Google’s Real Secret Spy Program? Secure FTP

http://www.wired.com/threatlevel/2013/06/google-uses-secure-ftp-to-feds/

by smaili • 13 years ago

116 46 13 years ago

wired.com

drivebyacct22• 13 years ago

Thank god it's "secure". FTPS or SFTP, dare anyone ask?

switch33• 13 years ago

Hey man. NSA stands for No Such Agency.

And SFTP stands for secure for NSA file transfer protocol, cause they are cool katz apparently.

drivebyacct22• 13 years ago

Congratulations, that's the first time I've managed to laugh about PRISM in the last week.

WestCoastJustin• 13 years ago

ZDNet.com reported in 2010 [1] (and others [2]), that when Google was hacked via suspected chinese hackers, that their "internal spy system was the target".

...they [hackers] apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press. "Right before Christmas, it was, 'Holy s!@#, this malware is accessing the internal intercept [systems],'" he said.

I guess this could be the system that google uses to compile the data before transmission, or something else, but none the less, it does raise questions.

[1] http://www.zdnet.com/blog/foremski/googles-internal-spy-syst...

[2] http://www.informationweek.com/security/attacks/google-auror...

rasterizer2• 13 years ago

I assume they need to know what data to send; the "system" might refer to the database with FISA orders.

gwgarry• 13 years ago

Or it could mean Google is lying or just trying to create rhetoric to confuse the public to keep them from looking for alternatives to their search engine and other services.

magicalist• 13 years ago

Isn't that referring to this: http://arstechnica.com/security/2013/05/chinese-hackers-who-... ?

which appears to have been a list of people that had been targets of "surveillance orders", which would have given the Chinese intel on any operatives that were being watched by the US, but isn't the "backdoor access system" that Schneier said it was at the time (seemingly without a source, but it's hard to tell as he doesn't say where that information comes from and no one else seems to have picked it up subsequently).

I swear that that ars story had an HN thread (maybe the washington post source article did?) but I can't find it now.

betterunix• 13 years ago

Ah, well, glad that is cleared up. "We never give the government direct access to our systems, nor do we have a server set up for them to obtain copies. Instead, we just use scp to send the data directly to the government's systems! Trust us, we respect your privacy while we do this -- it's even encrypted!"

cromwellian2• 13 years ago

Google never said it doesn't send data on user accounts when proper legal warrants are served, it publishes these facts in the yearly Transparency Report.

What people were worried about, a "dragnet" that allows arbitrary access and intercept of any user data by the NSA turns out to be false.

Unless you think you can use SFTP to upload, in real time, all traffic on Google services.

felisGoodman• 13 years ago

If the NSA can request data on 'suspects' at will from Google, how is that functionally different from a dragnet? Arbitrary data could be collected via phone records, then email/user data could be requested from Google/Facebook based on 'suspicious activity'.

I bet that the bombshell disclosure will be that these 'proper legal warrants' are actually just arbitrary requests justified via the Patriot Act or similar.

cracell2• 13 years ago

Google continuing to deny that their is a dragnet is not evidence that their is no dragnet. If there was a dragnet it is very likely that they legally are not allowed to admit it as per terms of the court order.

There's nothing Google could say or do to clear their name on this. The NSA, Congress or the Executive branch need to detail the level of access and the form of access that the NSA has to Google's information in order to clear Google's name. Even that unfortunately has to be taken with a large grain of salt.

There's simply too much information pointing towards mass surveillance with assistance from US companies to believe what the companies themselves say. This is a shitty position for Google to be in but consumers didn't put them in it, the US government did by admitting to the PRISM slides being correct without detailing how the companies mentioned on them are involved.

rasterizer2• 13 years ago

How else would one comply with data requests?

mpyne7• 13 years ago

Print out a bunch of QR codes and FedEx it, I guess.

bitwize2• 13 years ago

Look, you either install the special bugging equipment -- and deny that it was ever installed -- or you find that you are suddenly guilty of wire fraud, insider trading, tax evasion, or similar.

astrange• 13 years ago

Your post is not obviously connected to anything that's happened in reality. That is, you're just replying to Google's claim with "they're lying" but giving no way to move the argument forward. How do you plan to test this?

crgt• 13 years ago

Your parent post may be referring to what happened to the CEO of Qwest after declining to support the surveillance state.

https://en.wikipedia.org/wiki/Joseph_Nacchio

wahnfrieden• 13 years ago

Hate to leave irrelevant comments, but gawd Wired is annoying on mobile. That header just continuously jumps in and out senselessly as I consume the article, very distracting.

brown9-22• 13 years ago

What is confusing to me about this idea is that it would seem as if Google would then only be passing over past data for the requested account.

Since FISA is all about active surveillance and wiretaps (of phones when it was written in 1978), wouldn't the government also want a way to watch activities in online accounts in realtime?

spartango• 13 years ago

It's worth looking into FISA (and the DOJ interpretations of it) to see if the court can approve requests for user credentials/tokens. This would give intelligence officers more continuous access to user data, though they would still be legally limited to the time period approved by the court.

mpyne7• 13 years ago

With a frequent enough update cycle there's no reason it can't be close to real time. The government's systems could then use inotify or some other filesystem watcher to automatically reload the page when new data comes in over SFTP.

brown9-22• 13 years ago

If this is the case, then Google's assertion that it's just SFTP seems a bit meaningless.

tlrobinson• 13 years ago

Providing descriptions of how they comply with these requests is a good start.

However, they should be even more specific. A skeptical person could say this still leaves the door open to, say, a custom SFTP server that gives the NSA access to any user data. I don't believe that's the case, but I think they should provide more detailed procedures for exactly how they comply with these requests.

e.x.

"The following procedure is the only method by which we provide data to law enforcement:

1. When we receive a request for user data from law enforcement, our legal department thoroughly examines the request to ensure it's legitimate, not overly broad, blah, blah, blah.

2. X person performs Y steps to extract the specifically requested data from our data stores, with Z safeguards to assure no additional data is included.

3. The legal department reviews the extracted data to ensure it matches the requested data, and only the requested data.

4. X person sends data to law enforcement agency using Y methods (i.e. uploading data to a SFTP server account) and notifies the agency that the request has been fulfilled."

drsim• 13 years ago

This is what they're dancing around, instead releasing tidbits of info that make it look as if it's not as bad.

Just because the transfer mechanism is sftp doesn't matter. My supposition is that prism is an auto-importer of these files: able to parse the data formats from these companies and present it to agents in their database UI.

Prism: import.io for anyone's data?

JeanSebTr• 13 years ago

So no Plug&PLay device installed at Google by the NSA? Even so it would be so easy to install a generic program on Google's servers to make live query on any dataset. Google probably use SQL everywhere right?

Seriously, these conspiracy theories are simply impossible most times.

ErikAugust• 13 years ago

"Photoillustration: Kevin Poulsen/Wired"

Anyone else find humor in this?

nikcub• 13 years ago

Google continue to deny, rather than explicitly explain why their name is mentioned as a partner in an internal NSA document.

A remaining explanation that matches all the known facts right now is that PRISM is a data format or data standard. It makes the process more efficient since it doesn't require the NSA to adapt disparate data sources from different web companies.

One of the other slides mentions that this is a big problem for SIGINT at NSA. PRISM being a data standard would also explain why the program only cost the NSA $20M.

The difference between the tech companies participating in the program would be how they implemented it - perhaps Google push the data to the NSA but it sounds like other participants let the NSA pull the data (or they store it on a third server which the NSA retrieves from - the lockbox).

Also, saying that the requests are 'legal' isn't reassuring, since a large part of the recent NSA revenlations is the world finding out just what the Obama administration considers to be 'legal'.

Legal means nothing more than finding a government lawyer who will write an opinion that blanket metadata requests or pulling or pushing data from Facebook and Google is legal. The opinion is classified, the court arguments are classified, there is only the government at the court and it is presented to a judge who is appointed by the government.

Exact same thing happen with John Yoo and his legal opinion that the torture the government was carrying out was legal[1]. When the rest of the world found out just what the government considered legal, it very quickly became illegal.

[1] http://en.wikipedia.org/wiki/Torture_Memos

McGlockenshire• 13 years ago

Google continue to deny, rather than explicitly explain why their name is mentioned as a partner in an internal NSA document.

Assuming that PRISM is the mechanism by which FISA requests are fulfilled, they can't discuss FISA requests in the open without breaking the law.

jellicle• 13 years ago

Well, John Yoo authored his torture opinions in 2003. They were only really repudiated in 2009, when Obama took office. That's not "very quickly", in my book.

grandalf• 13 years ago

Recall Wired's role in the Bradley Manning case. Regarding Wikileaks, Wired has consistently acted as a propaganda voice for the US Government.

As a result I'm reluctant to take this article with more than a grain of salt.

Google’s Real Secret Spy Program? Secure FTP

Related Stories