6 ms·

Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

114 points by nopacience 8y ago

ccnafr 8y ago
Please, do hand over that memo. I'll be watching this closely. I'd love to read the entire thing, not just the parts that WSJ selected.
- sololipsist 8y ago
  I have found over and over and over that when I read "memos" or "screeds" or whathaveyou coming from the tech industry I inevitably find that a huge portion of the media is pushing a narrative that is so uniform and so disjoint from the actual content I have a hard time imagining how it wasn't coordinated journo-pros-style.
  - recursive 8y ago
    James Damore?
    - sololipsist 8y ago
      That's an example, yes.
cirenehc 8y ago
I have never worked at any company that publishes every security bug discovered internally. This is ridiculous.
- toomuchtodo 8y ago
  Would you be surprised by legislation or insurance regulations that required such disclosures?
  - kodablah 8y ago
    Yes. E.g. did you find a whiteboard facing an open window? Did leave a confidential document sitting on their desk? Did someone forget to close the filing cabinet to sensitive documents? Has anyone ever been able to access confidential information at your company without permission? Of course we can pick and choose analogies (hint: we'll never get it right, but that's what happens when comparisons are asked for). But if we're asking for disclosures for security holes that could lead (or have lead) to unauthorized access, I expect to see a seemingly interminable list.
    - toomuchtodo 8y ago
      I appreciate the feedback.
    - ne0sapi3n 8y ago
      None of those examples remotely resemble the G+ issues and subsequent shuttering.
      - tptacek 8y ago
        No, they don't: they're all more severe than what happened at G+ with this vulnerability. Vulnerabilities of the kind we're discussing are utterly routine, and would probably merit a sev:low in an external assessment.
- ne0sapi3n 8y ago
  Would you think that a company ought to publish at least the security bugs that make them end the service? Your straw man is ridiculous.
- imglorp 8y ago
  Same. But the users whose data was emitted should have been immediately notified. That's (a) law in some places, (b) common decency if one party holds another's PII and then fails to keep it private.
  - klodolph 8y ago
    > But the users whose data was emitted should have been immediately notified. If we’re still talking about the same bug… I thought that there was no evidence that anybody’s data was exfiltrated through this vulnerability? Granted, absence of evidence is not evidence of absence, but who, exactly, are you saying should be notified? I would say yes, if some person’s PII data was improperly disclosed, yes, disclose the breach to that person. But if there is not any evidence that some particular person’s data was exposed here, do you go around telling people that their data “could have” been accessed, “if”? Physical security analogy—let’s say I found out that the window was unlocked. It’s been unlocked for three years, and I pull security tapes. Nobody is on tape coming in through the window, but the old tapes have been erased. I don’t have any evidence that anybody came in through the window, and yet I can’t disprove it either.
    - TangoTrotFox 8y ago
      Google was able to finger a specific number of accounts that had data marked as private that may have been shared with third parties. The thing that makes this issue unique and interesting is that Google is claiming is that they deleted all the relevant logs, so they can't confirm whether the private information was indeed shared or not. This is a big problem since if this becomes a valid way of deferring responsibility or accountability, it creates a major incentive for companies to copy Google's claim here.
      - klodolph 8y ago
        That doesn’t sound especially unique or interesting, I would expect API access logs to expire after a time and without more knowledge of the specifics, two weeks seems reasonable to me. I would assume that the logs themselves contain PII so increasing the retention has a risk, too. Speaking of retention, given GDPR I would expect the logs to be expired after some known amount of time just for regulatory compliance reasons. If you go too hard towards forcing disclosures you get pathological incentives to not retain the logs in the first place, the same way people at large companies these days will keep some discussions out of email so they can’t get subpoenaed. That’s not an excuse for bad behavior, but if you force companies to retain more logs for audit purposes, and you force companies to have PII retention policies that limit the retention period, you can easily force a company into a position where the cheapest way out is to reduce the detail in the logs to the point where they’re not useful for security audits any more (if this has the primary purpose of PII retention compliance).
- sz4kerto 8y ago
  Depends on the industry. E.g. if you're working in defense or healthcare, then just the possibility of a data leak might be something you're obligated to report on. And a Google- or Facebook-size company might easily fall into the category where even "near miss" events should be disclosed. Basically you have to conduct an internal risk evaluation and depending on the overall risk assessment, you need or don't need to publicly report on it. Of course the bar is much lower than 'certain data leak'.
  - cirenehc 8y ago
    I have worked in healthcare related systems before that needs to be HIPAA compliant, even for those systems public disclosure of a vulnerability is not a requirement. No software is bug free, and many seemingly benign bugs are security vulnerabilities. Try and name one company that reports all their bugs (security/non security) discovered internally.
    - ne0sapi3n 8y ago
      "all their bugs (security/non security) discovered internally" No one. And no one is asking this of G+. Congratulations on this apparently successful straw man.
  - tptacek 8y ago
    I won't do work for the Federal government, but I've worked with companies of all sizes in healthcare, manufacturing, finance, and utilities, and at none of them was it a norm that internal vulnerabilities be disclosed publicly. People keep saying that there are certain kinds of companies where you have to disclose, and I have come to the conclusion that they are simply making that up because it sounds good to them.
  - wglb 8y ago
    With respect to just the possibility of a data leak might be something you're obligated to report on, I haven't heard of this being a real requirement. I would be curious to see links or evidence to the contrary.
- jlarocco 8y ago
  It's disappointing to see people defending Google on this. Whether the vulnerability was discovered internally or not, they were leaking people's data, and the responsible thing to do is tell them. Even if it's only a possibility, people have the right to know.
  - wglb 8y ago
    There is no evidence that they were leaking people's data.
    - jlarocco 8y ago
      I don't think that's up for debate. Both the WSJ and Google's own engineers came to the conclusion that they were. If the data wasn't leaking there wouldn't be anything for Google to cover up in their memo. The only question left is who was affected, and Google doesn't know because they deleted the logs. The responsible thing to do would be notify everybody using that part of the service.
      - wglb 8y ago
        I agree that it is not up for debate. They did not lose any information. The google announcement here https://www.blog.google/technology/safety-security/project-strobe/ https://www.blog.google/technology/safety-security/project-s... says that they looked for leakages and We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused. The difference is between data being exposed and data being leaked. The difference is quite critical.
        mtgx 8y ago
        They only "know" the data didn't leak in the 2 weeks prior to them finding out about it.
        jlarocco 8y ago
        First, I don't think the difference between exposed and leaked matters with respect to whether they need to notify users about it. In any case, I don't believe their answer. Once the API response leaves the server with extra information there's no way for them to know which fields the caller looked at because it's all done client side.
kodablah 8y ago
> Three Republican senators have sent a letter to Google today demanding the company hand over an internal memo based on which Google decided to cover up a Google+ data leak instead of going public as most companies do. That's a loaded first sentence. Here's another way of writing it: "Three Republican senators have sent a letter to Google today asking the company to please provide internal memo based on which Google decided to not disclose a Google+ bug that could have leaked data instead of going public as very few companies would." Or break it up if that's too wordy. ZDNet and the writer of this article should be ashamed of themselves. How much more clearly can you out yourself as biased garbage? To the contents of the letter itself [0], just answer the 8 questions straight up, and give the memo. Doesn't appear like a witch hunt quite yet. On questions 3, 4, and 5 just make it clear that software bugs are rampant, many have the ability to get bad things when exploited, and on 6 either inundate them with a deluge of security bugs or explain that there are probably thousands. On #7, the answer better be an emphatic "yes" or I will be very disappointed. If it becomes more political, there needs to be legal requirements for disclosing all security vulns (instead of just exploited ones) or they need to recognize it's untenable to ask for them. Can't have it both ways and just pick a company's vuln because of an article about them and not ask other companies for theirs. 0 (PDF) - https://www.commerce.senate.gov/public/_cache/files/4852b311-0953-4ac8-ac43-a91dde229cc1/E300DA0C7659678AE0AE37AEB9746200.thune-wicker-moran-letter-to-google-10.11.18.pdf https://www.commerce.senate.gov/public/_cache/files/4852b311...
- sololipsist 8y ago
  > How much more clearly can you out yourself as biased garbage? Are you really surprised, or are you just pretending to be? This is par for the course for every major journalism outfit - from Fox to MSNBC down to NPR and PBS. There isn't a single major outlet, irrespective of funding model or platform, that isn't blatantly biased.
- ccnafr 8y ago
  > out yourself as biased garbage? Biased based on your opinion. I personally think this is a very big deal and I don't see anything wrong in that sentence. If you think Google is innocent, just look at the facts. 1) They had an internal memo discouraging public disclosure. 2) They only came clean with the leak after WSJ reached out for comment before the publication of a story. 3) They buried the "leak" announcement in a gigantic blog post. The blog post was meant to announce a new project, but about halfway through the middle they disclosed a data-leaking bug. I'd say the tone of the article is in response to Google's observed and recorded actions. Yeah, I'd say the article and letter's tone is just about right.
IX-103 8y ago
Since the "memo" is part of a discussion between lawyers and execs wouldn't the memo be considered privileged? That doesn't mean that Senators can't ask, but if you set the expectation of handing out privileged information whenever you're asked it kinda makes "privileged" communication not mean anything.
Bhilai 8y ago
Google admitted that they don't keep any logs around. So in the absence of logs, I am not sure how they are making the claim that their API was not abused. So there is definitely more transparency required about their internal investigation and how they are so certain. Just because Google has a great security team, I would not put my blind faith on them.
- skybrian 8y ago
  I don't believe they made that claim? They said they didn't have evidence that the API was abused.
  - lmkg 8y ago
    They said that they kept logs for only two weeks, because the logs themselves contained private information. Those logs contained no evidence of abuse.
- joshuamorton 8y ago
  >Google admitted that they don't keep any logs around. They didn't say that, they stated that in the logs they had, which were not fully comprehensive, there was no evidence of abuse. > am not sure how they are making the claim that their API was not abused. They didn't claim this. But one could, for example, set up a honeypot and monitor any suspicious activity going forward, then if anyone attempted to abuse the vulnerability before it was publicized, they would know it might have been abused, but lack of use over a long timescale could give reasonable certainty that no one took advantage of the vuln. (I work at Google, but not on G+ and not on security).
sctb 8y ago
Previously: https://news.ycombinator.com/item?id=18212759 https://news.ycombinator.com/item?id=18212759.
fredgrott 8y ago
Its somewhat a miss-leading title.... Can you cover-up legal activity? No, of course not..non-story here

114 points by nopacience 8y ago

Please, do hand over that memo. I'll be watching this closely. I'd love to read the entire thing, not just the parts that WSJ selected.

sololipsist 8y ago
I have found over and over and over that when I read "memos" or "screeds" or whathaveyou coming from the tech industry I inevitably find that a huge portion of the media is pushing a narrative that is so uniform and so disjoint from the actual content I have a hard time imagining how it wasn't coordinated journo-pros-style.
- recursive 8y ago
  James Damore?
  - sololipsist 8y ago
    That's an example, yes.

cirenehc 8y ago

I have never worked at any company that publishes every security bug discovered internally. This is ridiculous.

toomuchtodo 8y ago
Would you be surprised by legislation or insurance regulations that required such disclosures?
- kodablah 8y ago
  Yes. E.g. did you find a whiteboard facing an open window? Did leave a confidential document sitting on their desk? Did someone forget to close the filing cabinet to sensitive documents? Has anyone ever been able to access confidential information at your company without permission? Of course we can pick and choose analogies (hint: we'll never get it right, but that's what happens when comparisons are asked for). But if we're asking for disclosures for security holes that could lead (or have lead) to unauthorized access, I expect to see a seemingly interminable list.
  - toomuchtodo 8y ago
    I appreciate the feedback.
  - ne0sapi3n 8y ago
    None of those examples remotely resemble the G+ issues and subsequent shuttering.
    - tptacek 8y ago
      No, they don't: they're all more severe than what happened at G+ with this vulnerability. Vulnerabilities of the kind we're discussing are utterly routine, and would probably merit a sev:low in an external assessment.
ne0sapi3n 8y ago
Would you think that a company ought to publish at least the security bugs that make them end the service? Your straw man is ridiculous.
imglorp 8y ago
Same. But the users whose data was emitted should have been immediately notified. That's (a) law in some places, (b) common decency if one party holds another's PII and then fails to keep it private.
- klodolph 8y ago
  > But the users whose data was emitted should have been immediately notified. If we’re still talking about the same bug… I thought that there was no evidence that anybody’s data was exfiltrated through this vulnerability? Granted, absence of evidence is not evidence of absence, but who, exactly, are you saying should be notified? I would say yes, if some person’s PII data was improperly disclosed, yes, disclose the breach to that person. But if there is not any evidence that some particular person’s data was exposed here, do you go around telling people that their data “could have” been accessed, “if”? Physical security analogy—let’s say I found out that the window was unlocked. It’s been unlocked for three years, and I pull security tapes. Nobody is on tape coming in through the window, but the old tapes have been erased. I don’t have any evidence that anybody came in through the window, and yet I can’t disprove it either.
  - TangoTrotFox 8y ago
    Google was able to finger a specific number of accounts that had data marked as private that may have been shared with third parties. The thing that makes this issue unique and interesting is that Google is claiming is that they deleted all the relevant logs, so they can't confirm whether the private information was indeed shared or not. This is a big problem since if this becomes a valid way of deferring responsibility or accountability, it creates a major incentive for companies to copy Google's claim here.
    - klodolph 8y ago
      That doesn’t sound especially unique or interesting, I would expect API access logs to expire after a time and without more knowledge of the specifics, two weeks seems reasonable to me. I would assume that the logs themselves contain PII so increasing the retention has a risk, too. Speaking of retention, given GDPR I would expect the logs to be expired after some known amount of time just for regulatory compliance reasons. If you go too hard towards forcing disclosures you get pathological incentives to not retain the logs in the first place, the same way people at large companies these days will keep some discussions out of email so they can’t get subpoenaed. That’s not an excuse for bad behavior, but if you force companies to retain more logs for audit purposes, and you force companies to have PII retention policies that limit the retention period, you can easily force a company into a position where the cheapest way out is to reduce the detail in the logs to the point where they’re not useful for security audits any more (if this has the primary purpose of PII retention compliance).
sz4kerto 8y ago
Depends on the industry. E.g. if you're working in defense or healthcare, then just the possibility of a data leak might be something you're obligated to report on. And a Google- or Facebook-size company might easily fall into the category where even "near miss" events should be disclosed. Basically you have to conduct an internal risk evaluation and depending on the overall risk assessment, you need or don't need to publicly report on it. Of course the bar is much lower than 'certain data leak'.
- cirenehc 8y ago
  I have worked in healthcare related systems before that needs to be HIPAA compliant, even for those systems public disclosure of a vulnerability is not a requirement. No software is bug free, and many seemingly benign bugs are security vulnerabilities. Try and name one company that reports all their bugs (security/non security) discovered internally.
  - ne0sapi3n 8y ago
    "all their bugs (security/non security) discovered internally" No one. And no one is asking this of G+. Congratulations on this apparently successful straw man.
- tptacek 8y ago
  I won't do work for the Federal government, but I've worked with companies of all sizes in healthcare, manufacturing, finance, and utilities, and at none of them was it a norm that internal vulnerabilities be disclosed publicly. People keep saying that there are certain kinds of companies where you have to disclose, and I have come to the conclusion that they are simply making that up because it sounds good to them.
- wglb 8y ago
  With respect to just the possibility of a data leak might be something you're obligated to report on, I haven't heard of this being a real requirement. I would be curious to see links or evidence to the contrary.
jlarocco 8y ago
It's disappointing to see people defending Google on this. Whether the vulnerability was discovered internally or not, they were leaking people's data, and the responsible thing to do is tell them. Even if it's only a possibility, people have the right to know.
- wglb 8y ago
  There is no evidence that they were leaking people's data.
  - jlarocco 8y ago
    I don't think that's up for debate. Both the WSJ and Google's own engineers came to the conclusion that they were. If the data wasn't leaking there wouldn't be anything for Google to cover up in their memo. The only question left is who was affected, and Google doesn't know because they deleted the logs. The responsible thing to do would be notify everybody using that part of the service.
    - wglb 8y ago
      I agree that it is not up for debate. They did not lose any information. The google announcement here https://www.blog.google/technology/safety-security/project-strobe/ https://www.blog.google/technology/safety-security/project-s... says that they looked for leakages and We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused. The difference is between data being exposed and data being leaked. The difference is quite critical.
      - mtgx 8y ago
        They only "know" the data didn't leak in the 2 weeks prior to them finding out about it.
      - jlarocco 8y ago
        First, I don't think the difference between exposed and leaked matters with respect to whether they need to notify users about it. In any case, I don't believe their answer. Once the API response leaves the server with extra information there's no way for them to know which fields the caller looked at because it's all done client side.

kodablah 8y ago

> Three Republican senators have sent a letter to Google today demanding the company hand over an internal memo based on which Google decided to cover up a Google+ data leak instead of going public as most companies do. That's a loaded first sentence. Here's another way of writing it: "Three Republican senators have sent a letter to Google today asking the company to please provide internal memo based on which Google decided to not disclose a Google+ bug that could have leaked data instead of going public as very few companies would." Or break it up if that's too wordy. ZDNet and the writer of this article should be ashamed of themselves. How much more clearly can you out yourself as biased garbage? To the contents of the letter itself [0], just answer the 8 questions straight up, and give the memo. Doesn't appear like a witch hunt quite yet. On questions 3, 4, and 5 just make it clear that software bugs are rampant, many have the ability to get bad things when exploited, and on 6 either inundate them with a deluge of security bugs or explain that there are probably thousands. On #7, the answer better be an emphatic "yes" or I will be very disappointed. If it becomes more political, there needs to be legal requirements for disclosing all security vulns (instead of just exploited ones) or they need to recognize it's untenable to ask for them. Can't have it both ways and just pick a company's vuln because of an article about them and not ask other companies for theirs. 0 (PDF) - https://www.commerce.senate.gov/public/_cache/files/4852b311-0953-4ac8-ac43-a91dde229cc1/E300DA0C7659678AE0AE37AEB9746200.thune-wicker-moran-letter-to-google-10.11.18.pdf https://www.commerce.senate.gov/public/_cache/files/4852b311...

sololipsist 8y ago
> How much more clearly can you out yourself as biased garbage? Are you really surprised, or are you just pretending to be? This is par for the course for every major journalism outfit - from Fox to MSNBC down to NPR and PBS. There isn't a single major outlet, irrespective of funding model or platform, that isn't blatantly biased.
ccnafr 8y ago
> out yourself as biased garbage? Biased based on your opinion. I personally think this is a very big deal and I don't see anything wrong in that sentence. If you think Google is innocent, just look at the facts. 1) They had an internal memo discouraging public disclosure. 2) They only came clean with the leak after WSJ reached out for comment before the publication of a story. 3) They buried the "leak" announcement in a gigantic blog post. The blog post was meant to announce a new project, but about halfway through the middle they disclosed a data-leaking bug. I'd say the tone of the article is in response to Google's observed and recorded actions. Yeah, I'd say the article and letter's tone is just about right.

IX-103 8y ago

Since the "memo" is part of a discussion between lawyers and execs wouldn't the memo be considered privileged? That doesn't mean that Senators can't ask, but if you set the expectation of handing out privileged information whenever you're asked it kinda makes "privileged" communication not mean anything.

Bhilai 8y ago

Google admitted that they don't keep any logs around. So in the absence of logs, I am not sure how they are making the claim that their API was not abused. So there is definitely more transparency required about their internal investigation and how they are so certain. Just because Google has a great security team, I would not put my blind faith on them.

skybrian 8y ago
I don't believe they made that claim? They said they didn't have evidence that the API was abused.
- lmkg 8y ago
  They said that they kept logs for only two weeks, because the logs themselves contained private information. Those logs contained no evidence of abuse.
joshuamorton 8y ago
>Google admitted that they don't keep any logs around. They didn't say that, they stated that in the logs they had, which were not fully comprehensive, there was no evidence of abuse. > am not sure how they are making the claim that their API was not abused. They didn't claim this. But one could, for example, set up a honeypot and monitor any suspicious activity going forward, then if anyone attempted to abuse the vulnerability before it was publicized, they would know it might have been abused, but lack of use over a long timescale could give reasonable certainty that no one took advantage of the vuln. (I work at Google, but not on G+ and not on security).

sctb 8y ago

Previously: https://news.ycombinator.com/item?id=18212759 https://news.ycombinator.com/item?id=18212759.

fredgrott 8y ago

Its somewhat a miss-leading title.... Can you cover-up legal activity? No, of course not..non-story here