I also don't think the openness on the calendar is the issue, more the stalking part. Just like how seeing where people go on the streets is natural, but sneaking behind someone everyday up to their house becomes something else altogether.

It's really neither. It's the part where information on someone else's calendar was disseminated to an external third party.

That is not what the note said. It said that screenshots made their way outside the company.

I would associate that with an email account that wasn't the work account, a printed page that was taken off-premises, a non-work cloud-hosted storage service, or to a computer that wasn't a work computer. It does not say that the place the information was sent to was any third party.

It could turn out that the information was sent to a third party, but that has not (yet) been claimed.

Ah, I follow. "Outside the company" could mean "cold storage."

Yup! I assume that at this point general counsel is involved in everything Google says publicly; it's then worth nitpicking at the exact details of what has or has not been admitted, because legal folk definitely have!

There are 2 points here 1. The visibility of the activity. I have no experience with google calendar at this level but the normal from my perspective would be that only free/busy information is by default available. If the company wants every info to be available then it might be that the employees were not adequately informed about this in order either to not enter private info in their calendar or mark them explicitly as private

2. The fact that this kind of information made it outside of the company. I believe this is the consequence of making such info available to all and in a company with so many thousand employees like it or not there are some bad apples that will take advantage of everything

I'm using Google calendar at work, and I guess the version Google uses internally is not that different.

You can decide whether everyone can see the details or whether they just see "busy" everywhere.

I think it's good to see the title, for example if I have a meeting about the feature Foobar and a coworker sees that, he might want to reach out to say he's got some insight about it.

A normal Outlook setup is that you can see people's availability in their calendars but you can only see the details for your immediate team or if people have specifically enabled it.

There is no reason to have your full calendar visible by all by default.

In a work context, which is what G Suite is meant for, there's no reason not to have it public.

Also, "public" here means only the time & title, not detailed description, participants, attachments etc. You can easily set individual events to private, or default everything to private if you wish.

why would you need to see the meeting topic? All you should be able to see is availability.

Because in Google's conceptualization, organization is horizontal and extremely employee-driven.

It's ultimately the individual employee that knows whether or not a meeting is relevant to them. And they can only know that if they have information on the meeting.

So someone can just up and invite themselves to a meeting I set up and did not invite them to?

Sounds like an entirely toxic environment.

Not really. The principle in play is "We're all adults; don't be a dick."

Proper etiquette would be to ping the meeting organizer and ask if they mind if you sit in. If they don't, no problem. If they do, you work something out relevant to the reason you wanted to sit in. But one can't even start that conversation without knowledge of relevant meeting topics.

The fact I know what meetings my coworkers are having doesn't imply I should be crashing them any more than the fact I can see when my coworkers are at their desks implies I should be continuously bothering them.

Because that’s the domain-wide setting that Google configured for all of its employees accounts.

There is no reason to show the title to all by default. Only 'free', 'busy', 'away', etc is enough, which is standard in Outlook.

"Hey Steve, I noticed you're meeting with Bob and Janet tomorrow on foo. I'm working on foo-sec and could use more details on foo; mind if I sit in?"

Google's corporate culture is to make it as easy as possible to have that happen.

I think the GP is referring to personal calendars, not work calendars.

I'd blame the user. Speculation: when you add an event you can choose whether you add it to the work or to the personal calendar and those people chose to add it to the work calendar, which is public so others in Google can see when that person is busy, which in turn is useful to schedule meetings, etc

> Back in the day while I was at Google, you could look at anyone else's calendar

Maybe that is why google screws up its data security outside too. Such things shouldnt be allowed in the first place.

Outlook is great comparing to this.