7 ms·

Google was a premium partner in the Prysm NSA program. According to the first leaks, Google along with Facebook, Skype and Apple were the first to sign up to th

Google was a premium partner in the Prysm NSA program. According to the first leaks, Google along with Facebook, Skype and Apple were the first to sign up to the NSA spying programs as partners. All along they're trying to paint themselves as victims of the spying, which is ridiculous really...but I guess they can still fool a large population.

sarciszewski 12y ago
The NSA was also wiretapping the connections between Google's datacenters, so they were victims of the NSA too. (Until we know more about their relationship with the NSA, I also don't condemn them for the PRISM allegations.)
- ForHackernews 12y ago
  I acknowledge there's a moral and ethical distinction there, but I dispute that there's any pragmatic difference: If you use Google services, your data is compromised, period. It doesn't really matter whether the NSA or GCHQ are tapping Google's datacenters, paying off low-level employees, operating under a legal court order, or benefiting from the enthusiastic help of Google executives. The end result is the same: You cannot trust cloud services.
  - fixermark 12y ago
    The question has never been "Can you trust cloud services?" It's "Can you trust them more than the alternatives?" Yes, you can almost certainly keep your private data more secure in a system you build and monitor yourself(1). Until an NSA or GCHQ-level entity takes interest in you, and uses a 0-day exploit on your system or just physically walks in with a warrant and steals your physical media. How is that functionally different from "If the NSA / GCHQ takes interest in you, they can have the cloud service provider hand your data over?" And that's before you add the overhead of maintaining, securing, and physically protecting your own systems. (1) Note that even this step is a huge hurdle for most people; "You cannot trust cloud services" basically tells those people "Don't use the Internet."
    - throwaway2048 12y ago
      There is a massive, massive difference between automatically slurping all data coming in and out of a cloud provider, and going after somebody with a targeted exploit or physically seizing machines.
      - tubbs 12y ago
        I'd rather make them go through the trouble of getting my data physically then just typing grab * -ss 834-29-1293 or whatever they do.
        sarciszewski 12y ago
        Is 834-29-1293 your actual SSN? :\
        maxerickson 12y ago
        834 was never used as an area number: http://www.socialsecurity.gov/employer/ssns/HGJune2411_final.txt http://www.socialsecurity.gov/employer/ssns/HGJune2411_final...
    - deleted 12y ago
      [deleted]
    - belorn 12y ago
      The difference is the same that enable a police officer to walk the street, but require a warrant before entering a home. Even NSA do not like to invade peoples homes. Its a health risk for agents, its costly, it competes with other agencies, and its bad for PR. The legal steps required are also much smaller when asking a cloud service to hands over information.
- Zigurd 12y ago
  The answer CAN be "all of the above." Just because the NSA went beyond any agreement they may have with Google, and Google is genuinely pissed off about that, doesn't mean Google (or any other major technology company in the US) hasn't cooperated with the government regarding surveillance. It is certain that telecom carriers participated willingly in the massive collection of telephone network CDRs from way back when these were on mag tape. So far, every time someone has asked "What if the government is using X for surveillance?" the answer has eventually been yes. 100% of the time. Nothing is out of bounds. And that includes making partners victims if it is part of the mission to collect everything. Belgium, for example, is both a partner, somewhere in the hierarchy of partners outside of the Five Eyes, and a victim of GCHQ hacking. Being a partner doesn't spare you and being a victim isn't indicative you're not a partner.
  - sarciszewski 12y ago
    I don't dispute that there was some collusion or collaboration, but at the same time, I don't condemn people on an incomplete pictures. Period. For all we know, PRISM was more-or-less a euphemism for "we had a shallow collaboration that we used to pivot into a larger compromise of their networks". Conversely, I'm going to have to agree with 'tptacek and his (probably not popular) opinion on Google and their influence on privacy and security at large. https://news.ycombinator.com/item?id=8949256 https://news.ycombinator.com/item?id=8949256 So I stand by my decision to not condemn them until we learn more about the nature of their collaboration with the NSA's plot to deteriorate human rights the world over. Not because I love Google and think they can do no evil, but because I believe in charitable debate and skeptical inquiry.
    - Zigurd 12y ago
      > I believe in charitable debate and skeptical inquiry. I believe in the odds. And the odds are that any technology that has a high potential to significantly add to surveillance capabilities has been exploited for that purpose either by hacking it or convincing (strong-arming if needed) the technology provider to cooperate. I don't deny that Google does a lot of great things in general, and in security research specifically. That would be denying the plain facts. But I also do not think that has any impact at all on the relationships the government builds with (or forces upon) large corporations regarding national security. When the chips are down, the NSA and other TLAs are going to get what they want. Now that tptacek is part of a larger transnational security company, he may find that out firsthand.
paulhauggis 12y ago
You're getting down voted because of all the Google, Facebook, and Apple employees here on HN.
- paulhauggis 12y ago
  point proven.
  - Oletros 12y ago
    What is proven? Your wrong assumptions?

sarciszewski 12y ago

The NSA was also wiretapping the connections between Google's datacenters, so they were victims of the NSA too. (Until we know more about their relationship with the NSA, I also don't condemn them for the PRISM allegations.)

ForHackernews 12y ago
I acknowledge there's a moral and ethical distinction there, but I dispute that there's any pragmatic difference: If you use Google services, your data is compromised, period. It doesn't really matter whether the NSA or GCHQ are tapping Google's datacenters, paying off low-level employees, operating under a legal court order, or benefiting from the enthusiastic help of Google executives. The end result is the same: You cannot trust cloud services.
- fixermark 12y ago
  The question has never been "Can you trust cloud services?" It's "Can you trust them more than the alternatives?" Yes, you can almost certainly keep your private data more secure in a system you build and monitor yourself(1). Until an NSA or GCHQ-level entity takes interest in you, and uses a 0-day exploit on your system or just physically walks in with a warrant and steals your physical media. How is that functionally different from "If the NSA / GCHQ takes interest in you, they can have the cloud service provider hand your data over?" And that's before you add the overhead of maintaining, securing, and physically protecting your own systems. (1) Note that even this step is a huge hurdle for most people; "You cannot trust cloud services" basically tells those people "Don't use the Internet."
  - throwaway2048 12y ago
    There is a massive, massive difference between automatically slurping all data coming in and out of a cloud provider, and going after somebody with a targeted exploit or physically seizing machines.
    - tubbs 12y ago
      I'd rather make them go through the trouble of getting my data physically then just typing grab * -ss 834-29-1293 or whatever they do.
      - sarciszewski 12y ago
        Is 834-29-1293 your actual SSN? :\
        maxerickson 12y ago
        834 was never used as an area number: http://www.socialsecurity.gov/employer/ssns/HGJune2411_final.txt http://www.socialsecurity.gov/employer/ssns/HGJune2411_final...
  - deleted 12y ago
    [deleted]
  - belorn 12y ago
    The difference is the same that enable a police officer to walk the street, but require a warrant before entering a home. Even NSA do not like to invade peoples homes. Its a health risk for agents, its costly, it competes with other agencies, and its bad for PR. The legal steps required are also much smaller when asking a cloud service to hands over information.
Zigurd 12y ago
The answer CAN be "all of the above." Just because the NSA went beyond any agreement they may have with Google, and Google is genuinely pissed off about that, doesn't mean Google (or any other major technology company in the US) hasn't cooperated with the government regarding surveillance. It is certain that telecom carriers participated willingly in the massive collection of telephone network CDRs from way back when these were on mag tape. So far, every time someone has asked "What if the government is using X for surveillance?" the answer has eventually been yes. 100% of the time. Nothing is out of bounds. And that includes making partners victims if it is part of the mission to collect everything. Belgium, for example, is both a partner, somewhere in the hierarchy of partners outside of the Five Eyes, and a victim of GCHQ hacking. Being a partner doesn't spare you and being a victim isn't indicative you're not a partner.
- sarciszewski 12y ago
  I don't dispute that there was some collusion or collaboration, but at the same time, I don't condemn people on an incomplete pictures. Period. For all we know, PRISM was more-or-less a euphemism for "we had a shallow collaboration that we used to pivot into a larger compromise of their networks". Conversely, I'm going to have to agree with 'tptacek and his (probably not popular) opinion on Google and their influence on privacy and security at large. https://news.ycombinator.com/item?id=8949256 https://news.ycombinator.com/item?id=8949256 So I stand by my decision to not condemn them until we learn more about the nature of their collaboration with the NSA's plot to deteriorate human rights the world over. Not because I love Google and think they can do no evil, but because I believe in charitable debate and skeptical inquiry.
  - Zigurd 12y ago
    > I believe in charitable debate and skeptical inquiry. I believe in the odds. And the odds are that any technology that has a high potential to significantly add to surveillance capabilities has been exploited for that purpose either by hacking it or convincing (strong-arming if needed) the technology provider to cooperate. I don't deny that Google does a lot of great things in general, and in security research specifically. That would be denying the plain facts. But I also do not think that has any impact at all on the relationships the government builds with (or forces upon) large corporations regarding national security. When the chips are down, the NSA and other TLAs are going to get what they want. Now that tptacek is part of a larger transnational security company, he may find that out firsthand.

paulhauggis 12y ago

You're getting down voted because of all the Google, Facebook, and Apple employees here on HN.

paulhauggis 12y ago
point proven.
- Oletros 12y ago
  What is proven? Your wrong assumptions?