Google Chief Architect: we only respond to specific orders about individuals

https://plus.google.com/u/0/103389452828130864950/posts/huwQsphBron

by msabalau • 13 years ago

158 103 13 years ago

plus.google.com

waterphone• 13 years ago

To be clear, this is the chief architect of Google+, not Google as a whole. Would he necessarily know?

packetslave2• 13 years ago

He actually responded to just this question in the comments (and he's a very senior 10-year engineer, so it's plausible).

"I have various reasons to believe that the odds that I would have known about it are higher than those for most employees -- but it still wouldn't be a certainty. That said, the odds are good enough that I would be fairly surprised, and rather furious, to find out that such a thing had been happening without my knowledge."

msabalau3• 13 years ago

Also worth reading is the comment thread. " We don't sell our users' information to anybody.... we do use user information to target ads: this approach has made us what's technically known as "large stacks of cash:" "

packetslave2• 13 years ago

For clarity, he's currently chief architect for Social/Google+ not Google as a whole, but he's still a very senior, longtime engineer.

msabalau3• 13 years ago

Good clarification. Only so many words that would fit into the headline...

saraid2163• 13 years ago

One more character would have been sufficient...

nostrademons• 13 years ago

Yeah, I saw the headline and thought "We have a chief architect?", but then I saw who it was, and he really does have a longtime track record of critical contributions to both G+ and Search before it.

mh-• 13 years ago

to be frank, that changes my opinion of the significance of his posting quite a bit.

it'd be nice if someone would correct the title of this.

eightyone• 13 years ago

We pretty much already have confirmation that PRISM exists. [1] It's a little funny all of these companies expect us to believe that none of them are involved.

[1] http://gizmodo.com/the-government-responds-to-the-prism-spyi...

fchollet2• 13 years ago

"the only way in which Google reveals information about users are when we receive lawful, specific orders about individuals -- things like search warrants."

Things like search warrants? What has been described in the PRISM slides is an interface in which a NSA agent can access a subject's data at will, in a few clicks and an affirmation that "yes, this person is a terrorist".

Also the US government has confirmed that systematic collection of user data was indeed happening for non-US citizens. What of that? Are they users of lesser rights in the eyes of Google, etc?

danso6• 13 years ago

Things like search warrants? What has been described in the PRISM slides is a interface in which a NSA agent can access a subject's data at will, in a few clicks and an affirmation that "yes, this person is a terrorist".

Google has officially denied being a part of PRISM. The way you phrased this statement makes it sound like the OP is sneakily leaving out the PRISM implementation, which would be sneaky if Google were a part of PRISM.

(this doesn't mean that Google's isn't flat-out lying about everything...but you seem to be alleging a contradiction where there is none, at least in the OP)

"Also the US government has confirmed that systematic collection of user data was indeed happening for non-US citizens. What of that? Are they users of lesser rights in the eyes of Google, etc?"

NSA's mandate since its inception is to conduct surveillance of foreign communications suspected to be a threat to America...So while it's still worth arguing whether the surveillance they conduct is unethical or unproductive, it's not going to be worthwhile arguing whether they do it at all.

edit: removed sarcasting phrasing that was too assholish for a Friday after work.

fchollet2• 13 years ago

This is not about what the NSA does, this is about whether Google and co are handing out foreign users' data to the NSA. It appears they are.

I hope every non-american netizen realizes that their private communications are being systematically collected by US intelligence. It is now impossible to trust an american company.

Before the Internet, the ECHELON program was shown to have been used for private industrial espionage on foreign compagnies [1]. I assume this is happening on another scale entirely now, with the cooperation of Google, Apple, FB and MSFT.

1. http://en.wikipedia.org/wiki/ECHELON

cpleppert• 13 years ago

> Things like search warrants? What has been described in the PRISM slides is a interface in which a NSA agent can access a subject's data at will, in a few clicks and an affirmation that "yes, this person is a terrorist".

I'm not sure where you getting that from the slides. They don't explain how an analyst uses the system.

>Google has officially denied being a part of PRISM. The way you phrased this statement makes it sound like the OP is sneakily leaving out the PRISM implementation, which would be sneaky if Google were a part of PRISM.

Other media reports from insiders (not information on the leaked slides) make it sound like PRISM is more of an NSA internal thing that aggregates data and presents it to analysts. Based on the description of the slides it sounds like the NSA has some integration with the on site premises of the target company.

So it could be as simple as PRISM is just a way of automating the whole process of getting data from a valid warrant which would be consistent with the denials made tech companies. They don't have any contact with 'PRISM' per se; they have just set up their systems to spit out data when they get a valid warrant.

lawnchair_larry4• 13 years ago

Google has officially denied being a part of PRISM.

They have denied knowledge of the use of the word "PRISM" to describe anything that they are participating in. So, they've denied nothing in that regard. It just means PRISM is the NSA codename.

codex• 13 years ago

Google merely stated that they had not heard of PRISM--probably because they were told it was called something else.

brown9-2• 13 years ago

Google operates in other countries as well and has to respect their laws, I imagine not everyone calls it "a search warrant".

Also, National Security Letters.

andyl• 13 years ago

Since the Chief Architect is so supportive of privacy rights - I'd like to participate in G+ using a pseudonym. How about it Google??

mayanksinghal• 13 years ago

Something like this? https://plus.google.com/+BradleyHorowitz/posts/SM5RjubbMmV

BCM43• 13 years ago

No, that says you can't use a pseudonym without proving to Google that it is one a lot of people know you by.

msabalau3• 13 years ago

He is responding in the thread, so you could actually ask there, and maybe hear an answer, as opposed to merely being snarky here.

Unless, of course, you are someone who actually needs a pseudonym even to ask such a question, in which case such a forum is not for you...

ISL• 13 years ago

This is the sort of response that I find convincing. Thank you, Dr. Zunger.

lvs• 13 years ago

"Google had no involvement in the PRISM program and the first we heard of it was when Greenwald's article hit the press."

Greenwald broke the story about the Verizon FISA warrant, not the PRISM story. These are (ostensibly) different things.

signed0• 13 years ago

I think he broke both stories.

From http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...

The Guardian has verified the authenticity of the document, a 41-slide PowerPoint presentation

runn1ng2• 13 years ago

What I don't get is:

from US government, we got confirmations - half-ass confirmations, but still confirmations - that PRISM is real, we maybe have some information wrong and we should stop asking and talking about it, but it's real.

While the companies and its architects all oppose the claims in a way that's very convincing.

I don't know what to believe anymore.

danso6• 13 years ago

I can't tell you want to believe, but maybe a place to start is: the world is a confusing place, full of miscommunication and gray areas. Why should we expect the world to be as it is in the movies, in which bad guys are obviously bad and that there is an "ending" in which things are clear?

For starters, I just re-skimmed the Washington Post report and noticed that it has since been amended:

It is possible that the conflict between the PRISM slides and the company spokesmen is the result of imprecision on the part of the NSA author. In another classified report obtained by The Post, the arrangement is described as allowing “collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,” rather than directly to company servers.

edit: Here's the link: http://www.washingtonpost.com/investigations/us-intelligence...

I think I'm wrong that that was one of the actual changes since yesterday...either way, the Post is allowing for the possibility of a miscommunication/misinterpretation by its source. Business Insider also alleges of other hedging by the WaPo here: http://www.businessinsider.com/washington-post-updates-spyin...

At this moment in time, we still do not know two things: who the leaker is, beyond a "career intelligence officer" and the contents of this 41-slide presentation other than the 3 or 4 slides that the Post and the Guardian have published. The identity or motives of the leaker isn't necessary to know, but it's kind of problematic when we are missing context to the so-far published slides that explain the PRISM program. For example, it kind of changes things if the first two slides say "PROPOSAL" or the last slide says "APRIL FOOLS"

runn1ng2• 13 years ago

Well it's pretty clear now

https://news.ycombinator.com/item?id=5843352

They don't have direct backdoor, but they have a system in place for a fast and effortless data sharing.

nullc2• 13 years ago

Yeah, but you'd need a Dynamic Tasking Control Protocol. A big mirror makes a big beam.

saraid2163• 13 years ago

Don't believe. Ever. Agnosticism is a philosophy that extends well beyond religion.

Instead, focus on what you want to be true and figure out how to make that true. You probably don't want PRISM to exist, or more generally, you probably don't want an extensive surveillance program of PRISM's caliber or greater to exist. In America, or anywhere? Be specific. Figure out exactly why each component is problematic. Understand that.

Then start going about making it harder to exist. Learn about and teach ways to circumvent. Talk to people and convince them of your well-founded views. Turn the world into a place where PRISM won't exist. It's a project that can easily exceed your lifetime.

But it's better than belief.

md224• 13 years ago

Be specific. Figure out exactly why each component is problematic. Understand that.

Totally agree.

But it's better than belief.

As someone dealing with what might be called a mild epistemological crisis, I can sympathize with the advice to apply agnosticism liberally, but I'm not sure belief can be avoided. If you want to take action for or against something, you have to ask: what if your information about that thing is malformed or incomplete, due to human error (either your own or somewhere in your chosen network of cognitive authority) or even malice? The answer is that you'll never know for sure. You could always be the victim of your own or someone else's bias.

So I'm just saying, action requires a leap of faith, sometimes just a microscopic leap, but a leap nonetheless. Belief is, alas, inescapable.

onecommentonly• 13 years ago

> the fact that we do stand up for individual users' privacy and protection, for their right to have a personal life which is not ever shared with other people without their consent, even when governments come knocking at our door with guns, is one of the two most important reasons that I am at this company

The indisputable fact is that your company gathers a lot of private info online about its users for profit, make that for extra, extra profit. Best case scenario, it makes NSA's job super easy, all they have to do is ask for it. Worst case scenario, the government knows all our thoughts as we type on Google search and everything else we do on Google. I do not trust that such info will stay private. Not anymore.

> the national security apparatus has convinced itself and the rest of the government that the only way it can do its job is to know everything about everyone. That's not how you protect a country. We didn't fight the Cold War just so we could rebuild the Stasi ourselves.

Yeah, WTF do they think they are, Google or Facebook?????

uotnr• 13 years ago

What might have happened is this: 1. NSA bribed someone to obtain Google's SSL certificate private keys 2. NSA installed wiretaps outside of all Google datacenters 3. NSA hired someone to write software that would reconstruct Gmail inboxes, login activity, etc. based on the decrypted traffic

If Facebook, Google, etc. are indeed innocent they should change SSL certificates immediately, store the new ones in secure cryptographic hardware, stop offering non-HTTPS access, and start inspecting network equipment for the wiretaps.

lawnchair_larry4• 13 years ago

It sounds like this employee was not even aware that Google's "Transparency Report" specifically does not include the number of FISA orders that they have received:

"Update 2013-06-07: at the time that we wrote this post, we asked Google whether its Transparency Report included data about secret FISA court orders that would send data to the NSA. The response we received was extremely vague, but seemed to possibly be "no". In the wake of yesterday's revelations that the NSA was harvesting data from Microsoft, Yahoo!, Google, Facebook, AOL, PalTalk, Skype, Youtube and Apple, Google has now clearly confirmed that the numbers in its Transparency Report do not include the number of orders or targets for NSA surveillance."

https://www.eff.org/deeplinks/2013/03/new-statistics-about-n...

This is especially interesting, because it means Google has acknowledged the distinction between NSLs, which include a gag order, and some other even more secret directive, which services NSA surveillance.

It's also worth noting that if Google was willingly supplying anything PRISM-like, this employee would not be allowed to know without a Top Secret clearance. Any Google employees who do have such clearance face the threat of prison if they tell him or anyone else.

rieter• 13 years ago

He said "as much as possible".

danso6• 13 years ago

It sounds like this employee was not even aware that Google's "Transparency Report" specifically does not include the number of FISA orders that they have received

Are you concluding that from this statement?

"I'm not sure what the details of this PRISM program are, but I can tell you that the only way in which Google reveals information about users are when we receive lawful, specific orders about individuals -- things like search warrants. And we continue to stand firm against any attempts to do so broadly or without genuine, individualized suspicion, and publicize the results as much as possible in our Transparency Report."

He may be ignorant of that fact...however, that last statement, "as much as possible", would cover that. However, his assertion that "the only way in which Google reveals information about users are when we receive lawful, specific orders about individuals" would still cover FISA, because FISA, as far as we know, is specifically for the targeted surveillance of individuals.

Moreover, FISA, as it applies to Americans, requires a court-approved warrant for that surveillance. So again, what the OP is claiming is non-contradictory, because FISA requests are both legal actions that target individuals that go through an approval process.

This is entirely different than what PRISM is alleged to be, which, well, we don't know exactly what it is, but involves the warrantless surveillance of Internet usage with the collaboration of Internet companies...currently, Google is outright denying being a part of that.

Some relevant links: http://en.wikipedia.org/wiki/United_States_Foreign_Intellige...

http://www.huffingtonpost.com/2012/12/30/obama-fisa-warrantl...

Also worth noting, national security letters, which Google does oppose, are controversial because, among other things, they do not require a warrant. This is not the case with FISA and American citizens.

lawnchair_larry4• 13 years ago

Ah, you are right on the PRISM distinction, I mixed up details with the "metadata" thing, which I'm sure is not accidental. A lot of the responses from government officials are to the effect of "these aren't a concern, because to get the metadata we need to go through FISA courts for every individual", which is just a red herring now.

So, there are:

1. NSLs, published on the transparency report

2. FISA orders, which are "through a court", but is by all accounts just rubber stamping, not on the transparency report

3. PRISM, which is intended to bypass FISA entirely, according to the Guardian article. Either Google is lying, the NSA is doing it without Google's knowledge, or there is subtle wordplay involved (so, lying). Or, that it's been grossly misreported.

icambron2• 13 years ago

This denial is a lot stronger than Page's, which was full of weasel words. Unless Zunger is just lying, which somehow seems unlikely (forgive my naiveté), it'll be interesting to know how PRISM actually works. But I will say that his faith in his company sounds misplaced, since Google's more official denials are so weak.

edit: clarity

saalweachter2• 13 years ago

He hints at a couple of reasons for his confidence in his post.

One of his assumptions was that people would notice surreptitiously installed hardware or software doing the monitoring. I don't think this is unreasonable. Hoovering up all the private data in Google is bound to be a big job, regardless of whether you are sieving it on site or transferring it off site. Even if it would only take a few people to install and manage, everyone else would probably be tripping over it constantly. Accessing all of Google's data means you'd be tied into nearly every system.

It's possible to keep projects secret inside a large company like Google, but only if an exceedingly few number of people know about it, and have good reasons to not tell anyone else. A system with as much surface area as you'd probably need to hoover off all of Google's data would be vulnerable to almost every engineer and datacenter worker accidentally running across while debugging other problems. Even -- especially? -- if they didn't realize the significance of it immediately, they'd probably ask their coworkers about this weird extra code/jobs/hardware, and pretty soon everyone would have heard about it. Once everyone inside of Google had heard of it, I think you'd have a very hard time keeping the secret from leaking into the outside world.

icambron2• 13 years ago

Right, that mostly paraphrases his arguments. But it doesn't convincingly eliminate a few possibilities for how this works.

One possibility: Google obviously has some capacity to honor search warrants and NSLs. And presumably that involves some technical artifacts somewhere: admin-level API access to data and some sort of external endpoint through which the government can actually make those requests. So that's all stuff we can confidently say is already there humming along happily, whether used for nefarious purposes or not.

OK, so given that those exist, how much volume do they support? How hard would it be to modify them to bypass the scrutiny process? Or give the NSA access to those endpoints instead of just domestic law enforcement? In other words, these are just changes to the process, totally invisible to anyone without explicit access to it. It might not involve any weird hardware at all, and could operate with very few people in the know.

Another possibility: Google handed over its TLS keys and just let the taps happen upstream.

That's why the confidence of a senior person that there isn't fishy hardware running around makes the question of how PRISM works more interesting. But it certainly doesn't make the project impossible.

Edit: removing distracting aside

andreyf3• 13 years ago

His comments are actually the most insightful points I've seen about the discussion regarding PRISM:

I have my own suspicions -- which I won't go into here -- about what PRISM was actually about. I'll just say that there are ways to intercept people's Google, Facebook, etc., traffic in bulk without sticking any moles into the org -- or directly tapping their lines. You may find some interesting hints in the leaked PRISM slides [1], especially the second and fourth ones shown there. The subtleties of phrasing are important, I suspect, not because they were trying to be elliptical but because they reveal what was obvious to the people who were giving that presentation.

And like I said, I have both some reason to believe that there aren't such devices inside Google, and that the PRISM slides are actually talking about a somewhat different kind of data collection -- one that's done from outside the companies.

Any ideas what he could be thinking?

1. http://www.washingtonpost.com/wp-srv/special/politics/prism-...

jmgao2• 13 years ago

A target's phone call, e-mail or chat will take the cheapest path, not the physically most direct path - you can't always predict the path

Dates When PRISM Collection Began For Each Provider

This is complete conjecture, but this reads to me like the NSA set up its own backhauls and set up peering agreements at artifically low prices to get traffic going over their pipes. Is there historical data for route announcements available anywhere? There are a lot of specific dates that could confirm/disprove this.

ihsw• 13 years ago

This is expounded upon in some news articles, particularly that data is routed not by the most efficient geographic route but by the cheapest by dollar price.

It's a very important tidbit of information that divulges the heart of the matter -- the NSA is a backbone operator[1]. It's a tall claim to make, however their involvement in internet exchange points (and other regional network access points) would be far more difficult to conceal.

[1] http://en.wikipedia.org/wiki/Tier_1_network#List_of_tier_1_n...

andrewcooke• 13 years ago

OK, so when did Google push SSL everywhere? How does that fit with the graph at http://cdn.theatlantic.com/static/mt/assets/science/assets_c... ?

It's possible Google come out as good guys in this...?

xfs• 13 years ago

This.

Acquire access to major routers, send routing commands, route target traffic into their hidden networks, and avoid physically wiretapping anything. And this framework can be done globally:

Your target's communications [...] flowing into and through the U.S. is as easy as announcing BGP route advertisements globally.

Actually the Great Firewall of China started investigated realtime and fine-grained control of national routing infrastructure as early as in 2003.[1] This allows them to apply routing policies to routers national-wide in seconds. One observable effect is that a single address can be null routed immediately after failure to get blocked by TCP resets. It is believed the HTTPS MITM of Github last time was also helped by this routing framework. And the GFW is viewed by the Chinese government as a national security framework. No wonder the USG is doing the same thing.

[1]: Liu, G., Yun, X., Fang, B., Hu, M. 2003. A control method for large-scale network based on routing diffusion. Journal of China Institute of Communications: 10.

JunkDNA3• 13 years ago

Beam splitters (prisms?) inside the backbone providers. All traffic goes to its destination unharmed, but the NSA gets all the packets. SSL is harder, but all you need is the private keys. Those are hard to get but not impossible for someone with the resources of the government. This is the only scalable way to do what they are supposed to be doing and not involve lots of outsiders. Note that the people who have really clammed up the past few days are the telecoms in all this.

jonknee2• 13 years ago

It has been well known that they already do the beam splitting portion, so it's really just up to the keys.

est• 13 years ago

That's why IMHO secret sharing[1] algorithms are so important

We store only parity of data in one data center, and some in another on a different continent. Any data intercepted or lost does not damage the integrity of the whole, plus this makes ISP can not discriminate raw binary data.

[1] http://en.wikipedia.org/wiki/Secret_sharing, invented by Adi Shamir, the S of RSA

jcampbell15• 13 years ago

This is exactly the conclusion I came to. My guess is they have the SSL/TLS keys.

That being said, tptacek thinks we are wrong, and he is a subject matter expert, so I am not sure.

alyx• 13 years ago

Ok so they split and copy all the packets, nobody else is concerned with the complexity of tagging, filtering, rebuilding and contextualizing this conceptual volume of packet data?

Beam splitters are not enough, they would need something to interpret this traffic.

Something is missing here.

silverlake• 13 years ago

Here's a much simpler explanation: The Feds submit a FISA order for specific data collection. The companies' lawyers approve it. Then the NSA has a convenient user interface for accessing that data (perhaps real-time?) somehow from the companies' servers (possibly through an intermediary). How else is this data being sent to Ft. Mead? Thumb drives via FedEx?

The dates on the slides might be when a company has erected some convenient access point to grab the data "lawfully" obtained by a FISA order. Microsoft whipped something together quickly. Apple took years to get the UX just right.

Frankly, sucking in ALL of the Internet seems extremely difficult and useless. We're talking GOOG+AAPL+MS+YHOO+Skype+many more. And all for $20M/year? The gov't spends more on toilet paper.

twinge• 13 years ago

This is my thoughts exactly. I cannot imagine any hugely sophisticated data collection infrastructure costing a mere $20m a year.

More likely this is software written to take in structured data obtained by subpoena -- as it's generated by targeted users. This "ultimate user data liberation" API may have even been the system at Google that was attacked by the Chinese: http://www.washingtonpost.com/world/national-security/chines...

losvedir• 13 years ago

Oh, that makes a lot of sense. Referring to this:

http://cdn.theatlantic.com/static/mt/assets/science/assets_c...

For only $20M/yr (which is nothing by government standards), I could definitely see that being a roadmap for building the user friendly endpoint to obtain the relatively small number of legally obtained records from each provider.

codezero• 13 years ago

I wonder if he's hinting at spying on XMPP -- a lot of the companies implicated use this protocol and the timelines of the powerpoint timeline is aligned with a lot of companies mobile growth as well as XMPP usage -- also, this might explain why Google is suddenly dropping XMPP support (rather than just being "closed")

0x08bc2ff1• 13 years ago

There are two features in the slides that need to be accounted for in any explanation.

1. The second slide, which implies that the fact that the internet traffic passes through the US is relevant.

This implies that either some physical interception was necessary, either from outside the companies, or from the inside with their cooperation, or that it was legally necessary (on order to require the companies to deliver the information. And yet it would seem like the issue of what the NSA could require US companies to reveal, is orthogonal from which traffic passes through the US, since in that case the issue would be what was stored on US servers.

2. The implied cooperation from the companies in the slides. According to the Washington Post, the "Special Source Operations" in the logo refers to "the NSA term for alliances with trusted U.S. companies". Given this, and the use of the terms "providers", it seems unlikely that no cooperation from the companies is involved.

From the above, I would propose that the PRISM scheme must involve some combination of physical interception, and cooperation from the companies involved.

For example, the NSA may be intercepting traffic then asking the companies for private keys for some of the traffic they intercept. This would fit the above facts in that it requires the traffic to pass through the US, and also requires cooperation from the companies.

tptacek2• 13 years ago

Two things that cannot be true at the same time: this Google+ post, and the idea that Google coughed up their TLS keys to the government.

JunkDNA3• 13 years ago

You're one of the few whose opinion I would trust on this: how much data would the NSA need to derive TLS encryption keys from encrypted data? I feel like I read once that you could possibly use statistical methods to derive the key if you had enough encrypted source data.

tptacek2• 13 years ago

The technique they'd be using to do that would be new to science.

Here it is worth pointing out that Google did something awhile ago to make NSA's job much harder (if their goal is to read everyone's mail): they became aggressive advocates for TLS forward secrecy.

http://googleonlinesecurity.blogspot.com/2011/11/protecting-...

TLS forward secrecy involves the ephemeral Diffie Hellman ciphersuites (which your browser supports). Instead of deriving a session key and using the server's RSA key to convey it, the DHE ciphersuites run the DH protocol to derive a session key between the client and the server, and then use the RSA key to sign the exchange ("breaking the tie" if there was a MITM). The RSA key is never used to convey a session key; if you got all of Google's TLS keys, you would not be able to go back in time and decrypt old sessions that used a DHE ciphersuite.

It is also worth pointing out that some of the hardest people working in security show business, including Adam Langley and Michal Zalewski and Justin Schuh, people with unimpeachable reputations in my field, work for Google on these problems.

voidlogic2• 13 years ago

"Two things that cannot be true at the same time"

Only if you assumed he is fully informed. Do you think Google chief software architect would fall within "need to know", if Google had been ordered to hand over their SSL private keys? I doubt it.

jonknee2• 13 years ago

I wonder what the NSA thinks about Google's plan to change their SSL certificates?

http://googleonlinesecurity.blogspot.com/2013/05/changes-to-...

Seems like that could put a crimp on any beam split obtained data. At least for a short while.

jcrites• 13 years ago

I'd really like to know whether Google shared its SSL/TLS certificates with government agencies. I asked the author (Yonatan Zunger) a short question and he replied to say he doesn't know anything. I followed up with:

It seems you care very much about user privacy:
> I would no longer be working at Google [but for] the fact that we do stand up for individual users' privacy
Will you be willing to find out whether Google has shared its SSL/TLS keys for public sites with government agencies? As a person interested in user privacy, I imagine this will be as of much interest as whether they have direct access to the data.
As you mentioned, direct access would require Google to build something. Intercepting SSL/TLS traffic would not.
If Google shared its SSL keys, then the NSA can intercept all inbound and outbound traffic, and would be able to capture virtually all Google user data. They can store the data and search it. They wouldn't particularly even benefit from direct access to Google's data, if they're planning to store it themselves anyway.
I would be great to hear an affirmation from Google that it has not shared its encryption keys with governments.

I can't figure out how to link to my comment, but it appears in the comments on Yonatan Zunger's post. (See original post)

lifeguard2• 13 years ago

"might have also denied knowledge of the full scope of cooperation with national security officials because employees whose job it is to comply with FISA requests are not allowed to discuss the details even with others at the company" http://www.nytimes.com/2013/06/08/technology/tech-companies-...

Welcome to evil google team. It was nice knowing you. You will not miss me, but good bye.

Glyptodon• 13 years ago

Somebody probably puts the census in their inbox, then.

cupcake-unicorn• 13 years ago

With all of the conspiracy theories floating around, what about something fun, like the government proved P=NP and is just able to secretly crack the encryption keys, passwords, etc., like that silly movie "The Traveling Salesman Problem" where they turn algorithms into an action packed movie.

Seriously though, it seems like the general consensus is that no one on either side is actually lying, but the companies involved are using weasely language that can be interpreted to exclude any kind of indirect access, SSL keys, etc? I'm surprised at the tone of the statements the companies are giving, because were it to come out that the companies are giving indirect access, their adamance would just make them look terrible...It's as if the companies in their statements, at least FB and Google, sound shocked, hurt, etc. to find out people would assume that of them.

mortehu• 13 years ago

It's widely known and admitted that they have indirect access, by issuing warrants and being provided with slices of the data. You must be talking about some specific form of indirect access?

bsaul• 13 years ago

one thing crossed my mind : could the fact that this things blows up right when china's president is coming to the US to talk about cyber espionage and individual liberties be a coincidence ?

DenisM• 13 years ago

That's a good point. It does seem like the slides are fake and someone is trying to play the public against Internet companies, or alternatively, that someone is playing public against US governement.

Google Chief Architect: we only respond to specific orders about individuals

Related Stories