Building privacy and security that works for everyone

The Google Safety Engineering Center in Munich is a global hub for privacy and safety engineering. Engineers Wieland Holfelder and Stephan Micklitz explain how Google builds transparency and control into its products.

Wieland Holfelder was still living in the US when he received his acceptance letter for a new job at Google. He’d moved to Silicon Valley from Germany and had been working there for 12 years, for companies including Mercedes-Benz. In 2008, everything changed. Holfelder’s American friends and colleagues were excited about his new position and employer. But his future workplace wasn’t in Mountain View, California – it was in Munich, Germany. There, his news was often met with less enthusiasm. As well as the usual congratulatory messages, Holfelder also received occasional frowns and questioning looks from his German friends when he mentioned the name “Google.” But Holfelder knows how sensitive Europeans – and especially Germans – can be when it comes to their data.

Holfelder, the Site Lead for Google’s Engineering Center, is sitting in the Munich office’s canteen, which feels more like a restaurant with its tasteful décor and floor-to-ceiling windows. From the fragments of conversation that can be made out over the general buzz in the room, it’s clear that English is the lingua franca of Munich’s “Googlers.” And the Silicon Valley influence doesn’t end there – the brick building, which was opened in 2016, houses a fitness studio, coffee bar, billiard room, and library. Around 750 employees from all over the world work at this branch, most of whom are software developers. Their working hours often spill into the evening, as video conferences with colleagues at Google’s headquarters in Mountain View are only possible from early evening onwards.

Director of Engineering Stephan Micklitz, who is responsible for the data privacy standards of Google’s products globally, also works at the Munich office. Having joined the team in 2007, he is one of the original Munich Googlers. It was Micklitz and his team that developed the original My Account service, which later became Google Account. This digital cockpit can be used by anyone who has an account with Google, as well as those who simply use Google’s search engine or YouTube. Google Account allows settings to be easily managed. Users can also run a Security Checkup to see how well their data is protected against an external attack, and use the Privacy Checkup to decide what personal information of theirs is stored on Google’s servers and what isn’t.

According to Holfelder and Micklitz, no other company in the industry is doing as much to protect its users’ data from online attacks. And it’s true that Google’s server infrastructure is considered one of the most secure in the world. The security system is complex and includes multiple levels. Data is stored in encrypted form in data centers around the world – facilities that resemble maximum-security prisons. “Even if someone in one of our biometrically protected data centers came across a hard drive containing your emails, they wouldn’t be able to do anything with it,” explains Holfelder. “All the information on it is distributed across various data centers – and it’s encrypted.” Plus, if hackers discover a weakness in Google’s interfaces or products despite all these measures, the company offers generous rewards in return for this information. It’s therefore more worthwhile for would-be cybercriminals to report a security vulnerability than to exploit it.

The same is true of ads, which is how Google makes most of its money. Data can help make ads more relevant to you -- so that if you’re looking for a new grey sofa, you see ads that answer that need. Some people find this useful; others find it irritating. Micklitz explains that it’s possible to simply switch off this ad personalization feature. “Via Google Account, of course,” he adds. Users who turn this feature off will still see ads, but they will no longer be tailored to their interests. “We use data to make advertising more relevant to our users,” Holfelder chimes in. “But we don’t sell any personal data.”

Photographs: Myrzik & Jarisch