On Confirmed Assumptions or, Not Trusting Google is a Good Idea

by __hudson__ • 13 years ago

382 219 13 years ago

__hudson__2• 13 years ago

I wonder if donating to wikileaks or even sending an email to wikileaks offering to volunteer would be enough to interest someone in government in getting all your 1's & 0's.

smokeyj• 13 years ago

Yes, along with picking your nose and tying your shoes -- but that should only matter to a coward.

__hudson__2• 13 years ago

I wasn't trying to sound paranoid or cowardly. I was just curious what opinions people had on the level of involvement with Wikileaks that would be enough to get the governments attention.

marshray• 13 years ago

email to wikileaks offering to volunteer

It's hard to imagine anything more interesting to the NSA, but for not just the obvious reason.

Wikileaks set itself up as a nexus of exchange for state secrets of a great many states. Any state with an intelligence operation would want to penetrate that organization to have access to raw data and advance notice of anything interesting about to go down.

I've often wondered if such organizations (not naming names) ever wondered why they get approximately one volunteer from each European nation.

signed02• 13 years ago

If Google has records of all emails that have been sent and deleted, presumably even if you don't have a Gmail account the government could ask Google for all emails that had ever been sent to your account.

Just as the Syrian government is unlikely to be able to get Google to give them information on particular dissidents, it would be wise for American activists to choose a email provider that is not located in the United States.

coolhandluke3• 13 years ago

Indeed. Once I manage to anonymously acquire some Bitcoins, I will be looking for a reputable VPS host based in Europe (that I can pay with Bitcoins) where I can run my own mail system.

sneak7• 13 years ago

Why, so that all the emails you send and receive can go right back to american PRISM partners? There's little point to that when everyone you email uses gmail.

dmix2• 13 years ago

I recommend https://countermail.com/

tantalor• 13 years ago

Presumably the same justification/reasoning could be used to serve a home/business search warrant.

daviddoran• 13 years ago

Would a judge approve the warrant though? Just because this person communicated with Assange?

betterunix7• 13 years ago

Gee, it sure would be nice to know what happens at a FISC hearing...

burntsushi4• 13 years ago

That might be the case. But you'd know about it. And why.

magicalist5• 13 years ago

You would know about it, but the warrant can still be sealed if it "is necessitated by a compelling government interest", so you can no idea why it was being done.

In theory you can get this reversed, but it is common for courts to uphold the government's interest in keeping investigations secret well beyond normal disclosure dates, in a few cases even up to and during the trial against the person who was served the warrant.

Semiapies• 13 years ago

"Not trusting" in this case is more of an operational than moral/ethical judgement, and more general than Google - you can't rely on privacy from any company if the government can send them a letter saying, "Gimme everything on this guy, bitches."

And, well, if you don't want to run to Hong Kong, you're pretty much the government's bitch in that circumstance...

rasterizer2• 13 years ago

Abit harsh on Google. I mean what are they to do?

betterunix7• 13 years ago

Maybe engineer a service that is harder to wiretap? It is not easy, but they have some of the best computer scientists on this planet working for them. If I were them, I would start somewhere around here:

http://crypto.stanford.edu/adnostic/adnostic.pdf

walls• 13 years ago

Wire tapping is completely irrelevant to the question.

tptacek7• 13 years ago

It's not directly apropos this particular thread, but Google has engineered an email service that is particularly difficult to wiretap. To wit:

(a) They're the Internet's foremost adopter and proponent of DHE ciphersuites, which drastically reduce the impact of losing the RSA key that underpins most site's TLS security, and, just as importantly, forces adversaries to actively MITM every connection in order to decrypt them.

(b) They're a pioneer in key pinning, which bakes the identity of their key into the Chrome browser binary, meaning that when your Chrome browser talks to Google's mail service, it's unlikely to trust any otherwise- valid- looking certificate presented by a MITM attacker.

Google's mail service is better encrypted than most banks.

embolism28• 13 years ago

Google's business model is to tap your communications and use the profile they create of you to target advertising.

They are constantly pushing for access to more of your personal information, not less.

acdha• 13 years ago

Maybe engineer a service that is harder to wiretap?

You can't solve a legal problem with engineering. We're talking about the same agencies who had the ability to get all of the major phone carriers to install wiretapping services – there's no reason to believe they wouldn't do the same to anyone else of interest.

jwr• 13 years ago

Die. Lose to a competitor that is based in a free country and/or offers a paid service and therefore does not need access to the entirety of people's data to serve ads.

mtgx• 13 years ago

They keep the deleted e-mails too? So even if you want to escape that 180 days law that says after 180 days it's free for all for authorities to get your e-mails, then deleting them before that time passes won't do you much good.

So basically the authorities will have access to your e-mails anyway. It's just that they won't get them in the first 180 days. And of course this just applies to police/FBI, as NSA can get them from the day you sent them.

signed02• 13 years ago

Not necessarily. Just because the government asks for them doesn't mean they exist. I'd be surprised if they were actually deleted though.

gohrt3• 13 years ago

Google doesn't 100% say that the data is totally totally gone, but seems to say that it is no longer indexed for lookup by your accounr, after 60days after deletion: https://support.google.com/mail/answer/7401?hl=en

rasterizer2• 13 years ago

They didn't say they keep deleted mail, could be boilerplate warrant language.

thrownaway24242• 13 years ago

Google's chairman has publicly stated that Google deletes things when you ask for them to be deleted. Video here starting at 4:00 mark and relevant discussion ending at around 5:45.

http://video.foxbusiness.com/v/3899047/google-ceo-recession-...

coolhandluke3• 13 years ago

as NSA can get them from the day you sent them.

I wouldn't be surprised if the NSA didn't have the e-mail captured, sorted, and analyzed before it's processed on the receiving end and shows up in the user's mailbox.

drivebyacct24• 13 years ago

basically the authorities will have access to your e-mails anyway

How is this not the wide assumption being made right now? How is there ANY question remaining of whether or not they have such access?

digitalengineer4• 13 years ago

"Google is, however, allowed to tell me what account is involved, and I can do whatever I want with the information Google gave me"

So Google was allowed, not required. Looks like they did the right thing by at least telling OP what they were forced to do. Shouldn't the title be "Not trusting your Government"?

kybernetyk2• 13 years ago

Maybe "not trusting Google with your data" would be a better fit.

digitalengineer4• 13 years ago

How about "not trusting 3rd party with your (unencrypted) data"?

notaddicted• 13 years ago

The author doesn't anywhere claim to be a US citizen, so it probably isn't his government.

digitalengineer4• 13 years ago

Good call. Just assumed it was, my bad.

dlss• 13 years ago

It's both. If you are going to use a cloud service, you have to trust both the provider and the government where they operate.

(With the exception of things like tarsnap).

cube13• 13 years ago

(With the exception of things like tarsnap).

The chain of trust still extends to them. You're trusting that they're actually doing everything they say they're doing.

If you don't own the hardware and the building where the hardware is, you have to trust that they're doing everything you want them to be doing.

eliben• 13 years ago

No, because blaming Google is trendy lately and will bring more traffic to the site.

andrewljohnson• 13 years ago

Google should invent a distributed, encrypted email protocol and make that network an option in GMail for storage and message sending. That would be a great PR move - if there is no central server, and no central message pipe, it's a little hard for anyone to think Google wants to be complicit in spying.

embolism28• 13 years ago

That would be the antithesis of what Google does - they give away services for free in exchange for access to personal information that they use to sell more precise targeting to advertisers.

Google's business relies on them being able to examine your personal data. That's how Gmail is paid for.

Perhaps someone who has a different business model e.g. Samsung, Microsoft, or Apple should do this.

sp332• 13 years ago

Google already offers paid email accounts that don't show ads.

jmillikin14• 13 years ago

How would you implement a secure web interface to distributed encrypted storage? The moment a user wants to view email in their browser, it needs to be decrypted by Google's server (or decrypted by Javscript served from Google's server, which is equivalent from a security perspective).

For users who are willing to give up the web interface, there are many open-source email clients that provide strong encryption (e.g. Thunderbird + GPG).

embolism28• 13 years ago

The web is simply not designed with privacy in mind. People should stop using webmail.

throwaway100012• 13 years ago

Expect that Google wants to read what you wrote on the email and to whom. Of course to help you see more ads, er better ads. Cause you're just dying for another dozen ads.

Imagine a Google Glass wearer and a NSA order to record everything he sees?

jkrems4• 13 years ago

Well, it would be possible to make the ad-thing part of displaying the message. That's the moment when you have to decrypt it anyhow.

gohrt3• 13 years ago

That wouldn't be Gmail in any sense. Why would google be involved in that product -- they dont' provide the server, the delivery, the spam detection (right?)

If you dont want to use Gmail for some or all messages, just don't use Gmail.

emiliobumachar2• 13 years ago

They could provide all the client software. Hell, they could even make ad targeting work by moving their mail-reading bots to the client and have them select ads from a stack of mothership-provided ads, with no feedback except following the link if you click.

But I agree with you that it's very different from anything they do. Also, too vulnerable to piracy or cloning. Aaand it may not be feasible to run their bots in a weak machine.

emiliobumachar2• 13 years ago

Not counting monetization, the main difficulty with implementing true privacy - from the provider itself - of web services is the necessity to cut the "account recovery" feature.

When the provider can't access your data, if you lose your password, all of your data is gone forever. If you are willing to live with that, alternatives already exist, as others pointed out.

sneak7• 13 years ago

There already is a distributed, encrypted email protocol. That's what gmail uses.

Trusting "someone" on a distributed network to store information for you long term isn't a good idea. They disappear and your data is gone too.

Also, if you can find them to request the data, a search warrant can find them to request it, too.

Also, crypto doesn't help. It would be foolish to assume gmail messages aren't encrypted on disk. The keys have to be stored somewhere. End users can't and won't securely store key material. Store them on the server, and it's subject to the warrant.

throwaway100012• 13 years ago

Google shouldn't be trusted with everything you have. Between Analytics, Android, Google Search, Documents and E-mail they know what you are thinking and virtually everything you do, online and offline. Even if the current management are saints--I doubt it--the next team will push the envelope to monetize it even more. And then there is the NSA and FBI and the local divorce lawyer. If it's there they will get it.

So try things like blocking analytics at host level, using either gmail or search etc etc. Makes it harder for NSA. Can you imagine yourself in a trial trying to explain why you visited certain sites or searched for certain keywords 3 years ago? Were you really researching what you saw on CSI or were you preparing the perfect murder of your wife?

burntsushi4• 13 years ago

This just seems like a variation of the argument that you should get out of the way of the bullet instead of demanding that the gunman not shoot you in the first place.

I should be able to give whatever data I want to Google without worrying that the government is going to take it from Google in secret.

embolism28• 13 years ago

That is a laudable and idealistic goal, but we don't live in that world. Furthermore Google itself knows more than we do about how easily governments can access the data it accumulates.

If it chose to, Google could protect users by developing services that do not rely on Google itself examining their personal data.

Google understands the risks better than its users but chooses to expose them because doing so is aligned with its business model and philosophy whereas protecting them is not.

It's a bit like recommending someone travel through a war zone on a bicycle when a tank is an available alternative, because the bike carries advertising you profit from and the tank does not.

mpyne12• 13 years ago

Given the advance of Big Data (outside and inside of the government), it sounds to me like a variation of the argument that there's a reason people lock their car doors if they have valuables. Yes, people shouldn't steal from you, but if you really wanted those valuables then a wee amount of due diligence towards risk reduction wouldn't kill you either.

In a perfect world we wouldn't need locks at all, either on our cars or our houses. But when the world is not perfect then sometimes it becomes more reasonable to abate the risk ourselves than to shout at the whole world to stop being imperfect.

gnosis3• 13 years ago

Google is spyware.

This has been obvious for a long time.

Most other "free" web services aren't much better.

It's sad that it's taken so long for people to start realizing and caring about this, but better late than never.

kostya-kow• 13 years ago

Most other "free" web services aren't much better.

Most non-free web services are equally happy giving away your data to the government. Apple, MS and all the other companies are no better than Google.

And Google is not the problem -- it is just a symptom. The problem is the government that does not respect the rights of people.

gnosis3• 13 years ago

My use of the term "free" was not intended to imply that "non-free" web services were any better.

I used the term to highlight that what most people consider "free" web services actually have a price.

That price is usually your privacy.

roderick3427• 13 years ago

I completely agree with you.

magicalist5• 13 years ago

What paid web service based in the US (or in a country with applicable data sharing laws) is going to refuse all search warrants for you?

Maybe you were looking for "Most other web services not in Iceland aren't much better"?

icebraining5• 13 years ago

Complying with search warrants would not be nearly as problematic if Google didn't capture so much data about its users, or made a bigger effort to prevent itself from reading it (and hence be unable to provide it).

See http://www.daemonology.net/blog/2012-01-19-playing-chicken-w...

markdown2• 13 years ago

It's sad that it's taken so long for people to start realizing and caring about this, but better late than never.

LOL, you really think people have started caring about this? Nobody but a handful of techies and tech writers gives a shit.

tptacek7• 13 years ago

How, in short, is this shit valid under the U.S. Bill of Rights? I’d really like someone to explain that to me. With a straight face. Preferably without making me want to punch them in the process.

Well, he's going to want to punch me, but here's what I think(?) the answer is:

(a) He's not a US person, but instead a well-known citizen of Iceland, living abroad, and is thus not protected by the Fourth Amendment, at least to the extent that anything in the Fourth Amendment conflicts with any interest of the US.

(b) He's a person of interest in the investigation of one of the most significant leaks of national security information in US history.

ef42• 13 years ago

The legal theory that the bill of rights only applies to US citizens is dangerous and wrong.

It applies to actions of the United States government. It is a list of things they may not do.

tptacek7• 13 years ago

That's a theory that suggests all spying is unconstitutional.

randallsquared• 13 years ago

Some of the bill of rights is that, and some clearly refers to things protecting "the people". I am no constitutional scholar, but this does seem to indicate that those specific rights are rights that are intended to apply to citizens of the US.

rgbrenner3• 13 years ago

No, tptacek is right... if you are a foreigner living abroad, the bill of rights does not apply to you:

In 1957, the court changed its position, overturning decades of precedent to declare that American citizens are in fact protected against U.S. government misbehavior by the Bill of Rights even outside the country. Unfortunately for the rest of the world, the court limited its ruling to U.S. citizens. Foreigners remained stuck with the old rule that the Bill of Rights doesn't apply abroad.[0]

So US citizens are protected whether they are within US borders or abroad. And foreigners are protected if they are within US borders... but once they leave, it no longer applies.

[0]. http://articles.latimes.com/2005/dec/16/opinion/oe-raustiala...

ChuckMcM• 13 years ago

If you have the time, I really really recommend listening to the "Civil Liberties and the Bill of Rights" [1] which is available from The Great Courses (and the Sunnyvale library, possibly a library near you as well) It is an excellent introduction into how the systems works (or doesn't work) and how it evolves the interpretation of the Constitution as it applies to citizens and noncitizens alike.

[1] http://www.thegreatcourses.com/tgc/courses/course_detail.asp...

charonn03• 13 years ago

While I would prefer your stance to be correct, the Supreme Court has held that the Constitution applies only to persons within the USA. For example, Downes v. Bidwell found that "the Constitution does not apply to foreign countries [...]" [1] and that it doesn't apply to US Citizens if they are outside of the US, "[the] Constitution can have no operation in another country." [2]

[1] http://caselaw.lp.findlaw.com/scripts/getcase.pl?court=us&vo...

[2] https://supreme.justia.com/cases/federal/us/140/453/case.htm...

sliverstorm• 13 years ago

I can easily see it in a very literal interpretation of the documents though. For example, all of the amendments refer to "the people". "The people's right shall not be infringed..."

Who is "the people"? Well, the Constitution starts out like so:

We the people of the United States

aetch• 13 years ago

If you want to see how it is currently in effect, look no further than Guantanamo Bay. Non-citizens also under the label of terrorists (hint: not human) do not receive right from the US

anigbrowl• 13 years ago

That's what you may have thought it meant, or what you think it should mean, but it's not what it does mean. If you are so sure it's wrong, then it's up to you to make the argument for why, instead of just handwaving it away because you don't like it.

fnordfnordfnord• 13 years ago

It's morally wrong, but that's the way our gov't plays it.

nsomaru• 13 years ago

Regarding (a) --- I don't understand how this argument that the constitution of a country (which represents its highest thoughts and ideals) can be applied selectively (i.e., only to citizens). If the thoughts contained therein regarding the rights of human beings are indeed 'True', then surely they should apply to all human beings?

If the US insists on waiving the rights of non-citizens, despite the constitution, then it should also accept that it cannot prosecute any non-citizen for non compliance with its laws because they were not afforded the same rights.

Gotta have both sides of the coin.

B0Z3• 13 years ago

I don't understand how this argument that the constitution of a country (which represents its highest thoughts and ideals) can be applied selectively (i.e., only to citizens). If the thoughts contained therein regarding the rights of human beings are indeed 'True', then surely they should apply to all human beings?

You'll get little argument from most 'Mericans for your statement that these rights are human rights. The argument you will get is the rationality of transference. The difference between the OP and any American is citizenship and history.

US citizens of today are beneficiary to a Constitution that was crafted and bled for, over 200 years ago, with nasty war for our independence and claim to self governance. I didn't fight this battle. My father didn't fight this battle. Neither did his father. But one of the dumb-luck results of not only being born in the US to American citizens, are the benefits bestowed upon me by the war that was fought for the benefit of future generations (i.e. ME).

Now... this is going to sound really pointed and "f* y", but there's no other way to say it. Those 200+ year old men and women didn't fight this war for people in other countries, they did it for their own sons, daughters, and many generations that would come.

I agree! Those rights that were fought for should be universal human rights for every single person on the planet. But that's why you have to fight whatever government collects your taxes for those very rights on your own.

Respectfully.

leoc• 13 years ago

He's not a US person, but instead a well-known citizen of Iceland, living abroad, and is thus not protected by the Fourth Amendment

Again, that actually isn't particularly obvious in this kind of situation. The US property of non-resident aliens enjoys constitutional protection against (for example) expropriation. But there's no equivalent protection for their US cloud data? Oh Well.

On the other hand, as far as I can tell (IANAL) the fellow just got served a warrant, or at least a pretty ordinary court order of the kind that isn't related to foreign-intelligence loopholes or restricted to non-USPERSes. That's roughly the kind of thing that will happen to you in any jurisdiction if prosecutors have good evidence that you have information material to a huge criminal investigation. Maybe the secrecy or the breadth of the order was dubious. (I think it's also very likely that his GMail was scoped out with a FAA702 before the government decided to re-request the information using a means that would allow it to be introduced by the prosecution in a US court case.) But fundamentally it seems </sunglasses> he just got served ... I'll get my coat.

rsingel• 13 years ago

No, this could happen to a U.S. citizen as well. The Electronic Communications Privacy Act applies to foreigners as well as Americans.

A grand jury subpoena can get at your communications without any showing of probable cause, whether you are a U.S. person or a foreigner.

danbruc• 13 years ago

Maybe there is no need for the Fourth Amendment to apply - these rights are human rights and can be found in the Universal Declaration of Human Rights (UDHR) [1]. As far as I know the UDHR is not legally binding but there are other international laws covering the same topics as the UDHR, for example the International Covenant on Civil and Political Rights (ICCPR) [2]. Maybe a bit naive, but at least in theory I - living in Europe - should be able to sue the United States for human rights violation if the NSA read my emails without justified suspicion.

[1] http://en.wikipedia.org/wiki/Universal_Declaration_of_Human_...

[2] http://en.wikipedia.org/wiki/International_Covenant_on_Civil...

fady• 13 years ago

off-topic: you need some line-height for that post.. very hard to read.

https://www.dropbox.com/s/602d01t8ahqw1km/Screenshot%202013-...

lettergram• 13 years ago

Why not just keep all your data on your own computer? No need to have a cloud and if it's email your worried about, well, it's assured if the U.S. government wants your conversations they will get it unless you jump through some pretty large hoops.

tyrion• 13 years ago

Isn't all "this shit" in violation of the International Bill of Human Rights?

"No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." -- International Bill of Human Rights, article 12.

I also found interesting to read the "CCPR General Comment No. 16" [1] on the right to privacy.

[1] http://www.unhchr.ch/tbs/doc.nsf/(Symbol)/23378a8724595410c1...

jkrems4• 13 years ago

I think the US government showed in the last ten years that they don't care much about those "basic human rights". I'm pretty sure torture, drone killings, locking innocent people away without due process, and silencing dissidents also kind of violates the IBoHR.

pbhjpbhj• 13 years ago

I'm not saying I approve but the key word is "arbitrary". The USG would presumably say this isn't arbitrary interference as it's in the course of a criminal investigation.

thrownaway24242• 13 years ago

How, exactly, is it a violation of that? They have a warrant. It's due process.

ethanazir• 13 years ago

the gmail network effect pulls in people who would rather not be grokked.

contingencies5• 13 years ago

Right. This is why we need encryption.

mpyne12• 13 years ago

We have encryption. We need to use it.

zenbowman• 13 years ago

"I believe that organisations don’t really have a right to secrecy and I believe that the more open a society, a society where people have more information is a society where we can take more informed decisions and where we perhaps won’t need the gatekeepers that are currently in place as much" -Herbert Snorrason

If he doesn't believe organizations have a right to secrecy, then why does he believe that he is entitled to secrecy. Privacy and secrecy are the same thing, claiming to be pro-privacy but against secrecy is dishonest.

PavlovsCat• 13 years ago

Privacy and secrecy are the same thing

No, they aren't (e.g. that I want to be alone when going to the bathroom doesn't mean it's a secret what I am doing there). Even if they were, persons and organizations are not the same thing either.

Andrew_Quentin3• 13 years ago

Why don't you sue and find out?

On Confirmed Assumptions or, Not Trusting Google is a Good Idea

Related Stories