6 ms·

Google on NSA: No server access, no back door, no drop box, no free-for-all

71 points by moultano 13y ago

quaunaut 13y ago
I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. Which would mean none of these companies are lying- but still that the Government is way overstepping, by leaps and bounds. There's also the distinct possibility this is all bullshit. There have been a lot of holes and misinformation on Snowden's side("They can watch your thoughts form as you type", when none of the services except for GMail send textual data at real-time, etc), and the Q&A either doubled down some of them or was trying to be misleading. I'm still waiting for the Guardian to stop milking this and just give us the rest of the slides, the rest of their evidence. At this point, my confidence in the story is shaken enough that I want more if I'm gonna go Pitchfork in hand at the NSA with all of this.
- captn3m0 13y ago
  This is what I've been wondering about. PRISM was revealed in a 41 slide doc, and we are yet to see any but the 4 slides guarding and WP shared. Now that NSA knows about the leak, I don't think releasing them would have any further repercussions, other than better a better understanding of the PRISM program.
- indrax 13y ago
  Gmail uses https by default now.
  - smegel 13y ago
    SMTP doesn't though (although gmail-to-gmail is probably OK).
    - lazyjones 13y ago
      Google still sends and accepts SMTP over TLS (using RC4) if your server is configured to handle it and has a snakeoil-CA-signed certificate. I just looked at our mail.log to confirm this.
  - signed0 13y ago
    Would it be crazy to think that Google may have given the NSA a copy of their SSL certificate?
    - proksoup 13y ago
      We've known about the AT&T closets for years right? My understanding of SSL is weak, but if the NSA theoretically acquired the right private keys / SSL certificates / whatever through hook or by crook, they couldn't just watch everything then could they? Are the PRISM slide dates when they acquired said certificates/keys for said providers? Were non-legal means of acquiring used? My real question is - Does it matter that the collection of data is outside of Google's control? Should Google care that in the process of Google collecting data the NSA is intercepting it. Should Google want to stop that, if it were theoretically happening "in the middle". Google's attitude scares me.
    - pvnick 13y ago
      I was thinking the same thing. I wonder how many (if any) FISA orders were for SSL keys. If I were Keith Alexander those would be high on my list.
    - keysize 13y ago
      Would it be crazy to think that Google still uses 1024-bit SSL certificates at a time when even Godaddy recommends a bigger size? Because they do.
      - packetslave 13y ago
        Here's an interview question for you: "You're currently using 1024-bit SSL certificates. You want to start using 2048-bit certificates instead. What do you need to worry about if you're the size of Google?"
      - Matt_Cutts 13y ago
        We're in the process of upgrading to 2048 bits: http://thenextweb.com/google/2013/05/23/google-to-upgrade-its-ssl-certificates-to-2048-bit-keys-by-end-of-2013-will-start-the-process-on-august-1/ http://thenextweb.com/google/2013/05/23/google-to-upgrade-it...
- ianhawes 13y ago
  If this were happening at the packet level, PRISM would need constant maintenance for each service, and a MUCH higher budget than $20mil a year. Think about it, to be effective, you'd need to parse the format at which the data is sent. Formats and protocols change daily for all these services. And I highly doubt analysts are expected to look at pcap dumps to put together intelligence. I think reality is that PRISM is nothing more than a parsing software for data dumps after NSA has legally obtained the data from the provider. And I'm willing to bet the other 37 slides show that.
  - duaneb 13y ago
    They might not be parsed, they could just be indexed and stored (think a time-aware google search for this data).
    - ianhawes 13y ago
      But still, NSA would need to know the entire IP range of all public facing servers, their purpose in relation to the service (for example, which IP range handles Gmail vs Search). Plus, if this were a store-it-and-forget-it situation, PRISM wouldn't be limited to the services it could support. Things just aren't adding up, here.
      - duaneb 13y ago
        Yea, it strikes me as ridiculously inefficient compared to forcing them via law.
        res0nat0r 13y ago
        Much of this ISP / Tier 1 Network sniffing by Narus and other private tech companies is documented in James Bamfords' book about the NSA dating back to 2008. http://www.amazon.com/The-Shadow-Factory-Eavesdropping-America/dp/0307279391 http://www.amazon.com/The-Shadow-Factory-Eavesdropping-Ameri... It has been going on for a long time.
        VladRussian2 13y ago
- ChrisAntaki 13y ago
  Yep, there is a constant upstream wiretap in the USA. This includes phone calls, texts and emails. http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ This has been public knowledge since 2007. ;) PRISM helps the NSA in 2 ways: 1 - Collecting unencrypted versions of secured (https) communication. Note: They already have the encrypted copy. 2 - Collecting metadata, as in the case of Verizon. This allows them to make targeted database retrievals, from their massive data set.
- duaneb 13y ago
  > I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. It's entirely possible that this is happening, especially if it's plausible that the government forcibly acquired Google's root certs.
sampsonjs 13y ago
Yahoo fought Prism and failed: http://www.newyorker.com/online/blogs/closeread/2013/06/yahoo-and-the-secret-court.html http://www.newyorker.com/online/blogs/closeread/2013/06/yaho.... Yahoo now wants us to believe that this was a court order saying, in effect, Yahoo must comply with court orders to turn over specific user data. WTF? Yahoo also wants its users to believe that Prism is nothing to worry about, even though it tried to fight it back in 2008. "Notwithstanding the parade of horribles trotted out by the petitioner ... Little more than a lament about the risk that government officials will not operate in good faith." Nothing to see here folks, move along!
- anigbrowl 13y ago
  A real mischaractterization of the opinion: http://www.fas.org/irp/agency/doj/fisa/fiscr082208.pdf http://www.fas.org/irp/agency/doj/fisa/fiscr082208.pdf Of course, the thing about slippery-slope arguments is that you never have to deliver on them. It's curious that people who scoff at the idea of a rock that keeps tigers away are so willing to believe in one that attracts them.
genwin 13y ago
Why would the NSA be building a facility large enough to store a big chunk of the planet's digital info if they'll have data for only a few thousand Google users?
- asperous 13y ago
  The facilities are not just for Google, they are for a lot of survalence data including underwater recording of internet backbones.
  - genwin 13y ago
    Including all phone conversations, and not just foreign ones. Why wouldn't the NSA request all Google searches, with IP address? That would be highly valuable info.
signed0 13y ago
It seems strange that they didn't just say this in the first place.
- moultano 13y ago
  They did, but everyone picked apart the language so much that it seemed like they didn't.
  - Groxx 13y ago
    To be fair, there was plenty to pick apart, and there was the eerie similarity to the letters from other companies. And they (all) refuted "direct access" but weaseled / legalesed out of any kind of actual refutation of excessive access to data. This is much clearer. This is what everyone very obviously wanted at the very beginning, and it does seem strange that they didn't do this then, or at all sooner. What took them so long?
    - moultano 13y ago
      They have been saying this from the beginning. https://plus.google.com/116899029375914044550/posts/TMh6gUVrwMq https://plus.google.com/116899029375914044550/posts/TMh6gUVr...
mindcrime 13y ago
I'm sorry, but I can't take these statements at face value. Those PRISM slides have not exactly been disavowed by the NSA, and they make it quite clear that there is some kind of "program" that Google (and others) are part of. I don't buy that it's no more than "you send us a court order and we send you the data" because that wouldn't justify having a name ("PRISM") and a list of "join dates" for the various companies, etc. Simply put, I think Google, Yahoo, Apple, MS, etc. are all lying about their involvement in all this, to some extent. Maybe the NSA does or doesn't have "direct" access (whatever you think that means) but I believe there is something going on, beyond the run of the mill request/response scenario.
- jpatokal 13y ago
  Is your hypothesis falsifiable? In other words, is there anything Google could do or say to convince you that they are not, in fact, in cahoots with the NSA?
  - ekianjo 13y ago
    They could release all details regarding what the NSA asked of them, for starters, and what they do to ensure the NSA has no way to get data from Google in one way or another. And participate in stopwatching.us. Why no support there?
    - jpatokal 13y ago
      You are aware that Google is currently suing FISA for the right to release that information, yes? http://money.cnn.com/2013/06/18/technology/security/google-nsa-first-amendment/index.html http://money.cnn.com/2013/06/18/technology/security/google-n...
      - ekianjo 13y ago
        Yes, and it seems more like a PR coup than anything else, seriously. For a company that has as much resources as Google, this is far from being significant.
coopdog 13y ago
Given that it's from a lawyer also, who no offence are often skilled at lying by telling only the truth, it does make me a little hesitant to accept this. I'd rather hear it directly from the CEO or some senior engineer, in the hope that they'd know there's not some legal loophole they have to tread carefully around as they speak. Great that Google are saying this though. Let's fix the politics, stop the secret court rulings and gag orders and have them say it one last time, along with the approximate number of users effected by all requests ever.
- ianhawes 13y ago
  http://googleblog.blogspot.com/2013/06/what.html?m=1 http://googleblog.blogspot.com/2013/06/what.html?m=1 From Larry Page, CEO of Google That IS what you wanted, right?
  - coopdog 13y ago
    I'm pretty sure that was written by a lawyer according to talking points from PR and given a glance and stamp by the CEO Really it's all for nothing though until the politics are sorted out
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
duaneb 13y ago
Doesn't the government have the capability to force corporations to lie about matters of national security (of which the most benign form is a gag letter)? Or is that just FUD?
rdl 13y ago
At this point, it seems more plausible to me that Google is telling the truth here and the Prism slides are either inaccurate or refer to DPI reconstruction or just a live hosting/presentation environment for conventionally-delivered dossiers. I can't see Google intentionally making statements which are both incorrect and falsifiable to this degree, especially since it looks like more leaks are coming, or actual official declassifications. There is absolutely some horrible shit going down -- backbone sniffing and DPI, mass telephone metadata (and either OTA or carrier-delivered copies of content for "interesting" numbers and maybe areas), etc. And, there are serious future trust issues with cloud computing. But, at this time, I don't think NSA has pervasive access at Google -- I'm sure they (and the Chinese, Israel, and others) have Google staff who they know are likely to be "friendly" if they actually did need to do something (much much more applicable to non-US agencies), but even that doesn't need to be formalized until used. Because NSA has so many other tools (legal and technical) to use, I don't think they do high-odds-of-being-detected stuff, certainly not on a widespread basis. Active MITM of connections, or really intrusive requests to companies, seems unlikely. This is not the case for China, Israel, etc., so they are far far more likely to use external or internal attacks (other than legal) to get data from companies. And, guess what -- look at the news or your own networks -- lots of attacks from China, some quite sophisticated and successful. I'd actually say there are higher odds of a given Google SRE being purely commercially evil and selling access to crime organizations than that NSA is doing this actively against Google. This all means the threat is every bit as real as if NSA were doing it pervasively if you're likely to be a target. I don't think we ever thought NSA was using its pervasive monitoring for anything other than ultimately going after some specific targets, not for general law enforcement risk, so the situation is no different either way -- you can mostly trust Google if you blend in, but can't if you're "interesting". Against some kind of pervasive secret program involving many people: The odds of a single Googler on any team being a "whistleblower" are far higher than the odds at NSA, and we've had a lot of espionage leaks over the years, plus actual leakers. Occam's razor is that Google is telling the truth here.
- throwaway10001 13y ago
  Against some kind of pervasive secret program involving many people: The odds of a single Googler on any team being a "whistleblower" are far higher than the odds at NSA, and we've had a lot of espionage leaks over the years, plus actual leakers. Ya think that random Googlers would spy for NSA or feed them info? They are probably hundreds of Googlers with Top Secret clearance.
embolism 13y ago
The problem is that Google's business model fundamentally makes it into a liability for a free society. The more they stockpile data on people, the more dangerous they become. Unless we have a change in the constitution that spells out a clear limit on the government's right to access this data (and for that matter, limits google's own rights to use it), the risk of misuse will only grow. Even if the NSA's access today is somewhat limited, the risk won't get any less. Google is like a fireworks factory waiting for a stray spark.
- BouncyBall 13y ago
  Perhaps, its a good thing that the worlds most powerful agency has a close interior relationship with the most powerful corporation. How else would you get the human race to move forward?
jread 13y ago
I believe these statements are sidestepping the facts. Explicit requests for user data and backdoor access are a separate issue. If Prism involves capturing and storing packets at major Internet backbones (perhaps just upstream from private networks like Google's), anything plaintext could be searched and extracted after the fact - email messages, web browsing, chat, etc. To this day, a significant amount of communication related Internet traffic is not encrypted. I've worked on software that does exactly this. Here is a public marketing writeup: "Every packet is recorded, classified, and indexed, making quick discovery, reconstruction, and delivery of files in their original formats easy and intuitive. Reconstruct email attachments, windows file transfers, PDF, Word, PowerPoint, Excel, and more, giving you full visibility into everything on your network.... Show all activity over time for a single user or all file-type activity over time for all users." NSA could apply simple port based filtering to limit capture to only those packets related to communication, thereby streamlining storage requirements. If this was the Prism architecture, then these company statements would be truthful, but misleading. The NSA does not have direct access to their systems or user data, but if the NSA is allowed to record user traffic before it enters, or after it leaves their doors, then the end result is similar.
- alwaysdoit 13y ago
  Sure, but Google has been pushing enabling HTTPS including forward secrecy by default for years now.
  - jread 13y ago
    Source encryption does not guarantee endpoint encryption. In the case of gmail via https, an email recipient might download or forward in it in plaintext via pop, imap, smtp or an http email client.
ck2 13y ago
Qualifying Phrases of this decade: "Under this program" "That we know of" "Not willfully" They are like a get-out-of-jail-free card. "No more illegal wiretapping of all US citizens like under Bush" (we'll just make it legal instead).
CamperBob2 13y ago
Of course, the one thing we know for certain is that to the extent that a company is required to assist with extra-Constitutional surveillance efforts, they are also required to lie about it if asked. So this is yet another zero-information thread on the subject.

71 points by moultano 13y ago

I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. Which would mean none of these companies are lying- but still that the Government is way overstepping, by leaps and bounds. There's also the distinct possibility this is all bullshit. There have been a lot of holes and misinformation on Snowden's side("They can watch your thoughts form as you type", when none of the services except for GMail send textual data at real-time, etc), and the Q&A either doubled down some of them or was trying to be misleading. I'm still waiting for the Guardian to stop milking this and just give us the rest of the slides, the rest of their evidence. At this point, my confidence in the story is shaken enough that I want more if I'm gonna go Pitchfork in hand at the NSA with all of this.

captn3m0 13y ago
This is what I've been wondering about. PRISM was revealed in a 41 slide doc, and we are yet to see any but the 4 slides guarding and WP shared. Now that NSA knows about the leak, I don't think releasing them would have any further repercussions, other than better a better understanding of the PRISM program.
indrax 13y ago
Gmail uses https by default now.
- smegel 13y ago
  SMTP doesn't though (although gmail-to-gmail is probably OK).
  - lazyjones 13y ago
    Google still sends and accepts SMTP over TLS (using RC4) if your server is configured to handle it and has a snakeoil-CA-signed certificate. I just looked at our mail.log to confirm this.
- signed0 13y ago
  Would it be crazy to think that Google may have given the NSA a copy of their SSL certificate?
  - proksoup 13y ago
    We've known about the AT&T closets for years right? My understanding of SSL is weak, but if the NSA theoretically acquired the right private keys / SSL certificates / whatever through hook or by crook, they couldn't just watch everything then could they? Are the PRISM slide dates when they acquired said certificates/keys for said providers? Were non-legal means of acquiring used? My real question is - Does it matter that the collection of data is outside of Google's control? Should Google care that in the process of Google collecting data the NSA is intercepting it. Should Google want to stop that, if it were theoretically happening "in the middle". Google's attitude scares me.
  - pvnick 13y ago
    I was thinking the same thing. I wonder how many (if any) FISA orders were for SSL keys. If I were Keith Alexander those would be high on my list.
  - keysize 13y ago
    Would it be crazy to think that Google still uses 1024-bit SSL certificates at a time when even Godaddy recommends a bigger size? Because they do.
    - packetslave 13y ago
      Here's an interview question for you: "You're currently using 1024-bit SSL certificates. You want to start using 2048-bit certificates instead. What do you need to worry about if you're the size of Google?"
    - Matt_Cutts 13y ago
      We're in the process of upgrading to 2048 bits: http://thenextweb.com/google/2013/05/23/google-to-upgrade-its-ssl-certificates-to-2048-bit-keys-by-end-of-2013-will-start-the-process-on-august-1/ http://thenextweb.com/google/2013/05/23/google-to-upgrade-it...
ianhawes 13y ago
If this were happening at the packet level, PRISM would need constant maintenance for each service, and a MUCH higher budget than $20mil a year. Think about it, to be effective, you'd need to parse the format at which the data is sent. Formats and protocols change daily for all these services. And I highly doubt analysts are expected to look at pcap dumps to put together intelligence. I think reality is that PRISM is nothing more than a parsing software for data dumps after NSA has legally obtained the data from the provider. And I'm willing to bet the other 37 slides show that.
- duaneb 13y ago
  They might not be parsed, they could just be indexed and stored (think a time-aware google search for this data).
  - ianhawes 13y ago
    But still, NSA would need to know the entire IP range of all public facing servers, their purpose in relation to the service (for example, which IP range handles Gmail vs Search). Plus, if this were a store-it-and-forget-it situation, PRISM wouldn't be limited to the services it could support. Things just aren't adding up, here.
    - duaneb 13y ago
      Yea, it strikes me as ridiculously inefficient compared to forcing them via law.
      - res0nat0r 13y ago
        Much of this ISP / Tier 1 Network sniffing by Narus and other private tech companies is documented in James Bamfords' book about the NSA dating back to 2008. http://www.amazon.com/The-Shadow-Factory-Eavesdropping-America/dp/0307279391 http://www.amazon.com/The-Shadow-Factory-Eavesdropping-Ameri... It has been going on for a long time.
      - VladRussian2 13y ago
ChrisAntaki 13y ago
Yep, there is a constant upstream wiretap in the USA. This includes phone calls, texts and emails. http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ http://www.wired.com/threatlevel/2007/05/mark_klein_docu/ This has been public knowledge since 2007. ;) PRISM helps the NSA in 2 ways: 1 - Collecting unencrypted versions of secured (https) communication. Note: They already have the encrypted copy. 2 - Collecting metadata, as in the case of Verizon. This allows them to make targeted database retrievals, from their massive data set.
duaneb 13y ago
> I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. It's entirely possible that this is happening, especially if it's plausible that the government forcibly acquired Google's root certs.

sampsonjs 13y ago

Yahoo fought Prism and failed: http://www.newyorker.com/online/blogs/closeread/2013/06/yahoo-and-the-secret-court.html http://www.newyorker.com/online/blogs/closeread/2013/06/yaho.... Yahoo now wants us to believe that this was a court order saying, in effect, Yahoo must comply with court orders to turn over specific user data. WTF? Yahoo also wants its users to believe that Prism is nothing to worry about, even though it tried to fight it back in 2008. "Notwithstanding the parade of horribles trotted out by the petitioner ... Little more than a lament about the risk that government officials will not operate in good faith." Nothing to see here folks, move along!

anigbrowl 13y ago
A real mischaractterization of the opinion: http://www.fas.org/irp/agency/doj/fisa/fiscr082208.pdf http://www.fas.org/irp/agency/doj/fisa/fiscr082208.pdf Of course, the thing about slippery-slope arguments is that you never have to deliver on them. It's curious that people who scoff at the idea of a rock that keeps tigers away are so willing to believe in one that attracts them.

genwin 13y ago

Why would the NSA be building a facility large enough to store a big chunk of the planet's digital info if they'll have data for only a few thousand Google users?

asperous 13y ago
The facilities are not just for Google, they are for a lot of survalence data including underwater recording of internet backbones.
- genwin 13y ago
  Including all phone conversations, and not just foreign ones. Why wouldn't the NSA request all Google searches, with IP address? That would be highly valuable info.

signed0 13y ago

It seems strange that they didn't just say this in the first place.

moultano 13y ago
They did, but everyone picked apart the language so much that it seemed like they didn't.
- Groxx 13y ago
  To be fair, there was plenty to pick apart, and there was the eerie similarity to the letters from other companies. And they (all) refuted "direct access" but weaseled / legalesed out of any kind of actual refutation of excessive access to data. This is much clearer. This is what everyone very obviously wanted at the very beginning, and it does seem strange that they didn't do this then, or at all sooner. What took them so long?
  - moultano 13y ago
    They have been saying this from the beginning. https://plus.google.com/116899029375914044550/posts/TMh6gUVrwMq https://plus.google.com/116899029375914044550/posts/TMh6gUVr...

mindcrime 13y ago

I'm sorry, but I can't take these statements at face value. Those PRISM slides have not exactly been disavowed by the NSA, and they make it quite clear that there is some kind of "program" that Google (and others) are part of. I don't buy that it's no more than "you send us a court order and we send you the data" because that wouldn't justify having a name ("PRISM") and a list of "join dates" for the various companies, etc. Simply put, I think Google, Yahoo, Apple, MS, etc. are all lying about their involvement in all this, to some extent. Maybe the NSA does or doesn't have "direct" access (whatever you think that means) but I believe there is something going on, beyond the run of the mill request/response scenario.

jpatokal 13y ago
Is your hypothesis falsifiable? In other words, is there anything Google could do or say to convince you that they are not, in fact, in cahoots with the NSA?
- ekianjo 13y ago
  They could release all details regarding what the NSA asked of them, for starters, and what they do to ensure the NSA has no way to get data from Google in one way or another. And participate in stopwatching.us. Why no support there?
  - jpatokal 13y ago
    You are aware that Google is currently suing FISA for the right to release that information, yes? http://money.cnn.com/2013/06/18/technology/security/google-nsa-first-amendment/index.html http://money.cnn.com/2013/06/18/technology/security/google-n...
    - ekianjo 13y ago
      Yes, and it seems more like a PR coup than anything else, seriously. For a company that has as much resources as Google, this is far from being significant.

coopdog 13y ago

Given that it's from a lawyer also, who no offence are often skilled at lying by telling only the truth, it does make me a little hesitant to accept this. I'd rather hear it directly from the CEO or some senior engineer, in the hope that they'd know there's not some legal loophole they have to tread carefully around as they speak. Great that Google are saying this though. Let's fix the politics, stop the secret court rulings and gag orders and have them say it one last time, along with the approximate number of users effected by all requests ever.

ianhawes 13y ago
http://googleblog.blogspot.com/2013/06/what.html?m=1 http://googleblog.blogspot.com/2013/06/what.html?m=1 From Larry Page, CEO of Google That IS what you wanted, right?
- coopdog 13y ago
  I'm pretty sure that was written by a lawyer according to talking points from PR and given a glance and stamp by the CEO Really it's all for nothing though until the politics are sorted out

deleted 13y ago

[deleted]

deleted 13y ago

[deleted]

duaneb 13y ago

Doesn't the government have the capability to force corporations to lie about matters of national security (of which the most benign form is a gag letter)? Or is that just FUD?

rdl 13y ago

At this point, it seems more plausible to me that Google is telling the truth here and the Prism slides are either inaccurate or refer to DPI reconstruction or just a live hosting/presentation environment for conventionally-delivered dossiers. I can't see Google intentionally making statements which are both incorrect and falsifiable to this degree, especially since it looks like more leaks are coming, or actual official declassifications. There is absolutely some horrible shit going down -- backbone sniffing and DPI, mass telephone metadata (and either OTA or carrier-delivered copies of content for "interesting" numbers and maybe areas), etc. And, there are serious future trust issues with cloud computing. But, at this time, I don't think NSA has pervasive access at Google -- I'm sure they (and the Chinese, Israel, and others) have Google staff who they know are likely to be "friendly" if they actually did need to do something (much much more applicable to non-US agencies), but even that doesn't need to be formalized until used. Because NSA has so many other tools (legal and technical) to use, I don't think they do high-odds-of-being-detected stuff, certainly not on a widespread basis. Active MITM of connections, or really intrusive requests to companies, seems unlikely. This is not the case for China, Israel, etc., so they are far far more likely to use external or internal attacks (other than legal) to get data from companies. And, guess what -- look at the news or your own networks -- lots of attacks from China, some quite sophisticated and successful. I'd actually say there are higher odds of a given Google SRE being purely commercially evil and selling access to crime organizations than that NSA is doing this actively against Google. This all means the threat is every bit as real as if NSA were doing it pervasively if you're likely to be a target. I don't think we ever thought NSA was using its pervasive monitoring for anything other than ultimately going after some specific targets, not for general law enforcement risk, so the situation is no different either way -- you can mostly trust Google if you blend in, but can't if you're "interesting". Against some kind of pervasive secret program involving many people: The odds of a single Googler on any team being a "whistleblower" are far higher than the odds at NSA, and we've had a lot of espionage leaks over the years, plus actual leakers. Occam's razor is that Google is telling the truth here.

throwaway10001 13y ago
Against some kind of pervasive secret program involving many people: The odds of a single Googler on any team being a "whistleblower" are far higher than the odds at NSA, and we've had a lot of espionage leaks over the years, plus actual leakers. Ya think that random Googlers would spy for NSA or feed them info? They are probably hundreds of Googlers with Top Secret clearance.

embolism 13y ago

The problem is that Google's business model fundamentally makes it into a liability for a free society. The more they stockpile data on people, the more dangerous they become. Unless we have a change in the constitution that spells out a clear limit on the government's right to access this data (and for that matter, limits google's own rights to use it), the risk of misuse will only grow. Even if the NSA's access today is somewhat limited, the risk won't get any less. Google is like a fireworks factory waiting for a stray spark.

BouncyBall 13y ago
Perhaps, its a good thing that the worlds most powerful agency has a close interior relationship with the most powerful corporation. How else would you get the human race to move forward?

jread 13y ago

I believe these statements are sidestepping the facts. Explicit requests for user data and backdoor access are a separate issue. If Prism involves capturing and storing packets at major Internet backbones (perhaps just upstream from private networks like Google's), anything plaintext could be searched and extracted after the fact - email messages, web browsing, chat, etc. To this day, a significant amount of communication related Internet traffic is not encrypted. I've worked on software that does exactly this. Here is a public marketing writeup: "Every packet is recorded, classified, and indexed, making quick discovery, reconstruction, and delivery of files in their original formats easy and intuitive. Reconstruct email attachments, windows file transfers, PDF, Word, PowerPoint, Excel, and more, giving you full visibility into everything on your network.... Show all activity over time for a single user or all file-type activity over time for all users." NSA could apply simple port based filtering to limit capture to only those packets related to communication, thereby streamlining storage requirements. If this was the Prism architecture, then these company statements would be truthful, but misleading. The NSA does not have direct access to their systems or user data, but if the NSA is allowed to record user traffic before it enters, or after it leaves their doors, then the end result is similar.

alwaysdoit 13y ago
Sure, but Google has been pushing enabling HTTPS including forward secrecy by default for years now.
- jread 13y ago
  Source encryption does not guarantee endpoint encryption. In the case of gmail via https, an email recipient might download or forward in it in plaintext via pop, imap, smtp or an http email client.

ck2 13y ago

Qualifying Phrases of this decade: "Under this program" "That we know of" "Not willfully" They are like a get-out-of-jail-free card. "No more illegal wiretapping of all US citizens like under Bush" (we'll just make it legal instead).

CamperBob2 13y ago

Of course, the one thing we know for certain is that to the extent that a company is required to assist with extra-Constitutional surveillance efforts, they are also required to lie about it if asked. So this is yet another zero-information thread on the subject.