Asking the U.S. to allow Google to publish more national security request data

http://googleblog.blogspot.com/2013/06/asking-us-government-to-allow-google-to.html

by Lightning • 13 years ago

717 179 13 years ago

googleblog.blogspot.com

Assertions in the press that our compliance with these requests gives the U.S. government unfettered access to our users’ data are simply untrue. However, government nondisclosure obligations regarding the number of FISA national security requests that Google receives, as well as the number of accounts covered by those requests, fuel that speculation.

Sounds suspiciously like they are going to ruin everyone's nerd rage.

jlgreco5• 13 years ago

You really love that phrase, don't you? I'm sure in other communities it is a great way to marginalize those with interests that you do not share.

youngerdryas3• 13 years ago

I really doubt Google is going to play chicken about something so serious as giving away all their user data. Is it incomprehensible to you that they are telling the truth?

tptacek17• 13 years ago

You're suggesting that the idea of Google as a tool for the NSA is a marginal interest on HN?

haberman3• 13 years ago

It's one thing to care about privacy issues, it's another to believe (and react to, and soapbox about) a distorted and inaccurate version of reality. A lot of the "nerd rage" has involved people assuming facts that may not in fact be true. People who do this marginalize themselves. In general we call them "conspiracy theorists."

For the facts that do indeed turn out to be true, soapbox away.

jka2• 13 years ago

Aggregate number of requests is one thing, but perhaps some indication of how much content is provided with the average request would be required to really indicate what is going on here?

An API may serve millions of requests per day and return single-integer responses, or it might serve one batch query per day and provide a nested document with many sub-sections.

powera• 13 years ago

From the article: "We therefore ask you to help make it possible for Google to publish in our Transparency Report aggregate numbers of national security requests, including FISA disclosures—in terms of both the number we receive and their scope"

jka2• 13 years ago

Not sure how I missed that on the first read through - good to see though, reassuring as long as the scope descriptions are reasonably clear!

rasterizer• 13 years ago

"millions of requests per day"?! the number of FISA requests since 1979 is just short of 34,000: http://www.motherjones.com/mojo/2013/06/fisa-court-nsa-spyin...

Let's try and keep the speculation to a minimum.

RobAtticus2• 13 years ago

Pretty sure he was just giving a generic example rather than specifically talking about this case.

masterzora• 13 years ago

It seems less like speculation and more an example of how raw number of requests doesn't mean a whole lot in and of itself.

pyre• 13 years ago

As others have stated, it's fairly apparent that the parent poster wasn't talking about actual numbers, and was painting an example where the number of requests is meaningless without the scope (i.e. does each request specify one individual, or 20 individuals?). That said, this includes NSLs (National Security Letters) which do not have to go through a court, and which I don't believe there are any published numbers for (either in number of NSLs or their scope).

slg2• 13 years ago

This is the kind of response I was expecting from tech companies. The mistrust of the government has extended to this industry and we can't simply rest on a simple denial of the accusations. Many people now believe that companies like Google send a complete copy of their entire customer records to the NSA. That is a dangerous belief and like discussed on other threads here, it could really damage the long term viability of the tech industry. This is at least a start to try to change public opinion.

EthanHeilman3• 13 years ago

It could really damage the long term viability of the __US__ tech industry dealing irreparable damage to one of the major assets of the US economy has. I would expect companies that need a strong international security reputation to begin closing up shop and moving away.

The NSA just killed the goose that lays the golden egg and not much is going change that.

slg2• 13 years ago

I disagree that this is a problem limited to US companies. With the global nature of the tech industry, I think a product's or service's country of origin has seen a reduced importance over the years. I don't think the average consumer knows that Waze is based in Israel. I don't foresee anyone considering the NSA and choosing a Canadian designed Blackberry phone over a US designed Apple one. Instead I think this will just instill a general distrust of technology and the cloud. I doubt people will be discerning enough to focus their suspicions.

salimmadjd• 13 years ago

I agree! This opens the door for new services based in countries like Iceland to compete in the international market. I'm surprised libertarian minded investors like Peter Thiel have not began a fund in some of these countries. Even signaling such a move would give Google, Facebook, etc. strong argument to fight off NSA's broad requests and we all win!

lern_too_spel2• 13 years ago

I wouldn't say the NSA killed the goose any more than I would say any other organizations that request warrants for user data did. What killed the goose was mass hysteria caused by a mistaken belief that Google let NSA see any user's data at the touch of a button. Poor journalism killed the golden goose.

1morepassword• 13 years ago

mistrust of the government has extended to this industry

I'm sorry, are we now taking the opportunity to blame big evil government for this?

The mistrust of this industry has always existed as a completely separate issue due to the utter lack of respect for privacy and privacy related laws, an attitude of which Google is one the most prominent exponents. This is a company that lobbies governments against privacy protection.

An industry that has for years tried to convince the public that surrendering your privacy to them for profit is perfectly okay has zero credibility in this matter.

burntsushi• 13 years ago

You have a valid point, but you're overlooking a really crucial difference: data in the hands of a corporations means something entirely different from data in the hands of government. One of them has a monopoly on the use of force and the other doesn't. At least, that's the distinction that is important to me.

mtgx3• 13 years ago

I'm only upvoting this not because I have much loyalty or trust left for Google, but because I want many other companies to follow their lead and flood the Administration with such requests.

I still feel this does very little, though. They need to be asking them for much more. They need to ask them to end the spying. Until then I'm still hoping Google, Microsoft, Facebook and others will suffer greatly for this abroad, and lose a ton of business and customers, both small and major.

Maybe then they'll start doing some real lobbying to the government to end the madness, and maybe the government will stop thinking all the spying is worth breaking all international relationships and hurting the US economy in the process.

Until that happens, if Google cares that much about encryption and their users' privacy, they should show me they are willing to implement OTR, ZRTP and PGP in their services. The same goes for Microsoft and Facebook. Otherwise, this press release means nothing except for showing that "they are doing something".

tptacek17• 13 years ago

So you'll be happy when the US ends all foreign signals intelligence? Or makes the Internet a safe haven from signals intelligence?

Also: by offering PGP in GMail, Google would harm online security. If you want PGP, install it on your computer. Google won't do anything to stop you.

rdl6• 13 years ago

1. Google probably should offer passive S/MIME on mail. START TLS goes a long way, but providing the same signals about message authenticity to people who IMAP from gmail as who use the web UI would be nice.

A non-google-trusting way to do PGP with a better UI/UX would also be a nice feature for gmail. Just indicating "encrypted" at the message-list view or something. I have PGP working quite nicely in mutt, but a lot of people seem to prefer webmail.

2. I'd actually prefer a world where signals intelligence, outside extremely tactical intelligence, were impossible through technical means. I think we'll be there at some point, just because the cost of protection is dropping.

(confidentiality and message integrity should be feasible for any reasonable government defender at this point. traffic analysis/direction finding/etc. burns bandwidth and latency budgets, so that might be harder, but you can do arbitrarily well.)

The US (government and citizens/private industry) probably has more to gain from universally strong COMSEC vs. effective USG SIGINT.

xtrumanx• 13 years ago

I wish you wouldn't phrase your questions like that as it invites some to accuse you of implying that it's either the US spies on everybody or ends all foreign signals intelligence.

Also, the fellow you replied to didn't specify what sort of spying needs to be stopped. He could have no issue with foreign signals intelligence (which presumably means spying on non-US folks).

mtgx3• 13 years ago

It's not about a few people using those encryption tools. It's about major companies like Google making them mainstream tools, and also making them very easy to use (as easy as it can get).

quantumpotato_2• 13 years ago

Harm online security how?

adventured• 13 years ago

The parent said absolutely nothing about ending all foreign signals intelligence. You're intentionally dramatizing.

flyinRyan5• 13 years ago

I would. Any secrets we allow the government to keep are a license to be abused. They're barely capable of following their own laws under the microscope. I doubt they even try so long as the citizens aren't aware of their activities.

declan2• 13 years ago

Here's some background on what's actually going on: http://news.cnet.com/8301-13578_3-57588752-38/google-to-feds...

leoc• 13 years ago

And the surveillance process must comply with the Fourth Amendment.

This phrasing seems to suggest that the intended target of FISA 702 - the US cloud data of non-US-resident non-US-citizens - enjoys Fourth Amendment-based protections, such as the probable cause requirement, under FISA 702. But in fact it seems that (IANAL) FISA 702 is compatible with the Fourth Amendment (if it is) only in the sense that slavery was compatible with the Fifth Amendment: simply because the Fifth Amendment does not apply to slaves. If 702 envisaged non-resident aliens' US cloud data as being protected by the Fourth Amendment then it would presumably require the US government to establish probable cause at the FISC (or some other court). But in fact 702 doesn't seem to require the government to claim any kind of cause or suspicion or even state any purpose or motivation for the search to the FISC. The FISA 702 PowerPoints obtained by the ACLU under FOI make it clear that the US government understands FISA 702 as removing the probable cause requirement http://www.aclu.org/files/pdfs/natsec/faafoia20101129/FAAFBI... .

tikums• 13 years ago

"if Google cares that much about encryption and their users' privacy, they should show me they are willing to implement OTR, ZRTP and PGP"

That would only make sense if they wouldn't be required to become your key escrow service (=custodians of your private keys). PGP is also a pretty bad choice for private communication, as it offers no forward-secrecy. Something like client-side OTR implementation would be better.

tptacek17• 13 years ago

In expressing his view that Google is being harmed by USG's lack of transparency (combined with the godawful operational security of the contractor-run intelligence agencies), is Google's chief counsel here starting to build the standing to sue the government?

If this whole debacle sets up an epic confrontation between Google and the DoJ, I may have to reevaluate how irritated I am at how "Prism" has been reported. More Greenwald agita! Let's see if we can pick a fight!

haberman3• 13 years ago

Just to clarify, I think you are irritated with the inaccurate/sensationalist reporting of PRISM, and not that it was leaked to begin with?

tptacek17• 13 years ago

My perspective on this is going to sound weird to you.

1. I am very irritated at inaccurate and sensationalized reporting.

2. I think the USG should have been much more open and forthcoming, at least in the aggregate, about how foreign signals intelligence was coming into contact with online services used mostly by citizens.

3. I think leaking details of signals intelligence programs should be a crime.

4. I hope Google picks a giant fight with the DoJ and wins it.

declan2• 13 years ago

I like the theory, but you don't need to send an open letter for standing. The FISCOR already granted standing exists for providers.

jeremyjh2• 13 years ago

This is wishful thinking.

I have two ideas that are just as well supported by the complete lack of facts that we all have.

First, that Google is setting us up to believe a half-truth related to FISA letter counts. There are such numbers, we will get them, and they will not include all surveillance conducted with Google's data but anyone who says that will be back to being a crank.

Second, that Google perceives an existential threat to their company along two related but separate axis. The first is that their customers will leave, but that is less likely than the second. The second is that their best employees will leave. Googlers will not want to consider themselves as clerks in the Ministry of Truth. If they and their peers began to think about it in that way, then they will leave and the business will eventually die. If their employees have a credible excuse to think of their employer as a noble crusader, then this threat is significantly mitigated.

tptacek17• 13 years ago

How is that claim falsifiable?

WestCoastJustin• 13 years ago

You have to think, that with the limited data they are allowed to release, this must be extremely frustrating! A true rock and a hard place. The general public are led to believe, that they are willing to conspire secretly together with the government, to spy on their customers, must not only be infuriating, but brand damaging! Then you are required by law not to defend yourself ;)

p.s. I'm taking google at their word -- that they are not giving 'direct access' to the NSA. I am assuming they know, that the truth could leak out at some point, where they to lie about it.

spankalee• 13 years ago

As a Google employee I find it extremely frustrating. I'm sure it's even more so for the executives and founders who created the brand and are being personally questioned and attacked on top of it.

lignuist• 13 years ago

I'm more interested in the international numbers, as US politics seems to differentiate between US citizens and non-US citizens when it comes to human rights.

Edit: Or is this also including requests for users in other countries? Sorry, English is not my mother tongue, so I might got it wrong.

asperous• 13 years ago

I believe, if it continues as it is currently, the numbers are government requests, and how many users effected. There is no check or distinguishment in whether the government and the user's country match.

They also publish non-us government requests as well.

mpyne2• 13 years ago

The cat's definitely out of the bag anyways, so Drummond is definitely right that mentioning FISA numbers can't further harm national security. Make the right call, Mr. Attorney General!

corresation5• 13 years ago

What are the legal ramifications if employees at Google also work at the behest of the NSA/FBI/CIA (unbeknownst to Google)? It is one thing to compel the organization to reveal information, but what are the legal questions around essentially spies within the various corporations?

This very blog post mentions that Google hires some of the best security engineers in the world. I'm sure having "prior" employment at the NSA would look great on a resume, and put the person in a position to compromise essentially all internal security and data integrity.

tptacek17• 13 years ago

It would be a felony for anyone at NSA to attempt to "turn" an employee of Google and get them to leak secret information from Google's systems.

richtr• 13 years ago

That is your interpretation of the law...

- NSA 2013

blake80862• 13 years ago

Really? What law is that covered under?

(genuinely interested, because I did not know this)

flyinRyan5• 13 years ago

You mean a felony in the way that assassinating people is against US and international law, it's illegal to hold someone more than 24 hours without charging them and so on? I'm not sure how much laws like that matter at this point.

floitsch• 13 years ago

Disclaimer: I work at Google.

I'm working on the client-side (Chrome) and my knowledge in the server area is therefore limited, but from my understanding this would be really hard.

1. Googlers have access to almost all source code. It would be difficult to hide code that just sends data to an outside entity.

2. Google continually monitors its (internal) bandwidth. This is done to optimize traffic, and detect intruders. A rogue Googler would trigger the same traps that are exist for potential hackers.

3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files.

jsolson2• 13 years ago

3. Google's infrastructure changes. You can't just install a gateway to the NSA and expect it to continue working for a long time. It's not as if user-data was stored in simple text-files.

I think this was the biggest bullshit signal for me (also a Googler, although a recent addition). The high rate of change of Google's infrastructure is astounding when you consider the scale it operates at. The notion of trying to maintain a functional API in secret of the scope they're talking about is laughable without a pretty sizable team.

Impossible? No, probably not, but really ridiculously unlikely.

TomGullen2• 13 years ago

I see a big potential benefit for the NSA to have a spy within google who simply manually pulls and relays info on people at th nsa's request... It doesn't have to be a full Api

jfoster2• 13 years ago

1. What if the source code that does this isn't checked in? You would need to verify that the runtime matches the source code. What if it's not spread across Google's entire codebase, and is just in one of the pieces of infrastructure that almost all of the data hits? (eg. map-reduce clusters)

2. The link out to the NSA would need to be massive as well. Would be very difficult to keep that secret. A 4G modem is not going to cut it.

3. Sure, but I imagine the NSA would be happy to put in the maintenance effort required. The data would have high ROI from their perspective.

flyinRyan5• 13 years ago

1. Googlers have access to almost all source code.

So what. The world has access to the Linux source code. If I told you there was code in there that sent every byte written to disk to some external entity could you find it? Even if it was clear enough for you to find it, you'd have to be looking for it.

Further, you said yourself that googlers have access to almost all source code. How do you know something else isn't injected in before deployment. Honestly, the vast majority of googlers would have no idea and no way to have any idea if something like this were going on. Especially if people's jobs/freedom depending on no one knowing.

brown9-22• 13 years ago

In order for this to be an option, it would have to mean that all of the internal security and audit controls at Google were bullshit, wouldn't it?

corresation5• 13 years ago

Security and audit controls are almost always bullshit. We're discussing a story that arose because a three-month tenure employee for an external contractor had wide ranging access to tonnes of stuff in the NSA. Previously Bradley Manning demonstrate the same with the armed forces.

Are all internal Google communications encrypted? Probably not, but even if they are if you work in network security you likely hold the keys to that encryption regardless. You probably have access to their PKI keys as well.

ck2• 13 years ago

If google wants absolution it needs to state it's saving no more tracking data than the minimum required by law.

But it's saving a whole lot more than that. Much more.

ben_pr2• 13 years ago

The issue here is that Google doesn't know how much data the NSA collects. The NSA has access to the internet backbone that Google uses and can read whatever traffic it wishes that leaves the Google network. Obviously this is not everything but most everything. It is a low view of the NSA to think that they do not have the ability to real-time decrypt SSL certs from every major SSL cert authority. So while Google can claim they do not allow the NSA direct access to it's servers that is only a small comfort in the big scheme of things.

This sort of response from Tech companies is just a distraction from the real issue.

youngerdryas3• 13 years ago

So while Google can claim they do not allow the NSA direct access to it's servers

That is the entire story in this case, direct access to the servers.

lawnchair_larry• 13 years ago

It is a low view of the NSA to think that they do not have the ability to real-time decrypt SSL certs from every major SSL cert authority.

No it isn't.

ben_pr2• 13 years ago

Well, think again. You really think the NSA can't make the SSL cert vendors turn over the keys? I wouldn't count on it. https://news.ycombinator.com/item?id=5933784

kllrnohj• 13 years ago

It is a low view of the NSA to think that they do not have the ability to real-time decrypt SSL certs from every major SSL cert authority.

For most SSL certs this is probably true, but Google uses perfect forward secrecy which makes this very unlikely if not damn near impossible: http://googleonlinesecurity.blogspot.com/2011/11/protecting-...

jmillikin• 13 years ago

  > It is a low view of the NSA to think that they do not
  > have the ability to real-time decrypt SSL certs from
  > every major SSL cert authority.

The technology required to break SSL is sufficiently advanced that any organization possessing it would probably have easier ways to collect data, all of which would grossly outmatch all known security precautions. There would be no need for any of these sneaking-around stuff because breaking SSL is an instant win condition.

nitrogen3• 13 years ago

The only thing required to "break" SSL in the absence of some serious protocol flaw is either the ability to MITM connections with a CA-signed certificate, or possession of the private key used by the server.

ChuckMcM3• 13 years ago

Ok, so its a bit snarky, but I wish Google would invest as much cleverness in evading the letter of these non-disclosure rules as they do in evading the letter of the tax laws in their various jurisdictions. Perhaps they could create Google Panama Ltd which is the official entity to petition for all FISA and NSL requests which is an independently operating subsidiary based in Panama and outside the jurisdiction of the disclosure rules or something. There are a lot of smart people there, you can figure this out.

billnguyen• 13 years ago

The US needs to close its tax loopholes and stop blaming people for taking advantage of its own terrible laws. As long as the loopholes exist its in everyones best interests to take advantage of everything they can.

jholman2• 13 years ago

It's not just snarky, it's preposterously unreasonable.

How much work do you, personally, put into making money? At least 40 hours a week, I'm guessing, plus the time you spend on managing your investments, doing your taxes, and so on? How much work do you put into maintaining your own privacy? Is it even 1 hour per week, on average? Really?

Note that Google has, allegedly, already put a LOT of work into pushing back on ensuring that due process is followed. Many engineers, many lawyers, lots of executive-decision-effort.

Maybe you don't believe anything Drummond or Page say? Maybe you think google.com/transparencyreport is purely fabricated? Maybe you think Google should violate the law and get shut down (that's what you said, actually, with "evade the letter of the law", but I find that position so laughable that I assume I misunderstood you)? Maybe you yourself actually DO spend the same time on privacy that you spend on pecuniary gain, or maybe you expect Google to hew to a higher standard than you yourself do?

nitrogen3• 13 years ago

On your last point, I would argue that the more power and information an organization or individual has, the higher the standard should be.

ChuckMcM3• 13 years ago

Not precisely a rebuttal (you missed my point) but an interesting point in it's own right which I read was "Can you evaluate dollar value of privacy using the dollar value of your income stream?" And doing a sort of solve for X thing where you end up with hours invested in maintaining privacy becoming valued at hours invested in generating income. If I misunderstood please let me know, but assuming that I got the gist of it...

For me, I don't believe there is even a piece wise approximation between time investment and privacy value because the tools are so much different and the available actions being constrained. To illustrate where I get hung up on that reasoning, if you build a phishing page setup and contract a botnet to spam few hundred million people with phone phish-spam, you might get a lot of "income" for a relatively small time investment, similarly you can get greatly increase your privacy by investing in forged identity documents. So at the least we would have to constrain the hours invested in legitimate ways to enhance ones privacy and legitimate ways to enhance one's income.

Next there is an issue of facilitating the effort, so when company A sells me raw materials at a modest markup they facilitate my ability to make a living using them to provide said raw materials.If instead they were to charge an extortionate mark up, I might still be able to make a living but I might find the effort to do so requiring many many more hours of time investment. So at what point do the actions of my raw materials supplier work for or against my efforts at generating income. Similarly the provider of my tools can make it easier or less easy for me to maintain my privacy, so for example a Google Drive plugin which let me keep everything on their servers encrypted. If Google provides that then its a small number of hours invested to enhance my privacy, but if I have to rely on a third party who is acting without support from Google, then it takes many more hours for the same level of enhancement.

Given these built in and essentially intractable forces which affect the efficiency of hours invested needed to achieve the desired result, I am not persuaded by your claim that I can evaluate the 'worth' of privacy using your proposed reasoning.

Google can, and apparently does, to things like warrant notices where if you are suddenly asked to reconfirm your acceptance of their terms of service it's a signal that a warrant was served to them that they had to turn over your data. I think these sorts of things help them in the eyes of their users and are not illegal. They meet the letter of the law and so are not actionable, just as their transferring of rights around amongst their national subsidiaries is a completely legal way of not paying more tax.

My call to action was to try to think of ways that would make things like the PRISM data not useful to the NSA and yet meet their obligations under the law. I mentioned one (in cloud encryption with client side decryption) but I am sure there are others.

jroseattle• 13 years ago

Unfortunately, the statements from everyone involved have made me skeptical to the point I feel I have to consistently read between the lines and pick a statement apart.

What does "unfettered access" mean? What are "valid legal requests"?

While there is an implication of spirit in their words, I know deep down that everyone involved is focused on the letter of their words.

This has nothing to do with my personal trust and confidence in Google, but in my trust and confidence in this entire charade. Google is part of it, whether they're on the right side or not. I simply cannot tell.

acqq• 13 years ago

Exactly, if the requests exist only to cover the legality of the access of the U.S. citizen data as long as they are on U.S. soil, the numbers they mention would still represent just a small piece of the whole picture.

At least they mention in one sentence "the number of FISA national security requests that Google receives, as well as the number of accounts covered by those requests" which is already much more useful information than only the "number of requests." We saw that in Verizon case one single request was enough to mean "give me all about everything from everybody."

saalweachter2• 13 years ago

While I'd like to know how many secret requests are being made to whom, why should I ever believe any numbers?

We're living in crazy-town, maybe we always were. What is to stop the A.G. from publicly saying "Yes, disclose away!" and then to privately send one of those magic-do-anything-we-say requests saying, "Don't disclose X, Y, and Z."? Or if we are given an accurate count today, what is to prevent the government from in the future secretly retracting that privilege?

I think in the end we can be satisfied by nothing less than some sort of "Too Many Secrets" Constitutional Amendment, stating clearly that no private citizen can be required or compelled to partake in a "National Security" cover-up, so that everyone currently bound up in the web of lies could speak up without fear of persecution.

That is what galls me as much as anything. If the government wants to gather data and keep secrets, let them gather and keep them themselves. Drafting people against their will into compulsory service in signals-intelligence, forcing them to lie to their loved ones and the world, and persecuting them for honesty, is absolutely amoral.

bo10242• 13 years ago

Good point. If they can force companies to lie about the existence of FISA requests, why wouldn't they force them to lie about the number of such?

kvb2• 13 years ago

What lies have companies told?

DannyBee4• 13 years ago

[citation needed].

Again, i have seen this in argument after argument. Nobody has yet provided any legal authority that states it is constitutional or legal for the government to compel forced lies. They can compel silence, for sure.

There is plenty of authority in other contexts (IE not national security), that the government cannot compel you to speak misleading or non-truthful information.

I wish this idea that everyone must be lying because the government can legally, force them to, would stop.

I imagine someone started with the NSL gag orders, which compel silence, and then just started saying they compel you to lie instead (which they don't).

In fact, even the compel silence part of the NSL was found unconstitutional.

pvdm• 13 years ago

The seed of doubt has already been planted. Sorry, I am looking to secure my data and will not trust any third party ever again.

mrschwabe2• 13 years ago

Who cares people? The gig is up on Google. They are in PRISM. Instead of upvoting every piece of Google PR we should be ignoring their rhetoric and distancing ourselves from this company; and the other 9 implicated in PRISM.

Secret partnerships with government agencies is detrimental to free market capitalism and goes against the true spirit of entrepreneurship.

anoncowardftw• 13 years ago

So I'm a bit confused. Google has been happily complying with NSA without a care or concern in the world. Now some news leaks that they have been.. Happily complying with NSA without a care or concern in the world.

So they release an "open" letter trying to redirect the masses attention, and I'm not a little shocked it's working. People are actually praising Google? WTH? If Google really cared this letter is like 5 years too late doncha think? Google cares about one thing! That they got caught not giving a crap about the privacy/rights of their customers.

News Flash, they still don't give a crap. But hey, if losing gmail, google+, picasa, blogspot, drive etc. would just cause your world to fall apart, then keep using it and just be honest that you don't give a crap about your privacy or rights any more than Google does.

mrschwabe2• 13 years ago

The sad thing is that this letter is currently frontpage/top of HN. The #1 most important company implicated in this NSA leak; the very company accused of co-operating & enabling the NSA's intrusive violation of our privacy - is now enjoying this great exposure at the top of HN as 'hackers' eat it up.

wutbrodo2• 13 years ago

So they release an "open" letter trying to redirect the masses attention If Google really cared this letter is like 5 years too late doncha think?

You should read the news occasionally. Google has been publishing a Transparency Report since 2010, and has been expanding it since then. Not quite 5 years, but more than long enough to render your comment paranoid nonsense.

aresant• 13 years ago

Traitor or not, you can't argue with the fact that Ed Snowden just gave Google, FB, Yahoo, MSFT, etc fighting ammunition to at least address these issues with the government publicly, and for that I am thankful.

furyofantares• 13 years ago

Google has nothing to hide.

Strange phrase to put in there.

hoytie2• 13 years ago

I suppose it would be nice to know how many FISA requests there have been, but what does the number of requests have to do with the core issue? Is the number of FISA requests in proportion to the amount of data being shared? Does it tell us the nature of what is shared or how it is shared? We still know nothing about the contents of legal FISA requests and therefore can't really say whether a single request violates our rights or not. Publishing aggregates tells us essentially nothing because we still don't know the limits of a request, or at least I don't.

javyerderderyan• 13 years ago

Too late...

malandrew2• 13 years ago

Please also request tagging for each of the requests. e.g.

    2013-07-12
        Foreign National
        Drug Related - Cocaine
    2013-07-18 
        US Citizen 
        Drug Related - Marijuana
        Request from FBI
    2013-07-22 
        Foreign National
        Terrorism Related
    2013-08-01
        Foreign National
        Industrial Espionage

I think it's really important that we know how many of the requests have to do with the existential threat of terrorism, since that is the example the administration and Congress keep using to justify these actions.

The more metadata the better. If they want our metadata, it's only fair that we get their metadata too, to be able to keep tabs on their actions.

malandrew2• 13 years ago

I would also like to see Google and other companies specifically fund counter-surveillance technologies, like end-to-end human friendly encryption.

I would love it if Chrome came with a GPG chrome extension that worked with Yahoo Mail, Gmail and other popular webmail clients right out of the box. Mozilla should also have a plugin that comes preinstalled for this.

The limiting factor in adopting end-to-end encryption in email is network effects. Preinstalling GPG support in browsers is half the battle.

taktix• 13 years ago

Google's statement is too stuffed with presuppositions and it comes off as manipulative, at least to me.

If it wasn't for this earth-rattling leak, Google would still be merrily handing over my emails to the NSA. Fail.

hoytie2• 13 years ago

I'm really curious what they intend to share as what they describe as the scope of the requests.

spinchange• 13 years ago

Now, THIS is deserving of a White House petition.

return0• 13 years ago

Are they allowed to disclose the nondisclosure order?

TomGullen2• 13 years ago

Googles lost my trust. To my newly discovered emabarassment I naively and passionately defended them amongst my friends for several years. Seems like if a company gets big enough it's ethical demise is a certain inevitability (yes, I'm a little late to the party). What a pathetic untrustworthy world I find myself now living in.

o0-0o• 13 years ago

Why doesn't the government just profile. We all know who the terrorists are.

Lost_BiomedE• 13 years ago

Really, this is exactly what I expect of people wanting to do the right thing when in between a rock and a hard place. I imagine this is what I would do if sincere and in their position.

Thanks Google.

etherael2• 13 years ago

From here on in this is the only privacy model I will consider trustworthy for a cloud service;

You have the encryption key, the data on our servers is completely useless without that encryption key. We are physically unable to be compelled to comply with any orders to violate your privacy from anyone.

The only example of a cloud service I can think of that matches this off the top of my head is spideroak and tarsnap, perhaps also the new torrent sync? I'm not entirely certain how that works but I do recall a client side crypto key being involved in there somewhere?

plywoodtrees3• 13 years ago

You can use things like Duplicity which locally encrypt backups and then store them to arbitrary cloud services.

The problem is, if the data is opaque to the cloud service, it is very hard for it to do anything other than passively store and retrieve it, at which point it is not really a cloud service at all.

And even then: they can give logs to authorities showing what you accessed when and from where, they probably know your credit card and billing details.

etherael2• 13 years ago

I have an 8gb truecrypt file on dropbox, pretty much regardless of what they're compelled to do, it's secure. That's the model I think should be standard for cloud ops.

However, you do bring up an interesting point, it is indeed harder to do "useful stuff" when the store is untrusted and has no idea what it's holding, string searches et al become pretty much impossible generally speaking, big bummer there.

Perhaps this will be a good accelerant for the adoption of homomorphic encryption algorithms?

annnnd• 13 years ago

Smart response. Very smart. Damage control at its best: "How we wish we could tell you that it's not so bad as you think it is... but government won't let us... Government, pretty please?"

They just put the spotlight on Administration, which of course won't allow it. Smart.

wmt• 13 years ago

"Assertions in the press that our compliance with these [FISA] requests gives the U.S. government unfettered access to our users’ data are simply untrue."

What about the non-FISA requests, has any of them given the U.S. government unfettered access to user data?

What does unfettered mean? "You only can access all user data for 2 hours" "You need to specify (through tickboxes?) all the user data you wish to download to PRISM" "You only access all user data of all German users"

patrickmay• 13 years ago

Asking is far too polite. Every citizen, not just Google, should be demanding the end to these secret orders and secret courts. The government is supposed to be our servant, not our master. We need to start treating it appropriately.

Ziomislaw• 13 years ago

the first question anyone should ask themselves is - how do you know they will tell the truth? they might be forced by their police state law to pretend the numbers are low and you have no way to be sure. you can not trust any company based in Police State of America, everything they tell you might be because law requires them to.

Asking the U.S. to allow Google to publish more national security request data

Related Stories