Hunting google

[DaveB]

So parent co. is in talks with google about moving corporate e-mail to gmail.

Part of the discussion revolves around where the data will be held and issues of transmission between territories and across boarders. Google are notoriously tight lipped about where their data centers are located although there is some info publicly available it is a little out of date now.

This got me thinking about how you would go about tracking down these data centers. Google register almost all their IP addresses to HQ in Mountain View CA. So geographic lookups aren't going to work.

So, my thought is, can you use the RTT data from ICMP Pings to estimate distance between nodes and triangulate a location. Given a sufficiently large sample size from a sufficiently wide range of locations could you figure out where Google is hiding?

Some of the problems I can see are the fact that many network providers use QoS to downgrade ICMP traffic, effectively slowing it down and artificially inflating the RTT.

Google appears to redirect all requests to a single "server" based on the requesters location. So from a UK address Google.co.uk, Google.com,google.de etc all resolve to the same IPaddress or range of addresses.

There is no guarantee that any Ping request will take the most direct route to it's destination.

Any thoughts?

[doodab]

A couple of thoughts.

Round trip times aren't really measures of physical distance which you can triangulate. Cables follow indirect physical routes and delays due to routers, switches and optical transmission equipment are equivalent to hundreds or thousands of kilometres of optical fibre cable.

Also, you have no visibility of what goes on behind closed doors. The public IP addresses, even if you could tie them to a physical location, won't help you locate the data which will most like be distributed across multiple machines in multiple physical locations.

[d000hg]

Considering Google basically has their own private internet, I think this is likely to be pretty difficult. Once it gets inside Google it could bounce around between their own servers/nodes, if my limited understanding is right.

[RichardCranium]

Can you not change the problem? That is, you don't need to know where Google stores its data. What you need is confirmation it will only store it in places you approve of.

Can you not just ask them to commit to storing it in the EU or to conform to the "US-EU Safe Harbour Framework"?

Then if they cannot commit to that, you just have to find another solution.

I don't know about Google email, but Google does make use of the framework for some things:

Google Jobs:

Privacy Policy

All Application Information you submit to Google is collected by Google in the United States, as well as the jurisdiction where the contact for the position is located. Application Information may be shared with our affiliates, subsidiaries or joint ventures in other jurisdictions for employment consideration purposes. This Policy is governed by United States law.

For individuals located in the European Union, by submitting your Application Information you are agreeing to the transfer of that information outside the European Economic Area (“EEA”) to countries where privacy standards may differ. Google adheres to the US Safe Harbor privacy principles with respect to Application Information collected by entities located in the EEA and transferred to Google in the United States. For more information about the Safe Harbor framework or our registration, see the U.S. Department of Commerce website at Export.gov - Safe Harbor.

Google app engine:

Comment 5 by deo@google.com, Nov 12, 2008

as noted in our privacy policy, Google adheres to all
of the principles set forth in the U.S. Department of Commerce Safe Harbor framework
(http://www.export.gov/safeharbor/SafeHarborInfo.htm), and is registered with the
U.S. Department of Commerce's Safe Harbor Program. This means that EU regulatory
organizations permit the storage of personal data on Google's servers.

As to where specific data is stored, that may be a separate issue outside of EU Safe
Harbor compliance itself, unless I'm misinterpreting the question.

[DaveB]

I'm leaving all the legal discussion to the professionals, 9 months on an OU Law course doesnt really qualify me to take part

It was more of a curiosity thing really. Google wont say where their data centers are, so is there a way to track them down anyway? Not specifically to identify where our data is likely to end up, just to do it cos they wont tell anyone anyway.

The whole US-EU Safe harbour thing is complicated by the fact that parent co is Swiss, and Switzerland is not actually part of the EU. There is a US-Swiss Safeharbour list, but Googles entry on that is identicle tio their EU entry and makes no mention of Swiss law etc. As I said, one for the lawyers.