8 ms·

Google handed over years of e-mails belonging to WikiLeaks chatroom admin

179 points by gcb0 13y ago

ferdo 13y ago
I've never owned a gmail account but have sent to plenty. Gmail is like the 21st century party landline but only a relative few people can listen in. > Because I talked to Julian Assange, all information held by Google relating to my user account with them can be handed over to US prosecutors—not just the contents of my conversations with Julian. There it is: If you have online contact with someone that's of interest, there's a chance all of your info will be of interest also.
- superuser2 13y ago
  Have you considered the possibility that we hear about surveillance of GMail accounts only because so many people happen to use GMail? Is there any particular property of Google that makes it more likely to cooperate with government than any other email provider? Or, if you're in the "host your own email" crowd, what makes you think your ISP won't cooperate with the government just like Google does?
  - deleted 13y ago
    [deleted]
  - spc476 13y ago
    It depends on what you mean by "host your own email." Sure, a server at, say, RackSpace, might be vulnerable to government intrusion without your knowledge, but if you have a physical server at your home, then the best that the government can do (without your knowledge) is to tap your upstream connection, which does little for past emails.
    - jaggederest 13y ago
      You assume they can't just rootkit and browse your server at will? On one hand, government agencies are notoriously ineffective with technology. On the other hand, I'd rather assume competence and be incorrect than the opposite.
    - superuser2 13y ago
      >the best that the government can do (without your knowledge) is to tap your upstream connection, which does little for past emails. Really only applies to emails before Room 641A. It might be easier to go after email at the provider level, but NSA is capable of capturing all internet traffic if it wants to.
  - spindritf 13y ago
    > Or, if you're in the "host your own email" crowd, what makes you think your ISP won't cooperate with the government just like Google does? They don't have the information Google does because it's on an e-mail server under your bed. And you enjoy certain legal protections as a citizen in your home country. It's not a particularly enticing solution but it does have its upsides.
    - thrownaway2424 13y ago
      If your email server were under your bed, the FBI would just serve the warrant on you in person, seize your computer and all other computers in the same building, any spare disk drives, routers, appliances, and whatnot laying around, and probably half of the rest of your belongings besides. For those of you outside the USA, the NSA/DIA will just hack into your server and take your email.
      - superuser2 13y ago
        It is worth noting that they often choose to do this the "loud" way, but the FBI has been granted warrants to pick people's locks and copy their hard drives without leaving traces. Alarm monitoring companies are also subject to the jurisdiction of the United States, so that won't help you either.
        cinquemb 13y ago
        Someone could rig up their own system to notify themselves which is very doable. I can see the situation where someone gets notified, then emails their server to backup offsite, and wipe the hard drives (and for those well versed in demo, there's always that option…).
        betterunix 13y ago
        Why wipe the hard drives? Use WDE, and have the alarm (a) unmount the drive, (b) overwrite the system's RAM with 0s (or at least the portion of RAM where the keys are stored), and (c) power down the system. That is a lot faster that making a backup and wiping the drives; by the time an agent has snuck in and located the computer, the process should be over. Also, it might help to install a security camera, so you can tell the difference between a rat triggering the alarm and an FBI agent (I'll leave it to the audience to make a few jokes). Alarm is triggered, the camera starts sending pictures of the intruders to your smartphone or to Usenet (encrypted, using a key you keep on a smartcard) or whatever.
  - betterunix 13y ago
    Here is the difference between GMail and a self-hosted email system: when you delete messages over IMAP, they do not get deleted in GMail. "All Mail" keeps all your mail, forever, unless you log in via the web interface and delete it manually. You could always use the web interface, but now encrypting your messages is much harder. These are the sort of design decisions that can have far-reaching implications. Google was not thinking about protecting its users from government surveillance when it designed GMail.
    - magicalist 13y ago
      As others have noted elsewhere, that's not true: you can have it delete emails on delete, but you do have to turn that on yourself. It's not the default, and defaults matter, but it is an option that appears as soon as you click "enable IMAP" in gmail (go ahead and try it in your gmail settings). You'll have to read the options, yes, but considering the whole UX thing for gmail has been "never have to delete an email again", it's not an unmotivated default. Also, I hope your email client does secure deletes on local disk by default.
      - betterunix 13y ago
        Frankly, I missed the option, and usually I am pretty good with noticing if the defaults are what I want. The only reason I even noticed that "delete" was not actually deleting mail was that I had to search through All Mail one day, and I noticed some messages that I was sure I deleted. What makes this worse is the completely counterintuitive nature of deleting messages from All Mail: they just come back. I suppose it should have occurred to me that this is a setting I can change, but considering the other oddities I have seen in GMail's IMAP support I just jumped to the assumption that it is another weird "feature." Really though, the point still stands: Google was not considering protecting its users from government surveillance to be a priority here. They probably had other reasons, maybe even well-justified reasons, for the defaults they chose, but those reasons only make sense in the context of their engineering requirements. "Also, I hope your email client does secure deletes on local disk by default." I do something better: whole disk encryption. Actually, since I use an SSD now, "securely deleting" anything is non-trivial; it is better to just negate the need for it by never storing plaintexts anywhere.
- mtgx 13y ago
  What's a "person of interest"? Can they obtain a (normal) warrant for that? What's the charge brought against Assange from the US government?
- pradocchia 13y ago
  > If you have online contact with someone that's of interest, there's a chance all of your info will be of interest also. Yes, I believe two degrees of separation is the rule of thumb here. McCarty is one degree, so to complete the graph, they need all his data. William Binney mentioned this two-degree rule in his recent interview w/ USA Today (warning, autoplay): http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd... Note that two degrees was Binney's conservative proposal at the time to help preserve the privacy of the general population. The higher-ups weren't interested. But I assume there has been some research into how many degrees of separation are required to reach some threshold of confidence, and 2 degrees is pretty good.
- betterunix 13y ago
  "There it is: If you have online contact with someone that's of interest, there's a chance all of your info will be of interest also." Aside from the obvious chilling effect this has, how do you know if the people you speak to will become "persons of interest" later? Anyone you speak to now could be a high-profile activist in a year. That means that anyone could be the subject of this sort of surveillance.
  - mpyne 13y ago
    He was working in the same organization as Assange, let's not act like he was some random fan who sent a one-off email.
Jabbles 13y ago
What could Google have done better? (Specifically in regards to this case. And assuming they pushed back on orders like this, like they claim to do.)
- bobbydavid 13y ago
  don't forget to mention that Google is also the entity reporting that the information was handed over.
- breck 13y ago
  Push back more on the request? The 4th amendment includes this part: "particularly describing the place to be searched, and the persons or things to be seized" Describing what you want as " all e-mails " is exactly the type of description this part of the amendment is meant to prevent. It's way too broad.
  - thrownaway2424 13y ago
    There is a 10-bullet list of the particular things to be seized. How would you have made it more specific?
    - betterunix 13y ago
      By not having such broad categories of things to be seized. It is not "specific" to seize "every email message he sent to anyone ever."
      - thrownaway2424 13y ago
        I'm sure that will be of great interest if this person is ever charged with a crime. Until then, he has neither venue nor standing to challenge the warrant. Imperfect warrants are a problem for the state at trial. Outside of trial, any old warrant will do.
      - breck 13y ago
        Exactly. "All emails" negates all bullet points. It's like asking for 9 specific items in a real world warrant, and then point #10 is "and your whole house and everything in it".
ars 13y ago
The title makes it seem like they did it for fun, rather than as the result of a court order.
acgourley 13y ago
Can someone clarify if Google had to reveal they had done this? The article implies that they did not, and thus the reveal was a "not evil" gesture of transparency. But I'm wondering if they may have known it would get out anyway and they are just getting in front of it. Anyone have more information?
- packetslave 13y ago
  From http://www.google.com/transparencyreport/userdatarequests/legalprocess/#what_does_google_do http://www.google.com/transparencyreport/userdatarequests/le... "We notify users about legal demands when appropriate, unless prohibited by law or court order."
- tensafefrogs 13y ago
  Your wording implies that you think Google has something to hide or to be embarrassed about releasing the data, and that is not the case. The government asks for people's data all the time, and Google is legally obligated to provide the requested data. They then go the extra step and tell the users as soon as they are allowed to. There's nothing here to "get in front of."
  - acgourley 13y ago
    I could have chosen more fair words - that isn't what I meant to say. Anyway sounds like it's generally a good guy move, just wanted to check what others thought.
rasterizer 13y ago
Already thoroughly discussed here: https://news.ycombinator.com/item?id=5920530 https://news.ycombinator.com/item?id=5920530 and here: http://news.ycombinator.com/item?id=5921005 http://news.ycombinator.com/item?id=5921005
marekmroz 13y ago
"Rouge" whistleblower group? Really Ars? As opposed to what, an NSA approved whistleblower group?
iSnow 13y ago
Why for heaven's sake does anyone who does anything that might piss of a government use GMail or any hosted mail provider? This is far beyond me.
- d4nt 13y ago
  The definition of "anyone who does anything that might piss off a government" includes a lot of people. What if I become a political activist in 20 years time, I might well piss of a future government, should I stop using gmail now in case that happens?
  - iSnow 13y ago
    Not now, but exactly at that point in time.
- tensafefrogs 13y ago
  Because this is America, and it's supposed to be an amazing country where you have wonderful rights as outlined in the constitution.
- wutbrodo 13y ago
  That was my thought too, but to be fair: " 'Thankfully, neither of us use our Google accounts for anything remotely sensitive,' McCarthy wrote on his blog on Friday."
wyck 13y ago
The online "territory" will shift away from America eventually, especially for non Americans who are still stuck under the USA's influence. This is exactly the kind of thing, along with recent events, that will eventually deal a major blow to US based tech.

179 points by gcb0 13y ago

ferdo 13y ago

I've never owned a gmail account but have sent to plenty. Gmail is like the 21st century party landline but only a relative few people can listen in. > Because I talked to Julian Assange, all information held by Google relating to my user account with them can be handed over to US prosecutors—not just the contents of my conversations with Julian. There it is: If you have online contact with someone that's of interest, there's a chance all of your info will be of interest also.

superuser2 13y ago
Have you considered the possibility that we hear about surveillance of GMail accounts only because so many people happen to use GMail? Is there any particular property of Google that makes it more likely to cooperate with government than any other email provider? Or, if you're in the "host your own email" crowd, what makes you think your ISP won't cooperate with the government just like Google does?
- deleted 13y ago
  [deleted]
- spc476 13y ago
  It depends on what you mean by "host your own email." Sure, a server at, say, RackSpace, might be vulnerable to government intrusion without your knowledge, but if you have a physical server at your home, then the best that the government can do (without your knowledge) is to tap your upstream connection, which does little for past emails.
  - jaggederest 13y ago
    You assume they can't just rootkit and browse your server at will? On one hand, government agencies are notoriously ineffective with technology. On the other hand, I'd rather assume competence and be incorrect than the opposite.
  - superuser2 13y ago
    >the best that the government can do (without your knowledge) is to tap your upstream connection, which does little for past emails. Really only applies to emails before Room 641A. It might be easier to go after email at the provider level, but NSA is capable of capturing all internet traffic if it wants to.
- spindritf 13y ago
  > Or, if you're in the "host your own email" crowd, what makes you think your ISP won't cooperate with the government just like Google does? They don't have the information Google does because it's on an e-mail server under your bed. And you enjoy certain legal protections as a citizen in your home country. It's not a particularly enticing solution but it does have its upsides.
  - thrownaway2424 13y ago
    If your email server were under your bed, the FBI would just serve the warrant on you in person, seize your computer and all other computers in the same building, any spare disk drives, routers, appliances, and whatnot laying around, and probably half of the rest of your belongings besides. For those of you outside the USA, the NSA/DIA will just hack into your server and take your email.
    - superuser2 13y ago
      It is worth noting that they often choose to do this the "loud" way, but the FBI has been granted warrants to pick people's locks and copy their hard drives without leaving traces. Alarm monitoring companies are also subject to the jurisdiction of the United States, so that won't help you either.
      - cinquemb 13y ago
        Someone could rig up their own system to notify themselves which is very doable. I can see the situation where someone gets notified, then emails their server to backup offsite, and wipe the hard drives (and for those well versed in demo, there's always that option…).
        betterunix 13y ago
        Why wipe the hard drives? Use WDE, and have the alarm (a) unmount the drive, (b) overwrite the system's RAM with 0s (or at least the portion of RAM where the keys are stored), and (c) power down the system. That is a lot faster that making a backup and wiping the drives; by the time an agent has snuck in and located the computer, the process should be over. Also, it might help to install a security camera, so you can tell the difference between a rat triggering the alarm and an FBI agent (I'll leave it to the audience to make a few jokes). Alarm is triggered, the camera starts sending pictures of the intruders to your smartphone or to Usenet (encrypted, using a key you keep on a smartcard) or whatever.
- betterunix 13y ago
  Here is the difference between GMail and a self-hosted email system: when you delete messages over IMAP, they do not get deleted in GMail. "All Mail" keeps all your mail, forever, unless you log in via the web interface and delete it manually. You could always use the web interface, but now encrypting your messages is much harder. These are the sort of design decisions that can have far-reaching implications. Google was not thinking about protecting its users from government surveillance when it designed GMail.
  - magicalist 13y ago
    As others have noted elsewhere, that's not true: you can have it delete emails on delete, but you do have to turn that on yourself. It's not the default, and defaults matter, but it is an option that appears as soon as you click "enable IMAP" in gmail (go ahead and try it in your gmail settings). You'll have to read the options, yes, but considering the whole UX thing for gmail has been "never have to delete an email again", it's not an unmotivated default. Also, I hope your email client does secure deletes on local disk by default.
    - betterunix 13y ago
      Frankly, I missed the option, and usually I am pretty good with noticing if the defaults are what I want. The only reason I even noticed that "delete" was not actually deleting mail was that I had to search through All Mail one day, and I noticed some messages that I was sure I deleted. What makes this worse is the completely counterintuitive nature of deleting messages from All Mail: they just come back. I suppose it should have occurred to me that this is a setting I can change, but considering the other oddities I have seen in GMail's IMAP support I just jumped to the assumption that it is another weird "feature." Really though, the point still stands: Google was not considering protecting its users from government surveillance to be a priority here. They probably had other reasons, maybe even well-justified reasons, for the defaults they chose, but those reasons only make sense in the context of their engineering requirements. "Also, I hope your email client does secure deletes on local disk by default." I do something better: whole disk encryption. Actually, since I use an SSD now, "securely deleting" anything is non-trivial; it is better to just negate the need for it by never storing plaintexts anywhere.
mtgx 13y ago
What's a "person of interest"? Can they obtain a (normal) warrant for that? What's the charge brought against Assange from the US government?
pradocchia 13y ago
> If you have online contact with someone that's of interest, there's a chance all of your info will be of interest also. Yes, I believe two degrees of separation is the rule of thumb here. McCarty is one degree, so to complete the graph, they need all his data. William Binney mentioned this two-degree rule in his recent interview w/ USA Today (warning, autoplay): http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd... Note that two degrees was Binney's conservative proposal at the time to help preserve the privacy of the general population. The higher-ups weren't interested. But I assume there has been some research into how many degrees of separation are required to reach some threshold of confidence, and 2 degrees is pretty good.
betterunix 13y ago
"There it is: If you have online contact with someone that's of interest, there's a chance all of your info will be of interest also." Aside from the obvious chilling effect this has, how do you know if the people you speak to will become "persons of interest" later? Anyone you speak to now could be a high-profile activist in a year. That means that anyone could be the subject of this sort of surveillance.
- mpyne 13y ago
  He was working in the same organization as Assange, let's not act like he was some random fan who sent a one-off email.

Jabbles 13y ago

What could Google have done better? (Specifically in regards to this case. And assuming they pushed back on orders like this, like they claim to do.)

bobbydavid 13y ago
don't forget to mention that Google is also the entity reporting that the information was handed over.
breck 13y ago
Push back more on the request? The 4th amendment includes this part: "particularly describing the place to be searched, and the persons or things to be seized" Describing what you want as " all e-mails " is exactly the type of description this part of the amendment is meant to prevent. It's way too broad.
- thrownaway2424 13y ago
  There is a 10-bullet list of the particular things to be seized. How would you have made it more specific?
  - betterunix 13y ago
    By not having such broad categories of things to be seized. It is not "specific" to seize "every email message he sent to anyone ever."
    - thrownaway2424 13y ago
      I'm sure that will be of great interest if this person is ever charged with a crime. Until then, he has neither venue nor standing to challenge the warrant. Imperfect warrants are a problem for the state at trial. Outside of trial, any old warrant will do.
    - breck 13y ago
      Exactly. "All emails" negates all bullet points. It's like asking for 9 specific items in a real world warrant, and then point #10 is "and your whole house and everything in it".

ars 13y ago

The title makes it seem like they did it for fun, rather than as the result of a court order.

acgourley 13y ago

Can someone clarify if Google had to reveal they had done this? The article implies that they did not, and thus the reveal was a "not evil" gesture of transparency. But I'm wondering if they may have known it would get out anyway and they are just getting in front of it. Anyone have more information?

packetslave 13y ago
From http://www.google.com/transparencyreport/userdatarequests/legalprocess/#what_does_google_do http://www.google.com/transparencyreport/userdatarequests/le... "We notify users about legal demands when appropriate, unless prohibited by law or court order."
tensafefrogs 13y ago
Your wording implies that you think Google has something to hide or to be embarrassed about releasing the data, and that is not the case. The government asks for people's data all the time, and Google is legally obligated to provide the requested data. They then go the extra step and tell the users as soon as they are allowed to. There's nothing here to "get in front of."
- acgourley 13y ago
  I could have chosen more fair words - that isn't what I meant to say. Anyway sounds like it's generally a good guy move, just wanted to check what others thought.

rasterizer 13y ago

Already thoroughly discussed here: https://news.ycombinator.com/item?id=5920530 https://news.ycombinator.com/item?id=5920530 and here: http://news.ycombinator.com/item?id=5921005 http://news.ycombinator.com/item?id=5921005

marekmroz 13y ago

"Rouge" whistleblower group? Really Ars? As opposed to what, an NSA approved whistleblower group?

iSnow 13y ago

Why for heaven's sake does anyone who does anything that might piss of a government use GMail or any hosted mail provider? This is far beyond me.

d4nt 13y ago
The definition of "anyone who does anything that might piss off a government" includes a lot of people. What if I become a political activist in 20 years time, I might well piss of a future government, should I stop using gmail now in case that happens?
- iSnow 13y ago
  Not now, but exactly at that point in time.
tensafefrogs 13y ago
Because this is America, and it's supposed to be an amazing country where you have wonderful rights as outlined in the constitution.
wutbrodo 13y ago
That was my thought too, but to be fair: " 'Thankfully, neither of us use our Google accounts for anything remotely sensitive,' McCarthy wrote on his blog on Friday."

wyck 13y ago

The online "territory" will shift away from America eventually, especially for non Americans who are still stuck under the USA's influence. This is exactly the kind of thing, along with recent events, that will eventually deal a major blow to US based tech.