10 ms·

Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand ove

by Dove 13y ago

Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. I'm not sure how much more strongly you'd like that worded. It seems pretty complete to me.

mullingitover 13y ago
It's exactly the kind of denial you'd expect them to issue if they were legally required to deny any involvement.
- cheald 13y ago
  I agree, but what could Page say to convince us otherwise? Either the government is coercing them, and they have to issue lies as denials, or they are participating voluntarily and are voluntarily lying, or they are not participating. The second option seems unlikely to me.
  - mpyne 13y ago
    Well, you can't prove a negative so I'm not sure there's anything Page can say. But at the same time they can't all be right. NSA says it's getting data in some form from Google, Page says no direct access. The truth is probably somewhere in the middle then... but where?
    - cheald 13y ago
      I'm 100% with you. I don't know what Page could say, and I agree that it's extremely likely that the truth is somewhere in the middle, but damned if any of us have any ability to actually suss out what that is. It's very frustrating. I just think it's important to not be entirely cynical here, and to keep in mind what such a statement might look like if it were being truthful. I don't know how much different it might be, which generally makes the statement only as good as Larry Page's word, and only then if he doesn't have a gun to his head.
    - anon808 13y ago
      The truth comes from the source that wasn't intended to be public.
    - dragonwriter 13y ago
      I don't know why we'd expect the truth to be in the middle. If the NSA document is genuine, the information the NSA is collecting from Google is part of a Top Secret program as described in the leaked internal document. If that is true, why would we expect that Google officials would be able to make any public confirmation of the Top Secret program? And, given that, why, in that case, would we expect the truth to be "in the middle"? Conversely, if the leaked document is not genuine, then I still don't see any basis for expecting the truth to be in the "middle" between the false document and the Google denial.
      - dwild 13y ago
        Did I miss some information? I only saw two slides. One that show the potential data accessible and one that show when the companies were added. It doesn't say exactly that they had access to everything. As far as we know PRISM can simply be there to centralize the information that the NSA got in legals ways. We do know that the government ask about 100 users account information each day to Google, we can guess that they do the same to every company on that list and they were all added to PRISM at the date you can find on the slides. I mean that slide contains one of the most important information that we currently have to guess the magnitude of PRISM, the budget. They only need 20 millions $ every years. True data mining is much more expensive than that.
    - bilbo0s 13y ago
      I don't know how many of us served as officers in the military, but the requisite action in this situation is pretty clear. If one is interested in day to day security, speaking from a strictly tactical perspective: You assume Google is giving the NSA information and act accordingly. Doubts are like bothersome flies... until they are crushed... you will never be comfortable at your current position.
    - darkarmani 13y ago
      > NSA says it's getting data in some form from Google, Page says no direct access. Page says no direct access and not even legal access at that scale (verizon). He doesn't say they don't have any access -- in fact he says they comply within the bounds of law, but it's not at the Verizon scale.
  - sjs382 13y ago
    We obviously stil have a lot to learn about PRISM... But with that said, I have some conflicting instincts & feelings about all of this and the company responses. On one hand, I would think a very-visible CEO of a major corp would keep their name off of a press release, if the press release was a lie that they were compelled to tell by the government. On the other hand, I feel like each company's response and their use of the exact same terminology ("direct access", etc) feels like a wink and a nod.
    - cheald 13y ago
      I completely agree, and I don't know how to reconcile the two. If I was going to go completely conspiracy-nutter, I'd say that Page has been kept out of the loop intentionally for plausible deniability, and the actual incursion happens at a much lower level, where the people involved are coerced into keeping their mouths shut. That way, the bigwigs get to tell what they think is the truth, the NSA gets their data, and nobody is the wiser. Granted, I think that belongs more in the plot of a thriller novel than in this actual world we're living in, but given the revelations of the past couple of days, fiction doesn't seem that implausible.
      - deleted 13y ago
        [deleted]
    - sinnerswing 13y ago
      This may not be PRISM, but wtf is this??? "A US government-mandated backdoor allowed China to hack into Gmail" "In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access." http://www.cnn.com/2010/OPINION/01/23/schneier.google.hacking/index.html http://www.cnn.com/2010/OPINION/01/23/schneier.google.hackin...
      - gohrt 13y ago
        Schneier is a smart guy, but he provides no evidence, links, or conjecture of what this backdoor may be. Maybe those hackers just used the regular tech support "back door", as in "SELECT * FROM gmail where email = 'target@gmail.com'
  - ket 13y ago
    > or they are participating voluntarily and are voluntarily lying, ... seems unlikely to me. Their business is based on user's data. If you do not feel comfortable giving them your data, it might hurt their business. Hence, IMHO, they do have some incentive to deny PRISM, regardless of the facts.
  - declan 13y ago
    Or the news organizations summarizing the leaked slides got it wrong.
- rasterizer 13y ago
  That's not true, in Verizon's case they just said that they are under a gag-order: http://publicpolicy.verizon.com/blog/entry/from-the-desk-of-randy-milch http://publicpolicy.verizon.com/blog/entry/from-the-desk-of-...
- ttrreeww 13y ago
  There are cases in which you can't even confirm the existence of a gag order. I can not believe it's constitutional... but they do it.
  - SilasX 13y ago
    What about the strategy you hear about of getting around this? Where they say "we're not under a gag order" (or whatever) each day until they are, until they go under a gag order, at which point it reveals they are. Now, I'm not so naive to think that if someone tried this, the government and courts would just say "Herp, derp, you sure outfoxed us there!" But has that strategy ever been tested in court?
    - ttrreeww 13y ago
      I'd imaging it'd get you a free one way ticket to Cuba, not charged.
    - bigiain 13y ago
      Rsync.net does this: http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt And they note: This scheme is not infallible. Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations. The news clip in the signed message serves to demonstrate that that update could not have been created prior to that date. It shows that a series of these updates were not created in advance and posted on this page.
- colin_jack 13y ago
  One thing we know for sure is the truth of what they have been doing will leak out.
- davidmr 13y ago
  I've never heard it said that anyone was required to deny involvement. Did you mean that exactly as you wrote? I think there's a world of difference between a gag order where you are not allowed to confirm, and an order to explicitly deny involvement. I'm not saying the former is "good", but there's a difference.
  - bigiain 13y ago
    OK, I'll say it. I think there's a non-zero probability that there are US government agencies who can and have compelled people to explicitly deny something that they know is true. Realistically, it would boggle my mind to discover they'd done that to all the founders/CEOs/legal departments of all the companies involved here (at least Google/Facebook/Apple/Yahoo/AOL), but given the stakes in this game - I have no doubt that it _could_ be done.
- danso 13y ago
  No, it's not. Gag orders can also be satisfied by saying "no comment" or just not saying anything at all, which is differently then actively denying something.
- Dove 13y ago
  That's moving the goalposts, though. The initial assertion -- that this is a cleverly-worded non-denial -- doesn't hold up with the text. Page is clearly and unambiguously denying that Google supplies any information to the government on a millions-of-users scale. Saying that denial is a lie . . . is a completely different charge.
  - deleted 13y ago
    [deleted]
  - white_devil 13y ago
    > Page is clearly and unambiguously denying that Google supplies any information to the government on a millions-of-users scale. Kind of like Mariano Rajoy insisted that Spain didn't need a bailout?
    - adventured 13y ago
      And the Federal Reserve said there was no real estate bubble to worry about. And the banks were well capitalized.
      - magicalist 13y ago
        Yes, and murderers always insist that they're innocent. QED. We've got them now!
  - hotpockets 13y ago
    Google could be searching email for certain series of characters, like "xxxx obama" and handing that over. Perhaps NSA supplies google a list of phrases to look for.
- Dove 13y ago
  I don't think so. Those usually sound like, "We cannot confirm or deny the existence of such a program," or "It is not our policy to comment on national security topics" or "No comment." or even "We'll wait for the results of the investigation." I don't think the government generally asks civilians to lie so enthusiastically, because . . . well, as a rule, they just aren't good at it. No, I think it's most likely that Page doesn't know of any such program. Now, it's always possible that such a thing is being carried out on the scale everyone fears by a rogue, loyal-to-the-NSA employee, or a group of them. Or it's possible the original Powerpoint slide including Google as an information source is oversimplified or even inaccurate. Such things do happen when presenting overviews of program capabilities. And many other things in between are possible. It's concerning, but . . . I'll wait for the results of the investigation. ;)
  - mullingitover 13y ago
    It's also possible that Larry is concerned about his share price, and what would happen to it if Google was revealed to be completely in bed with the NSA (My guess is it would fall quite a bit). He has real money at stake in limiting the damage that comes from this revelation.
    - Avenger42 13y ago
      The fallout in such a case has to be smaller than it would be if it comes out later that, not only were they in bed with the NSA, they (and the other companies in this situation) blatantly lied about it with their statements today.
      - bigiain 13y ago
        I guess keeping an eye out for Larry (et al) cashing out shares over the next few weeks/months might be a good indicator of the likelyhood of exactly that "coming out later".
        gohrt 13y ago
- declan 13y ago
  This is a false assumption. AT&T did not deny opening its networks to the NSA during the EFF litigation. It simply declined to comment, and offered suggestions (which I wrote about at the time) about how the law allowed it to comply with such a secret court order. It's the opposite of what Larry Page is doing.
- Matt_Cutts 13y ago
  Really? You don't see any difference between the denial posted by Google's CEO vs. the way that (say) Verizon responded? Here's Verizon's response: http://www.businessinsider.com/verizons-memo-to-workers-about-nsa-2013-6 http://www.businessinsider.com/verizons-memo-to-workers-abou...
  - ynniv 13y ago
    A better carefully worded response is still a carefully worded response. Google is in a difficult place because we all expected this to be happening, there are now documents suggesting that it has been happening, and no one takes at face value anything that sounds like a lawyer wrote it. EDIT: I mean: (a) No one cares if they have heard about a program called "PRISM" when the point of that program is to aggregate data from other programs. (b) Anyone who is actually innocent in this needs to stop mentioning "direct access to servers": no one expects this program to be directly accessing servers. (c) We also don't care whether actions were "in accordance with the law", as the constitutionality of the surrounding laws is part of the debate. I will say that "Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false." is a good statement to make. It sounds broad in a good way and doesn't appear to have many weasel words, other than specifying "Internet activity" and not email or general activity. Are Google searches even "Internet activity", or is he referring to Google Analytics / Google +1 / 8.8.8.8 DNS?
    - solnyshok 13y ago
      "direct access to servers" looks suspicios to me as well. However, maybe several dozen lawyers had no clue how to react today, and they just copied one another's text?
      - Matt_Cutts 13y ago
        More likely: the first paragraph from the Guardian and the Washington Post both emphasized "direct" access. See the picture here: http://cl.ly/image/2S3i1g2W2R2k http://cl.ly/image/2S3i1g2W2R2k If you're refuting claims of behavior X, it's natural to say "We don't do behavior X."
- sullivandanny 13y ago
  No, it's not. What little we've had about super-secret legal requests isn't that companies have to lie about them. It's that they can't acknowledge them at all. So the answer they give when asked, and they do get asked, is "no comment." If they were voluntarily part of PRISM, and legally required to keep that quiet, I'd expect them to say "no comment." Doing the opposite make so little sense. It means they're having to flat-out lie to their users, something very hard to recover from.
  - RWeaver 13y ago
    The thing is "no comment" would basically confirm that 'something' is happening that's secret. Everyone would go conspiracy wild and pull everything they have away from Google. They probably want to confirm it, but in a completely open and transparent way that assures people there's nothing they should fear here, which they can't do because it's all cloaked in secrecy.
boi_v2 13y ago
Well, I guess he will have to find a proper way to prove it, because if you are satisfied with just a blog post maybe you should think again.
- stinkytaco 13y ago
  I'm curious why we're satisfied with an anonymous leaker and some shoddy looking powerpoints. I'm not going to comment on what's true or what's not, but I know a few things: 1. Having been "in the news" or when I've had firsthand knowledge of an event in the news, I'm always shocked by how inaccurate the news is. Usually not in broad strokes, but in lots of details. I have learned to take everything I read in the media with a healthy grain of salt. I'm not dissing journalists here, but that's what they are: journalists. They are not tech experts. What we are reading could very well be inaccurate. We've not vetted their source either. At least Google is known entity. 2. This whole "we scan everything" business just seems farfetched. That's a lot of data to just double. 3. This program has been subject to oversight. I haven't lost that much faith in my elected officials, or government employees for that matter.
  - thebordella 13y ago
    Many times this. Do you all remember when the "news" was "leaked" by "anonymous hackers" who claimed to lift Apple user data from a hacked FBI laptop? The Internet lost its mind frothing against the surveillance state. The minority of critical thinkers who suggested that maybe the claims of anonymous hackers shouldn't be taken entirely at face value were either ignored or shouted down. Blanket denials by the FBI were met with retorts of "we know they're lying!". News outlets -- many the very same covering the PRISM story -- repeated uncritically the accusations of the FBI harvesting Apple user data. Do you all remember what the actual outcome of that story was? Spoiler alert: the allegations were grade-A bullshit. The only part that was true was that it involved (old) data lifted from a hack (against an app developer). Everything else was bogus self-aggrandizing, and the Internet loudmouths played right into it. Why? Because it confirmed people's existing fears. The sad reality is that everything that has hit the news about this PRISM story -- and the Verizon story -- has actually shed very little light on anything. We have a source with unknown credibility providing incomplete and possibly even misunderstood information colliding with large corporate and government interests. Maybe everyone is lying. Maybe nobody is. The only thing that is certain is that people unquestionably believe claims that confirm their existing beliefs.
natrius 13y ago
The Verizon order explicitly applies to calls within America between American citizens, which is why it was so novel. PRISM, as described, only incidentally collects information about Americans. This statement does not preclude the direct access to user data that the PRISM reports describe.
- onecommentonly 13y ago
  The Guardian suggested that more leaks are going to be published...
riotingpscifis 13y ago
Consider the NSA having MITM capabilities before the data reaches google: 1) This is exactly what you would need to do, to consider it realtime 2) None of the denials cover this
- snowwrestler 13y ago
  If it's MITM between user and Google, then Google would not be coordinating or even necessarily aware.
- drivebyacct2 13y ago
  They'd have to MITM SSL traffic largely. Also, that's what they were doing for more traditional wiretaps and you should be sure that they have access to siphon off live traffic for analysis if they want.
  - dllthomas 13y ago
    "They'd have to MITM SSL traffic largely." To be fair, if anyone can do this it's precisely these people. ... still not likely, though, I agree.
    - reedlaw 13y ago
      Is that even possible if Google's SSL certs have Extended Validation? They'd have to have cooperation all the way down to the browser vendors and I can't see Mozilla caving that easily.
      - dllthomas 13y ago
        I was referring to cryptographic attacks. Unlikely that they have such, but if anyone does, it's pretty likely to be them.
      - amatix 13y ago
        There are several governments (Spain, France, Netherlands, Japan) who publicly have Root CAs in the trusted browser list[1]. It seems pretty likely (cf say, Prism) that the NSA has a CA cert where they can generate whatever certificates they want in order to MITM browser SSL communications... [1] http://www.mozilla.org/projects/security/certs&#x2F http://www.mozilla.org/projects/security/certs/
bane 13y ago
Google doesn't have to actively disclose...the government just needs to know where to "listen" to get the same data that's moving around Google's data centers.
chebucto 13y ago
He did not say "We only give data to the government in response legal requests about named individuals."
Nelson69 13y ago
What's become very clear is that there is a lot of careful parsing going on. Careful parsing of the constitution, careful parsing of various laws, very very careful interpretation of the words on the page. Does Google give anyone, any company, any entity, anyone at all direct access to their data? They've specifically excluded NSA. Does NSA subcontract that to Booz Allen Hamilton? Google claims that no government has this access, what about one of the 1200+ Top Secret cleared contracting companies? Can these companies officially comment on this stuff yet? Or are they violating court orders if they talk about it? I like Google, I really want to trust them and I think they've moved the needle in our industry in some very positive ways. Honestly though, I think they could make much much stronger statements about this stuff. I expect them to say stuff like this to keep up with appearances.
- ralfd 13y ago
  Did you read Larry's blog post? He didn't rule out the NSA, he did rule out the USgovernment period. Quote: > Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers.
  - Nelson69 13y ago
    I did read it, with the dozens of other articles and such it's blurred together. He did rule out the US Government, does that rule out contractors? Does that rule out Verizon? What if Google has data in someone else' datacenter? That's specifically what they said the US government doesn't have direct access to. Do they give carte blanch access to their data to ANYONE? Regardless of the datacenter. If they don't they can say that.
    - aiiane 13y ago
      No one gets carte blanch access. Even Googlers don't get carte blanch access.
  - HoochTHX 13y ago
    And yet this still misses more important issues. While it is fantastic that Google does not give the USG a free pass to the whole enchilada, Google still collects and stores this data, and gives it when compelled, if they truly had the users best interests in mind they would reduce the data collected to only what they MUST have to do what they do, and not use Vacuum cleaner like methods to get and keep everything they can, if Google did not keep it, the USG would not want it. So the best way for Google to be a part of the solution would be to reduce what they intake and keep, burn the rest.
onecommentonly 13y ago
Either way, if Google has troves of info of everything you do online, NSA will get it. One way or another, front door, back door, in-direct access and what not
rsingel 13y ago
There's 2 different things going on, under different legal authorities and Google is confusing them. Verizon was given a Patriot Act order for business records, metadata; no names; no content, but all citizens or foreigner. Google and other tech companies are said to have gotten orders under section 702 of the FISA Amendments Act of 2008. That allows the government to compel communications companies to furnish lots of metadata and CONTENT on NON-U.S. persons. This was Congress legalizing warrantless wiretapping ala AT&T, but limiting it by requiring it to be targeted at non U.S. persons. Compliance is mandatory, under contempt of court and companies must provide facilities and help. They also get reimbursed. So it's likely Google never got an order like Verizon did, they likely got one that involves content, but is supposed to exclude intentional targeting of Americans.
- Dove 13y ago
  I don't buy it. What I quoted above doesn't say anything about US persons or non-US persons, about content or metadata, about this law or that one. It just says, Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. Now, Page may well be lying, but he definitely isn't weaseling. I'm pretty sure that denial covers both of the possibilities you're referring to.
  - A1kmm 13y ago
    I think there are a lot of possibilities that could be consistent with Page's statement that also involve the NSA spying on Google users. For example, perhaps the NSA asked Google to disclose their SSL private keys; then, if they are willing to do an active attack with their own infrastructure, they could transparently perform a MITM attack on all requests to gmail, and it would be virtually undetectable. Another possibility is that the NSA could have served orders on Google employees directly, and they are compelled not to tell their managers about what they did for the NSA.
    - pyre 13y ago
      | they are compelled not to tell their managers | about what they did for the NSA. This seems problematic. What if another employee discovers what was done? What if it goes all the way up the chain? When they ask the employee why the created a backdoor, is the employee then obligated to lie? Get fired for the lie? Go to prison while maintaining it's not a NSA secret program?
ricardobeat 13y ago
What about the date where "PRISM collection began" for Google, given as 1/14/09? What is that about? http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents&#x2F http://www.washingtonpost.com/wp-srv/special/politics/prism-...;
adventured 13y ago
Prism has been admitted by the government to exist. The notion that it exists, and Google isn't involved in it, is pretty absurd. That'd be like talking about tapping the telecom companies, but leaving out Verizon and AT&T. See: "The top intelligence official in the United States condemned as “reprehensible” leaks revealing a secret program to collect information from leading Internet companies and said a separate disclosure about an effort to sweep up records of telephone calls threatens “irreversible harm” to the nation’s national security." Mr. Clapper said in a statement that the classified program to collect information from Internet providers is used to “protect our nation from a wide variety of threats” and he condemned the leaks of documents describing its existence. http://www.nytimes.com/2013/06/08/us/intelligence-chief-calls-leaks-on-us-data-collection-reprehensible.html http://www.nytimes.com/2013/06/08/us/intelligence-chief-call...
- rpgmaker 13y ago
  Also, this is very interesting from a NYTimes article on the matter: "But instead of adding a back door to their servers, the companies were essentially asked to erect a locked mailbox and give the government the key, people briefed on the negotiations said. Facebook, for instance, built such a system for requesting and sharing the information, they said." They didn't give the NSA "direct access" to their system but created a front end for them instead... LOL.

by Dove 13y ago

mullingitover 13y ago

It's exactly the kind of denial you'd expect them to issue if they were legally required to deny any involvement.

cheald 13y ago
I agree, but what could Page say to convince us otherwise? Either the government is coercing them, and they have to issue lies as denials, or they are participating voluntarily and are voluntarily lying, or they are not participating. The second option seems unlikely to me.
- mpyne 13y ago
  Well, you can't prove a negative so I'm not sure there's anything Page can say. But at the same time they can't all be right. NSA says it's getting data in some form from Google, Page says no direct access. The truth is probably somewhere in the middle then... but where?
  - cheald 13y ago
    I'm 100% with you. I don't know what Page could say, and I agree that it's extremely likely that the truth is somewhere in the middle, but damned if any of us have any ability to actually suss out what that is. It's very frustrating. I just think it's important to not be entirely cynical here, and to keep in mind what such a statement might look like if it were being truthful. I don't know how much different it might be, which generally makes the statement only as good as Larry Page's word, and only then if he doesn't have a gun to his head.
  - anon808 13y ago
    The truth comes from the source that wasn't intended to be public.
  - dragonwriter 13y ago
    I don't know why we'd expect the truth to be in the middle. If the NSA document is genuine, the information the NSA is collecting from Google is part of a Top Secret program as described in the leaked internal document. If that is true, why would we expect that Google officials would be able to make any public confirmation of the Top Secret program? And, given that, why, in that case, would we expect the truth to be "in the middle"? Conversely, if the leaked document is not genuine, then I still don't see any basis for expecting the truth to be in the "middle" between the false document and the Google denial.
    - dwild 13y ago
      Did I miss some information? I only saw two slides. One that show the potential data accessible and one that show when the companies were added. It doesn't say exactly that they had access to everything. As far as we know PRISM can simply be there to centralize the information that the NSA got in legals ways. We do know that the government ask about 100 users account information each day to Google, we can guess that they do the same to every company on that list and they were all added to PRISM at the date you can find on the slides. I mean that slide contains one of the most important information that we currently have to guess the magnitude of PRISM, the budget. They only need 20 millions $ every years. True data mining is much more expensive than that.
  - bilbo0s 13y ago
    I don't know how many of us served as officers in the military, but the requisite action in this situation is pretty clear. If one is interested in day to day security, speaking from a strictly tactical perspective: You assume Google is giving the NSA information and act accordingly. Doubts are like bothersome flies... until they are crushed... you will never be comfortable at your current position.
  - darkarmani 13y ago
    > NSA says it's getting data in some form from Google, Page says no direct access. Page says no direct access and not even legal access at that scale (verizon). He doesn't say they don't have any access -- in fact he says they comply within the bounds of law, but it's not at the Verizon scale.
- sjs382 13y ago
  We obviously stil have a lot to learn about PRISM... But with that said, I have some conflicting instincts & feelings about all of this and the company responses. On one hand, I would think a very-visible CEO of a major corp would keep their name off of a press release, if the press release was a lie that they were compelled to tell by the government. On the other hand, I feel like each company's response and their use of the exact same terminology ("direct access", etc) feels like a wink and a nod.
  - cheald 13y ago
    I completely agree, and I don't know how to reconcile the two. If I was going to go completely conspiracy-nutter, I'd say that Page has been kept out of the loop intentionally for plausible deniability, and the actual incursion happens at a much lower level, where the people involved are coerced into keeping their mouths shut. That way, the bigwigs get to tell what they think is the truth, the NSA gets their data, and nobody is the wiser. Granted, I think that belongs more in the plot of a thriller novel than in this actual world we're living in, but given the revelations of the past couple of days, fiction doesn't seem that implausible.
    - deleted 13y ago
      [deleted]
  - sinnerswing 13y ago
    This may not be PRISM, but wtf is this??? "A US government-mandated backdoor allowed China to hack into Gmail" "In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access." http://www.cnn.com/2010/OPINION/01/23/schneier.google.hacking/index.html http://www.cnn.com/2010/OPINION/01/23/schneier.google.hackin...
    - gohrt 13y ago
      Schneier is a smart guy, but he provides no evidence, links, or conjecture of what this backdoor may be. Maybe those hackers just used the regular tech support "back door", as in "SELECT * FROM gmail where email = 'target@gmail.com'
- ket 13y ago
  > or they are participating voluntarily and are voluntarily lying, ... seems unlikely to me. Their business is based on user's data. If you do not feel comfortable giving them your data, it might hurt their business. Hence, IMHO, they do have some incentive to deny PRISM, regardless of the facts.
- declan 13y ago
  Or the news organizations summarizing the leaked slides got it wrong.
rasterizer 13y ago
That's not true, in Verizon's case they just said that they are under a gag-order: http://publicpolicy.verizon.com/blog/entry/from-the-desk-of-randy-milch http://publicpolicy.verizon.com/blog/entry/from-the-desk-of-...
ttrreeww 13y ago
There are cases in which you can't even confirm the existence of a gag order. I can not believe it's constitutional... but they do it.
- SilasX 13y ago
  What about the strategy you hear about of getting around this? Where they say "we're not under a gag order" (or whatever) each day until they are, until they go under a gag order, at which point it reveals they are. Now, I'm not so naive to think that if someone tried this, the government and courts would just say "Herp, derp, you sure outfoxed us there!" But has that strategy ever been tested in court?
  - ttrreeww 13y ago
    I'd imaging it'd get you a free one way ticket to Cuba, not charged.
  - bigiain 13y ago
    Rsync.net does this: http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt And they note: This scheme is not infallible. Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations. The news clip in the signed message serves to demonstrate that that update could not have been created prior to that date. It shows that a series of these updates were not created in advance and posted on this page.
colin_jack 13y ago
One thing we know for sure is the truth of what they have been doing will leak out.
davidmr 13y ago
I've never heard it said that anyone was required to deny involvement. Did you mean that exactly as you wrote? I think there's a world of difference between a gag order where you are not allowed to confirm, and an order to explicitly deny involvement. I'm not saying the former is "good", but there's a difference.
- bigiain 13y ago
  OK, I'll say it. I think there's a non-zero probability that there are US government agencies who can and have compelled people to explicitly deny something that they know is true. Realistically, it would boggle my mind to discover they'd done that to all the founders/CEOs/legal departments of all the companies involved here (at least Google/Facebook/Apple/Yahoo/AOL), but given the stakes in this game - I have no doubt that it _could_ be done.
danso 13y ago
No, it's not. Gag orders can also be satisfied by saying "no comment" or just not saying anything at all, which is differently then actively denying something.
Dove 13y ago
That's moving the goalposts, though. The initial assertion -- that this is a cleverly-worded non-denial -- doesn't hold up with the text. Page is clearly and unambiguously denying that Google supplies any information to the government on a millions-of-users scale. Saying that denial is a lie . . . is a completely different charge.
- deleted 13y ago
  [deleted]
- white_devil 13y ago
  > Page is clearly and unambiguously denying that Google supplies any information to the government on a millions-of-users scale. Kind of like Mariano Rajoy insisted that Spain didn't need a bailout?
  - adventured 13y ago
    And the Federal Reserve said there was no real estate bubble to worry about. And the banks were well capitalized.
    - magicalist 13y ago
      Yes, and murderers always insist that they're innocent. QED. We've got them now!
- hotpockets 13y ago
  Google could be searching email for certain series of characters, like "xxxx obama" and handing that over. Perhaps NSA supplies google a list of phrases to look for.
Dove 13y ago
I don't think so. Those usually sound like, "We cannot confirm or deny the existence of such a program," or "It is not our policy to comment on national security topics" or "No comment." or even "We'll wait for the results of the investigation." I don't think the government generally asks civilians to lie so enthusiastically, because . . . well, as a rule, they just aren't good at it. No, I think it's most likely that Page doesn't know of any such program. Now, it's always possible that such a thing is being carried out on the scale everyone fears by a rogue, loyal-to-the-NSA employee, or a group of them. Or it's possible the original Powerpoint slide including Google as an information source is oversimplified or even inaccurate. Such things do happen when presenting overviews of program capabilities. And many other things in between are possible. It's concerning, but . . . I'll wait for the results of the investigation. ;)
- mullingitover 13y ago
  It's also possible that Larry is concerned about his share price, and what would happen to it if Google was revealed to be completely in bed with the NSA (My guess is it would fall quite a bit). He has real money at stake in limiting the damage that comes from this revelation.
  - Avenger42 13y ago
    The fallout in such a case has to be smaller than it would be if it comes out later that, not only were they in bed with the NSA, they (and the other companies in this situation) blatantly lied about it with their statements today.
    - bigiain 13y ago
      I guess keeping an eye out for Larry (et al) cashing out shares over the next few weeks/months might be a good indicator of the likelyhood of exactly that "coming out later".
      - gohrt 13y ago
declan 13y ago
This is a false assumption. AT&T did not deny opening its networks to the NSA during the EFF litigation. It simply declined to comment, and offered suggestions (which I wrote about at the time) about how the law allowed it to comply with such a secret court order. It's the opposite of what Larry Page is doing.
Matt_Cutts 13y ago
Really? You don't see any difference between the denial posted by Google's CEO vs. the way that (say) Verizon responded? Here's Verizon's response: http://www.businessinsider.com/verizons-memo-to-workers-about-nsa-2013-6 http://www.businessinsider.com/verizons-memo-to-workers-abou...
- ynniv 13y ago
  A better carefully worded response is still a carefully worded response. Google is in a difficult place because we all expected this to be happening, there are now documents suggesting that it has been happening, and no one takes at face value anything that sounds like a lawyer wrote it. EDIT: I mean: (a) No one cares if they have heard about a program called "PRISM" when the point of that program is to aggregate data from other programs. (b) Anyone who is actually innocent in this needs to stop mentioning "direct access to servers": no one expects this program to be directly accessing servers. (c) We also don't care whether actions were "in accordance with the law", as the constitutionality of the surrounding laws is part of the debate. I will say that "Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false." is a good statement to make. It sounds broad in a good way and doesn't appear to have many weasel words, other than specifying "Internet activity" and not email or general activity. Are Google searches even "Internet activity", or is he referring to Google Analytics / Google +1 / 8.8.8.8 DNS?
  - solnyshok 13y ago
    "direct access to servers" looks suspicios to me as well. However, maybe several dozen lawyers had no clue how to react today, and they just copied one another's text?
    - Matt_Cutts 13y ago
      More likely: the first paragraph from the Guardian and the Washington Post both emphasized "direct" access. See the picture here: http://cl.ly/image/2S3i1g2W2R2k http://cl.ly/image/2S3i1g2W2R2k If you're refuting claims of behavior X, it's natural to say "We don't do behavior X."
sullivandanny 13y ago
No, it's not. What little we've had about super-secret legal requests isn't that companies have to lie about them. It's that they can't acknowledge them at all. So the answer they give when asked, and they do get asked, is "no comment." If they were voluntarily part of PRISM, and legally required to keep that quiet, I'd expect them to say "no comment." Doing the opposite make so little sense. It means they're having to flat-out lie to their users, something very hard to recover from.
- RWeaver 13y ago
  The thing is "no comment" would basically confirm that 'something' is happening that's secret. Everyone would go conspiracy wild and pull everything they have away from Google. They probably want to confirm it, but in a completely open and transparent way that assures people there's nothing they should fear here, which they can't do because it's all cloaked in secrecy.

boi_v2 13y ago

Well, I guess he will have to find a proper way to prove it, because if you are satisfied with just a blog post maybe you should think again.

stinkytaco 13y ago
I'm curious why we're satisfied with an anonymous leaker and some shoddy looking powerpoints. I'm not going to comment on what's true or what's not, but I know a few things: 1. Having been "in the news" or when I've had firsthand knowledge of an event in the news, I'm always shocked by how inaccurate the news is. Usually not in broad strokes, but in lots of details. I have learned to take everything I read in the media with a healthy grain of salt. I'm not dissing journalists here, but that's what they are: journalists. They are not tech experts. What we are reading could very well be inaccurate. We've not vetted their source either. At least Google is known entity. 2. This whole "we scan everything" business just seems farfetched. That's a lot of data to just double. 3. This program has been subject to oversight. I haven't lost that much faith in my elected officials, or government employees for that matter.
- thebordella 13y ago
  Many times this. Do you all remember when the "news" was "leaked" by "anonymous hackers" who claimed to lift Apple user data from a hacked FBI laptop? The Internet lost its mind frothing against the surveillance state. The minority of critical thinkers who suggested that maybe the claims of anonymous hackers shouldn't be taken entirely at face value were either ignored or shouted down. Blanket denials by the FBI were met with retorts of "we know they're lying!". News outlets -- many the very same covering the PRISM story -- repeated uncritically the accusations of the FBI harvesting Apple user data. Do you all remember what the actual outcome of that story was? Spoiler alert: the allegations were grade-A bullshit. The only part that was true was that it involved (old) data lifted from a hack (against an app developer). Everything else was bogus self-aggrandizing, and the Internet loudmouths played right into it. Why? Because it confirmed people's existing fears. The sad reality is that everything that has hit the news about this PRISM story -- and the Verizon story -- has actually shed very little light on anything. We have a source with unknown credibility providing incomplete and possibly even misunderstood information colliding with large corporate and government interests. Maybe everyone is lying. Maybe nobody is. The only thing that is certain is that people unquestionably believe claims that confirm their existing beliefs.

natrius 13y ago

The Verizon order explicitly applies to calls within America between American citizens, which is why it was so novel. PRISM, as described, only incidentally collects information about Americans. This statement does not preclude the direct access to user data that the PRISM reports describe.

onecommentonly 13y ago
The Guardian suggested that more leaks are going to be published...

riotingpscifis 13y ago

Consider the NSA having MITM capabilities before the data reaches google: 1) This is exactly what you would need to do, to consider it realtime 2) None of the denials cover this

snowwrestler 13y ago
If it's MITM between user and Google, then Google would not be coordinating or even necessarily aware.
drivebyacct2 13y ago
They'd have to MITM SSL traffic largely. Also, that's what they were doing for more traditional wiretaps and you should be sure that they have access to siphon off live traffic for analysis if they want.
- dllthomas 13y ago
  "They'd have to MITM SSL traffic largely." To be fair, if anyone can do this it's precisely these people. ... still not likely, though, I agree.
  - reedlaw 13y ago
    Is that even possible if Google's SSL certs have Extended Validation? They'd have to have cooperation all the way down to the browser vendors and I can't see Mozilla caving that easily.
    - dllthomas 13y ago
      I was referring to cryptographic attacks. Unlikely that they have such, but if anyone does, it's pretty likely to be them.
    - amatix 13y ago
      There are several governments (Spain, France, Netherlands, Japan) who publicly have Root CAs in the trusted browser list[1]. It seems pretty likely (cf say, Prism) that the NSA has a CA cert where they can generate whatever certificates they want in order to MITM browser SSL communications... [1] http://www.mozilla.org/projects/security/certs&#x2F http://www.mozilla.org/projects/security/certs/

bane 13y ago

Google doesn't have to actively disclose...the government just needs to know where to "listen" to get the same data that's moving around Google's data centers.

chebucto 13y ago

He did not say "We only give data to the government in response legal requests about named individuals."

Nelson69 13y ago

What's become very clear is that there is a lot of careful parsing going on. Careful parsing of the constitution, careful parsing of various laws, very very careful interpretation of the words on the page. Does Google give anyone, any company, any entity, anyone at all direct access to their data? They've specifically excluded NSA. Does NSA subcontract that to Booz Allen Hamilton? Google claims that no government has this access, what about one of the 1200+ Top Secret cleared contracting companies? Can these companies officially comment on this stuff yet? Or are they violating court orders if they talk about it? I like Google, I really want to trust them and I think they've moved the needle in our industry in some very positive ways. Honestly though, I think they could make much much stronger statements about this stuff. I expect them to say stuff like this to keep up with appearances.

ralfd 13y ago
Did you read Larry's blog post? He didn't rule out the NSA, he did rule out the USgovernment period. Quote: > Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers.
- Nelson69 13y ago
  I did read it, with the dozens of other articles and such it's blurred together. He did rule out the US Government, does that rule out contractors? Does that rule out Verizon? What if Google has data in someone else' datacenter? That's specifically what they said the US government doesn't have direct access to. Do they give carte blanch access to their data to ANYONE? Regardless of the datacenter. If they don't they can say that.
  - aiiane 13y ago
    No one gets carte blanch access. Even Googlers don't get carte blanch access.
- HoochTHX 13y ago
  And yet this still misses more important issues. While it is fantastic that Google does not give the USG a free pass to the whole enchilada, Google still collects and stores this data, and gives it when compelled, if they truly had the users best interests in mind they would reduce the data collected to only what they MUST have to do what they do, and not use Vacuum cleaner like methods to get and keep everything they can, if Google did not keep it, the USG would not want it. So the best way for Google to be a part of the solution would be to reduce what they intake and keep, burn the rest.

onecommentonly 13y ago

Either way, if Google has troves of info of everything you do online, NSA will get it. One way or another, front door, back door, in-direct access and what not

rsingel 13y ago

There's 2 different things going on, under different legal authorities and Google is confusing them. Verizon was given a Patriot Act order for business records, metadata; no names; no content, but all citizens or foreigner. Google and other tech companies are said to have gotten orders under section 702 of the FISA Amendments Act of 2008. That allows the government to compel communications companies to furnish lots of metadata and CONTENT on NON-U.S. persons. This was Congress legalizing warrantless wiretapping ala AT&T, but limiting it by requiring it to be targeted at non U.S. persons. Compliance is mandatory, under contempt of court and companies must provide facilities and help. They also get reimbursed. So it's likely Google never got an order like Verizon did, they likely got one that involves content, but is supposed to exclude intentional targeting of Americans.

Dove 13y ago
I don't buy it. What I quoted above doesn't say anything about US persons or non-US persons, about content or metadata, about this law or that one. It just says, Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. Now, Page may well be lying, but he definitely isn't weaseling. I'm pretty sure that denial covers both of the possibilities you're referring to.
- A1kmm 13y ago
  I think there are a lot of possibilities that could be consistent with Page's statement that also involve the NSA spying on Google users. For example, perhaps the NSA asked Google to disclose their SSL private keys; then, if they are willing to do an active attack with their own infrastructure, they could transparently perform a MITM attack on all requests to gmail, and it would be virtually undetectable. Another possibility is that the NSA could have served orders on Google employees directly, and they are compelled not to tell their managers about what they did for the NSA.
  - pyre 13y ago
    | they are compelled not to tell their managers | about what they did for the NSA. This seems problematic. What if another employee discovers what was done? What if it goes all the way up the chain? When they ask the employee why the created a backdoor, is the employee then obligated to lie? Get fired for the lie? Go to prison while maintaining it's not a NSA secret program?

ricardobeat 13y ago

What about the date where "PRISM collection began" for Google, given as 1/14/09? What is that about? http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents&#x2F http://www.washingtonpost.com/wp-srv/special/politics/prism-...;

adventured 13y ago

Prism has been admitted by the government to exist. The notion that it exists, and Google isn't involved in it, is pretty absurd. That'd be like talking about tapping the telecom companies, but leaving out Verizon and AT&T. See: "The top intelligence official in the United States condemned as “reprehensible” leaks revealing a secret program to collect information from leading Internet companies and said a separate disclosure about an effort to sweep up records of telephone calls threatens “irreversible harm” to the nation’s national security." Mr. Clapper said in a statement that the classified program to collect information from Internet providers is used to “protect our nation from a wide variety of threats” and he condemned the leaks of documents describing its existence. http://www.nytimes.com/2013/06/08/us/intelligence-chief-calls-leaks-on-us-data-collection-reprehensible.html http://www.nytimes.com/2013/06/08/us/intelligence-chief-call...

rpgmaker 13y ago
Also, this is very interesting from a NYTimes article on the matter: "But instead of adding a back door to their servers, the companies were essentially asked to erect a locked mailbox and give the government the key, people briefed on the negotiations said. Facebook, for instance, built such a system for requesting and sharing the information, they said." They didn't give the NSA "direct access" to their system but created a front end for them instead... LOL.