5 ms·

I'm sure the US government DOES have spies working inside Google as we speak

by thechut 14y ago

GHFigs 14y ago
You're sure?
jballanc 14y ago
I'm sure the US doesn't need to bother wasting the resources required to train and embed a spy when a lawyer with a subpoena will do...
- alexgartrell 14y ago
  I know that this is a pot shot against the American legal system (especially with regard to copyright stuff), but it really makes no sense. A spy would likely be no more expensive than a legal team (in fact, he'd be subsidized by his salary at Google) and would be monumentally more effective and secretive. Beyond that, the hard part of training a spy to get into Google would be getting a good enough computer science student involved. From there, it's really just a matter of teaching them to cover their tracks semi-intelligently. However, given what I'm sure is a mountain of completely legitimate reasons to look at user data (for example, to resolve data corruption, investigate malicious users, etc.) and an inconceivably larger mountain of user data to look at, I don't actually think it'd be that hard to get away with it.
  - neurotech1 14y ago
    A surprisingly few people at Google have the authorized access to read a users GMail mailbox. It would mainly be the GMail Site Reliability Engineers, and support teams. The developers usually don't access to peoples inboxes. Any support/SRE/developer access to a users' GMail mailbox would be logged and if they exceeded their authorized access by such as accessing a "public" persons email, They'd be fired pretty quickly.
    - alexgartrell 14y ago
      I'm sure the auditing and control is more than enough to stop your average creeper employee from reading normal people's inboxes, but I very much doubt that it's enough to stop a very smart, very determined spy from doing the same. At the end of the day, someone has root, and that guy can do pretty much anything. I'm confident that Google is doing a better job than pretty much anyone else, but this problem is a more or less unsolvable one. Edited to add that another interesting idea is that the people who man the DC's are actually pretty sparse (relatively few people for a lot of servers) so it's not inconceivable that one could trigger a failure on an important box, take down a replica of the figure's mailbox, swap out the drive for RMA and then do a quick copy. I bet this would be easy. I guess my point is that no level of internal controls at any company can actually stop a determined government. If that were true, governments, which are much more paranoid than tech companies, would have eradicated spying a long time ago.
      - adestefan 14y ago
        Wow are people over-thinking this. Once again XKCD to the rescue. http://xkcd.com/538/ http://xkcd.com/538/
      - Athas 14y ago
        > At the end of the day, someone has root, and that guy can do pretty much anything. I do not disagree with your overall assessment, but this is not strictly true. Most good real-world security schemes don't follow the 'root is God'-model of Unix, and for good reason. It's perfectly possible to design a system where each operation performed by a "superuser" must be validated, or at least logged.
        walshemj 14y ago
        But does Google follow best practice or did they invent their own half-assed method - the evidence from the way the Chinese hacked them is the latter. If Google were serious they should have brought out Bruces company Counterpane and put him in charge of security.
  - kirian 14y ago
    Probably easier to recruit someone already inside Google than train a computer scientist spy and hope they manage to get hired by Google.
    - troels 14y ago
      Ha .. We had the exact same thought there ;)
  - troels 14y ago
    Why train a spy, when you can just bribe someone already on the inside?
    - gojomo 14y ago
      Why pick just one when you can afford both? Penetration in depth.
      - comex 14y ago
        Because if just one agent gets caught, you're looking at a nightmarish scandal.
    - TeMPOraL 14y ago
      You could bribe ("recruit") someone inside to spy for you...
  - tsotha 14y ago
    >I know that this is a pot shot against the American legal system (especially with regard to copyright stuff), but it really makes no sense. A spy would likely be no more expensive than a legal team (in fact, he'd be subsidized by his salary at Google) and would be monumentally more effective and secretive. A spy would also be illegal and, more importantly, potentially very embarrassing politically. It should be clear to anyone by now, the US government doesn't care about cost or efficiency. And further, there are secret court proceedings for national security kinds of cases (of which there are literally hundreds at any given time), so there's no secrecy advantage.
    - walshemj 14y ago
      UM you know governments have exemptions to those laws in fact these days all western TLA's have a statutory basis took a while in the UK's case mind you.
      - tsotha 14y ago
        The US government has no such exemption. They can't put an agent into a domestic company unless there's some evidence the company is deliberately breaking the law.
        walshemj 14y ago
        Thats why a I mentioned statutory if for example the FBI had suspicions that the KGB/SVR or another state had agents within a company they would take action and they have caught a number of spies doing this. The KGB back in the day had an entire department Line X that was dedicated to industrial espionage - Putin apparently was in this Department
ImprovedSilence 14y ago
I'm sure the US doesn't need spys working in Google. I'm sure there is systemic collaboration with the NSA, to the point where they don't need spys "working" for google. Also, I think actual spys are placed much closer to personal sources of information, not technical. If that makes any sense. I guess I'm trying to say is, if you are going after computer information, you're going to get it from the outside. If you're going after people information, you're going to have a guy on the ground.

I'm sure the US government DOES have spies working inside Google as we speak

by thechut 14y ago

I'm sure the US government DOES have spies working inside Google as we speak

GHFigs 14y ago

You're sure?

jballanc 14y ago

I'm sure the US doesn't need to bother wasting the resources required to train and embed a spy when a lawyer with a subpoena will do...

alexgartrell 14y ago
I know that this is a pot shot against the American legal system (especially with regard to copyright stuff), but it really makes no sense. A spy would likely be no more expensive than a legal team (in fact, he'd be subsidized by his salary at Google) and would be monumentally more effective and secretive. Beyond that, the hard part of training a spy to get into Google would be getting a good enough computer science student involved. From there, it's really just a matter of teaching them to cover their tracks semi-intelligently. However, given what I'm sure is a mountain of completely legitimate reasons to look at user data (for example, to resolve data corruption, investigate malicious users, etc.) and an inconceivably larger mountain of user data to look at, I don't actually think it'd be that hard to get away with it.
- neurotech1 14y ago
  A surprisingly few people at Google have the authorized access to read a users GMail mailbox. It would mainly be the GMail Site Reliability Engineers, and support teams. The developers usually don't access to peoples inboxes. Any support/SRE/developer access to a users' GMail mailbox would be logged and if they exceeded their authorized access by such as accessing a "public" persons email, They'd be fired pretty quickly.
  - alexgartrell 14y ago
    I'm sure the auditing and control is more than enough to stop your average creeper employee from reading normal people's inboxes, but I very much doubt that it's enough to stop a very smart, very determined spy from doing the same. At the end of the day, someone has root, and that guy can do pretty much anything. I'm confident that Google is doing a better job than pretty much anyone else, but this problem is a more or less unsolvable one. Edited to add that another interesting idea is that the people who man the DC's are actually pretty sparse (relatively few people for a lot of servers) so it's not inconceivable that one could trigger a failure on an important box, take down a replica of the figure's mailbox, swap out the drive for RMA and then do a quick copy. I bet this would be easy. I guess my point is that no level of internal controls at any company can actually stop a determined government. If that were true, governments, which are much more paranoid than tech companies, would have eradicated spying a long time ago.
    - adestefan 14y ago
      Wow are people over-thinking this. Once again XKCD to the rescue. http://xkcd.com/538/ http://xkcd.com/538/
    - Athas 14y ago
      > At the end of the day, someone has root, and that guy can do pretty much anything. I do not disagree with your overall assessment, but this is not strictly true. Most good real-world security schemes don't follow the 'root is God'-model of Unix, and for good reason. It's perfectly possible to design a system where each operation performed by a "superuser" must be validated, or at least logged.
      - walshemj 14y ago
        But does Google follow best practice or did they invent their own half-assed method - the evidence from the way the Chinese hacked them is the latter. If Google were serious they should have brought out Bruces company Counterpane and put him in charge of security.
- kirian 14y ago
  Probably easier to recruit someone already inside Google than train a computer scientist spy and hope they manage to get hired by Google.
  - troels 14y ago
    Ha .. We had the exact same thought there ;)
- troels 14y ago
  Why train a spy, when you can just bribe someone already on the inside?
  - gojomo 14y ago
    Why pick just one when you can afford both? Penetration in depth.
    - comex 14y ago
      Because if just one agent gets caught, you're looking at a nightmarish scandal.
  - TeMPOraL 14y ago
    You could bribe ("recruit") someone inside to spy for you...
- tsotha 14y ago
  >I know that this is a pot shot against the American legal system (especially with regard to copyright stuff), but it really makes no sense. A spy would likely be no more expensive than a legal team (in fact, he'd be subsidized by his salary at Google) and would be monumentally more effective and secretive. A spy would also be illegal and, more importantly, potentially very embarrassing politically. It should be clear to anyone by now, the US government doesn't care about cost or efficiency. And further, there are secret court proceedings for national security kinds of cases (of which there are literally hundreds at any given time), so there's no secrecy advantage.
  - walshemj 14y ago
    UM you know governments have exemptions to those laws in fact these days all western TLA's have a statutory basis took a while in the UK's case mind you.
    - tsotha 14y ago
      The US government has no such exemption. They can't put an agent into a domestic company unless there's some evidence the company is deliberately breaking the law.
      - walshemj 14y ago
        Thats why a I mentioned statutory if for example the FBI had suspicions that the KGB/SVR or another state had agents within a company they would take action and they have caught a number of spies doing this. The KGB back in the day had an entire department Line X that was dedicated to industrial espionage - Putin apparently was in this Department

ImprovedSilence 14y ago

I'm sure the US doesn't need spys working in Google. I'm sure there is systemic collaboration with the NSA, to the point where they don't need spys "working" for google. Also, I think actual spys are placed much closer to personal sources of information, not technical. If that makes any sense. I guess I'm trying to say is, if you are going after computer information, you're going to get it from the outside. If you're going after people information, you're going to have a guy on the ground.