Patriot Act Haunts Google Service

The Globe and Mail has an interesting piece taking a look at Google's latest headache, the US Government. Many people are suddenly deciding to spurn Google's services and applications because it opens up potential avenues of surveillance. "Some other organizations are banning Google's innovative tools outright to avoid the prospect of U.S. spooks combing through their data. Security experts say many firms are only just starting to realize the risks they assume by embracing Web-based collaborative tools hosted by a U.S. company, a problem even more acute in Canada where federal privacy rules are at odds with U.S. security measures."

Comments

Not good enough

[Naughty Bob]

Spurning these services will mark you out for further surveillance straight away.

Have they never read Crime and Punishment?

Re:Not good enough

[Anonymous Coward]

I would, but I am afraid to check it out from the library and get added to the terrorist watch list.

Re:Not good enough

[TommydCat]

This guy spurned the services and look what happens to him!

Re:Not good enough

[grcumb]

Spurning these services will mark you out for further surveillance straight away.

'Mark you out?' The fact of the matter is, everything we transmit outside of the firewall is subject to surveillance these days. And most companies have no clue how much of their data is crossing the firewall every day.

I don't know why people are getting their knickers in a knot over Google, when the main problem lies with the US backbone carriers, who - with only one known exception - have opened their networks to constant and widespread monitoring by US security agencies. Google at very least had the guts to fight a public legal battle with the Feds over release of even sanitised data.

The story here may be the danger to companies when they bring these companies inside the firewall, but again, refusing to trust Google is a funny place to start enforcing data integrity. The plain and simple fact is that the greatest threat of corporate data leaks is from staff who, whether through sins of omission or commission, carry sensitive data on laptops, thumb drives, CDs without any protections whatsoever.

I'd like to believe that data protection regimes are so advanced in these companies that the potential threat posed by Google and other online services is the main concern, but I find that impossible to do. I have to conclude, therefore that this is nothing more than a tiny kernel of truth wrapped in chocolatey FUD-ness that PHBs and corporate counsel love so much.

Re:Not good enough

[fugue]

The "wrong book" is in the library in order to fish for enemies of the people. Sort of how Bush was on the ballot to fish for people who should never be allowed to reproduce. Only someone forgot an important detail somewhere along the way.

Privacy is an illusion

[rbanzai]

The war over privacy in the U.S. was fought during the last eight years and common people lost. Nothing is secure. No information is out of reach of any government agency that decides it wants it, and there are no legal protections. Laws are in place now to make sure that our old image of privacy can never be restored, no matter what the current presidential candidates might claim. They don't us t have that privacy back because it does not serve their purpose.

The war was fought. We lost. I don't blame people from other nations for being concerned but if they haven't already lost privacy where they live they soon will, and it isn't coming back.

Unbelieveable!

[Flakeloaf]

You mean, if I enter personal information on a free web server run by some organization whose business model is the harvesting and sale of personal information, that my personal information might not be kept private?

Horror of horrors.

How did google get singled out?

[joeflies]

ever look at the kind of data stored in an online CRM, like salesforce.com? complete sales records, every email to every client, all the product defect issues. Maybe the SEC and the IRS may decide to look at raw data and not wait for the auditor report to come back.

Only terrorists host files abroad!

[Digestromath]

In this day and age, anyone who 'hides' thier data beyond the reach of America's patriotic government data mining operations is a cut and clear terrorist! Whether it be in some dank and dusty cave in the mountains of Afghanistan, or a climate controlled secure facility in Canada.

Uncle Sam says "Do your part, keep data in America!"

When you host abroad, your hosting with Osama!

Privacy is for the unpatriotic!

Corporate Espionage?

[SuperBanana]

Many people are suddenly deciding to spurn Google's services and applications because it opens up potential avenues of surveillance.

Um, how about corporate espionage? Nothing, absolutely nothing, stops Google from harvesting everything they can get their hands on- and they have the storage systems and human expertise to do it.

Case and point: I emailed a link to a wiki I had just set up to 3 people, two of whom had Gmail accounts. A spider from Google hit the page hours before anyone else did, hitting the wiki just after I emailed the link out. There were no public links to the site, and no referral URL.

So, let's see: processing your email to show you relevant ads? Check. Processing email to feed URLs to their spider? Check. What else does Google do with your email? Wouldn't it be the greatest tool in their quivver- the "God Google"? Sit down with HipWebShit.com, then an hour after the meeting and see a)How many people search/click on links for HipWebShit b)Who from HipWebShit.com has sent gmail users email (and what it says...), c)Who is talking about HipWebShit from/to a Gmail account period (ie general "valley buz"?

Hint: why do you think Google has so many PhDs? It starts getting creepy when you realize that Google seems to work very hard to keep their employees inside the google campus as much as possible, how secretive their operations are (seriously, nobody can compete with them anymore- it's not like they're guarding the henhouse for competition reasons) and how cult-like the atmosphere is...

Re:Corporate Espionage?

[hxnwix]

It starts getting creepy when you realize that Google seems to work very hard to keep their employees inside the google campus as much as possible, how secretive their operations are (seriously, nobody can compete with them anymore- it's not like they're guarding the henhouse for competition reasons) and how cult-like the atmosphere is More sympathetically: if you keep the workers at work, they work more. However, I can't discount your view completely. Perhaps they really are preparing their worker bees for the transfer to the comet hale bop UFO, and if you are correct, they'd want to hold those workers close to their incorporeal breast so that word of this lunacy doesn't spread beyond the compound confines.

I emailed a link to a wiki I had just set up to 3 people, two of whom had Gmail accounts. A spider from Google hit the page... Oh my gord. They sent a digital arachnid!?

Hint: why do you think Google has so many PhDs? I don't know. Because they're employing Dr. Evil(s)?

Re:Corporate Espionage?

[PS3Penguin]

Or .. its how the gmail anit-smap system tries to find and filter out spam / virus links by tasting what links are sent to gmail recipients and looking for known exploits / spam / etc. Sorry if that was tin-foil-hatted enough :)

Re:VIRUS ALERT

[Anonymous Coward]

This has a spoofed link whose structure identical to this post http://science.slashdot.org/comments.pl?sid=496946&cid=22837250 which, when clicked on, downloads a virus, brings up dozens of pages in Firefox in seconds and tries to use mailto: BEWARE curious people.

Re:PGP

[Digi-John]

yes, sTeganogRaphy seems like a good idea to me... perhaps we coUld even embed SecreTs iN Our messages ON slashdot or somEthing...

Re:"Patriot" act

[Sperbels]

All they have to do is shout "Think of the children" or "We need this to fight terrorism" and the majority who have no interest in delving into the consequences of any given action will line up behind them like good little citizens. That'll only work for so long. Then they'll need a new boogey man to scare the shit out of everyone. It's almost amusing sometimes to watch old movies to see how our nation's top boogey man evolves... right now I'm thinking of Back to the Future. During that era, the boogey men were Libyans. They used to be Russians, and Germans/Japanese before that, and now it's Al Qaida. Is there ever a time when we don't single out someone as the enemy and use them as an excuse to gain more control of the domestic population? I guess I just hate freedom...don't listen to me.

Re:Don't keep logs

[AHuxley]

Its the NSA at the choke points of google's wonderful optical roll out that should have most of you thinking a bit harder.
Google wants to play nice in Asia, the NSA upgrades in Hawaii.

http://cryptome.org/google/kunia-us.htm

Re:I Propose

[protolith]

I propose Google Subpoena Gpoena - A searchable database of all of the gov't data requests and all associated legal documents, especially what is being requested and why.

The snooping would be greatly curtailed if there was no anonymity for a snooping govt. If every request was made naked in front of the teeming millions only the most vital info requests would occur.

Request for serches from machine No 000.000.000.0000 in relation to ongoing criminal investigation associated with charges of ... ... ... ... would seem legit.

Request for all machines that searched for "TSA" , "Liquid" , and "explosive" for ongoing terrorist investigation would suddenly seem quite dubious without better specifics.

No rule of law with data hosted in the US

[farbles]

The trouble here is not Google, it is the fact there is no longer the rule of law with regards to data hosted in the United States. When the government can take any information they like from a server hosted in their country with no warrant, no notification, no nothing, then it's not law, it's criminal activity no matter who does it.

Here in Canada this has been a big deal now for the last couple of years. I've been at many IT meetings where tracking down what was hosted on US-based servers and removing it back to Canada has been on the agenda. We're not perfect here but we do have PIPEDA, the protection of privacy act, binding our ISPs. You need access to data, convince a judge and get a warrant. That's the rule of law.

That this US government data free-for-all has not been a big deal to American sysadmins has been a source of more than a little concern and confusion to us here north of the border. As long as there remains an Emperor in the White House rather than a President I guess there will be no movement on this.

Erased White House email, backups, and hard drives without penalty despite a legal court order? That's some government you guys have running there. You might want to do something about it.

Re:Tragically PGP is too hard to use

[Zatar]

It's not just hard to use, it's also ugly as hell. I thought about starting to use PGP again recently and just using it for digital signatures makes my email nearly unreadable never mind using actual encryption. Here's a nice one-line email:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey dude, how's it going?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFH6CrifPJd VEzW7qwRAs8fAKCSg8j qWO8zfHpIrNKJ zBtrHF54UwCfQWhO
lGZk7Ys4hl e1OqxyEuHn1EY=
=izSS
-----END PGP SIGNATURE-----

If I sent this it a non-geek they'd probably go WTF? and tell me my email program is broken.

It would need to be transparently integrated into all popular email programs so that no one actually needs to see the code in their inbox. An argument could be made that in the long run PGP has actually made the problem worse by allowing email vendors to punt on the concept of encryption and just tell users "if you want encryption use PGP" instead of having to develop an integrated solution that actually works well enough for mass adoption.

Are they just NOW figuring that out?

[erroneus]

I'm rather surprised more aggressive measures to circumvent US communications and all other paths of commerce and communications haven't been attempted. Wanna do warrantless wiretaps on foreigners? Fine. Watch the foreigners build new lines of communications that do not connect to the U.S. Wanna log, fingerprint, probe and scan all foreigners who happen to fly over or through the U.S.? Fine. Watch the foreigners start to build airports in Mexico and Canada to avoid U.S. soil. Wanna monitor and observe all foreign commerce through U.S. banks? You get the idea.

At some point, the rest of the world will tire of these policies and take step to make the U.S. less relevant.

This could work

[fv]

I agree that exposing the extent of this could definitely help. When I received multiple FBI subpoenas in 2004 for Insecure.Org web logs, I notified Nmap users and it was posted to various web sites, including Slashdot.

After all of that press four years ago, the subpoenas stopped and I haven't received another one since. Maybe it is just a coincidence, but I'm happy about it nonetheless.

In other Nmap news, version 4.60 was just released. You might want to download it with Tor though, just to be on the safe side in case the subpoenas resume :).

-Fyodor