Not really internal. Long distance fiber lines between sites, mostly leased.

They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.

Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs.

It did raise a fascinating question about where the physical tap was and how the take was routed back.

You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery.

You do the tap in the middle of nowhere, and how do you get the data stream back?

I'd guess they went rural and just leased physically adjacent dark fiber to route out on.

The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.

Level 3 basically admitted they did it for them, so it would have been at a hub.

That Google incident sounds interesting, do you have links to the technical explanations? From a quick search all I could find are news reports.

It's from the OG PRISM slides. Previously Google's internal production network didn't use encryption, SSL/TLS was terminated at the perimeter. So the NSA simply tapped their dark fiber between data centers.

But it becomes significantly easier if Cloudflare performs this cooperation; most ISPs are required to maintain such data as well.