6 ms·

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data

I'm not particularly worried, Google and Facebook have two of the best security teams in the world and spend an amazing amount of money to protect customer data. NSA begs to differ, on both counts https://www.theguardian.com/us-news/the-nsa-files https://www.theguardian.com/us-news/the-nsa-files CIA too https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/

arkem 9y ago
I've read the reporting of Snowden's leaks and I have at least as much exposure to the inner workings of the five eyes as Snowden did and I have come to a different conclusion. I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion. I would not be surprised if intelligence agencies around the world including US based ones target Google's communications (probably in full accordance to each agency's authorization) but that would not be with Google's cooperation. I believe that Google is taking steps to protect customer data from all bad actors, including Government agencies. One initiative that was underway around the time I worked at Google was to encrypt all the data-center to data-center traffic at Google in an attempt to frustrate anyone who was tapping Google's backbone links.
- CaptSpify 9y ago
  > I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion Why does it matter if it's under legal compulsion or not. At the end of the day they are handing over your data. They could choose not to store it, thus making it impossible to do, but they don't.
  - alexasmyths 9y ago
    "Why does it matter if it's under legal compulsion or not. " Because we are all obliged to follow the law.
    - CaptSpify 9y ago
      A) No we aren't. Unjust laws should be fought. I realize that this is easier said than done, but it's still true. B) They could organize it so that even when the law comes asking, they can't comply, but they don't. What matters is that they are acting insecurely, and providing data that they shouldn't be storing/providing in the first place. The law is irrelevant here.
      - alexasmyths 9y ago
        "A) No we aren't. Unjust laws should be fought. " In the court system, not by disobeying. Your view of 'what is unjust' is likely completely different from the view of others. Particularly in this case, I don't have any problem with Google or FB handing over data for individuals under investigation, wherein a Judge had provided a warrant. This is 'legal' in every sense of the term and has been for some time. As for 'mass surveillance' - well, this was a murkier area, and has been cleared up by the Supreme Court, and I don't suspect they are doing it. If Google does not want to hand over data to officials producing warrants, they can take it up in court, and try to get an injunction against the process of handing over. If a judge feels there is merit to the case, they will grant the injunction while the case is being resolved. "They could organize it so that even when the law comes asking, they can't comply, but they don't." Nope. They can organize all they want, but if the Government is well within legal limits, Google et. al. would face some serious pain. Again for 'mass surveillance' stuff (i.e. legal ambiguity a few years ago), they'd have some legal footing to fight (i.e. try for injunctions), but for other things, not so much.
        CaptSpify 9y ago
        I disagree with your view of fighting unjust laws, but I can agree to disagree on that one. It's a complicated issue for sure. > Nope. They can organize all they want, but if the Government is well within legal limits You are misunderstanding what I mean here: Google can make it so that nobody except the user can read their data, but Google chooses not to. If they did this (read: the correct/secure way), then the government can ask all they want, and Google would be unable to comply.
  - fav_collector 9y ago
    Protection through obscurity. If the NSA needs to go through the legal process to access data, the chances of them looking through your data is much lower than if they had unrestricted access. The cost of data inquiry discourages data inquiries.
    - CaptSpify 9y ago
      That doesn't really answer my question though. The problem is that Google is handing over data, not what method is being used to try and access that data.
shallot_router 9y ago
Yes, but if you reside in the US and NSA or CIA want to get your data, they are going to get it. Even if you have the best security team and program in the world.
- tryingagainbro 9y ago
  Missed my point, maybe I didn't make that clear: if there's an org with brilliant math PHDs and security people with virtually unlimited budgets, that's NSA. Yet, their info got out. If they got hacked....
  - shallot_router 9y ago
    Ah sorry, I did misunderstand. Yes, no one is safe. Not Google, not Facebook, and not NSA or CIA or any agency or organization on Earth. A good defense is much harder than a good offense when it comes to infosec.
lend000 9y ago
They most likely have access on their own -- seems a bit suspicious why so many open AWS ops reqs require a security clearance.
- yandie 9y ago
  This is why: https://aws.amazon.com/govcloud-us/ https://aws.amazon.com/govcloud-us/ Only people with security clearance can access government cloud facilities
landryraccoon 9y ago
You're pointing out an orthogonal issue. If the US government wants your data and it's being held in a US company, then IT security isn't the issue, it's the legal framework. No IT security will help when armed agents of the government legally enter your business and coerce you into handing over your data. The US Government can equally detain you directly and coerce you into handing over all of your data if that's what the law allows.

arkem 9y ago

I've read the reporting of Snowden's leaks and I have at least as much exposure to the inner workings of the five eyes as Snowden did and I have come to a different conclusion. I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion. I would not be surprised if intelligence agencies around the world including US based ones target Google's communications (probably in full accordance to each agency's authorization) but that would not be with Google's cooperation. I believe that Google is taking steps to protect customer data from all bad actors, including Government agencies. One initiative that was underway around the time I worked at Google was to encrypt all the data-center to data-center traffic at Google in an attempt to frustrate anyone who was tapping Google's backbone links.

CaptSpify 9y ago
> I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion Why does it matter if it's under legal compulsion or not. At the end of the day they are handing over your data. They could choose not to store it, thus making it impossible to do, but they don't.
- alexasmyths 9y ago
  "Why does it matter if it's under legal compulsion or not. " Because we are all obliged to follow the law.
  - CaptSpify 9y ago
    A) No we aren't. Unjust laws should be fought. I realize that this is easier said than done, but it's still true. B) They could organize it so that even when the law comes asking, they can't comply, but they don't. What matters is that they are acting insecurely, and providing data that they shouldn't be storing/providing in the first place. The law is irrelevant here.
    - alexasmyths 9y ago
      "A) No we aren't. Unjust laws should be fought. " In the court system, not by disobeying. Your view of 'what is unjust' is likely completely different from the view of others. Particularly in this case, I don't have any problem with Google or FB handing over data for individuals under investigation, wherein a Judge had provided a warrant. This is 'legal' in every sense of the term and has been for some time. As for 'mass surveillance' - well, this was a murkier area, and has been cleared up by the Supreme Court, and I don't suspect they are doing it. If Google does not want to hand over data to officials producing warrants, they can take it up in court, and try to get an injunction against the process of handing over. If a judge feels there is merit to the case, they will grant the injunction while the case is being resolved. "They could organize it so that even when the law comes asking, they can't comply, but they don't." Nope. They can organize all they want, but if the Government is well within legal limits, Google et. al. would face some serious pain. Again for 'mass surveillance' stuff (i.e. legal ambiguity a few years ago), they'd have some legal footing to fight (i.e. try for injunctions), but for other things, not so much.
      - CaptSpify 9y ago
        I disagree with your view of fighting unjust laws, but I can agree to disagree on that one. It's a complicated issue for sure. > Nope. They can organize all they want, but if the Government is well within legal limits You are misunderstanding what I mean here: Google can make it so that nobody except the user can read their data, but Google chooses not to. If they did this (read: the correct/secure way), then the government can ask all they want, and Google would be unable to comply.
- fav_collector 9y ago
  Protection through obscurity. If the NSA needs to go through the legal process to access data, the chances of them looking through your data is much lower than if they had unrestricted access. The cost of data inquiry discourages data inquiries.
  - CaptSpify 9y ago
    That doesn't really answer my question though. The problem is that Google is handing over data, not what method is being used to try and access that data.

shallot_router 9y ago

Yes, but if you reside in the US and NSA or CIA want to get your data, they are going to get it. Even if you have the best security team and program in the world.

tryingagainbro 9y ago
Missed my point, maybe I didn't make that clear: if there's an org with brilliant math PHDs and security people with virtually unlimited budgets, that's NSA. Yet, their info got out. If they got hacked....
- shallot_router 9y ago
  Ah sorry, I did misunderstand. Yes, no one is safe. Not Google, not Facebook, and not NSA or CIA or any agency or organization on Earth. A good defense is much harder than a good offense when it comes to infosec.

lend000 9y ago

They most likely have access on their own -- seems a bit suspicious why so many open AWS ops reqs require a security clearance.

yandie 9y ago
This is why: https://aws.amazon.com/govcloud-us/ https://aws.amazon.com/govcloud-us/ Only people with security clearance can access government cloud facilities

landryraccoon 9y ago

You're pointing out an orthogonal issue. If the US government wants your data and it's being held in a US company, then IT security isn't the issue, it's the legal framework. No IT security will help when armed agents of the government legally enter your business and coerce you into handing over your data. The US Government can equally detain you directly and coerce you into handing over all of your data if that's what the law allows.