They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.

Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs.

It did raise a fascinating question about where the physical tap was and how the take was routed back.

You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery.

You do the tap in the middle of nowhere, and how do you get the data stream back?

I'd guess they went rural and just leased physically adjacent dark fiber to route out on.

The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.

Level 3 basically admitted they did it for them, so it would have been at a hub.