Google Takeout means something else in light of PRISM

https://rachelbythebay.com/w/2013/06/07/takeout/

by onosendai • 13 years ago

159 45 13 years ago

Udo2• 13 years ago

Exporting every account on a daily basis can't possible work for Google or the government. To be scalable and useful, and to meet the "no direct access to our servers" mantra, they would instead need for Google to replicate all database updates straight onto the NSA servers.

That's no small feat, and it certainly requires explicit engineering effort, but it's not a hugely complex undertaking either. Maybe the infrastructure of Takeout can also be used to do that, but the data transmission itself would have to work differently. Again, I believe it has to be basically a data pipe that replicates every user action, probably in real time.

leoc5• 13 years ago

I'm not aware of a good reason to think that Google sends all user data for everyone (or even all non-US-citizens) pre-emptively (or at all) to the NSA. The Takeout system is doubtless used to comply with FISA requests targeted at specific individuals, but it's not at all news that Google receives and accedes to such requests fairly routinely.

The three questions which remain open are 1) just how many individuals are getting FISAed - and has it gone up sharply thanks to the shiny new infrastructure for streamlining the request process? 2) do the FISA requests being acceded to now also include "broad sweep[s] for intelligence" in addition to those "specific orders about individuals" which the Internet companies have acknowledged (and which everyone knew about already) and 3) to what extent are the CEOs still fully aware of the nature and extent of the FISA inquiries now that the nice semi-automated processes are in place?

Udo2• 13 years ago

PRISM means that internet companies like Google will be free from future FISA and NSL headaches, and so they can even truthfully say that they haven't received any requests.

wavefunction• 13 years ago

Or they just put something upstream of the "server."

It's actually trivial if you really think about it.

jacquesm5• 13 years ago

It's actually not that trivial, if you really think about it.

mtgx3• 13 years ago

When this came out, I remembered about that whole "you can never really delete your Facebook account, or the data from Facebook's server" situation. The whole NSA thing could also be one of the reasons why you can not.

Oh, and you can't delete your Skype account either. Not even in the UI.

alan_cx• 13 years ago

I wonder if deactivating one's FB account triggers a copy to be sent to the NSA? The "Logic" being a panicked user trying to cover tracks.

mtgx3• 13 years ago

I wouldn't be shocked if that happened. There was some other leak a while ago saying that FBI thinks you're "suspicious" if you don't have a Facebook account. That's the world we live in now.

astrange• 13 years ago

I wonder why the quality of posts has gone down so far this week.

drivebyacct22• 13 years ago

Why on earth do you call out Skype? That's true of tons of services.

mtgx3• 13 years ago

Skype was another one of the services mentioned. Microsoft was also the first company to start giving data this way to NSA, according to the leak, since 2007, and they signed up Skype to it almost immediately after they bought it.

jacquesm5• 13 years ago

Let's all do a blogpost on PRISM and see how many eyeballs we can get.

Google takeout most likely has nothing whatsoever to do with PRISM or any other NSA programme, why go through a clunky one-user-at-a-time batch process when you can be comfortably sitting right where the action is, where updates are incremental and where information is available when it happens instead of when you ask for it.

Push over pull any day for the NSA and the likes.

onecommentonly2• 13 years ago

If Google says that Takeout has all your information stored on Google, and if NSA wants everything for Person X, why isn't this ideal?

jacquesm5• 13 years ago

Prism docs leaked put a huge accent on the fact that it is real-time.

On top of that google take-out is just google but a lot of other companies are listed as well. So, all things taken into account the two most likely have nothing to do with each other.

Rachelbythebay does not let any chance go by to diss her former employer and that's fine by me as long as it is based in fact, not in speculation. If she knows for a fact that this is the case that would change things considerably but from where I'm sitting this looks like speculation to me.

chmars2• 13 years ago

User data export features as they have been common recently – Facebook und Twitter for example offer similar features as Google Takeout – could without any doubt be used to export data for all kind of other 'users'.

NSA might tap every single bit of communication worldwide but getting structured data for users of specific interest directly from Google etc. is still much easier.

jacquesm5• 13 years ago

Except that in the case of google they have said that they only do that on a person-by-person basis, and that PRISM is apparently a wholesale affair.

There just simply is no tie-in between google checkout and PRISM as the article alleges as far as I can see.

lazyjones• 13 years ago

Good points - other things that mean something else in this light is the realname enforcing policy and the unification of Google accounts (that we got Google+ to blame for exclusively so far). Taking it further, I wonder what the information that Google's personalized search is based on, can be used for. It must be a good summary of your habits, interests etc., right?

sentenza• 13 years ago

I am kind of surprised how many people on HN try to downplay the PRISM thing. The recent revelations and controversy directly affect the business prospects of any US firm that stores data.

A couple of months ago I was on an education business fair in Germany and the first thing I heared at the booth of many data-handling businesses was: "We don't store anything in the United States. All our servers are in Europe/Germany."

I now wonder if next year, some will advertise that they don't even have a US subsidiary and are thus not under US jurisdiction.

realo• 13 years ago

That, exactly.

Google, Apple, Facebook and friends go to great lengths to evade taxes. When it comes to tax matters, those companies have no hesitation to use all the tricks available to a trans-national company. And they pay very smart people to invent schemes that ensure a maximum amount of money is kept out of the US IRS hands.

If Google, Facebook and friends were truly serious about protecting their users' privacy, they would. They would pay very smart people to invent schemes that ensure a maximum amount of user data is kept out of the US NSA hands.

But they don't.

agilebyte• 13 years ago

Maybe you can have one but not the other. These guys contract big consulting firms to be the middlemen between them and the government when it comes to tax laws. But I suspect you have to "give" something in return.

smtddr2• 13 years ago

It's one thing to have a bankaccount in the Netherlands, that's easy. A whole data-center? A data-center with all the infrastructure to support it and employees and it still needs to be fast enough that we can't see a slowdown from moving it out of USA? That's a different undertaking.

jacquesm5• 13 years ago

I'm surprised how many people think this is news.

It's simple: if it's passed through the USA, if you store it on a server in the USA or if it contains tags served from the USA you can bet that it's being tracked by one or more three letter agencies. To assume anything less would be folly given the amount of smoke that has been generated to date. To infer there is a fire somewhere is no feat of deduction.

The fact that there is now proof that at least some of these programs are real is only going to convince the last hold-outs, or at least, so I'd hope.

brown9-22• 13 years ago

If you stored data in the USA, you were already subject to all these things - search warrants from the FBI, FISA requests for a user's data, etc. The law has not changed.

If your servers are in Germany, then they are the subject of German law - and all of their similar, respective search and data laws.

If you weren't aware of this before, you either weren't large enough for anyone to ask for your data, you were lucky enough to never have to deal with this request (or your software isn't really used for communication or data storage), or you were simply ignorant of the legal situation

btilly2• 13 years ago

Obviously. But the USA and Germany are light years apart on questions of user privacy.

btilly2• 13 years ago

...in Germany and the first thing I heared at the booth of many data-handling businesses was: "We don't store anything in the United States. All our servers are in Europe/Germany."

There is a very simple reason why that is a marketing point, and any of those vendors would have been happy to expand on it, and probably do on their websites. That reason is that compliance with German law requires certification that all steps you take with data comply with German law, which is much easier to do with a vendor which exists in a jurisdiction that has similar data privacy laws, and is easiest if that vendor is German.

For a random example, see http://www.perspecsys.com/how-we-help/cloud-data-privacy/ger....

Now before you cheer Germany for this stance, stop and think. Normally HN is very supportive of anything that reduces red tape barriers to small startups trying to innovate. The kind of regulations that we're talking about both protect users, and make life a lot harder for startups.

mtts• 13 years ago

I doubt this is really an issue. Maybe some knee jerk anti-American types might spew nonsense like this but Europeans with a little more sense and insight and who actually care about this stuff are well aware that:

1. By law all European telecom providers, including ISPs, are required to provide a backdoor for everything that goes on on their networks (the infamous Data Retention Directive)

and

2. All European security agencies cooperate quite willingly with their American counterparts. Some more so than others (the ones from the former Eastern Block are particularly notorious in this regard) so if an American three letter agency wants your data, it'll get it.

ynniv• 13 years ago

Yep, Facebook has the same thing, which was also pitched as altruistic.

https://www.facebook.com/help/?page=116481065103985

myko• 13 years ago

And by all rational accounts, is altruistic.

sdfjkl• 13 years ago

Same goes for the Google Apps Email Audit API[1]. Heck, it even lets you set up keyword queries that get automatically copied to your spy inbox.

[1] https://developers.google.com/google-apps/email-audit/

yarou• 13 years ago

I think the Palantir link is the most plausible, it's startling to see how many companies utilize their technologies (mine does, under the premise of being "AML-compliant"). The end goal of these cretins is to chain men with invisible, digital shackles.

brown9-22• 13 years ago

Even in the absence of this specific Takeout tool, Google would need a way to comply with legal requests for a user's data across all of their various systems.

What is more likely than not is that the majority of employees at Google have no idea how the surveillance system that Google would need to have worked and were ignorant that it existed.

jerrya• 13 years ago

Home Depot sells shovels.

Sometimes bad guys kill people and use the shovels from Home Depot to bury the bodies.

There was this really great Zombie movie from 1985, Return of the Living Dead, that took place in a funeral home. I'm not going to give any spoilers, but you really need to see it.

Shovels mean something else in light of this discovery. Sorry Home Depot, I think your shovels have been co-opted.

Google Takeout means something else in light of PRISM

Related Stories