6 ms·

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data

by arkem 9y ago

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. The amount of convenience I get from Facebook and Google outweigh the risk I'm exposed to in my opinion. If Governments want to create data protection regulations I'll save my opinion until I see whatever regulation is proposed but I think it'll be difficult to create data protection regulation that is effective at protecting people without imposing a large expensive burden on companies.

mcast 9y ago
You're a little foolish to believe that some sensitive data within Google/Facebook/XYZ does not get shared outside with FVEY countries and intelligence agencies.
- arkem 9y ago
  As someone who has worked for a five eyes intelligence agency and at Google I can tell you that Google does not share sensitive data with the Government unless compelled to do so by law.
  - psyc 9y ago
    Do you have the "pay grade" to be able to make this assertion credibly? One cannot, in general, see the forest for the trees. This adage is not merely a put-down.
    - lisper 9y ago
      I worked for Google a long time ago and it's almost certainly true that this still official company policy. The real question is whether all Google employees always act in accordance with that policy. That is a much dicier proposition. It's also an open question how much data Google is compelled to share by law in the age of NSLs.
    - arkem 9y ago
      If you're asking whether I was the director of my agency or the CEO of Google then the answer is no. I have also not worked for the Government in about 6 years or Google in 4 years so maybe everything changed the moment I left. However, I was an Assistant Director (which is a senior tech / middle management kind of level) at first an intelligence agency, and then at a similar grade in a law enforcement organization and then later a security engineer at Google. The idea that an intelligence agency (or law enforcement agency) would ask Google for help isn't far fetched, in fact when I was in law enforcement we'd ask private companies for help all the time. Some of the time they'd help, the rest of the time they tell us to come back with a warrant. Google was famously in the second category, to the point where we'd not even bother asking. Even if we had a warrant we'd hesitate because we'd expect Google to challenge the warrant in court and it'd be a huge expensive hassle. When I worked at Google it was the same, the idea of sharing private information with anyone was anathema. Engineers even being able to see private information without an audit trail and alarms going off was next to impossible. The idea of a secret extra-legal conduit of information from Google to the US Government seems so far fetched to me that I have trouble even considering it. If there is a conduit for information it's there because the US Government has some legal instrument to compel Google to create it and that Google grudgingly has accepted the instrument as valid. But what do I know, like I said, I wasn't the CEO of Google or DIRNSA. Maybe I just was never in the right rooms or policy meetings? Maybe everything I saw was staged for my benefit.
      - puzzle 9y ago
        I'm not sure if it's still the case, but there used be ample variability of compliance in Google's transparency report across the globe. Outsiders assumed that in the US the percentage was higher because Google was in bed with the FBI and co. In reality, the explanation was even simpler: in the US, authorities either didn't bother asking, as you said, or put the effort in crafting a proper request. Elsewhere, they assumed they could obtain anything (or remove anything about a local figure), just because they had a badge. In some cases, the requests were so ridiculous that they had to be educated about how the law worked in their own country. Over time, compliance increased in those countries as well.
  - lisper 9y ago
    > unless compelled to do so by law That's a pretty significant hedge. Also, how effective are Google's processes against dishonest employees? It would not be hard for, say, the Chinese government to plant a mole in Google's security team. (Actually, the real nightmare scenario is a Chinese mole in Intel or Apple's hardware team.)
    - saalweachter 9y ago
      Honestly Google is one of the few companies I know of which really considers internal threats and has taken precautions to reduce the likelihood that internal bad actors will have access, to reduce the scope of access to any bad actors that slip through, and to ensure that illegitimate accesses will be noticed, reducing the time a bad actor will have access.
      - lisper 9y ago
        I believe you. But one still has to wonder who watches the watchmen.
        saalweachter 9y ago
        Crazy libertarian SREs. :-P
        JadeNB 9y ago
        > Crazy libertarian SREs. :-P A Google search didn't immediately clarify. What is 'SRE'? The most plausible de-abbreviation I could find was "site reliability engineer".
        joshuamorton 9y ago
        That'd be the right abbreviation.
        saalweachter 9y ago
        Site-reliability engineers is the correct de-abbreviation. While data at Google is tightly protected, everything else at Google is fairly transparent. In particular, you can see who is using what resources. SREs, among other things, monitor and manage this resource usage. Large, abnormal usages ("Why is someone copying all this data off-site?") will be noticed, and some of the people who will notice won't take "because the NSA told us to" as an acceptable answer.
  - avn2109 9y ago
    >> "...that Google does not share sensitive data with the Government..." It's possibly true that Google doesn't intentionally share data. But a nonzero fraction of Google's employees are actually working for the intelligence services of various countries. The fraction is debatable but it's naive/misleading to pretend that the big tech Co's aren't thoroughly penetrated by every halfway respectable intelligence outfit.
tryingagainbro 9y ago
I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. NSA begs to differ, on both counts https://www.theguardian.com/us-news/the-nsa-files https://www.theguardian.com/us-news/the-nsa-files CIA too https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/
- arkem 9y ago
  I've read the reporting of Snowden's leaks and I have at least as much exposure to the inner workings of the five eyes as Snowden did and I have come to a different conclusion. I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion. I would not be surprised if intelligence agencies around the world including US based ones target Google's communications (probably in full accordance to each agency's authorization) but that would not be with Google's cooperation. I believe that Google is taking steps to protect customer data from all bad actors, including Government agencies. One initiative that was underway around the time I worked at Google was to encrypt all the data-center to data-center traffic at Google in an attempt to frustrate anyone who was tapping Google's backbone links.
  - CaptSpify 9y ago
    > I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion Why does it matter if it's under legal compulsion or not. At the end of the day they are handing over your data. They could choose not to store it, thus making it impossible to do, but they don't.
    - alexasmyths 9y ago
      "Why does it matter if it's under legal compulsion or not. " Because we are all obliged to follow the law.
      - CaptSpify 9y ago
belltaco 9y ago
>Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data Are you serious? Wasn't Google found to be sending data between their data centers in plain text? https://www.theverge.com/2013/10/30/5046958/nsa-secretly-taps-into-google-yahoo-networks-to-collect-information https://www.theverge.com/2013/10/30/5046958/nsa-secretly-tap...
- TeMPOraL 9y ago
  I think one can excuse them from not securing themselves against their own government physically tapping their internal network.
  - ocdtrekkie 9y ago
    It's referred to as "their internal network", but these taps were not within their buildings, as far as I recall. From my understanding, these are still leased lines run externally from facility to facility. It's been generally assumed that nobody is between points A and B on that line, but the line is still largely traveling through unsupervised space, and we are not the only government to have invested significant resources into tapping lines. (I believe both the US and Russia has submarines specifically designed to facilitate tapping undersea cables.)
    - bluntfang 9y ago
      and don't forget that most (all?) modern lines have been funded directly by the US government. For all intents and purposes...they are government owned.
  - harry8 9y ago
    Their own government is just what we know about. You really think foreign governments weren't doing something similar? Why would you think that? We most certainly cannot excuse them.
solomatov 9y ago
>I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. The fact that they have the best engineers and the best infrastructure, doesn't mean that they are able to find all vulnerabilities and fix them in time. The only way to do it, is to have a proof that system is secure which is beyond our reach today.
JadeNB 9y ago
> I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. But the Google and Facebook security teams are particularly motivated to protect Google and Facebook, not me. If our interests happen to align, then I reap the benefits; but if they conflict, or even if they don't align particularly well, then the sterling quality of those teams becomes more or less useless to me.
- notacoward 9y ago
  Those teams are pretty motivated to protect users as well, because user population and network effects are key to their business models (perhaps a bit more for Facebook than for Google but still). If users started feeling like visiting those sites exposed them to security risks, as well as the existing privacy concerns, it would be disastrous for the bottom line.
s73ver_ 9y ago
I can't say I'm that concerned about those regulations being an expensive burden on companies. I'm more concerned about them being effective.
MrZongle2 9y ago
"...Google and Facebook have two of the best security teams in the world..." Accepting that statement at face value, I would still caution: today they do. What happens in 10 years when the bloom is off of the rose, and either cannot attract top talent or have ignored the need to stay on top of their game? That data's still there.

by arkem 9y ago

mcast 9y ago

You're a little foolish to believe that some sensitive data within Google/Facebook/XYZ does not get shared outside with FVEY countries and intelligence agencies.

arkem 9y ago
As someone who has worked for a five eyes intelligence agency and at Google I can tell you that Google does not share sensitive data with the Government unless compelled to do so by law.
- psyc 9y ago
  Do you have the "pay grade" to be able to make this assertion credibly? One cannot, in general, see the forest for the trees. This adage is not merely a put-down.
  - lisper 9y ago
    I worked for Google a long time ago and it's almost certainly true that this still official company policy. The real question is whether all Google employees always act in accordance with that policy. That is a much dicier proposition. It's also an open question how much data Google is compelled to share by law in the age of NSLs.
  - arkem 9y ago
    If you're asking whether I was the director of my agency or the CEO of Google then the answer is no. I have also not worked for the Government in about 6 years or Google in 4 years so maybe everything changed the moment I left. However, I was an Assistant Director (which is a senior tech / middle management kind of level) at first an intelligence agency, and then at a similar grade in a law enforcement organization and then later a security engineer at Google. The idea that an intelligence agency (or law enforcement agency) would ask Google for help isn't far fetched, in fact when I was in law enforcement we'd ask private companies for help all the time. Some of the time they'd help, the rest of the time they tell us to come back with a warrant. Google was famously in the second category, to the point where we'd not even bother asking. Even if we had a warrant we'd hesitate because we'd expect Google to challenge the warrant in court and it'd be a huge expensive hassle. When I worked at Google it was the same, the idea of sharing private information with anyone was anathema. Engineers even being able to see private information without an audit trail and alarms going off was next to impossible. The idea of a secret extra-legal conduit of information from Google to the US Government seems so far fetched to me that I have trouble even considering it. If there is a conduit for information it's there because the US Government has some legal instrument to compel Google to create it and that Google grudgingly has accepted the instrument as valid. But what do I know, like I said, I wasn't the CEO of Google or DIRNSA. Maybe I just was never in the right rooms or policy meetings? Maybe everything I saw was staged for my benefit.
    - puzzle 9y ago
      I'm not sure if it's still the case, but there used be ample variability of compliance in Google's transparency report across the globe. Outsiders assumed that in the US the percentage was higher because Google was in bed with the FBI and co. In reality, the explanation was even simpler: in the US, authorities either didn't bother asking, as you said, or put the effort in crafting a proper request. Elsewhere, they assumed they could obtain anything (or remove anything about a local figure), just because they had a badge. In some cases, the requests were so ridiculous that they had to be educated about how the law worked in their own country. Over time, compliance increased in those countries as well.
- lisper 9y ago
  > unless compelled to do so by law That's a pretty significant hedge. Also, how effective are Google's processes against dishonest employees? It would not be hard for, say, the Chinese government to plant a mole in Google's security team. (Actually, the real nightmare scenario is a Chinese mole in Intel or Apple's hardware team.)
  - saalweachter 9y ago
    Honestly Google is one of the few companies I know of which really considers internal threats and has taken precautions to reduce the likelihood that internal bad actors will have access, to reduce the scope of access to any bad actors that slip through, and to ensure that illegitimate accesses will be noticed, reducing the time a bad actor will have access.
    - lisper 9y ago
      I believe you. But one still has to wonder who watches the watchmen.
      - saalweachter 9y ago
        Crazy libertarian SREs. :-P
        JadeNB 9y ago
        > Crazy libertarian SREs. :-P A Google search didn't immediately clarify. What is 'SRE'? The most plausible de-abbreviation I could find was "site reliability engineer".
        joshuamorton 9y ago
        That'd be the right abbreviation.
        saalweachter 9y ago
        Site-reliability engineers is the correct de-abbreviation. While data at Google is tightly protected, everything else at Google is fairly transparent. In particular, you can see who is using what resources. SREs, among other things, monitor and manage this resource usage. Large, abnormal usages ("Why is someone copying all this data off-site?") will be noticed, and some of the people who will notice won't take "because the NSA told us to" as an acceptable answer.
- avn2109 9y ago
  >> "...that Google does not share sensitive data with the Government..." It's possibly true that Google doesn't intentionally share data. But a nonzero fraction of Google's employees are actually working for the intelligence services of various countries. The fraction is debatable but it's naive/misleading to pretend that the big tech Co's aren't thoroughly penetrated by every halfway respectable intelligence outfit.

tryingagainbro 9y ago

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. NSA begs to differ, on both counts https://www.theguardian.com/us-news/the-nsa-files https://www.theguardian.com/us-news/the-nsa-files CIA too https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/

arkem 9y ago
I've read the reporting of Snowden's leaks and I have at least as much exposure to the inner workings of the five eyes as Snowden did and I have come to a different conclusion. I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion. I would not be surprised if intelligence agencies around the world including US based ones target Google's communications (probably in full accordance to each agency's authorization) but that would not be with Google's cooperation. I believe that Google is taking steps to protect customer data from all bad actors, including Government agencies. One initiative that was underway around the time I worked at Google was to encrypt all the data-center to data-center traffic at Google in an attempt to frustrate anyone who was tapping Google's backbone links.
- CaptSpify 9y ago
  > I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion Why does it matter if it's under legal compulsion or not. At the end of the day they are handing over your data. They could choose not to store it, thus making it impossible to do, but they don't.
  - alexasmyths 9y ago
    "Why does it matter if it's under legal compulsion or not. " Because we are all obliged to follow the law.
    - CaptSpify 9y ago

belltaco 9y ago

>Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data Are you serious? Wasn't Google found to be sending data between their data centers in plain text? https://www.theverge.com/2013/10/30/5046958/nsa-secretly-taps-into-google-yahoo-networks-to-collect-information https://www.theverge.com/2013/10/30/5046958/nsa-secretly-tap...

TeMPOraL 9y ago
I think one can excuse them from not securing themselves against their own government physically tapping their internal network.
- ocdtrekkie 9y ago
  It's referred to as "their internal network", but these taps were not within their buildings, as far as I recall. From my understanding, these are still leased lines run externally from facility to facility. It's been generally assumed that nobody is between points A and B on that line, but the line is still largely traveling through unsupervised space, and we are not the only government to have invested significant resources into tapping lines. (I believe both the US and Russia has submarines specifically designed to facilitate tapping undersea cables.)
  - bluntfang 9y ago
    and don't forget that most (all?) modern lines have been funded directly by the US government. For all intents and purposes...they are government owned.
- harry8 9y ago
  Their own government is just what we know about. You really think foreign governments weren't doing something similar? Why would you think that? We most certainly cannot excuse them.

solomatov 9y ago

>I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. The fact that they have the best engineers and the best infrastructure, doesn't mean that they are able to find all vulnerabilities and fix them in time. The only way to do it, is to have a proof that system is secure which is beyond our reach today.

JadeNB 9y ago

> I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. But the Google and Facebook security teams are particularly motivated to protect Google and Facebook, not me. If our interests happen to align, then I reap the benefits; but if they conflict, or even if they don't align particularly well, then the sterling quality of those teams becomes more or less useless to me.

notacoward 9y ago
Those teams are pretty motivated to protect users as well, because user population and network effects are key to their business models (perhaps a bit more for Facebook than for Google but still). If users started feeling like visiting those sites exposed them to security risks, as well as the existing privacy concerns, it would be disastrous for the bottom line.

s73ver_ 9y ago

I can't say I'm that concerned about those regulations being an expensive burden on companies. I'm more concerned about them being effective.

MrZongle2 9y ago

"...Google and Facebook have two of the best security teams in the world..." Accepting that statement at face value, I would still caution: today they do. What happens in 10 years when the bloom is off of the rose, and either cannot attract top talent or have ignored the need to stay on top of their game? That data's still there.