25 ms·

Google Security Team Member on NSA: "Fuck These Guys"

1217 points by cdvonstinkpot 13y ago

thejosh 13y ago
Non mobile post: https://plus.google.com/114798402540078632611/posts/LW1DXJ2BK8k https://plus.google.com/114798402540078632611/posts/LW1DXJ2B...
- arkem 13y ago
  and here's the original "fuck these guys" post https://plus.google.com/108799184931623330498/posts/SfYy8xbDWGG https://plus.google.com/108799184931623330498/posts/SfYy8xbD... The submitted link is Mike Hearn agreeing with and elaborating on Brandon Downey's original thoughts on the matter.
ChuckMcM 13y ago
I wondered about that traffic, and getting confirmation from the source that the only way the NSA could have it would be by tapping into the internal network is as quite damning. Google has the best OpSec team I've ever known, it is my hope that they close this 'loophole' as completely as possible.
- bitskits 13y ago
  Closing that loophole was underway in Sept according to this article (also linked in the post)... http://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html http://www.washingtonpost.com/business/technology/google-enc...
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- frank_boyd 13y ago
  We still don't know if that was really a loophole or rather access given by Google (of course, they will decline that).
  - cbhl 13y ago
    My personal opinion is that it's more likely that the access was given by a telecom that Google leased from than from Google itself.
- rsync 13y ago
  Google, and their "geniuses" in opsec, should not be given a pass at all for this. Even if this is a leased private line, non-Internet routed, whatever, it is trivially easy to encrypt the communications and is absolutely a best practice. I see this as great big egg on their face. In fact, it's such a cock-up that one wonders if this is the plausibly deniable ingress that they agreed to provide for the NSA, et. al This is akin to using telnet to access your home server because you're "on your own network". Nobody does that and I can't believe they would have either.
  - ChuckMcM 13y ago
    You are of course entitled to your opinion, I know Brandon and I know how dedicated he is, I got to watch him and the OpSec team in action during the Chinese incursion. One of the side effects of being in the platforms group was that I had exceptional access to what was going on everywhere on Google's internal network and machines. And a lot changed after that event, both internally and externally. I can forgive someone for thinking that if they dug trenches in the street, bought some fiber, and ran it between a couple of buildings, in a country where the rule of law was in effect, they might consider it a reasonable assumption that the fiber is laying in the street unmolested. Even if the distance is such that they can't see the entire length of the ground above the conduit. Prior to Snowden's disclosures, it was the common belief amongst the security community that in 'safe' countries, the government in power would not subvert your infrastructure through physical access. They might do some network tricks, but not tap your fiber. In 'bad' countries counter measures were taken. And the network setup in say Russia or China was different than it was in the US and the UK. That your own government would illegally subvert your infrastructure [1] through the use of a technicality was not considered a "likely" threat [2]. Given that not it has been exploited it is rewriting a bunch of assumptions. I am not surprised in the least that they are now deploying the same hardening they use in hostile environments world wide. [1] The NSA cannot legally tap into communications infrastructure in the US (that is the FBI's job) and when the FBI does it they need a warrant. By doing this in the UK they sidestepped those constraints. [2] In classic vulnerability analysis you deploy your resources against both the probability and damage potential of a given threat. So for example datacenters are vulnerable to being bombed by aircraft, the probability of that is low enough that you don't defend against it, bombed by cars you put a security perimeter around the building.
- 1g00gler 13y ago
  If you're referring to the Orange team yes, they're pretty good. Brandon Downey has proved time and time again that his incompetence gets in the way of protecting Google's network. Perhaps if he spent less time posting garbage on eng-misc and more doing his job we could have implemented security measures to prevent this way sooner. Point your browser at go/privacyboost and search on Moma for Autobahn and the related CLs.
cromwellian 13y ago
It's ironic that when the Chinese attack against Google occurred, we thought the Chinese government was the most hostile state actor threat to worry about, but it turned out to be the US and UK government.
- repnescasb 13y ago
  no, YOU thought of China as terribly hostile. We in Europe know the deal for a very long time. It's not like there was no cold war and vietnam war and irak war and....
- babar 13y ago
  Why do people assume the Chinese government is not able to use similar techniques?
  - wmf 13y ago
    I would assume they use similar techniques within China and perhaps allied countries like North Korea and Cuba, but the US is performing wiretapping in at least the UK, Canada, Australia, and New Zealand. Also, how much non-Chinese Internet traffic passes through China?
    - maaku 13y ago
      > and perhaps allied countries like North Korea and Cuba Nobody is more distrusting of each other than two communist countries.
      - kika 13y ago
        Well, when you eat off the hand of the other country you don't have much choice. Nobody actually asks you if you trust or not.
      - nzp 13y ago
        Disregarding for a moment that a state can not be communist (one defining characteristic of communism being absence of state), only socialist, North Korea has long disassociated itself from communism. Since the 90s at least there has been a systematic removal of any mention of Marxism, communism and related terminology from the constitution, laws and official discourse.
SCdF 13y ago
This has been asked before, but I'd love to hear from a dev (anonymously of course) who actually helped build this NSA madness. Is it like The Cube, where no one really knew what each piece was for? Is it that they are morally pro the NSA's attitude toward personal and corporate privacy, or do they just not care either way?
- zaqokm 13y ago
  William Binney in an interview suggested that the tech he built for spying on foreign countries was simply retrofitted and used to spy internally. I am gathering not a lot of people actually knew what was happening at the beginning, and the tools they were using for "valid" purposes were just refocused.
  - PakG1 13y ago
    There still have to be technical people involved for refocusing software. You don't simply drag and drop an icon to get something redeployed for another purpose, and definitely not for something of this complexity.
    - zaqokm 13y ago
      I agree, however I think it is very credible that a lot of people involved in this were not fully aware or complicit in regards to what was happen. I do not think they were stupid, but just didn't see the entire picture, or were never given the entire picture.
      - deleted 13y ago
        [deleted]
- wmf 13y ago
  In The Shadow Factory (written after the Klein leaks but before Snowden), Bamford notes that a lot of surveillance equipment comes from Israel. I don't know much about Israeli culture but it may be significantly different from the US.
thex86 13y ago
Appreciate Mike speaking up like this. We need more people within the industry to speak up. Not just hackers. (People within these companies are also hackers, but they have more effect when they speak because they are part of a company)
- justin66 13y ago
  I agree, but I do wonder what is going to happen when people start speaking up to say something quite the opposite. "I don't speak for my employer, but I think the NSA is quite awesome and I don't mind that they've been listening to us at all." Or something to that effect. The clash might be interesting to watch.
  - dpacmittal 13y ago
    With the increasingly alarming NSA plans being revealed, if someone thinks NSA is doing a good job, they deserve to be fired. His thoughts and opinion doesn't give him the rights to have public data available to governments. This, ofcourse, assumes that he is into Security Team at some well known company.
  - rfnslyr 13y ago
    Anybody who praises the NSA should be blacklisted from existence in this solar system.
poxrud 13y ago
The NSA must have somebody working on the inside at google. Otherwise it would be extremely difficult to reverse engineer the RPC protocol that was used by google's servers to communicate between each other. Even on an unencrypted network I can image it would be very difficult to reverse engineer the protocol without any help.
- dragonwriter 13y ago
  Or, they could have just hired an ex-Googler familiar with the protocol. No need for someone working for the NSA "on the inside" at Google, and no need for reverse engineering.
  - acqq 13y ago
    Just "being familiar" would probably slow them down too much, considering how much different protocols they attacked "1622 Google authorization protocols" are listed on one NSA slide here: http://www.washingtonpost.com/blogs/the-switch/wp/2013/11/04/how-we-know-the-nsa-had-access-to-internal-google-and-yahoo-cloud-data/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/11/04... I know how hard it would be, I implement low level protocols (not Google's or of men in black).
- cromwellian 13y ago
  No need to reverse engineer it, it's a public spec, ProtoBufs. It's like saying "it's extremely difficult to reverse engineer JSON"
- vinkelhake 13y ago
  The RPC protocol is stated to be based on protocol buffers so the encoding is known. What you would need to do to reverse engineer it is coming up with matching message descriptions. But, even without that piece of the puzzle, reverse engineering a protocol that doesn't use encryption wouldn't be "extremely difficult". This is not an indication of an inside man. https://developers.google.com/protocol-buffers/docs/overview https://developers.google.com/protocol-buffers/docs/overview
bcoates 13y ago
Is information about disruptions to the US PSTN collected anywhere? The discussion of cable tapping and the NSA's apparent taste for doing things the expedient way instead of the legal way makes me wonder if the "vandalism" domestic underground fiber cuts in the years after 9/11 form an interesting pattern.
adamnemecek 13y ago
Wow, a guy working for Google said "fuck you" to the NSA. All my doubts and worries are gone now.
- maaku 13y ago
  He did preface it with a "I don't speak for my company".
  - adamnemecek 13y ago
    Therefore...?
    - maaku 13y ago
      I took your comment as being serious. Maybe my sarcasm detector needs adjustment.
- Amadou 13y ago
  Are you being sarcastic? For months Google's only public response was to lobby the government for permission to release stats(?) to prove that they complied with the law - nary a word of criticism for the law itself. So now that Google's own autonomy has been breached by the NSA (all above-board and legal according to the NSA's legions of loop-hole seeking lawyers) instead of just Google's users, now they are mad? I just made another post about how a lot of people are unable to imagine what its like for others to be in a situation until they themselves are in the same situation. But... I'm not so sure Google, as an organization, has fully recognized the scope of the problem here.
  - adamnemecek 13y ago
    I was being sarcastic, yes.
    - Amadou 13y ago
      OK. I had laugh-snort reading the discussion on that page - at one point the original author, Mike Hearn, tries to argue that ad-based services are actually a good thing for privacy. Does Kool-Aid have a google flavor now?
cpeterso 13y ago
I can understand using unencrypted network within a data center (unless you are doubly paranoid), but why wouldn't they encrypt data between data centers?
- parliament32 13y ago
  Apparently these data centers were linked via dedicated lines -- there was no traffic or outside access to these fiber lines. They were used solely for communication between the two data centers (so technically still an isolated network).
  - rurounijones 13y ago
    A pretty good example to smack in the face of all those "Just Air-gap your distributed SCADA system!" devotees.
    - Daniel_Newby 13y ago
      Such people exist?!
      - gonzo 13y ago
        they do, sadly
- us0r 13y ago
  They buy the lines in the ground. It is suppose to be 100% private. It is like having a wire from one room of your house to another. Wikileaks has a list of vendors/products who allow these types of things to happen. What I want to know is how they tapped the actual line. I would assume these lines are going directly into Google owned (or controlled) buildings.
  - noir_lord 13y ago
    You can tap fiber in a non-destructive way ( http://en.wikipedia.org/wiki/Fiber_tapping http://en.wikipedia.org/wiki/Fiber_tapping ) and in ways that increase attenuation only slightly (and that is contingent on you detecting it and having the equipment to even detect it). If you know the route the fibre takes (which should be public and certainly government knowledge) you can install the tap anywhere along the length of the cable, roll up with a van the equipment and two guys in high viz vests with a fake work order, who the hell is going to check....(think the Ghostbuster's scene where they close half the road). The crazy thing is that so many smart people at Google and encrypting the data still wasn't done.
allochthon 13y ago
My feeling is that the NSA/GCHQ hack was arguably an unfortunate thing for them to do, although somewhat predictable, once one knows of the existence of the network topology vulnerability that was exploited. But presumably somewhere in Google someone knew about this possibility sometime back. I wonder whether there was an assumption that nobody would be clever enough to figure things out, or whether security engineers were working 24/7 to fill in the gap and just didn't get there in time. Either way, this is a good stimulus for rolling out deeper encryption.
- deleted 13y ago
  [deleted]
sschueller 13y ago
How do we know the Chinese or someone else hasn't hacked into the NSA and is using that data to gain access to secure systems that would otherwise be almost impossible to break into. Wasn't there a Google break in not so long ago?
- Andrenid 13y ago
  Considering the track record of Governments and technology, I pretty much assume that whatever systems the NSA (and friends) had made are so ridden with holes that any/all people who really want access to it, already do, and that all our (worldwide citizens) access is basically out in the open now. If anything, I'm actually pretty impressed it has gone on this long without seeing posts on underground forums offering access via cracked/leaked accounts and 0days, in exchange for money. Or maybe it has?
frank_boyd 13y ago
Well that's ok. But what really needs to happen is this to come from the top management - and most of all, they need to ACT accordingly. Until then, all this "fuck them" exclamations aren't worth a dime.
- cromwellian 13y ago
  You mean like working on projects to encrypt all of their data center links, which started, incidentally, before the Snowden revelations. Or the fact that David Drummond and Eric Schmidt have publicly said the diplomatic equivalent of 'fuck these guys'?
- walshemj 13y ago
  And rather unprofessional where where these guys when Eric Schmidt was making his creepy uncle statements.
rurounijones 13y ago
Given the snippet of traffic involved, can they make an educated guess which links were compromised to get it? (It is DB replication traffic so if you know the source DB and the dest DB then you can work out the route... in theory anyway, with Google Complexity, who knows...)
lazyjones 13y ago
Cussing is all fine and understandable, but I missed the part where the Google opsec team was searching for and plugging the holes the NSA is exploiting, or switching to another carrier, or suing the NSA for illegal wiretapping.
- NamTaf 13y ago
  The problem is that it's not the NSA doing it. It's GCHQ, in the UK.
  - antihero 13y ago
    What was the physical location of this fiber? The UK?
    - estel 13y ago
      Yes, according to the Washington Post, the interception took place in the UK.
- raldi 13y ago
  Indeed, you missed it. It was back in September: http://articles.washingtonpost.com/2013-09-06/business/41831756_1_encryption-data-centers-intelligence-agencies http://articles.washingtonpost.com/2013-09-06/business/41831...
lsh123 13y ago
Lets start from the beginning: the NSA "hack" became possible because Google (and its security team) made bad assumptions about the security of the connection between Google's data centers and did not encrypt the traffic. Basically, this is security 101: protect data at rest and protect data in flight. So, sorry but I think the better subject for discussion would be how badly Google screwed up, not how evil is NSA. Moreover, it is not clear if other governments or criminals also had access to the users' data (e.g. in Google's data centers located outside of the US). So far Google did not produce any public post-mortem thus we have no clue how bad was the problem. P.S. I am sure I will get smashed in the comments, so let me say right away that NSA actions should be controlled and audited by the public (e.g. through our representatives in Congress). I think that the biggest "evil" here are the members of Congress who either approved NSA actions or failed to do their job and monitor/audit NSA properly. In particular, I would point my finger at Sen. Dianne Feinstein [D-CA] who should have been ousted from the office long time ago.
- raldi 13y ago
  Would you still feel Google had screwed up if the way the US government got the data was to burglarize one of their datacenters and tap directly into the machines' CPUs and memory buses?
  - lsh123 13y ago
    Yes (search for SSAE16 or SAS70). However, I would not feel the same way if US government would have used Area 51 technology to hack 4096 public key encryption. The difference from my perspective is that in "burglary" scenario (and un-encrypted traffic scenario as well) Google failed to protect against well known threats. And in the "alien technology" case Google did everything you can at the known security/technology level and the failure came from aliens (aka an "unexpected technology advances"). Basically, I think Google's decision to do not encrypt the traffic is a gross negligence and I would love to see how someone would sue Google for it.
    - jonknee 13y ago
      > Basically, I think Google's decision to do not encrypt the traffic is a gross negligence and I would love to see how someone would sue Google for it. Wow. Just wow.
tonyplee 13y ago
Just simple big government(s) v.s. big company - happened over and over again in history - remember how powerful Microsoft was in the end of the 90. Governments don't like challenge to its power. They will find ways to control the Jedi Council.
- cinquemb 13y ago
  I really don't think this is that clear cut. On this thread alone, two people have have vouched for their companies that encrypt internal traffic as standard MO (wepay, and another larger than google [by their words]) and considering that some mailing list chatter[0] has pointed out some interesting dynamics (read duplicitous) on the behalf of some companies (among the remarks on here), I wouldn't fool myself with its that simple. As someone working on a start up now dealing with crowd-sourcing/mining data on people/identities and leaving it public, it's very interesting to see the dynamics play out with online services especially with ones that create the perception of walled gardens vs those that position themselves as inherently public and the flak (or lack thereof) they take from privacy advocates and what not. [0] http://cryptome.org/2013/10/nsa-hysteria-coverup.htm http://cryptome.org/2013/10/nsa-hysteria-coverup.htm
bowlofpetunias 13y ago
Oh, the hypocrisy.... > "Bypassing that system is illegal for a good reason." Yes, so is invasion of privacy. Yet Google has no problem breaking the law and violating civil rights for profit. > "Unfortunately we live in a world where all too often, laws are for the little people." Yeah, like tax laws and privacy laws... If you want to get on this high horse, you shouldn't be working for Google.
- nodata 13y ago
  Erm, what? Which law did they break, and which civil rights did they violate?
  - CaptainZapp 13y ago
    Like indiscriminately and illegally sucking up WiFi data with their street view mobiles? Including account information and passwords on unsecured WiFi connections. Even if the accusation of "violating laws" may be a tad hyperbolic in the great scheme of things it's not a stretch to deem Google one of the most hypocritical companies around.
    - meowface 13y ago
      That did happen, but I believe the data was captured and stored by mistake. At the least, they had no intention to view or use any of that data. The NSA on the other hand actively intends everything it's doing in this case. Comparing Google's Wifi mishap with the NSA's hundreds (thousands?) of deeply questionable operations driven by invasions of privacy and security is comparing apples with oranges.
    - thezilch 13y ago
      Except, they didn't explicitly mean to do that, stopped doing that, and paid for the autonomous collection of trash that they threw out.
      - icecreampain 13y ago
caycep 13y ago
Here's one potential cultural snafu - my understanding is US intelligence based almost entirely on SIGINT. I'm not sure how great we are at plain old HUMINT, i.e. using people and relationships to get information and an overall picture of the world. So all the defense community was raised on SIGINT, and anything seen as a curb on this - technical or legal, they will probably view it as some sort of existential threat. They would then fight tooth and nail to block any sort of reform. And the military industrial complex has quite a lot of legislative muscle....
- ihsw 13y ago
  It hasn't always been this way, and I'm sure the State Department and the Office of the President rely on SIGINT far more than direct diplomacy -- even to the point where diplomatic efforts are, universally, a cold formality. They like to toss words like "Terrorism" around like frisbees hoping someone will catch it and toss it to someone else, however I personally think we can assume that direct diplomacy is dead. SIGINT is more consistent and dependable than engaging another nation's diplomatic apparatus, and all nations are clamoring for their own monitoring solution. It's a new baseline measurement of international political power -- the cost is so low that it's foolish not to get it.
- Nick_C 13y ago
  One of the outcomes of various 9/11 reviews was the realisation that HUMINT had degraded as far as it had. The problem is that it is very expensive, both in time and money, and it has uncertain outcomes. The rise of technology, both its widespread use by the public and the ability to capture it by agencies, had made SIGINT seem much more attractive in the couple of decades prior to 9/11. So, yes, agencies had become over-reliant on SIGINT over HUMINT, but for understandable reasons with the benefit of hindsight. Currently, they certainly don't view it as an existential threat and all agencies are working to re-establish HUMINT capability, the opposite of trying to block it. The trouble is that it is hard, really hard work.
sinak 13y ago
I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improvements Act, from Feinstein and the Senate Intelligence Committee. In short it legalizes most of what the NSA has been done. - Bill 2: The USA FREEDOM ACT, from Sensenbrenner and Leahy, currently being considered by the House/Senate Judiciary committees. It amends §215 of FISA to end bulk phone metadata collection and fixes some of the problems with §702 of the FISA Amendments Act (under which PRISM is run). But it doesn't fix §702 fully, does nothing to end BULLRUN (undermining encryption) nor the surveillance that happens outside FISA (MUSCULAR, for example, and god knows what else). Obviously the Feinstein bill can't be allowed to pass. But some really big names (ACLU, CDT) have thrown strong support behind the Freedom Act. I'm wondering what we as the Taskforce(.is) should do. It's clear to me that it doesn't go nearly far enough. And there's some chance that if it passes, Congress will view this whole thing as "dealt with" and not revisit the issue for years to come. But unfortunately the Freedom Act barely has the votes to get out of the judiciary committee, and getting it to pass through both houses requires a lot of momentum. We've been working on a campaign asking folks to call and oppose Feinstein, and potentially to support the Freedom Act. But I'm not sure if that's a right move. Unfortunately, the public doesn't understand why privacy is important, and Americans aren't nearly angry enough for Congress to do anything more substantial than the Freedom Act. We might be able to push for amendments, but it's a long shot. tl;dr - We've got two bills in Congress. One is terrible, one is mediocre. But we don't have the political momentum to do anything better than the mediocre bill. What do we do? Tech advocate conundrum.
- deleted 13y ago
  [deleted]
- serge2k 13y ago
  Try to find a fix for the ridiculously broken system that is the US government?
  - 13y ago
vorce 13y ago
I think it's time to also highlight the fact that people enabled the NSA to do these things. A lot of them engineers. In some cases I'm sure the ones building the stuff didn't or couldn't see the end goal. But I guess there have been many who HAVE suspected or known about the use-cases of the products/software that they have been a part of making. This scares me, it is time that engineers take some moral responsibility. Maybe some course in ethical decision making wouldn't hurt to include in engineering colleges? (Note: All fields should take moral responsibility, but engineers seem to be worse than a lot of others.)
stevenrace 13y ago
They are likely both complicit in - as well as victims of - fiber tapping given GOOG now owns the building housing one of the largest peering exchanges on the Internet [1]. [1] 111 Eight Ave in NYC (housing Hiberia's trans-Atlantic cable, Equinox, Deutsch Telecom, etc) http://www.datacenterknowledge.com/archives/2010/12/03/wsj-google-has-bought-111-8th-avenue/ http://www.datacenterknowledge.com/archives/2010/12/03/wsj-g...
gogobyte 13y ago
Fuck the monstrous police state!
rdl 13y ago
I'm personally far more angry with Congress utterly failing in their oversight role, and to some extent with the judiciary for becoming at best a rubber stamp, than with NSA. The President (pretty much from LBJ onward, but even farther back) is also fairly complicit in this, but that part is accelerating. I would probably be a single-issue voter if a candidate for congress were likely to win and was aligned with me on this issue but opposed on virtually everything else. One essentially-fantasy is to run for Congress directly. Unfortunately I haven't lived my entire life to my mid-30s in trying to become a viable political candidate, so this would be difficult. Central or Eastern WA is probably the best bet, along with starting a 50-500 person business which employs a lot of local people (manufacturing of some kind) and generally being an engaged local citizen for a decade or more. But that's a long term goal.
pvnick 13y ago
Keep in mind when considering reform by our legislature that any serious efforts on that front will likely be undermined with blackmail made possible by the very surveillance apparatus they are attempting to curtail [1]. I sincerely hope that Snowden's revelations prove or at least strongly hint towards such an assertion because until they do it's still "conspiracy theory." Free society is in deep shit, and for the life of me, even though I've thought about it obsessively for the past couple months now, I have no idea what can be done about it. [1] http://www.boilingfrogspost.com/tag/russ-tice/ http://www.boilingfrogspost.com/tag/russ-tice/
ismail 13y ago
'Privacy' currently is just a facade, most people have just not realised that. Here is an interesting fact, that joe public do not realise. If you have a mobile phone, you can be tracked, even if there is no GPS on the device. Besides this if the NSA chooses, they can track practically ANYONE in the world, all they need is a mobile number. I would not be surprised if this is actually one of the tools they have. How? Due to the nature of how GSM and mobile operators integrate when roaming. When a mobile operator signs an international roaming agreement, they setup signalling links between their switches and VLR's (Visitor Location Register). The mobile operator in the visited country needs to authenticate you against your home network, this happens via SS7. Once this link is established, it is assumed to be trusted, and most operators DO NOT apply any filtering on these commands. So with a carefully crafted SS7 command, you could request the location of a mobile subscriber, even if they have not even attempted to join your network. Now here is where it gets interesting, get access to send ss7 commands from an operator with many international roaming agreements, and you can get details on practically any subscriber. Get access to 2-4 (i.e AT&T, T-Mobile, Vodaphone) of these massive tier1 operators, and you can get the location of practically everyone with a mobile handset.
- Raphmedia 13y ago
  I don't have a mobile phone. You don't need one, really. Skype at work, landline at home. Why would I want to talk to anyone on the go? I go out for beers and other social activities all the time. My social life is not suffering at all. The need of having a cellphone is a lie.
__matt 13y ago
fuck these guys, they stole our business model!
dell1994 13y ago
Oops. What a Hypocrisy? The moral righteous Google. Little People vs Big People? Please stop. Don't do Evil still works for you guys.. I guess. You have the resources to defend it, if you want to defend. You choose not to in many ways. So please dont explode in profanity several times a day.
LiamMcCalloway 13y ago
I am surprised this exerpt from Alan Rusbriger's article in the New York Review of Books [1] hasn't made the rounds: > "But I did have an interesting (unattributable, of course) briefing from someone very senior in one West Coast mega-corporation who conceded that neither he nor the CEO of his company had security clearance to know what arrangements his own organization had reached with the US government. “So, it’s like a company within a company?” I asked. He waved his hand dismissively: “I know the guy, I trust him.” West Coast mega-corporation does not know what West Coast mega-corporation does. [1] http://www.nybooks.com/articles/archives/2013/nov/21/snowden-leaks-and-public/?page=2 http://www.nybooks.com/articles/archives/2013/nov/21/snowden...
w_t_payne 13y ago
So how long before HN gets shut down for supporting criminality and terrorism?
acd 13y ago
I think the trends has been like this and history tends to repeat it self but in different forms. 1) Main frame - central computing 2) PC revolution - decentralized computing 3) The cloud - central computing 4) ? Hackers invent p2p - decentralized network corporations,government not in control of any communication, information heavily encrypted possibly distributed using erasure codes. Network run by friends who you can trust. Code written by hackers
kgarten 13y ago
afterwards they will be fu* * * * using FISA court orders ...
theinterjection 13y ago
Has it ever occurred to anyone that, just maybe, the whole NSA thing is a cover-up to distract the attention from the fact that it's actually the megacorporations that want to spy on you? This is a good way for Google, Microsoft, etc. to look innocent. Let's not forget that it was us who decided to trust these corporations with all our personal data.
- AsymetricCom 13y ago
  This is absolutely true. DPI was used by corporations first. NSA et. al. have to use it to stay in the game. Of course, you'll never hear this because the multinational media decides who you root for.
w_t_payne 13y ago
So, this is how it's gonna play out: Over the next few years it will become more and more common for "in-flight" data to be encrypted. As the "low-hanging fruit" starts to disappear, state-level attackers will increasingly turn their attention from fibre to endpoint; with a corresponding increase in the number of attacks on mobile devices, apps, and embedded systems. This is, to put it mildly, incredibly challenging terrain for passive defence, where complexity all-but-guarantees unknown vulnerabilities and hidden attack vectors. Now, I am not too sure about the ethics of active defence / networked HIPS, (Too similar by a long shot to the sort of malevolent behaviour it is supposed to defend against) but it might be something that we are going have to have a look at.
blparker 13y ago
How does one "capture" data flowing over a private fiber channel? Does it require a physical tap?
- ForHackernews 13y ago
  Most likely, yes. You can tap a fiber optic line without breaking it by bending it such a way that light leaks out: http://www.techrepublic.com/blog/it-security/protect-your-network-against-fiber-hacks/222/ http://www.techrepublic.com/blog/it-security/protect-your-ne...
androtheos 13y ago
Any data running over a leased or owned fiber between data centers should still be encrypted. Why didn't they have a VPN between the data centers? I don't get it and I personally think it's inexcusable. I believe I would lose my job if I my companies data was stolen and their was something I could have done to prevent it, and rightly so. I personally think that everyone has been far to forgiving of companies like Google, Yahoo, Microsoft, Facebook etc... for having done such a poor job of protecting the data we entrust to them.
ynniv 13y ago
I think that we also forget in this age of reduced crime, that it doesn't matter whether or not something is illegal if you have no means of preventing someone from doing it or holding them responsible when they do. We discovered this situation not by uncovering the intrusion, but from leaked documents. The government has a lot of employees and likes to document its operations, which can lead to whistleblowing... organized crime has few employees, tight lips, and doesn't offer the same protection of whistleblowers. The problem here is not the NSA.
jokoon 13y ago
One of the few who dares thanking Snowden...
arca_vorago 13y ago
My bet, especially with the rumors of a secret google data ship, is that google is getting ready to make a data power play. Something along these lines: "Look at the horrible way NSA treated our customers... We're gonna make sure the NSA can't get our data in the future, and protect everyone's data. Come use our services where we treat you right!" It was always just a matter of time before a corporation had the ability to compete in the total information awareness arena with the three letters. Google is probably the primary candidate that has the capability, besides MS/Apple. Of course the three letters win on the data side, but the company wins on the customer side. Win win. For them. Lose for us.
josefresco 13y ago
Global security sure is easy if you're an engineer working for a large tech company. I say that with as much sarcasm as possible. Day after day I see post after post around the tech web about how horrible the actions are of the NSA but few if any propose a workable solution to balancing both securing and obscuring actions taken to protect a nation, with the public's need for privacy and protection from abuse. Oversight, oversight, oversight is all we hear yet nothing concrete to describe how the US (or any nation) is supposed to provide security and keep the enemy from monitoring the techniques and actions taken by intelligence services. Maybe I'm naive but I don't see a way to keep spying (something all nations do and have done for centuries) with the public's need for complete disclosure.
ksk 13y ago
Well, if you read the Terms of Service that Google (and to be fair - everyone else) makes people agree to - Google is free to sell your data to anyone they want. So I don't know which 'Google user' is expecting their data to be private anyway. Not to beat the 'you are the product' dead horse, but I wonder if they were to actually start selling user data would people be in uproar?
arkj 13y ago
This is just crap!!! The google guys are no better.
api 13y ago
"Unfortunately we live in a world where all too often, laws are for the little people." This is sort of the crux of it. We are degenerating into a true oligarchy and/or gangster state in which there are two different systems of law: one for the politically connected and one for the plebs.
ffrryuu 13y ago
There comes a time when principles are more important than life itself.
znowi 13y ago
It's good to see there are still people at Google with integrity and not afraid to speak up. Sadly, they do not run things. In this environment, you either quit or turn to the dark side.
davidgerard 13y ago
"Fuck these people" was Wikipedia's reaction to seeing the puzzle globe on the NSA slide too. First time I've ever seen Jimmy Wales use profanity in a tweet: https://twitter.com/jimmy_wales/status/362626509648834560 https://twitter.com/jimmy_wales/status/362626509648834560
AsymetricCom 13y ago
Lol a Brit trying to lay into an American corporation for imperialism. I wonder why a system he "worked" on for 1 (or 2) years was so easy to subvert. What a laugh.
kriro 13y ago
Where are the startups that disrupt the 1984 surveillance state? I think YC recently ventured into nonprofits, maybe they should consider adding one company that "furthers the cause of freedom" to each batch or something.
badwetter 13y ago
The judiciary should always have an adversarial relationship with the Intelligence community in order to have checks and balances. I think FISA could work with more and varied members on it's committee. Feinstein is a joke and obviously isn't well informed on the subject matter she's supposedly overlooking.
cgtyoder 13y ago
This is the first time I've seen a HN article pass the 1000-point mark. Who doesn't love someone telling the govt to eff off?
ratsmack 13y ago
This may put a small kink in their plans, but the NSA and GCHQ have unlimited resources and will find another way in.
puma1 13y ago
Being that google probably has an unreal security, did they know the NSA got in.. or was it a surprise after learning it from the info leak?

1217 points by cdvonstinkpot 13y ago

Non mobile post: https://plus.google.com/114798402540078632611/posts/LW1DXJ2BK8k https://plus.google.com/114798402540078632611/posts/LW1DXJ2B...

arkem 13y ago
and here's the original "fuck these guys" post https://plus.google.com/108799184931623330498/posts/SfYy8xbDWGG https://plus.google.com/108799184931623330498/posts/SfYy8xbD... The submitted link is Mike Hearn agreeing with and elaborating on Brandon Downey's original thoughts on the matter.

ChuckMcM 13y ago

I wondered about that traffic, and getting confirmation from the source that the only way the NSA could have it would be by tapping into the internal network is as quite damning. Google has the best OpSec team I've ever known, it is my hope that they close this 'loophole' as completely as possible.

bitskits 13y ago
Closing that loophole was underway in Sept according to this article (also linked in the post)... http://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html http://www.washingtonpost.com/business/technology/google-enc...
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
frank_boyd 13y ago
We still don't know if that was really a loophole or rather access given by Google (of course, they will decline that).
- cbhl 13y ago
  My personal opinion is that it's more likely that the access was given by a telecom that Google leased from than from Google itself.
rsync 13y ago
Google, and their "geniuses" in opsec, should not be given a pass at all for this. Even if this is a leased private line, non-Internet routed, whatever, it is trivially easy to encrypt the communications and is absolutely a best practice. I see this as great big egg on their face. In fact, it's such a cock-up that one wonders if this is the plausibly deniable ingress that they agreed to provide for the NSA, et. al This is akin to using telnet to access your home server because you're "on your own network". Nobody does that and I can't believe they would have either.
- ChuckMcM 13y ago
  You are of course entitled to your opinion, I know Brandon and I know how dedicated he is, I got to watch him and the OpSec team in action during the Chinese incursion. One of the side effects of being in the platforms group was that I had exceptional access to what was going on everywhere on Google's internal network and machines. And a lot changed after that event, both internally and externally. I can forgive someone for thinking that if they dug trenches in the street, bought some fiber, and ran it between a couple of buildings, in a country where the rule of law was in effect, they might consider it a reasonable assumption that the fiber is laying in the street unmolested. Even if the distance is such that they can't see the entire length of the ground above the conduit. Prior to Snowden's disclosures, it was the common belief amongst the security community that in 'safe' countries, the government in power would not subvert your infrastructure through physical access. They might do some network tricks, but not tap your fiber. In 'bad' countries counter measures were taken. And the network setup in say Russia or China was different than it was in the US and the UK. That your own government would illegally subvert your infrastructure [1] through the use of a technicality was not considered a "likely" threat [2]. Given that not it has been exploited it is rewriting a bunch of assumptions. I am not surprised in the least that they are now deploying the same hardening they use in hostile environments world wide. [1] The NSA cannot legally tap into communications infrastructure in the US (that is the FBI's job) and when the FBI does it they need a warrant. By doing this in the UK they sidestepped those constraints. [2] In classic vulnerability analysis you deploy your resources against both the probability and damage potential of a given threat. So for example datacenters are vulnerable to being bombed by aircraft, the probability of that is low enough that you don't defend against it, bombed by cars you put a security perimeter around the building.
1g00gler 13y ago
If you're referring to the Orange team yes, they're pretty good. Brandon Downey has proved time and time again that his incompetence gets in the way of protecting Google's network. Perhaps if he spent less time posting garbage on eng-misc and more doing his job we could have implemented security measures to prevent this way sooner. Point your browser at go/privacyboost and search on Moma for Autobahn and the related CLs.

cromwellian 13y ago

It's ironic that when the Chinese attack against Google occurred, we thought the Chinese government was the most hostile state actor threat to worry about, but it turned out to be the US and UK government.

repnescasb 13y ago
no, YOU thought of China as terribly hostile. We in Europe know the deal for a very long time. It's not like there was no cold war and vietnam war and irak war and....
babar 13y ago
Why do people assume the Chinese government is not able to use similar techniques?
- wmf 13y ago
  I would assume they use similar techniques within China and perhaps allied countries like North Korea and Cuba, but the US is performing wiretapping in at least the UK, Canada, Australia, and New Zealand. Also, how much non-Chinese Internet traffic passes through China?
  - maaku 13y ago
    > and perhaps allied countries like North Korea and Cuba Nobody is more distrusting of each other than two communist countries.
    - kika 13y ago
      Well, when you eat off the hand of the other country you don't have much choice. Nobody actually asks you if you trust or not.
    - nzp 13y ago
      Disregarding for a moment that a state can not be communist (one defining characteristic of communism being absence of state), only socialist, North Korea has long disassociated itself from communism. Since the 90s at least there has been a systematic removal of any mention of Marxism, communism and related terminology from the constitution, laws and official discourse.

SCdF 13y ago

This has been asked before, but I'd love to hear from a dev (anonymously of course) who actually helped build this NSA madness. Is it like The Cube, where no one really knew what each piece was for? Is it that they are morally pro the NSA's attitude toward personal and corporate privacy, or do they just not care either way?

zaqokm 13y ago
William Binney in an interview suggested that the tech he built for spying on foreign countries was simply retrofitted and used to spy internally. I am gathering not a lot of people actually knew what was happening at the beginning, and the tools they were using for "valid" purposes were just refocused.
- PakG1 13y ago
  There still have to be technical people involved for refocusing software. You don't simply drag and drop an icon to get something redeployed for another purpose, and definitely not for something of this complexity.
  - zaqokm 13y ago
    I agree, however I think it is very credible that a lot of people involved in this were not fully aware or complicit in regards to what was happen. I do not think they were stupid, but just didn't see the entire picture, or were never given the entire picture.
    - deleted 13y ago
      [deleted]
wmf 13y ago
In The Shadow Factory (written after the Klein leaks but before Snowden), Bamford notes that a lot of surveillance equipment comes from Israel. I don't know much about Israeli culture but it may be significantly different from the US.

thex86 13y ago

Appreciate Mike speaking up like this. We need more people within the industry to speak up. Not just hackers. (People within these companies are also hackers, but they have more effect when they speak because they are part of a company)

justin66 13y ago
I agree, but I do wonder what is going to happen when people start speaking up to say something quite the opposite. "I don't speak for my employer, but I think the NSA is quite awesome and I don't mind that they've been listening to us at all." Or something to that effect. The clash might be interesting to watch.
- dpacmittal 13y ago
  With the increasingly alarming NSA plans being revealed, if someone thinks NSA is doing a good job, they deserve to be fired. His thoughts and opinion doesn't give him the rights to have public data available to governments. This, ofcourse, assumes that he is into Security Team at some well known company.
- rfnslyr 13y ago
  Anybody who praises the NSA should be blacklisted from existence in this solar system.

poxrud 13y ago

The NSA must have somebody working on the inside at google. Otherwise it would be extremely difficult to reverse engineer the RPC protocol that was used by google's servers to communicate between each other. Even on an unencrypted network I can image it would be very difficult to reverse engineer the protocol without any help.

dragonwriter 13y ago
Or, they could have just hired an ex-Googler familiar with the protocol. No need for someone working for the NSA "on the inside" at Google, and no need for reverse engineering.
- acqq 13y ago
  Just "being familiar" would probably slow them down too much, considering how much different protocols they attacked "1622 Google authorization protocols" are listed on one NSA slide here: http://www.washingtonpost.com/blogs/the-switch/wp/2013/11/04/how-we-know-the-nsa-had-access-to-internal-google-and-yahoo-cloud-data/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/11/04... I know how hard it would be, I implement low level protocols (not Google's or of men in black).
cromwellian 13y ago
No need to reverse engineer it, it's a public spec, ProtoBufs. It's like saying "it's extremely difficult to reverse engineer JSON"
vinkelhake 13y ago
The RPC protocol is stated to be based on protocol buffers so the encoding is known. What you would need to do to reverse engineer it is coming up with matching message descriptions. But, even without that piece of the puzzle, reverse engineering a protocol that doesn't use encryption wouldn't be "extremely difficult". This is not an indication of an inside man. https://developers.google.com/protocol-buffers/docs/overview https://developers.google.com/protocol-buffers/docs/overview

bcoates 13y ago

Is information about disruptions to the US PSTN collected anywhere? The discussion of cable tapping and the NSA's apparent taste for doing things the expedient way instead of the legal way makes me wonder if the "vandalism" domestic underground fiber cuts in the years after 9/11 form an interesting pattern.

adamnemecek 13y ago

Wow, a guy working for Google said "fuck you" to the NSA. All my doubts and worries are gone now.

maaku 13y ago
He did preface it with a "I don't speak for my company".
- adamnemecek 13y ago
  Therefore...?
  - maaku 13y ago
    I took your comment as being serious. Maybe my sarcasm detector needs adjustment.
Amadou 13y ago
Are you being sarcastic? For months Google's only public response was to lobby the government for permission to release stats(?) to prove that they complied with the law - nary a word of criticism for the law itself. So now that Google's own autonomy has been breached by the NSA (all above-board and legal according to the NSA's legions of loop-hole seeking lawyers) instead of just Google's users, now they are mad? I just made another post about how a lot of people are unable to imagine what its like for others to be in a situation until they themselves are in the same situation. But... I'm not so sure Google, as an organization, has fully recognized the scope of the problem here.
- adamnemecek 13y ago
  I was being sarcastic, yes.
  - Amadou 13y ago
    OK. I had laugh-snort reading the discussion on that page - at one point the original author, Mike Hearn, tries to argue that ad-based services are actually a good thing for privacy. Does Kool-Aid have a google flavor now?

cpeterso 13y ago

I can understand using unencrypted network within a data center (unless you are doubly paranoid), but why wouldn't they encrypt data between data centers?

parliament32 13y ago
Apparently these data centers were linked via dedicated lines -- there was no traffic or outside access to these fiber lines. They were used solely for communication between the two data centers (so technically still an isolated network).
- rurounijones 13y ago
  A pretty good example to smack in the face of all those "Just Air-gap your distributed SCADA system!" devotees.
  - Daniel_Newby 13y ago
    Such people exist?!
    - gonzo 13y ago
      they do, sadly
us0r 13y ago
They buy the lines in the ground. It is suppose to be 100% private. It is like having a wire from one room of your house to another. Wikileaks has a list of vendors/products who allow these types of things to happen. What I want to know is how they tapped the actual line. I would assume these lines are going directly into Google owned (or controlled) buildings.
- noir_lord 13y ago
  You can tap fiber in a non-destructive way ( http://en.wikipedia.org/wiki/Fiber_tapping http://en.wikipedia.org/wiki/Fiber_tapping ) and in ways that increase attenuation only slightly (and that is contingent on you detecting it and having the equipment to even detect it). If you know the route the fibre takes (which should be public and certainly government knowledge) you can install the tap anywhere along the length of the cable, roll up with a van the equipment and two guys in high viz vests with a fake work order, who the hell is going to check....(think the Ghostbuster's scene where they close half the road). The crazy thing is that so many smart people at Google and encrypting the data still wasn't done.

allochthon 13y ago

My feeling is that the NSA/GCHQ hack was arguably an unfortunate thing for them to do, although somewhat predictable, once one knows of the existence of the network topology vulnerability that was exploited. But presumably somewhere in Google someone knew about this possibility sometime back. I wonder whether there was an assumption that nobody would be clever enough to figure things out, or whether security engineers were working 24/7 to fill in the gap and just didn't get there in time. Either way, this is a good stimulus for rolling out deeper encryption.

deleted 13y ago
[deleted]

sschueller 13y ago

How do we know the Chinese or someone else hasn't hacked into the NSA and is using that data to gain access to secure systems that would otherwise be almost impossible to break into. Wasn't there a Google break in not so long ago?

Andrenid 13y ago
Considering the track record of Governments and technology, I pretty much assume that whatever systems the NSA (and friends) had made are so ridden with holes that any/all people who really want access to it, already do, and that all our (worldwide citizens) access is basically out in the open now. If anything, I'm actually pretty impressed it has gone on this long without seeing posts on underground forums offering access via cracked/leaked accounts and 0days, in exchange for money. Or maybe it has?

frank_boyd 13y ago

Well that's ok. But what really needs to happen is this to come from the top management - and most of all, they need to ACT accordingly. Until then, all this "fuck them" exclamations aren't worth a dime.

cromwellian 13y ago
You mean like working on projects to encrypt all of their data center links, which started, incidentally, before the Snowden revelations. Or the fact that David Drummond and Eric Schmidt have publicly said the diplomatic equivalent of 'fuck these guys'?
walshemj 13y ago
And rather unprofessional where where these guys when Eric Schmidt was making his creepy uncle statements.

rurounijones 13y ago

Given the snippet of traffic involved, can they make an educated guess which links were compromised to get it? (It is DB replication traffic so if you know the source DB and the dest DB then you can work out the route... in theory anyway, with Google Complexity, who knows...)

lazyjones 13y ago

Cussing is all fine and understandable, but I missed the part where the Google opsec team was searching for and plugging the holes the NSA is exploiting, or switching to another carrier, or suing the NSA for illegal wiretapping.

NamTaf 13y ago
The problem is that it's not the NSA doing it. It's GCHQ, in the UK.
- antihero 13y ago
  What was the physical location of this fiber? The UK?
  - estel 13y ago
    Yes, according to the Washington Post, the interception took place in the UK.
raldi 13y ago
Indeed, you missed it. It was back in September: http://articles.washingtonpost.com/2013-09-06/business/41831756_1_encryption-data-centers-intelligence-agencies http://articles.washingtonpost.com/2013-09-06/business/41831...

lsh123 13y ago

Lets start from the beginning: the NSA "hack" became possible because Google (and its security team) made bad assumptions about the security of the connection between Google's data centers and did not encrypt the traffic. Basically, this is security 101: protect data at rest and protect data in flight. So, sorry but I think the better subject for discussion would be how badly Google screwed up, not how evil is NSA. Moreover, it is not clear if other governments or criminals also had access to the users' data (e.g. in Google's data centers located outside of the US). So far Google did not produce any public post-mortem thus we have no clue how bad was the problem. P.S. I am sure I will get smashed in the comments, so let me say right away that NSA actions should be controlled and audited by the public (e.g. through our representatives in Congress). I think that the biggest "evil" here are the members of Congress who either approved NSA actions or failed to do their job and monitor/audit NSA properly. In particular, I would point my finger at Sen. Dianne Feinstein [D-CA] who should have been ousted from the office long time ago.

raldi 13y ago
Would you still feel Google had screwed up if the way the US government got the data was to burglarize one of their datacenters and tap directly into the machines' CPUs and memory buses?
- lsh123 13y ago
  Yes (search for SSAE16 or SAS70). However, I would not feel the same way if US government would have used Area 51 technology to hack 4096 public key encryption. The difference from my perspective is that in "burglary" scenario (and un-encrypted traffic scenario as well) Google failed to protect against well known threats. And in the "alien technology" case Google did everything you can at the known security/technology level and the failure came from aliens (aka an "unexpected technology advances"). Basically, I think Google's decision to do not encrypt the traffic is a gross negligence and I would love to see how someone would sue Google for it.
  - jonknee 13y ago
    > Basically, I think Google's decision to do not encrypt the traffic is a gross negligence and I would love to see how someone would sue Google for it. Wow. Just wow.

tonyplee 13y ago

Just simple big government(s) v.s. big company - happened over and over again in history - remember how powerful Microsoft was in the end of the 90. Governments don't like challenge to its power. They will find ways to control the Jedi Council.

cinquemb 13y ago
I really don't think this is that clear cut. On this thread alone, two people have have vouched for their companies that encrypt internal traffic as standard MO (wepay, and another larger than google [by their words]) and considering that some mailing list chatter[0] has pointed out some interesting dynamics (read duplicitous) on the behalf of some companies (among the remarks on here), I wouldn't fool myself with its that simple. As someone working on a start up now dealing with crowd-sourcing/mining data on people/identities and leaving it public, it's very interesting to see the dynamics play out with online services especially with ones that create the perception of walled gardens vs those that position themselves as inherently public and the flak (or lack thereof) they take from privacy advocates and what not. [0] http://cryptome.org/2013/10/nsa-hysteria-coverup.htm http://cryptome.org/2013/10/nsa-hysteria-coverup.htm

bowlofpetunias 13y ago

Oh, the hypocrisy.... > "Bypassing that system is illegal for a good reason." Yes, so is invasion of privacy. Yet Google has no problem breaking the law and violating civil rights for profit. > "Unfortunately we live in a world where all too often, laws are for the little people." Yeah, like tax laws and privacy laws... If you want to get on this high horse, you shouldn't be working for Google.

nodata 13y ago
Erm, what? Which law did they break, and which civil rights did they violate?
- CaptainZapp 13y ago
  Like indiscriminately and illegally sucking up WiFi data with their street view mobiles? Including account information and passwords on unsecured WiFi connections. Even if the accusation of "violating laws" may be a tad hyperbolic in the great scheme of things it's not a stretch to deem Google one of the most hypocritical companies around.
  - meowface 13y ago
    That did happen, but I believe the data was captured and stored by mistake. At the least, they had no intention to view or use any of that data. The NSA on the other hand actively intends everything it's doing in this case. Comparing Google's Wifi mishap with the NSA's hundreds (thousands?) of deeply questionable operations driven by invasions of privacy and security is comparing apples with oranges.
  - thezilch 13y ago
    Except, they didn't explicitly mean to do that, stopped doing that, and paid for the autonomous collection of trash that they threw out.
    - icecreampain 13y ago

caycep 13y ago

Here's one potential cultural snafu - my understanding is US intelligence based almost entirely on SIGINT. I'm not sure how great we are at plain old HUMINT, i.e. using people and relationships to get information and an overall picture of the world. So all the defense community was raised on SIGINT, and anything seen as a curb on this - technical or legal, they will probably view it as some sort of existential threat. They would then fight tooth and nail to block any sort of reform. And the military industrial complex has quite a lot of legislative muscle....

ihsw 13y ago
It hasn't always been this way, and I'm sure the State Department and the Office of the President rely on SIGINT far more than direct diplomacy -- even to the point where diplomatic efforts are, universally, a cold formality. They like to toss words like "Terrorism" around like frisbees hoping someone will catch it and toss it to someone else, however I personally think we can assume that direct diplomacy is dead. SIGINT is more consistent and dependable than engaging another nation's diplomatic apparatus, and all nations are clamoring for their own monitoring solution. It's a new baseline measurement of international political power -- the cost is so low that it's foolish not to get it.
Nick_C 13y ago
One of the outcomes of various 9/11 reviews was the realisation that HUMINT had degraded as far as it had. The problem is that it is very expensive, both in time and money, and it has uncertain outcomes. The rise of technology, both its widespread use by the public and the ability to capture it by agencies, had made SIGINT seem much more attractive in the couple of decades prior to 9/11. So, yes, agencies had become over-reliant on SIGINT over HUMINT, but for understandable reasons with the benefit of hindsight. Currently, they certainly don't view it as an existential threat and all agencies are working to re-establish HUMINT capability, the opposite of trying to block it. The trouble is that it is hard, really hard work.

sinak 13y ago

I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance: - Bill 1: The FISA Improvements Act, from Feinstein and the Senate Intelligence Committee. In short it legalizes most of what the NSA has been done. - Bill 2: The USA FREEDOM ACT, from Sensenbrenner and Leahy, currently being considered by the House/Senate Judiciary committees. It amends §215 of FISA to end bulk phone metadata collection and fixes some of the problems with §702 of the FISA Amendments Act (under which PRISM is run). But it doesn't fix §702 fully, does nothing to end BULLRUN (undermining encryption) nor the surveillance that happens outside FISA (MUSCULAR, for example, and god knows what else). Obviously the Feinstein bill can't be allowed to pass. But some really big names (ACLU, CDT) have thrown strong support behind the Freedom Act. I'm wondering what we as the Taskforce(.is) should do. It's clear to me that it doesn't go nearly far enough. And there's some chance that if it passes, Congress will view this whole thing as "dealt with" and not revisit the issue for years to come. But unfortunately the Freedom Act barely has the votes to get out of the judiciary committee, and getting it to pass through both houses requires a lot of momentum. We've been working on a campaign asking folks to call and oppose Feinstein, and potentially to support the Freedom Act. But I'm not sure if that's a right move. Unfortunately, the public doesn't understand why privacy is important, and Americans aren't nearly angry enough for Congress to do anything more substantial than the Freedom Act. We might be able to push for amendments, but it's a long shot. tl;dr - We've got two bills in Congress. One is terrible, one is mediocre. But we don't have the political momentum to do anything better than the mediocre bill. What do we do? Tech advocate conundrum.

deleted 13y ago
[deleted]
serge2k 13y ago
Try to find a fix for the ridiculously broken system that is the US government?
- 13y ago

vorce 13y ago

I think it's time to also highlight the fact that people enabled the NSA to do these things. A lot of them engineers. In some cases I'm sure the ones building the stuff didn't or couldn't see the end goal. But I guess there have been many who HAVE suspected or known about the use-cases of the products/software that they have been a part of making. This scares me, it is time that engineers take some moral responsibility. Maybe some course in ethical decision making wouldn't hurt to include in engineering colleges? (Note: All fields should take moral responsibility, but engineers seem to be worse than a lot of others.)

stevenrace 13y ago

They are likely both complicit in - as well as victims of - fiber tapping given GOOG now owns the building housing one of the largest peering exchanges on the Internet [1]. [1] 111 Eight Ave in NYC (housing Hiberia's trans-Atlantic cable, Equinox, Deutsch Telecom, etc) http://www.datacenterknowledge.com/archives/2010/12/03/wsj-google-has-bought-111-8th-avenue/ http://www.datacenterknowledge.com/archives/2010/12/03/wsj-g...

gogobyte 13y ago

Fuck the monstrous police state!

rdl 13y ago

I'm personally far more angry with Congress utterly failing in their oversight role, and to some extent with the judiciary for becoming at best a rubber stamp, than with NSA. The President (pretty much from LBJ onward, but even farther back) is also fairly complicit in this, but that part is accelerating. I would probably be a single-issue voter if a candidate for congress were likely to win and was aligned with me on this issue but opposed on virtually everything else. One essentially-fantasy is to run for Congress directly. Unfortunately I haven't lived my entire life to my mid-30s in trying to become a viable political candidate, so this would be difficult. Central or Eastern WA is probably the best bet, along with starting a 50-500 person business which employs a lot of local people (manufacturing of some kind) and generally being an engaged local citizen for a decade or more. But that's a long term goal.

pvnick 13y ago

Keep in mind when considering reform by our legislature that any serious efforts on that front will likely be undermined with blackmail made possible by the very surveillance apparatus they are attempting to curtail [1]. I sincerely hope that Snowden's revelations prove or at least strongly hint towards such an assertion because until they do it's still "conspiracy theory." Free society is in deep shit, and for the life of me, even though I've thought about it obsessively for the past couple months now, I have no idea what can be done about it. [1] http://www.boilingfrogspost.com/tag/russ-tice/ http://www.boilingfrogspost.com/tag/russ-tice/

ismail 13y ago

'Privacy' currently is just a facade, most people have just not realised that. Here is an interesting fact, that joe public do not realise. If you have a mobile phone, you can be tracked, even if there is no GPS on the device. Besides this if the NSA chooses, they can track practically ANYONE in the world, all they need is a mobile number. I would not be surprised if this is actually one of the tools they have. How? Due to the nature of how GSM and mobile operators integrate when roaming. When a mobile operator signs an international roaming agreement, they setup signalling links between their switches and VLR's (Visitor Location Register). The mobile operator in the visited country needs to authenticate you against your home network, this happens via SS7. Once this link is established, it is assumed to be trusted, and most operators DO NOT apply any filtering on these commands. So with a carefully crafted SS7 command, you could request the location of a mobile subscriber, even if they have not even attempted to join your network. Now here is where it gets interesting, get access to send ss7 commands from an operator with many international roaming agreements, and you can get details on practically any subscriber. Get access to 2-4 (i.e AT&T, T-Mobile, Vodaphone) of these massive tier1 operators, and you can get the location of practically everyone with a mobile handset.

Raphmedia 13y ago
I don't have a mobile phone. You don't need one, really. Skype at work, landline at home. Why would I want to talk to anyone on the go? I go out for beers and other social activities all the time. My social life is not suffering at all. The need of having a cellphone is a lie.

__matt 13y ago

fuck these guys, they stole our business model!

dell1994 13y ago

Oops. What a Hypocrisy? The moral righteous Google. Little People vs Big People? Please stop. Don't do Evil still works for you guys.. I guess. You have the resources to defend it, if you want to defend. You choose not to in many ways. So please dont explode in profanity several times a day.

LiamMcCalloway 13y ago

I am surprised this exerpt from Alan Rusbriger's article in the New York Review of Books [1] hasn't made the rounds: > "But I did have an interesting (unattributable, of course) briefing from someone very senior in one West Coast mega-corporation who conceded that neither he nor the CEO of his company had security clearance to know what arrangements his own organization had reached with the US government. “So, it’s like a company within a company?” I asked. He waved his hand dismissively: “I know the guy, I trust him.” West Coast mega-corporation does not know what West Coast mega-corporation does. [1] http://www.nybooks.com/articles/archives/2013/nov/21/snowden-leaks-and-public/?page=2 http://www.nybooks.com/articles/archives/2013/nov/21/snowden...

w_t_payne 13y ago

So how long before HN gets shut down for supporting criminality and terrorism?

acd 13y ago

I think the trends has been like this and history tends to repeat it self but in different forms. 1) Main frame - central computing 2) PC revolution - decentralized computing 3) The cloud - central computing 4) ? Hackers invent p2p - decentralized network corporations,government not in control of any communication, information heavily encrypted possibly distributed using erasure codes. Network run by friends who you can trust. Code written by hackers

kgarten 13y ago

afterwards they will be fu* * * * using FISA court orders ...

theinterjection 13y ago

Has it ever occurred to anyone that, just maybe, the whole NSA thing is a cover-up to distract the attention from the fact that it's actually the megacorporations that want to spy on you? This is a good way for Google, Microsoft, etc. to look innocent. Let's not forget that it was us who decided to trust these corporations with all our personal data.

AsymetricCom 13y ago
This is absolutely true. DPI was used by corporations first. NSA et. al. have to use it to stay in the game. Of course, you'll never hear this because the multinational media decides who you root for.

w_t_payne 13y ago

So, this is how it's gonna play out: Over the next few years it will become more and more common for "in-flight" data to be encrypted. As the "low-hanging fruit" starts to disappear, state-level attackers will increasingly turn their attention from fibre to endpoint; with a corresponding increase in the number of attacks on mobile devices, apps, and embedded systems. This is, to put it mildly, incredibly challenging terrain for passive defence, where complexity all-but-guarantees unknown vulnerabilities and hidden attack vectors. Now, I am not too sure about the ethics of active defence / networked HIPS, (Too similar by a long shot to the sort of malevolent behaviour it is supposed to defend against) but it might be something that we are going have to have a look at.

blparker 13y ago

How does one "capture" data flowing over a private fiber channel? Does it require a physical tap?

ForHackernews 13y ago
Most likely, yes. You can tap a fiber optic line without breaking it by bending it such a way that light leaks out: http://www.techrepublic.com/blog/it-security/protect-your-network-against-fiber-hacks/222/ http://www.techrepublic.com/blog/it-security/protect-your-ne...

androtheos 13y ago

Any data running over a leased or owned fiber between data centers should still be encrypted. Why didn't they have a VPN between the data centers? I don't get it and I personally think it's inexcusable. I believe I would lose my job if I my companies data was stolen and their was something I could have done to prevent it, and rightly so. I personally think that everyone has been far to forgiving of companies like Google, Yahoo, Microsoft, Facebook etc... for having done such a poor job of protecting the data we entrust to them.

ynniv 13y ago

I think that we also forget in this age of reduced crime, that it doesn't matter whether or not something is illegal if you have no means of preventing someone from doing it or holding them responsible when they do. We discovered this situation not by uncovering the intrusion, but from leaked documents. The government has a lot of employees and likes to document its operations, which can lead to whistleblowing... organized crime has few employees, tight lips, and doesn't offer the same protection of whistleblowers. The problem here is not the NSA.

jokoon 13y ago

One of the few who dares thanking Snowden...

arca_vorago 13y ago

My bet, especially with the rumors of a secret google data ship, is that google is getting ready to make a data power play. Something along these lines: "Look at the horrible way NSA treated our customers... We're gonna make sure the NSA can't get our data in the future, and protect everyone's data. Come use our services where we treat you right!" It was always just a matter of time before a corporation had the ability to compete in the total information awareness arena with the three letters. Google is probably the primary candidate that has the capability, besides MS/Apple. Of course the three letters win on the data side, but the company wins on the customer side. Win win. For them. Lose for us.

josefresco 13y ago

Global security sure is easy if you're an engineer working for a large tech company. I say that with as much sarcasm as possible. Day after day I see post after post around the tech web about how horrible the actions are of the NSA but few if any propose a workable solution to balancing both securing and obscuring actions taken to protect a nation, with the public's need for privacy and protection from abuse. Oversight, oversight, oversight is all we hear yet nothing concrete to describe how the US (or any nation) is supposed to provide security and keep the enemy from monitoring the techniques and actions taken by intelligence services. Maybe I'm naive but I don't see a way to keep spying (something all nations do and have done for centuries) with the public's need for complete disclosure.

ksk 13y ago

Well, if you read the Terms of Service that Google (and to be fair - everyone else) makes people agree to - Google is free to sell your data to anyone they want. So I don't know which 'Google user' is expecting their data to be private anyway. Not to beat the 'you are the product' dead horse, but I wonder if they were to actually start selling user data would people be in uproar?

arkj 13y ago

This is just crap!!! The google guys are no better.

api 13y ago

"Unfortunately we live in a world where all too often, laws are for the little people." This is sort of the crux of it. We are degenerating into a true oligarchy and/or gangster state in which there are two different systems of law: one for the politically connected and one for the plebs.

ffrryuu 13y ago

There comes a time when principles are more important than life itself.

znowi 13y ago

It's good to see there are still people at Google with integrity and not afraid to speak up. Sadly, they do not run things. In this environment, you either quit or turn to the dark side.

davidgerard 13y ago

"Fuck these people" was Wikipedia's reaction to seeing the puzzle globe on the NSA slide too. First time I've ever seen Jimmy Wales use profanity in a tweet: https://twitter.com/jimmy_wales/status/362626509648834560 https://twitter.com/jimmy_wales/status/362626509648834560

AsymetricCom 13y ago

Lol a Brit trying to lay into an American corporation for imperialism. I wonder why a system he "worked" on for 1 (or 2) years was so easy to subvert. What a laugh.

kriro 13y ago

Where are the startups that disrupt the 1984 surveillance state? I think YC recently ventured into nonprofits, maybe they should consider adding one company that "furthers the cause of freedom" to each batch or something.

badwetter 13y ago

The judiciary should always have an adversarial relationship with the Intelligence community in order to have checks and balances. I think FISA could work with more and varied members on it's committee. Feinstein is a joke and obviously isn't well informed on the subject matter she's supposedly overlooking.

cgtyoder 13y ago

This is the first time I've seen a HN article pass the 1000-point mark. Who doesn't love someone telling the govt to eff off?

ratsmack 13y ago

This may put a small kink in their plans, but the NSA and GCHQ have unlimited resources and will find another way in.

puma1 13y ago

Being that google probably has an unreal security, did they know the NSA got in.. or was it a surprise after learning it from the info leak?