7 ms·

What are the legal ramifications if employees at Google also work at the behest of the NSA/FBI/CIA (unbeknownst to Google)? It is one thing to compel the organi

What are the legal ramifications if employees at Google also work at the behest of the NSA/FBI/CIA (unbeknownst to Google)? It is one thing to compel the organization to reveal information, but what are the legal questions around essentially spies within the various corporations? This very blog post mentions that Google hires some of the best security engineers in the world. I'm sure having "prior" employment at the NSA would look great on a resume, and put the person in a position to compromise essentially all internal security and data integrity.

tptacek 13y ago
It would be a felony for anyone at NSA to attempt to "turn" an employee of Google and get them to leak secret information from Google's systems.
- richtr 13y ago
  That is your interpretation of the law... - NSA 2013
  - jshen 13y ago
    And the NSA is not the one that ultimately decides the interpretation of the law.
    - mtgx 13y ago
      It's a good thing secret courts can, then.
      - tptacek 13y ago
        The actual filings before FISA are secret; they're signals intelligence cases. The laws the FISA court uses to authorize surveillance are not secret.
        nitrogen 13y ago
        But isn't the interpretation of those laws as used by the courts and the DoJ a secret?
        tptacek 13y ago
        In that ever court case involves a judge interpreting the law, and none of the FISA cases will ever be public because they involve confidential targets, informants, sources, and methods of intelligence gathering, yes. But the prevailing view seems to be that the whole FISA program is a system of secret laws, which is not in fact the truth.
        jbooth 13y ago
        Case law? Precedent?
        stdgy 13y ago
        The interpretation of the Law rests on judicial opinions. Many of those decisions are indeed secret, rendering the interpretation of the law itself secret. I think it's reasonable to say that this makes the laws 'secret', since it is impossible to know whether you are in violation without knowing the interpretation. Source: https://www.eff.org/deeplinks/2013/06/government-says-secret-court-opinion-law-underlying-prism-program-needs-stay https://www.eff.org/deeplinks/2013/06/government-says-secret...
        mindcrime 13y ago
        The laws the FISA court uses to authorize surveillance are not secret. Well, so far as we know anyway. There is still, AFAIK, an open question about the existence and/or exact nature of "secret laws" in the US. See John Gilmore's struggle to travel without offering up identity documents[1], for example. [1]: http://en.wikipedia.org/wiki/Gilmore_v._Gonzales http://en.wikipedia.org/wiki/Gilmore_v._Gonzales
    - dragonwriter 13y ago
      No, but they work for the guy that can-- 1. Veto prosecution efforts, and 2. Provide literal get out of jail free cards. So, there's a pretty good chance that unless its a rogue NSA operation, they are pretty well covered on the whole threat of criminal prosecution front.
- blake8086 13y ago
  Really? What law is that covered under? (genuinely interested, because I did not know this)
  - corresation 13y ago
    I second this question. I know it seems like it would be against the law...but a lot of things that seem like they would be against the law actually aren't, so I'm interested in specifics.
    - tptacek 13y ago
      Employees of the NSA cannot in fact do things that are felonies under federal law and be immune from prosecution.
      - absherwin 13y ago
        While you're correct as a matter of legal theory, this doesn't happen in practice. Aside from Felt and Miller who were given small fines and then pardoned, can you name another precedent for prosecuting government employees for overreach in intelligence and security matters? Is there even a single example where a meaningful penalty was dispensed?
- flyinRyan 13y ago
  You mean a felony in the way that assassinating people is against US and international law, it's illegal to hold someone more than 24 hours without charging them and so on? I'm not sure how much laws like that matter at this point.
floitsch 13y ago
Disclaimer: I work at Google. I'm working on the client-side (Chrome) and my knowledge in the server area is therefore limited, but from my understanding this would be really hard. 1. Googlers have access to almost all source code. It would be difficult to hide code that just sends data to an outside entity. 2. Google continually monitors its (internal) bandwidth. This is done to optimize traffic, and detect intruders. A rogue Googler would trigger the same traps that are exist for potential hackers. 3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files.
- jsolson 13y ago
  > 3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files. I think this was the biggest bullshit signal for me (also a Googler, although a recent addition). The high rate of change of Google's infrastructure is astounding when you consider the scale it operates at. The notion of trying to maintain a functional API in secret of the scope they're talking about is laughable without a pretty sizable team. Impossible? No, probably not, but really ridiculously unlikely.
  - jfoster 13y ago
    Google's own apps keep up with the infrastructure changes. Why would an NSA backdoor be any different to just another Google app?
    - jsolson 13y ago
      That was sort of my point: those apps require sizable teams and a huge amount of cooperation from dependencies. If you're operating in secret, cooperation is going to be a hard commodity to come by. I also feel like a sizable team of the sort of people who work at Google would inevitably have leaked something about this before now.
- TomGullen 13y ago
brown9-2 13y ago
In order for this to be an option, it would have to mean that all of the internal security and audit controls at Google were bullshit, wouldn't it?
- corresation 13y ago
  Security and audit controls are almost always bullshit. We're discussing a story that arose because a three-month tenure employee for an external contractor had wide ranging access to tonnes of stuff in the NSA. Previously Bradley Manning demonstrate the same with the armed forces. Are all internal Google communications encrypted? Probably not, but even if they are if you work in network security you likely hold the keys to that encryption regardless. You probably have access to their PKI keys as well.
  - DannyBee 13y ago
    You are seriously confused on both points.
    - corresation 13y ago
      What a convincing retort.
      - DannyBee 13y ago
        Yes, i'm going to describe internal security procedures in detail to a stranger. Suffice to say, the idea that random people in some nebulous "network security" group have access to all traffic related PKI (or whatever) is barely worth responding to. Google is not made of idiots. It is not a startup run in a garage where every the "IT guy" has access to all the private keys.
        corresation 13y ago
        Suffice to say, the idea that random people in some nebulous "network security" group have access to all traffic related PKI (or whatever) is barely worth responding to Curious sarcasm. Network security is a role, and it's one which Google holds in very high esteem. Yes, if someone is configuring IPSec or new load balancers or any other front-end system, they need the Google certs. This is a simple function of the job. It is not a startup run in a garage where every the "IT guy" Here you go again. "IT Guy" when I was talking about network security roles (which despite your laughable sarcasm we know is a role at Google) -- the guys in charge of the coop, protecting the chickens. Maybe they wolves. I have never, ever, in my life seen checks and controls that weren't laughably insecure. I've worked at a multinational bank, a large insurance company, a national telephone company, among other places. There will always be those people who cluck their mouths and wave their arms about how no way this is super advanced controls...in my experience it never, ever is.

tptacek 13y ago

It would be a felony for anyone at NSA to attempt to "turn" an employee of Google and get them to leak secret information from Google's systems.

richtr 13y ago
That is your interpretation of the law... - NSA 2013
- jshen 13y ago
  And the NSA is not the one that ultimately decides the interpretation of the law.
  - mtgx 13y ago
    It's a good thing secret courts can, then.
    - tptacek 13y ago
      The actual filings before FISA are secret; they're signals intelligence cases. The laws the FISA court uses to authorize surveillance are not secret.
      - nitrogen 13y ago
        But isn't the interpretation of those laws as used by the courts and the DoJ a secret?
        tptacek 13y ago
        In that ever court case involves a judge interpreting the law, and none of the FISA cases will ever be public because they involve confidential targets, informants, sources, and methods of intelligence gathering, yes. But the prevailing view seems to be that the whole FISA program is a system of secret laws, which is not in fact the truth.
        jbooth 13y ago
        Case law? Precedent?
      - stdgy 13y ago
        The interpretation of the Law rests on judicial opinions. Many of those decisions are indeed secret, rendering the interpretation of the law itself secret. I think it's reasonable to say that this makes the laws 'secret', since it is impossible to know whether you are in violation without knowing the interpretation. Source: https://www.eff.org/deeplinks/2013/06/government-says-secret-court-opinion-law-underlying-prism-program-needs-stay https://www.eff.org/deeplinks/2013/06/government-says-secret...
      - mindcrime 13y ago
        The laws the FISA court uses to authorize surveillance are not secret. Well, so far as we know anyway. There is still, AFAIK, an open question about the existence and/or exact nature of "secret laws" in the US. See John Gilmore's struggle to travel without offering up identity documents[1], for example. [1]: http://en.wikipedia.org/wiki/Gilmore_v._Gonzales http://en.wikipedia.org/wiki/Gilmore_v._Gonzales
  - dragonwriter 13y ago
    No, but they work for the guy that can-- 1. Veto prosecution efforts, and 2. Provide literal get out of jail free cards. So, there's a pretty good chance that unless its a rogue NSA operation, they are pretty well covered on the whole threat of criminal prosecution front.
blake8086 13y ago
Really? What law is that covered under? (genuinely interested, because I did not know this)
- corresation 13y ago
  I second this question. I know it seems like it would be against the law...but a lot of things that seem like they would be against the law actually aren't, so I'm interested in specifics.
  - tptacek 13y ago
    Employees of the NSA cannot in fact do things that are felonies under federal law and be immune from prosecution.
    - absherwin 13y ago
      While you're correct as a matter of legal theory, this doesn't happen in practice. Aside from Felt and Miller who were given small fines and then pardoned, can you name another precedent for prosecuting government employees for overreach in intelligence and security matters? Is there even a single example where a meaningful penalty was dispensed?
flyinRyan 13y ago
You mean a felony in the way that assassinating people is against US and international law, it's illegal to hold someone more than 24 hours without charging them and so on? I'm not sure how much laws like that matter at this point.

floitsch 13y ago

Disclaimer: I work at Google. I'm working on the client-side (Chrome) and my knowledge in the server area is therefore limited, but from my understanding this would be really hard. 1. Googlers have access to almost all source code. It would be difficult to hide code that just sends data to an outside entity. 2. Google continually monitors its (internal) bandwidth. This is done to optimize traffic, and detect intruders. A rogue Googler would trigger the same traps that are exist for potential hackers. 3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files.

jsolson 13y ago
> 3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files. I think this was the biggest bullshit signal for me (also a Googler, although a recent addition). The high rate of change of Google's infrastructure is astounding when you consider the scale it operates at. The notion of trying to maintain a functional API in secret of the scope they're talking about is laughable without a pretty sizable team. Impossible? No, probably not, but really ridiculously unlikely.
- jfoster 13y ago
  Google's own apps keep up with the infrastructure changes. Why would an NSA backdoor be any different to just another Google app?
  - jsolson 13y ago
    That was sort of my point: those apps require sizable teams and a huge amount of cooperation from dependencies. If you're operating in secret, cooperation is going to be a hard commodity to come by. I also feel like a sizable team of the sort of people who work at Google would inevitably have leaked something about this before now.
TomGullen 13y ago

brown9-2 13y ago

In order for this to be an option, it would have to mean that all of the internal security and audit controls at Google were bullshit, wouldn't it?

corresation 13y ago
Security and audit controls are almost always bullshit. We're discussing a story that arose because a three-month tenure employee for an external contractor had wide ranging access to tonnes of stuff in the NSA. Previously Bradley Manning demonstrate the same with the armed forces. Are all internal Google communications encrypted? Probably not, but even if they are if you work in network security you likely hold the keys to that encryption regardless. You probably have access to their PKI keys as well.
- DannyBee 13y ago
  You are seriously confused on both points.
  - corresation 13y ago
    What a convincing retort.
    - DannyBee 13y ago
      Yes, i'm going to describe internal security procedures in detail to a stranger. Suffice to say, the idea that random people in some nebulous "network security" group have access to all traffic related PKI (or whatever) is barely worth responding to. Google is not made of idiots. It is not a startup run in a garage where every the "IT guy" has access to all the private keys.
      - corresation 13y ago
        Suffice to say, the idea that random people in some nebulous "network security" group have access to all traffic related PKI (or whatever) is barely worth responding to Curious sarcasm. Network security is a role, and it's one which Google holds in very high esteem. Yes, if someone is configuring IPSec or new load balancers or any other front-end system, they need the Google certs. This is a simple function of the job. It is not a startup run in a garage where every the "IT guy" Here you go again. "IT Guy" when I was talking about network security roles (which despite your laughable sarcasm we know is a role at Google) -- the guys in charge of the coop, protecting the chickens. Maybe they wolves. I have never, ever, in my life seen checks and controls that weren't laughably insecure. I've worked at a multinational bank, a large insurance company, a national telephone company, among other places. There will always be those people who cluck their mouths and wave their arms about how no way this is super advanced controls...in my experience it never, ever is.