for consumers. “When an app prompts you for access to your Google account data, we always require that you see what data it has asked for, and you must grant it explicit permission,” the blog stated. For example, if a developer seeks access to both your Google Calendar entries and Google Drive documents, you will be able to choose to share one but not the other, Google says.

Among other privacy measures being implemented, Google is going to limit which Android apps are allowed to ask for permission to access text and call log data on your phone, with only an app that you’ve selected as your default app for making calls or text messages able to make such requests.

Like Facebook, Google has faced a series of privacy hiccups. Most recently, Google it was forced to update to its popular Chrome web browser after a backlash over recent changes to the way you log into the browser. Under that change, when you signed into any Google website, such as Gmail, you would be automatically signed into Chrome with the same account, even if that was not your intention.

Google also acknowledged recently that it allows apps from third parties to scan and share data from accounts, according to a letter sent to federal lawmakers.</s>Following a report Monday alleging that Google kept secret a data breach potentially impacting hundreds of thousands of Google+ users, the company is offering only a meager defense of why it kept silent for so long.



The Wall Street Journal reports that Google opted not to publicly disclose the exposure—both out of concern of how Congress might react and because of what harm it might’ve caused to Google’s own reputation. The Journal’s article, which cited multiple sources briefed about the incident as well as a leaked c-suite memo prepared by Google’s lawyers, preceded an announcement that Google+ would be shuttered for good 10 months from now.

Google itself disclosed Monday that a “bug” had left users of the failed social network exposed. But the company was apparently unable to say whether or not the leaked data had been misused at any point—only that it found “no evidence” misuse occurred. It’s also unclear whether Google’s decision to announce the Google+ shutdown was prompted by the Journal article. The company declined to respond to questions beyond providing Gizmodo a brief statement.

Up to 438 different applications may have had access to the personal data, which included users’ full names, email addresses, birth dates, gender, profile pics, where they lived, and occupations, among various other details. The bug is said to have been active since 2015. It remains unclear precisely how many users, if any, were affected.

Google said in an email that its privacy staff ultimately failed to meet “thresholds” necessary for public disclosure. For example, it was unable to “accurately identify” which users should be notified. (Google did not respond when asked to clarify why this was the case.) Google was also unable to ascertain whether the data had been misused at any point.

Furthermore, the company said, it wasn’t clear what actions, if any, might be taken by developers mistakenly given access to the data.

“Our Privacy & Data Protection Office reviewed this issue, looking at the type of data involved, whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response,” the company said, adding: “None of these thresholds were met in this instance.”

Google added that it goes beyond legal requirements when it believes user data may be affected by a security incident.

The memo reviewed by the Journal reportedly focused on the ramifications Google would like face if the incident were to go public at a time when Facebook was being scrutinized by a hostile Congress over the Cambridge Analytica scandal. It further noted that Google CEO Sundar Pichai would likely be forced to testify on Capitol Hill if knowledge of the exposure was public.

Citing someone familiar with Google’s thinking, the Journal reported that the legal memo “wasn’t a factor in the decision” not to go public, but instead “reflected internal disagreements over how to handle the matter.”

Sundar was widely criticized in September for declining an invitation to testify before the Senate Intelligence Committee. The CEO has agreed to appear before a House committee later this year to answer questions on a broad range of matters, including the largely unfounded allegations that Google “censors” conservative voices.

During a Senate Commerce Committee hearing late last month, Google’s chief privacy officer, Keith Enright, acknowledged that the company had “made mistakes in the past, from which we have learned, and improved our robust privacy program.” The committee’s chair, Sen. John Thune, did not immediately respond to a request for comment.

We’ll update if Google responds to our inquiries.</s>Apparently Google+ users weren’t the only ones not paying attention to the social network. According to a report in the , Google discovered a “software glitch” earlier this year that allowed third-party developers access to some 500,000 private profile data since 2015, including “full names, email addresses, birth dates, gender, profile photos, places lived, occupation and relationship status.”

That’s a lot of exposed data. And to make matters worse, Google found out about it in the spring and decided not to tell anyone, reports the . The paper says the search giant said in a memo that it kept the breach private to avoid public and regulatory scrutiny. Google told the that it considered “whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response, (and) none of these thresholds were met here.”

But Google is doing something about it today. In a blog post about its Project Strobe initiative, which is a “root-and-branch review of third-party developer access to Google account and Android device data,” Google announced that it will be shutting down Google+ for consumers between now and August due to “significant challenges” to maintaining a social network. The enterprise edition used by G Suite clients will not be affected by the change.

In the post, Google admits that Google+ “has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps.” Of note, it says that 90 percent of Google+ user sessions are less than five seconds.

But the shutdown isn’t just the result of low daily active users. It’s also due to the fact that Google had allowed developers access to both public and private profile fields. While Google found no evidence that developers misused this unintentional access and patched the bug in March, opting to keep this data secret isn’t cool, no matter how unpopular Google+ is.

In addition to shutting down the service, Google is also implementing several additional security features for its services, including:
• Limiting the types of apps that are permitted to access Gmail;
• Limiting apps’ ability to receive Call Log and SMS permissions on Android devices; and
• No longer making contact interaction data available via the Android Contacts API.

That’s all well and good, but Google will still have lots of questions to answer, some of which may be addressed on the stage tomorrow during its Made By Google event where the Pixel 3 is expected to debut.

Why this matters: Wait, Google+ is still a thing? All jokes aside, Google+ still has millions of users, and any breach that affects private information is a major one. And it raises the question: If Google hid this breach from the public, how do we know there aren’t others? Google’s business model is based on trust, and hiding a potentially dangerous breach for six months is not the way to keep it.</s>Google announced Monday that it will sunset the consumer version of Google+ by the end of August 2019 after a vulnerability in the social network exposed the personal data of up to 500,000 users between 2015 and March 2018.

A review of Google+ as part of the company's Project Strobe "crystallized what we've known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps," Ben Smith, Google fellow and vice president of Engineering wrote in a blog post. "The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds."

The review found no misuse of the data and the problem was fixed in March, but the company's privacy and data protection office said the vulnerability didn't meet the threshold of security issues to notify users of the data breach. According to a report published Monday by The Wall Street Journal, the vulnerability wasn't disclosed because Google didn't want to be subjected to regulatory scrutiny from lawmakers.

You may have deleted your Google+ profile a long time ago, but if you never did and it's been sitting in hibernation, here's what to do:

To save any of the data you shared on your Google+ account, including photos, visit Google Takeout's Download Your Data page, select Google+ (and any other Google products where you'd like an archive of your data). Choose Next and then select how you'd like your archive delivered. You can be sent a download link via email, the archive can be placed in your Google Drive or it can be uploaded to Dropbox or Microsoft OneDrive, with the links emailed to you.

Sign in to your account at http://plus.google.com/downgrade and follow the instructions to delete your Google+ profile. If you don't see the downgrade page and instead see an upgrade page, you have already deleted your Google+ profile (or didn't have one).

If you have the Google+ Android app, disable or delete it

Google reveals on a support page that the Google+ app can't be deleted on some Android devices, but they can be disabled on all Android devices. Either way, you'll want to open your Android device's Settings app, choose Apps & notifications, select Google+ and then tap Uninstall (or Disable).

How do I restore my deleted Google+ profile?

Read more: Google shutting down Google+ after exposing data of up to 500,000 users.

Pixel 3, Google Home Hub and Pixel Slate: Everything Google just announced.</s>Google has responded to a bug in its Google+ service by ending the service and adding several privacy changes.

However, one report said that when the tech giant first realized in March that account information of 500,000 users was potentially compromised, it wanted to keep mum for fear of government action.

Google put a brave face on the developments Monday when it announced the issue in a blog post.

Private information such as a user’s name, email address, occupation, gender and age could have been vulnerable, Google admitted.

“We ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API,” the post said, adding that Google found no evidence any private information was misused.

The blog post implied this was just part of the routine battle for privacy that is part of the online world.

“Every year, we send millions of notifications to users about privacy and security bugs and issues,” the blog post said. “Whenever user data may have been affected, we go beyond our legal requirements and apply several criteria focused on our users in determining whether to provide notice.”

But while Google was patting itself on the back, The Wall Street Journal reported that the company wanted to keep the breach quiet to avoid the incident leading to government action in response.

The breach was discovered in March, and spanned three years. The Journal reported that its reporters were shown a memo from Google’s legal and policy staff warning against disclosing what had happened because it would trigger “immediate regulatory interest.”

Revealing the incident would likely result “in us coming into the spotlight alongside or even instead of Facebook despite having stayed under the radar throughout the Cambridge Analytica scandal,” the memo said.

Disclosure “almost guarantees Sundar will testify before Congress,” referring to Google CEO Sundar Pichai.

The Journal reported that a Google spokesperson explained the decision not to disclose the breach initially.

Google considered “whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response,” the spokesperson said. “None of these thresholds were met here.”

However, The Washington Post reported that based on the type of personal information that was available, “Some of that qualifies as legally protected personally identifiable information, and its exposure could trigger scrutiny from federal and state regulators.”

RELATED: Facebook Wants People To Invite Its Cameras Into Their Homes

The lack of disclosure could still be trouble for Google, said Al Saikali, a lawyer with Shook, Hardy & Bacon LLP, who said class action lawsuits could be possible.

“The story here that the plaintiffs will tell is that Google knew something here and hid it. That by itself is enough to make the lawyers salivate,” he said.

Google said that its Google+ social service failed to attract consumers, noting that 90 percent of Google+ user sessions last fewer than 5 seconds. Google+ will fade away after 10 months, the company said.

We are committed to truth and accuracy in all of our journalism. Read our editorial standards.</s>David Greene talks to Douglas MacMillan of The Wall Street Journal about how Google exposed the private data of hundreds of thousands of Google+ users and then opted not to disclose the issue.</s>Google said Monday it is shutting down the long-ailing social network Google+ for consumer use amid new scrutiny of the company for reportedly failing to publicly disclose a security bug affecting users of the service.

In a blog post, the company admitted Google+ had failed to achieve “broad consumer or developer adoption” since it launched as a would-be Facebook rival in 2011. However, the announcement came moments after The Wall Street Journal reported Google had opted not to disclose a bug affecting hundreds of thousands of Google+ users at least in part to avoid additional regulatory scrutiny.

Google said in the blog post that it “discovered and immediately patched” a bug in March 2018. It said the bug could have affected up to 500,000 Google+ accounts, but the company found “no evidence” that any data was actually misused.

“Every year, we send millions of notifications to users about privacy and security bugs and issues,” a spokesperson for Google said in a statement provided to CNN Business. “Whenever user data may have been affected, we go beyond our legal requirements and apply several criteria focused on our users in determining whether to provide notice.</s>GOOGLE is shutting down the consumer version of its online social network after fixing a bug that exposed private data in as many as 500,000 accounts.

The US internet giant said it will "sunset" the Google+ social network for consumers that failed to gain meaningful traction after being launched in 2011 as a challenge to Facebook.

A Google spokesperson cited "significant challenges in creating and maintaining a successful Google+ that meets consumers' expectations" along with "very low usage" as the reasons for the move.

In March, a security audit revealed a software bug that gave third-party apps access to Google+ private profile data people meant to share only with friends.

Google said it was unable to confirm which accounts were affected by the bug, but an analysis indicated it could have been as many as 500,000 Google+ accounts.

"We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any profile data was misused," Google said in a blog post.

It was referring to application programming interface software for the social network.

The data involved was limited to optional profile fields, including name, age, gender, occupation and email address, Google said.

Information that could be accessed did not include posts, messages or telephone numbers, a spokesperson said.

Google did not specify how long the software flaw existed, or why it waited to disclose it.

The Wall Street Journal reported that Google executives opted against notifying users earlier because of concerns it would catch the attention of regulators and draw comparisons to a data privacy scandal at Facebook.

Earlier this year, Facebook acknowledged that tens of millions of users had personal data hijacked by Cambridge Analytica, a political firm working for Donald Trump in 2016.

"Every year, we send millions of notifications to users about privacy and security bugs and issues," a Google spokesman told AFP.

"Whenever user data may have been affected, we go beyond our legal requirements and apply several criteria focused on our users in determining whether to provide notice." The company said it determined its course of action based on the data involved in the breach, lack of evidence of misuse and challenges in accurately determining which users to inform.

Google will wind down Google+ during the coming 10 months to allow people time to download pictures, videos or other data they want from their accounts.

Meanwhile, Google planned to add new workplace-oriented features to enhance the appeal of Google+ as a "secure corporate social network" to be used inside business operations.

"We have many enterprise customers who are finding great value in using Google+ within their companies," the internet firm said.

"Our review showed that Google+ is better suited as an enterprise product where co-workers can engage in internal discussions."

As a result of the security audit, Google plans to allow users to more tightly control what data is available to applications that synch with Google accounts or its free Gmail email service.

"Going forward, consumers will get more fine-grained control over what account data they choose to share with each app," Google said.

Applications tailored to augment Gmail will also face new rules regarding data handling and be subject to security assessments, according to the company.

Applications for use on Android-powered smartphones that seek phone or SMS data will need to conform to stricter rules when it comes to calls or text messaging, Google said.
Google announces that it is shutting down its Google+ network for consumers after seven years due to "very low usage" and a software error, first reported by The Wall Street Journal, that potentially exposed the data of 500,000 users. Google+ will fully shut down in August 2019.