10 ms·

U.S. Government Compels Google To Hand Over Wikileaks Volunteer's Gmail Data

175 points by mcantelon 15y ago

zobzu 15y ago
tor developer didnt use tor ? odd.
- mkjones 15y ago
  Using tor wouldn't have helped anonymize his contact list.
chadp 15y ago
A good (but already known) reason to leave gmail.
- yanw 15y ago
  How is it a gmail only problem? The government got a court order to force them, Google didn't hand it over willingly. It's the government who is at fault here and the shitty laws that enable it.
  - Abundnce10 15y ago
    The article states that the government had a court order but didn't have a search warrant. It seems there is a loop in the system with the Electronic Communications Privacy Act. My questions is, did Google 'have' to give over his Gmail account information? Or do they just comply to make their lives easier?
    - fleitz 15y ago
      In today's society 'having to' and making your life easier is just about the same thing. Don't want to comply citizen? We do have those antitrust hearings scheduled in a few weeks, would be a shame if we found out you were running a monopoly and had to break up your company. When US citizens are assassinated by presidential order rather than being brought to trial it's probably time to 'make your life easier' rather than wait around for the ICC.
      - tripzilch 15y ago
        Interesting point. It's not unlikely that played a role in their decision not to fight it (too much).
    - tripzilch 15y ago
      The ISP Sonic fought against having to hand over the data and lost. Both Sonic and Google fought over the right to inform Mr. Appelbaum of the request for his data and won (afaik). The article says it is not known whether Google fought against having to hand over the data, like the ISP Sonic did. Which makes me assume the writers asked Google, they didn't answer, neither did they issue a press report one way or the other. Which leads me to believe that, no, Google did not fight the actual request and unlike the small ISP Sonic did just comply in order to make their lives easier. Of course it's just speculation but why else would we know about the other case Google did fight in this matter? Additionally, why would Google go through that trouble, they have no interest either way, and are not in the business of protecting their users from surveillance state governments. Apparently.
      - RobertKohr 15y ago
        Or they simply knew they were going to lose from the fact that they have already gone through this with similar cases. The law is the law, and they must comply.
    - yanw 15y ago
      The government doesn't need a search warrant to rummage through cloud data, that's the point.
  - wladimir 15y ago
    Right, it is a good reason for leaving all US services, just singling out gmail would be unfair. Too bad so many major ones are hosted in the US (or at least by US companies). We really need a less centralized internet... Otherwise, when the US turns into a loony military dictatorship it takes us all with it.
- inconditus 15y ago
  This only makes sense if you get a server at an off-shore host for mail, instead of using major email providers.
  - JoshTriplett 15y ago
    You speak of "off-shore" as though it represents some magically lawless region. As useful as that might be for these purposes, it doesn't exist. Your server will exist in some country. That country will have laws; those laws may or may not favor you. That country may or may not wish to refuse a US court order. Most countries are on fairly good terms with the US, and unlikely to say "no" to a request for evidence based on what looks like a standard legal investigation. Many of the countries not on good terms with the US rank pretty high on the list of places not well known for respecting rights, least of all privacy. And on top of all that, keeping a server outside the US does not render you personally immune to a US warrant if you remain in the US. (Most of the above applies for s/US/$country/g as well.) You're likely better off hosting a mail server here in the US, not actually storing any mail on it, downloading the mail immediately to a local mail store on an encrypted disk, and using encrypted email to protect new mails. That still won't render you immune to prosecution, but you might consider the consequences of refusing to decrypt a server preferable to the consequences of revealing the contents of your email. Or not.
    - guelo 15y ago
      I'm not a lawyer but I believe it would be very difficult for an FBI prosecutor to raise a case to international status and get a foreign judge to issue a subpoena. Most countries are very protective of spying on their citizens or corporations. I think the main danger of using a foreign host would be that the NSA has more spying leeway with international traffic so they probably will have already slurped and archived your mail off of the wire without needing to ask your mail host. SSL is supposed to help with that but I have my doubts that that stops the NSA if they want to target you.
    - meric 15y ago
      Or do the above, and then delete the mail. Not with the intention of destroying evidence of course, but because your hard disk can only store 1024 megabytes and you want to save disk space.
- artursapek 15y ago
  Hotmail would probably have had to do the same. The guy chose Gmail over Hotmail so people should leave Gmail? That's horrible logic.
GermTheGeek 15y ago
Now the question is: What major options do privacy advocates have apart from hosting their own mailservers?
- zobzu 15y ago
  gpg
- yanw 15y ago
  The slow and often fruitfulness process of changing the law.
- sashabables 15y ago
  hosting their own mailservers are great! http://soccerworldgame.com/ http://soccerworldgame.com/
- 01PH 15y ago
  Even if you host it yourself but at a regular hosting provider "they" might just confiscate your servers. Increasing email encryption usability might be the road out of this dilemma. Otherwise email encryption is going to stay within a very small circle of users.
  - GermTheGeek 15y ago
    When I said "Host your own" I meant on a physically secure box using full disk encryption. But I do like the idea of encryption, GPG does this really well already but key distribution is still a problem. Just an idea for a secure physical box: Throw in a external "always on" GPS receiver on the box and have it physically destroy the hard drive if it is outside of a certain area or if it detects a certain amount of movement (think someone removing it from a rack without disabling the service first). If your server was moved/confiscated it would ensure some safety. Just a tinfoil thought.
    - protomyth 15y ago
      When you say "physically destroy" do not use any form or anything that could be spun as a incinderary, explosive, or projectile device. The laws on those type of things will put you in prison for a long time.
cookiecaper 15y ago
Applebaum, a tor developer, is i am sure astute enough not to leave unencrypted mails on gmail. he is used to governmental abuse at airpoets etc., so i am sure he saw this coming.
- bdr 15y ago
  FYI it's "Appelbaum".
  - cookiecaper 15y ago
    Thanks. I typed that reply on my phone, so I don't remember if that was an autocorrect thing or if I just forgot how to spell it. Nevertheless, I appreciate the correction. :)
- kragen 15y ago
  He can't prevent people from sending him unencrypted emails on Gmail, except by not using Gmail, nor can he force Google to delete them.
  - cookiecaper 15y ago
    If he's receiving random emails they are probably not important or sensitive enough to be valuable to the government. If he's receiving non-random emails that contain sensitive data, it should all be encrypted. If you do get something important that is not encrypted, you can forward the mail to yourself as ciphertext. You're correct that Appelbaum has no control over Google's retention procedures.
    - kragen 15y ago
      The government did not request the contents of the mails in any case, but the header information: who Jake was communicating with, and when.
donohoe 15y ago
The headline is a little disingenuous (technically correct, yes...) - especially if thats all anyone ever reads. Google didn't hand this over on a whim, rather: The contacts list and IP address data of Jacob Appelbaum, a WikiLeaks volunteer and developer for Tor was given to the U.S. government after they requested it using a secret court order enabled by a controversial 1986 law called the Electronic Communications Privacy Act, according to the Wall Street Journal. The law allows the government to demand information from ISPs not only without a warrant, but without ever notifying the user. The problem/fault/remedy lies with the US gov, not so much the compelled company in this case.
- guelo 15y ago
  You wanted them to put that in the headline?
  - artursapek 15y ago
    I doubt donohoe wanted to put that in the headline, I think he is suggesting the tone of the headline doesn't accurately portray what happened.
  - waqf 15y ago
    It would have been easy to write a less disingenuous headline. For example, "U.S. Compelled Google To Hand Over Wikileaks Volunteer's Gmail Data."
    - nostrademons 15y ago
      That's what the headline reads now - what was it before?
      - abraham 15y ago
        Title on the article: > Google Hands Wikileaks Volunteer's Gmail Data to U.S. Government Implies that Google did so out of free will rather then being legally compelled to.
davidu 15y ago
I know Jake. I had the proud privilege of employing Jake. This is a fishing expedition, and an absolute abuse of the EPIC and PATRIOT acts. The NYT filed a lawsuit yesterday to try to start getting some transparency into these matters -- even Congress is urging people to find out the truth: http://www.techdirt.com/articles/20111010/04043716279/nytimes-sues-federal-government-refusing-to-reveal-its-secret-interpretation-patriot-act.shtml http://www.techdirt.com/articles/20111010/04043716279/nytime... People can dislike Wikileaks all they want, but this is exactly why they exist. The raw information is not being released and they see fit to do so. When the USG has a law on the books that congress passed but the DoJ won't share their interpretation of what the law means, you know something is very very wrong. (see: http://en.wikipedia.org/wiki/The_Trial http://en.wikipedia.org/wiki/The_Trial )
guelo 15y ago
Maybe Americans should use European hosts and Europeans can use American ones. Does anyone know of any good international webmail providers, with SSL?
- yaix 15y ago
  They interchange all kinds of information. Maybe we should all use Icelandic hosts.
- idonthack 15y ago
  Try hushmail, and/or use your webmail through tor. Also check out this list of VPNs: http://torrentfreak.com/which-vpn-providers-really-take-anonymity-seriously-111007/ http://torrentfreak.com/which-vpn-providers-really-take-anon...
- cookiecaper 15y ago
  My understanding is that using a non-domestic service would actually make it much easier to retain data under traditional espionage procedures. Perhaps this is incorrect. Clarifications welcome.
  - andrewcooke 15y ago
    it doesn't make any difference. you us citizens are being tapped just the same as all us evil foreign terrorists these days. https://www.eff.org/issues/nsa-spying https://www.eff.org/issues/nsa-spying
    - cookiecaper 15y ago
      I'm aware of the illegal NSA spying, but surely they're still somewhat more cautious about deploying domestic surveillance. Going overseas makes it all legal and OK, here they at least theoretically are not supposed to be doing things, and that's better than nothing, right?
      - andrewcooke 15y ago
RexRollman 15y ago
It fairness to Google, they fought this, and they are part of Digital Due Process, a group that is trying to get this law changed. http://www.digitaldueprocess.org/ http://www.digitaldueprocess.org/
sudonim 15y ago
From comments here, it looks like there aren't good options for secure email outside of the jurisdiction of the US government. I've been interested in setting this up for myself. If you're interested, let me know on this form, and I'll begin looking into the issues of where to host, and what legal structures I'd need to set up. https://ianap.wufoo.com/forms/do-you-want-secure-private-email/ https://ianap.wufoo.com/forms/do-you-want-secure-private-ema...
- cookiecaper 15y ago
  If the US decides it wants access to your accounts, I don't think putting a server in another country will be enough to stop them. The real answer to this and all other serious privacy issues is to use strong cryptography properly. There's no two ways about it. Anything that isn't encrypted before it sees a NIC should essentially be considered a public broadcast.
linuxhansl 15y ago
Would someone please remind me when Wikileaks was convicted or even accused of a crime? That's right: Neither ever happened. What is going on in this country? Is the desire to operate in the dark, to work behind the backs of the very people that this government represents so strong, that any organization shining light on this must be squashed?
RobertKohr 15y ago
Interestingly www.torproject.org is currently down... I don't know if this is related.
- RobertKohr 15y ago
  As is http://www.appelbaum.net/ http://www.appelbaum.net/ (his website)
natch 15y ago
Dear Google, There must be ways to protect user privacy that are better than collecting everything in a form that can just be handed over. Example: encrypt on the client side, with user-supplied, large, non-compromised keys, and don't ever inspect the data on the server. If you need to inspect data in order to serve relevant ads, do it on the client, and only send back enough information to tailor whatever ads are currently available. Maybe do the ad selection on the client too. If this doesn't work for one of your services, consider it for other services where it would work. Laws prevent you from providing service X without providing such-and-such a hook? Then don't provide service X. Provide a plugin framework instead, and let users bring their own service. Use your heads. Maybe use a bit of the compute power the client has available. You spun down a lot of your China presence because of stuff like this, supposedly. You should be able to take big steps anywhere, not just in China. You are smart. Figure. It. Out.

175 points by mcantelon 15y ago

zobzu 15y ago

tor developer didnt use tor ? odd.

mkjones 15y ago
Using tor wouldn't have helped anonymize his contact list.

chadp 15y ago

A good (but already known) reason to leave gmail.

yanw 15y ago
How is it a gmail only problem? The government got a court order to force them, Google didn't hand it over willingly. It's the government who is at fault here and the shitty laws that enable it.
- Abundnce10 15y ago
  The article states that the government had a court order but didn't have a search warrant. It seems there is a loop in the system with the Electronic Communications Privacy Act. My questions is, did Google 'have' to give over his Gmail account information? Or do they just comply to make their lives easier?
  - fleitz 15y ago
    In today's society 'having to' and making your life easier is just about the same thing. Don't want to comply citizen? We do have those antitrust hearings scheduled in a few weeks, would be a shame if we found out you were running a monopoly and had to break up your company. When US citizens are assassinated by presidential order rather than being brought to trial it's probably time to 'make your life easier' rather than wait around for the ICC.
    - tripzilch 15y ago
      Interesting point. It's not unlikely that played a role in their decision not to fight it (too much).
  - tripzilch 15y ago
    The ISP Sonic fought against having to hand over the data and lost. Both Sonic and Google fought over the right to inform Mr. Appelbaum of the request for his data and won (afaik). The article says it is not known whether Google fought against having to hand over the data, like the ISP Sonic did. Which makes me assume the writers asked Google, they didn't answer, neither did they issue a press report one way or the other. Which leads me to believe that, no, Google did not fight the actual request and unlike the small ISP Sonic did just comply in order to make their lives easier. Of course it's just speculation but why else would we know about the other case Google did fight in this matter? Additionally, why would Google go through that trouble, they have no interest either way, and are not in the business of protecting their users from surveillance state governments. Apparently.
    - RobertKohr 15y ago
      Or they simply knew they were going to lose from the fact that they have already gone through this with similar cases. The law is the law, and they must comply.
  - yanw 15y ago
    The government doesn't need a search warrant to rummage through cloud data, that's the point.
- wladimir 15y ago
  Right, it is a good reason for leaving all US services, just singling out gmail would be unfair. Too bad so many major ones are hosted in the US (or at least by US companies). We really need a less centralized internet... Otherwise, when the US turns into a loony military dictatorship it takes us all with it.
inconditus 15y ago
This only makes sense if you get a server at an off-shore host for mail, instead of using major email providers.
- JoshTriplett 15y ago
  You speak of "off-shore" as though it represents some magically lawless region. As useful as that might be for these purposes, it doesn't exist. Your server will exist in some country. That country will have laws; those laws may or may not favor you. That country may or may not wish to refuse a US court order. Most countries are on fairly good terms with the US, and unlikely to say "no" to a request for evidence based on what looks like a standard legal investigation. Many of the countries not on good terms with the US rank pretty high on the list of places not well known for respecting rights, least of all privacy. And on top of all that, keeping a server outside the US does not render you personally immune to a US warrant if you remain in the US. (Most of the above applies for s/US/$country/g as well.) You're likely better off hosting a mail server here in the US, not actually storing any mail on it, downloading the mail immediately to a local mail store on an encrypted disk, and using encrypted email to protect new mails. That still won't render you immune to prosecution, but you might consider the consequences of refusing to decrypt a server preferable to the consequences of revealing the contents of your email. Or not.
  - guelo 15y ago
    I'm not a lawyer but I believe it would be very difficult for an FBI prosecutor to raise a case to international status and get a foreign judge to issue a subpoena. Most countries are very protective of spying on their citizens or corporations. I think the main danger of using a foreign host would be that the NSA has more spying leeway with international traffic so they probably will have already slurped and archived your mail off of the wire without needing to ask your mail host. SSL is supposed to help with that but I have my doubts that that stops the NSA if they want to target you.
  - meric 15y ago
    Or do the above, and then delete the mail. Not with the intention of destroying evidence of course, but because your hard disk can only store 1024 megabytes and you want to save disk space.
artursapek 15y ago
Hotmail would probably have had to do the same. The guy chose Gmail over Hotmail so people should leave Gmail? That's horrible logic.

GermTheGeek 15y ago

Now the question is: What major options do privacy advocates have apart from hosting their own mailservers?

zobzu 15y ago
gpg
yanw 15y ago
The slow and often fruitfulness process of changing the law.
sashabables 15y ago
hosting their own mailservers are great! http://soccerworldgame.com/ http://soccerworldgame.com/
01PH 15y ago
Even if you host it yourself but at a regular hosting provider "they" might just confiscate your servers. Increasing email encryption usability might be the road out of this dilemma. Otherwise email encryption is going to stay within a very small circle of users.
- GermTheGeek 15y ago
  When I said "Host your own" I meant on a physically secure box using full disk encryption. But I do like the idea of encryption, GPG does this really well already but key distribution is still a problem. Just an idea for a secure physical box: Throw in a external "always on" GPS receiver on the box and have it physically destroy the hard drive if it is outside of a certain area or if it detects a certain amount of movement (think someone removing it from a rack without disabling the service first). If your server was moved/confiscated it would ensure some safety. Just a tinfoil thought.
  - protomyth 15y ago
    When you say "physically destroy" do not use any form or anything that could be spun as a incinderary, explosive, or projectile device. The laws on those type of things will put you in prison for a long time.

cookiecaper 15y ago

Applebaum, a tor developer, is i am sure astute enough not to leave unencrypted mails on gmail. he is used to governmental abuse at airpoets etc., so i am sure he saw this coming.

bdr 15y ago
FYI it's "Appelbaum".
- cookiecaper 15y ago
  Thanks. I typed that reply on my phone, so I don't remember if that was an autocorrect thing or if I just forgot how to spell it. Nevertheless, I appreciate the correction. :)
kragen 15y ago
He can't prevent people from sending him unencrypted emails on Gmail, except by not using Gmail, nor can he force Google to delete them.
- cookiecaper 15y ago
  If he's receiving random emails they are probably not important or sensitive enough to be valuable to the government. If he's receiving non-random emails that contain sensitive data, it should all be encrypted. If you do get something important that is not encrypted, you can forward the mail to yourself as ciphertext. You're correct that Appelbaum has no control over Google's retention procedures.
  - kragen 15y ago
    The government did not request the contents of the mails in any case, but the header information: who Jake was communicating with, and when.

donohoe 15y ago

The headline is a little disingenuous (technically correct, yes...) - especially if thats all anyone ever reads. Google didn't hand this over on a whim, rather: The contacts list and IP address data of Jacob Appelbaum, a WikiLeaks volunteer and developer for Tor was given to the U.S. government after they requested it using a secret court order enabled by a controversial 1986 law called the Electronic Communications Privacy Act, according to the Wall Street Journal. The law allows the government to demand information from ISPs not only without a warrant, but without ever notifying the user. The problem/fault/remedy lies with the US gov, not so much the compelled company in this case.

guelo 15y ago
You wanted them to put that in the headline?
- artursapek 15y ago
  I doubt donohoe wanted to put that in the headline, I think he is suggesting the tone of the headline doesn't accurately portray what happened.
- waqf 15y ago
  It would have been easy to write a less disingenuous headline. For example, "U.S. Compelled Google To Hand Over Wikileaks Volunteer's Gmail Data."
  - nostrademons 15y ago
    That's what the headline reads now - what was it before?
    - abraham 15y ago
      Title on the article: > Google Hands Wikileaks Volunteer's Gmail Data to U.S. Government Implies that Google did so out of free will rather then being legally compelled to.

davidu 15y ago

I know Jake. I had the proud privilege of employing Jake. This is a fishing expedition, and an absolute abuse of the EPIC and PATRIOT acts. The NYT filed a lawsuit yesterday to try to start getting some transparency into these matters -- even Congress is urging people to find out the truth: http://www.techdirt.com/articles/20111010/04043716279/nytimes-sues-federal-government-refusing-to-reveal-its-secret-interpretation-patriot-act.shtml http://www.techdirt.com/articles/20111010/04043716279/nytime... People can dislike Wikileaks all they want, but this is exactly why they exist. The raw information is not being released and they see fit to do so. When the USG has a law on the books that congress passed but the DoJ won't share their interpretation of what the law means, you know something is very very wrong. (see: http://en.wikipedia.org/wiki/The_Trial http://en.wikipedia.org/wiki/The_Trial )

guelo 15y ago

Maybe Americans should use European hosts and Europeans can use American ones. Does anyone know of any good international webmail providers, with SSL?

yaix 15y ago
They interchange all kinds of information. Maybe we should all use Icelandic hosts.
idonthack 15y ago
Try hushmail, and/or use your webmail through tor. Also check out this list of VPNs: http://torrentfreak.com/which-vpn-providers-really-take-anonymity-seriously-111007/ http://torrentfreak.com/which-vpn-providers-really-take-anon...
cookiecaper 15y ago
My understanding is that using a non-domestic service would actually make it much easier to retain data under traditional espionage procedures. Perhaps this is incorrect. Clarifications welcome.
- andrewcooke 15y ago
  it doesn't make any difference. you us citizens are being tapped just the same as all us evil foreign terrorists these days. https://www.eff.org/issues/nsa-spying https://www.eff.org/issues/nsa-spying
  - cookiecaper 15y ago
    I'm aware of the illegal NSA spying, but surely they're still somewhat more cautious about deploying domestic surveillance. Going overseas makes it all legal and OK, here they at least theoretically are not supposed to be doing things, and that's better than nothing, right?
    - andrewcooke 15y ago

RexRollman 15y ago

It fairness to Google, they fought this, and they are part of Digital Due Process, a group that is trying to get this law changed. http://www.digitaldueprocess.org/ http://www.digitaldueprocess.org/

sudonim 15y ago

From comments here, it looks like there aren't good options for secure email outside of the jurisdiction of the US government. I've been interested in setting this up for myself. If you're interested, let me know on this form, and I'll begin looking into the issues of where to host, and what legal structures I'd need to set up. https://ianap.wufoo.com/forms/do-you-want-secure-private-email/ https://ianap.wufoo.com/forms/do-you-want-secure-private-ema...

cookiecaper 15y ago
If the US decides it wants access to your accounts, I don't think putting a server in another country will be enough to stop them. The real answer to this and all other serious privacy issues is to use strong cryptography properly. There's no two ways about it. Anything that isn't encrypted before it sees a NIC should essentially be considered a public broadcast.

linuxhansl 15y ago

Would someone please remind me when Wikileaks was convicted or even accused of a crime? That's right: Neither ever happened. What is going on in this country? Is the desire to operate in the dark, to work behind the backs of the very people that this government represents so strong, that any organization shining light on this must be squashed?

RobertKohr 15y ago

Interestingly www.torproject.org is currently down... I don't know if this is related.

RobertKohr 15y ago
As is http://www.appelbaum.net/ http://www.appelbaum.net/ (his website)

natch 15y ago

Dear Google, There must be ways to protect user privacy that are better than collecting everything in a form that can just be handed over. Example: encrypt on the client side, with user-supplied, large, non-compromised keys, and don't ever inspect the data on the server. If you need to inspect data in order to serve relevant ads, do it on the client, and only send back enough information to tailor whatever ads are currently available. Maybe do the ad selection on the client too. If this doesn't work for one of your services, consider it for other services where it would work. Laws prevent you from providing service X without providing such-and-such a hook? Then don't provide service X. Provide a plugin framework instead, and let users bring their own service. Use your heads. Maybe use a bit of the compute power the client has available. You spun down a lot of your China presence because of stuff like this, supposedly. You should be able to take big steps anywhere, not just in China. You are smart. Figure. It. Out.