Google's Encryption Plan To Stifle NSA's Dragnet Will Raise the Stakes

CWmike writes "Google's strategy for making surveillance of user Internet activity more difficult for U.S. and foreign governments — started last year, but accelerated in June following the NSA leaks — is as much about economics as data encryption, experts say. Eric Grosse, vice president for security engineering at Google, told The Washington Post: 'It's an arms race.' The crux of the issue with Google making the NSA dragnet harder (knowing if the government wants in, it will get in) is that the NSA evaluates the tactic it uses by weighing the cost with the value of the information obtained. However, the agency does evaluate the tactic it uses by weighing the cost with the value of the information obtained. 'The NSA has turned the fabric of the Internet into a vast surveillance platform, but they are not magical,' Bruce Schneier, a renowned security technologist and cryptographer, wrote in The Guardian. 'They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible.' The NSA's capabilities for cracking encryption are not known outside the agency. However, the most secure part of an encryption system remains the 'mathematics of cryptography,' Schneier said. The greater weaknesses, and the ones mostly likely to be exploited by governments in general, are the systems at the start and end of the data flow. 'I worry a lot more about poorly designed cryptographic products, software bugs, bad passwords, companies that collaborate with the NSA to leak all or part of the keys, and insecure computers and networks.' Is this about citizen's rights, or a business decision (some might say an existential issue) for Google? Does it matter, and will it make a difference?"

Comments

Arms race

[udachny]

Eric Grosse, vice president for security engineering at Google, told The Washington Post: 'It's an arms race.' The crux of the issue with Google making the NSA dragnet harder (knowing if the government wants in, it will get in) is that the NSA evaluates the tactic it uses by weighing the cost with the value of the information obtained.

- yeah, it's an arms race alright. It's a kind of a race where if Google doesn't give the NSA what NSA wants, Google's employees and management will find itself on the wrong side of a gun.

Re:Arms race

[fuzzyfuzzyfungus]

Eric Grosse, vice president for security engineering at Google, told The Washington Post: 'It's an arms race.' The crux of the issue with Google making the NSA dragnet harder (knowing if the government wants in, it will get in) is that the NSA evaluates the tactic it uses by weighing the cost with the value of the information obtained.

- yeah, it's an arms race alright. It's a kind of a race where if Google doesn't give the NSA what NSA wants, Google's employees and management will find itself on the wrong side of a gun.

You might be underestimating the influence of the 'lobby furiously' step in American politics:

Team Google, or anybody else with nontrivial US presence(or who we feel like bag-n'-dragging, which we do sometimes), can't resist legal force; but if they can resist covert surveillance, they force the spooks to go to congress (Gen. Alexander's star trek paraphernalia and all) and slug it out with the representatives of all the major technology companies who are missing out on sweet foreign contracts because of (accurate) perceptions that they are the US government's little stooges. That isn't unwinnable; but it's a lot less comfortable than just slurping packets in the shadows, or basking in the warm glow of misplaced public confidence that you only go after 'bad people'.

It's not as though the civil libertarians can win this (either the legislative flavor, or the ones who think that their guns will save them); but the NSA has crossed the line into threatening shareholder value. That's serious business, probably Unamerican. We've installed brutal, CIA-backed, military juntas in countries we don't care about for pulling shit like that.

Re:Arms race

[Mitreya]

Team Google, or anybody else with nontrivial US presence(or who we feel like bag-n'-dragging, which we do sometimes), can't resist legal force; but if they can resist covert surveillance, they force the spooks to go to congress

That may be, but it is pretty obvious that Google has no interest in fighting that battle. They are making some noises now that it became apparent that they handed over the data -- but I have little reason to believe they are going to invest in a real fight (and maybe it isn't their responsibility).

Based on the previous post on slashdot, tech companies are fighting furiously to report the "total number of NSA requests" they complied with. Once they win, all will be well in the world.

Re:Arms race

[number11]

One thing your forgetting and I will continue to remind people of, what about the other agencies that are doing far more then the NSA and yet the media/press continues to its communist like reporting, by failing to report the other agencies and or anything else including companies heavily handed involvement with cooperating behind the public's back.

Of course other agencies (e.g. the DEA) are doing this. So hustle up some whistleblowers to make that newsworthy. Hustle up stories about how normal citizens (not druggies or drooling pervs, not that either taking drugs or drooling should be a crime) can be hurt by this.

The "news" follows what's hot,

Re:Arms race

[Zemran]

Criminals and terrorists do not have a problem getting around the NSA, it is only ordinary people that are being spied on. Anyone organisation that does anything suspect will set up their own DNS with their own TLDs (just like the .onion network) and work away unnoticed, even some companies are already doing this so that they have their own intranet on the internet, all requests for a .com address etc. are just passed on the normal DNS server. They can use their own mail system with as much good encryption as they like and the NSA do not even know it is there or have access if it is in another country. The normal people who are using Hotmail, Yahoo, Gmail etc. are the ones being spied on, even Snowden said this. They say that they are fighting terrorism but that is only to justify what they are doing, they are spying on you and I.

Re:Arms race

[Zemran]

Yes, there will be so much less spying on individuals if they tell us what we already know.

Re:Arms race

[Anonymous Coward]

That's one of the (unofficial) goals, population control. For that they track connections (so called metadata), in realtime can track and activate cellphones. So if there occupy-something is going on it easy to track who participates and who may be connected. Simply by checking phone locations and calls, and history. More important having private data NSA (or whatever agency or individual has access) can convince key person to "cooperate". It can be CEO or ordinary engineer. And yes, no way to complain, secret court and pocked judges are for this. System "works" and lives its own life. There is probably no one in charge, but many who use and abuse it. The way it evolves soon it will be used for targeted crowd control. To take out the leaders like ruling parties do in Russia and China, and many other countries.

Re:Arms race

[msauve]

Seriously? You really don't understand how it works. You could get rid of the entire DNS system, and build everything on raw IP addresses, and it wouldn't change the NSA's ability to intercept traffic at all.

Re:Arms race

[FriendlyLurker]

tech companies are fighting furiously to report the "total number of NSA requests" they complied with.

Considering that those requests are "extras" on top and in addition to the NSA's always on access to the backend servers (as per Prism docs), then even if they win that fight it will be little comfort. All the "total number of NSA requests" tell us is that after looking through all the users stored emails and search profiles the NSA then decided to put in an extra request to track a users search keystroke and other front end data.

Re:Arms race

[Proudrooster]

It's an arms race that Google might lose if end users start using Chrome extension to encrypt the contents of their mail and using NOSCRIPT to hide their identity. Google lives and dies by being to be our creepy friend from tracking us, serving us ads, and generating analytics. If Google does not provide the "illusion" of security soon, it could kill the golden goose. It is in both the interest of Google and NSA to take this step. I predict we won't hear a single protest from our spooky friends.

Re:Arms race

[AmiMoJo]

The logical solution is for Google to leave the US. Move their main business to Iceland or perhaps one of the better European countries, and have the US as just a subsidiary. Obviously any servers left in the US (for caching/content distribution) will be considered compromised but at least Google's staff would be beyond the reach of National Security Letters and other such bullshit.

Having such a large and well known company leave would really screw things up for the US government and perhaps US citizens would finally wake up and do something about it.

Re:Arms race

[AmiMoJo]

I think you overestimate the ability of terrorists and I know you underestimate the ability of the spies. For example GCHQ is known to have taps on major internet backbones, so even if you had your nice little alternate DNS system the moment any of that traffic hits the net they would have it. Worse still it appears that the NSA has made sure that many encryption standards are flawed in such a way that they could decrypt such traffic even if you tried to protect it.

Whenever terrorists have come to court it has emerged that they were basically incompetent, but the security forces were also incompetent so missed their opportunities to catch them.

Re:Arms race

[Dan667]

foreign companies are starting to choose companies outside the US to prevent nsa spying. Google has a financial interest to stop the nsa from losing them business.

Re:Arms race

[swillden]

They are making some noises now that it became apparent that they handed over the data

There is no evidence of that, and Google categorically denies handing over any data except in response to narrowly-tailored and proper legal requests.

Snowden's PRISM slide is the only thing that even points at Google handing over data, and given the time frame shown on the slide it's more likely that the NSA was snooping their network links without their knowledge -- until they switched to SSL by default for nearly everything.

Re:Arms race

[Jeremiah Cornelius]

Google works for the same bosses as the NSA. Google is Schmidt. Schmidt is Spook.

It's a shadow-boxing match - so you still trust the 'Net enough to put things of interest on the wire.

Re:Arms race

[Dextrously]

That would definitely be an interesting turn of events. Especially if Google then sponsored their US citizen employees becoming citizens of other European countries. That would be very interesting, and convenient. Not only would they be moving a large well known business out of the US, but they would also be pulling the talent with them.

Seriously doubt that it will happen, but I would be pleasantly surprised to be wrong.

That's a relief

[theweatherelectric]

Google's strategy for making surveillance of user Internet activity more difficult for U.S. and foreign governments

So.. the only organisation conducting invasive surveillance of my Internet activity will be Google? I'm most relieved.

Re:That's a relief

[bhagwad]

At least you have a choice to not use Google's products. I would much rather Google had access to my data than the government.

Re:That's a relief

[Anonymous Coward]

No, it's still NSA+Google+FBI and whatnot. It might hinder some forgein agencys in collection info but never the NSA.

Google is US based and has to provide access. It would be stupid to belive otherwise.

Re:That's a relief

[Architect_sasyr]

It's not much of a choice - over 65% of the 10,000 most visited websites use jQuery (for example). If you want a semi-decent web experience, giving up on Google is particularly difficult. I don't imagine that it is impossible (queue hater geeks who get away with it), but it's not going to be easy.

Re:That's a relief

[bhagwad]

Well, one can only control one's own actions. Websites can choose to use non google hosted jquery scripts which is very possible. Either way, it's a net of personal choices. All that can be said is that Google did a good job of convincing others to use its resources. But it didn't force them to. With the government...all choice and personal freedom is removed.

Re:That's a relief

[Architect_sasyr]

Sure, and I agree totally, unfortunately we can not convince others how to host their sites. I use jQuery on my sites, for example, and host the files myself. However, and especially with the advent of "cloud" computing, I have found this to be less and less the case. Google Analytics are another good example - people don't use AWStats (or similar) as much because Google does it all for them.

Great business model, terrible for privacy advocates.

Re:That's a relief

[PRMan]

I use NoScript to block Google Analytics. It's amazing how much faster the web is when you do that.

Re:That's a relief

[peppepz]

That's the only reason they're making all this hand-waving: have their customers believe that their data is safe with them - even when obviously it isn't the case - in order to reduce the damage to their revenue. Google's core business model lies in harvesting, analysing and storing massive amounts of user data. This depends entirely on Google's ability to have access to that data unencrypted. NSA and the likes will always share that ability with Google - or be a piece of paper away from acquiring it - so talking about encrypting the "pipes" while retaining the key to the data is pure gimmick.

Re:That's a relief

[sadboyzz]

Does NoScript still upgrade itself Every.Single.Day?

Re:That's a relief

[swillden]

Great business model, terrible for privacy advocates.

Is it really? Assuming Google does a good job of protecting user data (it does) and doesn't sell or otherwise distribute it to others (it doesn't, except as required by law*), then where is the harm to user privacy? Does it harm you to see ads that are relevant to you, rather than random ads?

* I think we currently have a problem with laws that compel companies to hand over too much, but that's a flaw in our laws, and one we should fix.

(Disclaimer: I work for Google, though I don't speak for Google and they don't speak for me.)

Re:That's a relief

[Architect_sasyr]

Great business model, terrible for privacy advocates.

Is it really?

Nice to see some staff around. Assuming you are correct, it is also safe to assume that a privacy advocate is using adblocking software, or has set the DoNotTrack header, and thus doesn't *want* their data protected, because they don't want people collecting their data at all and are making efforts to make this happen.

The problem, however, is that even with AdBlock, and DoNotTrack the end user runs into two issues which are almost insurmountable for the user experience.

1. The user can still be tracked by script, which is where NoScript comes in, unfortunately the lack of scripts makes a large number of websites unusable, and significantly degrades the user experience. More so when, like I suggested initially, most sites are hosting their script files with any third party.

Which leads me to 2. Even with script blocking enabled, there are still cookies to consider, and the same problems arise when attempting to access most websites.

So the average user can not concern themselves too much with privacy, not so much by choice, but because if they do they can't do all the things their friends are doing - youtube videos, the escapistmagazine (who need about 9 different hosts bypassed in NoScript to make their site *work* and are representative of a non-google entity), and the like all become effectively unusable by a group of people who are not highly technically minded.

I suggested originally that there are people who successfully browse the internet in a "private" fashion. Their selection of privacy usually means: Use a search engine that is inferior to google (because most of them are - and the term "google it" is being used even by clients of mine who use bing exclusively). Have a web browsing experience that is noticeably slower (Tor), or one that is noticeably "broken" (NoScript, No Cookies). AdBlock is about the only piece of software that sits, nicely, in the background relatively unobtrusively.

So, to sum up as it were, for the end user the business policy is excellent. They get a great web experience at the compromise of (a limited amount of?) their privacy, corporations have to use less bandwidth, web designers have to host less files, etc. etc. The privacy advocate gets an inferior experience because taking advantage of these features means their web traffic is monitored very closely in the name of better targeted ads.

Note: AdBlock means I don't get targeted ads (except in gmail), and google's work means I get web search results that are relevant to me. I love that it works like that, just pointing out the other side.

Certain content delivery networks already do this

[kriston]

Certain content delivery networks already do this. For decades.

I find it hard to believe that Google was really not encrypting its non-client ingress/egress traffic.

Plain text is still the prize

[AHuxley]

The plain text is still not legally protected under a NSL/hidden self-signed "court" at the advertising keyword end.
The metadata is still not legally protected under a NSL/hidden self-signed "court" as sent.
The mathematics of cryptography is great PR along the tube but reality sets in at the end of the tube again.
http://www.slate.com/blogs/future_tense/2013/09/09/shifting_shadow_stormbrew_flying_pig_new_snowden_documents_show_nsa_deemed.html
STORMBREW and FLYING PIG show some insights into router and covert data redirection, the use of fake security certificates and the results been unencrypted.
Also note the bypassing (man-in-the-middle) ability via security certificates aspect.

Not a solution.

[LWATCDR]

A technological solution will never work. The NSA had court orders and gag orders. While the NSA doing this does not shock or bother me the idea that you can stop them with technology is just silly. Human spies will get around that as they always have.

Re:Not a solution.

[AHuxley]

Now only the NSA and select advertisers can enjoy working on your data.

Re:Not a solution.

[JanneM]

"Human spies will get around that as they always have."

Security has never been about _absolute_ security, but simply about making it too expensive, dangerous or time consuming for an adversary to bother. We don't all live in bank vaults, after all; we don't need that much security for the kind of possessions we keep at home.

Schneiers point is the same: we don't need so much security the NSA could never get to our data. We just need enough security - and need enough of us to use it - that the effort to routinely record what we all are up to exceeds their capability of doing so. They do not have an infinite budget, or infinite man-hours.

Make routine surveillance not impossible but too expensive, that's the name of the game.

Re:Not a solution.

[LWATCDR]

The solution is change administrations and tighten the law. People are more than a bit foolish in that they see spying as a bad thing. For instance spying kept the Cuban Missile Crisis from getting out of hand. Spying prevented the UBoats from starving the UK into surrender. We just don't want too much spying. As I said the tech will never be the solution in the US. You need a political solution.
Even if we had a perfectly balanced system it would never make the tinfoil hat crowd happy. BTW odds are if your internet traffic goes overseas at all and possibly even if it does not the Russians and Chinese are also looking at it.

Re:Not a solution.

[JanneM]

As I'm not a US citizen and do not live in the US, it's all but certain that any political solution there will do nothing for me. And as you say, the NSA is not the only one listening anyhow. Making it too costly and difficult, and encouraging as many people as possible to do the same, is the way to go.

Re:Not a solution.

[AHuxley]

The reality of large US domestic data storage would point to a total lifetime of routine surveillance been in budget and technically workable.
The phone records aspect is a hint to that - bulk call metadata just waiting for 10's of years.
Its not the cold war where keywords would alert to a message/voice and then keep that instance for later human translation or storage.
Now you just keep the metadata, ip used, keywords found, voice print, image, video clip still, banking, telco use ie all traffic until needed. Tiny compressed, sorted, indexed fragments per person per day.
If they keep using keywords or connecting (3 hops) to 'anyone' - then more storage and contractor man-hours are added.
Nothing per generation of device is expensive if you can set the surrounding telco, legal and crypto standards.

Re:Not a solution.

[fustakrakich]

They do not have an infinite budget, or infinite man-hours.

Indefinite is close enough.

Re:Not a solution.

[Anonymous Coward]

I see. So it's okay to spy on me because it may have made sense to spy on nation-states during a time of war?

Your argument only makes sense if you first admit that the country is at war with its citizens. Over what, exactly? The threat of terrorism?

Re:Not a solution.

[Jah-Wren Ryel]

They're good for other reasons, such as stopping all the other attackers that aren't the U.S. government.

You are completely correct here. The NSA is answerable to we the people, those other attackers are not. Politics is what will fix the NSA, tech is what will fix the other guys. Google needs to seriously step up their political lobbying to in order to reign in the NSA. Encrypting all of their backhaul traffic won't make a difference if the NSA has compromised the end points to hand out the encryption keys whenever the NSA pings those boxes.

Re:Not a solution.

[AlphaWoIf_HK]

Neither freedom nor the constitution are negotiable; there is no "balanced system" except one where innocent people aren't spied on.

Re:Not a solution.

[Lincolnshire Poacher]

For instance spying kept the Cuban Missile Crisis from getting out of hand.

Just a minor issue, but can we please start to call that event the Turkish Missile Crisis?

After all, it was the USA that started the escalation by emplacing IRBMs in Italy and Turkey.

Re:Not a solution.

[oneandoneis2]

Given all the lies and disregard for the law already demonstrated, it's childish to think that any political solution could be trusted. If Obama said tomorrow "We've reined in the NSA, the law has been changed so they can't spy on you any more" only the most naive people would actually believe their Internet traffic was now private.

A political change to make privacy more important would be nice, but implementing a technical solution to make spying harder is vital. Neither is sufficient on its own, the aim HAS to be to get both.

Re:Not a solution.

[LWATCDR]

That is a myth. The IRBMs in Turkey did not increase the threat to the USSR in any significant way. It is just a way that folks like the shift blame. The US already had Atlas, Titan, Titan II, and Polaris in service with Minuteman entering service. At the time and all could strike the USSR while USSR had no effective means of striking the US as the BIson lacked the range and performance and the R-7 took days to prepare for launch. The IRBMs in Turkey where going to be retired because they where not cost effective or a good weapons system. Same thing with the Thor systems in the UK which were also retired at the same time as the Jupiters even though they were not part of the deal. Removing the Jupiter systems was a bone thrown to the USSR and nothing more.

Re:Not a solution.

[LWATCDR]

You never will and frankly none of us really want it. The results of perfect signals security could be a terrible thing.

Re:Not a solution.

[Urza9814]

The U.S. government presently spends tens of billions, employees many thousands of analysts and engineers, has unlimited time, and basically faces no danger whatsoever.

So...ten billion dollars, divided by 300 million people in the US, gives us a value of $33 per person that the NSA has budgeted to crack their encryption. Good luck brute-forcing PGP on a single Raspberry Pi.....

Yes, not everyone uses strong crypto. Nearly nobody does right now. So that value is far higher. But the technological solution of 'everyone encrypt everything' certainly *could* work, in theory. And yes, they have men with guns as well, but at that point it's no longer a surveillance problem. That's a lot harder to do covertly, which makes the political response much easier to rally.

Of course this is all a moot point unless you can figure out how to get grandma to encrypt and sign her emails...

Disinformation

[xtronics]

To me it was obvious from the start that Google was founded with borrowed search algorithms that had been honed for a different purpose: finding connections in intercepts. So now they are trying to sell that they will have crypto that is out of reach from an agency that they are in bed with? They PAY Google some undisclosed excessive amount to provide information. It is a profit center. I'm not even sure if Google is really a public company. (The name may have come from a joke about 'G'overnment 'OOGLing' )

Why would anyone believe they are on the publics side?

Re:Disinformation

[AHuxley]

Re Why would anyone believe they are on the publics side?
Globally you would want the servers in the US or near US/UK friendly sites/telco loops.
The fear is a network of French, Germany, Russian, Spanish, Chinese, Portuguese ect. of local quality domestic ad/seaching brands.
They would only respond to their govs interests and demands for bulk raw sharing be just to regionally politically tempting.
http://rt.com/news/prime-time/icq-panic-russia-us/
"It all went smoothly – until the recent announcement by US law enforcement bodies who claimed that homeland security could be jeopardized if the service is located in Russia."
http://rt.com/usa/russian-company-buys-icq/

Re:Disinformation

[u38cg]

You had me up to the point where you seriously suggest the government could successfully run a billion+ dollar profitable business.

Re:Disinformation

[reve_etrange]

borrowed search algorithms

Uh, you mean the Perron-Frobenius theorem? I'm pretty sure there was no NSA in 1912.

Re:Disinformation

[saleenS281]

The government is extremely successful at running many, many billion+ dollar businesses. The problem you have is that you think our government is in the business of serving the people. In that light, they are utter failures. In the light of making our legislative branch and all of their private-industry buddies criminally rich, they're a raging success.

When is the last time you heard about an ex congressman or senator going bankrupt?

Becoming uncivilized

[Neo-Rio-101]

"Civilization is the progress toward a society of privacy. The savage's whole existence is public, ruled by the laws of his tribe. Civilization is the process of setting man free from men."

~ Ayn Rand

Re:Becoming uncivilized

[flayzernax]

Cute comment. But if this is any indication of our civility.

We are all savages. I'm ready to go savage to the max. Because its disgusting the state our society is in. Just looking for an ISP on their home pages is all it takes.

Our species is in dire need of some house cleaning. And yep. I would gladly sacrifice my life if the future of the human race isn't guided in this direction and is strengthened through adversity. Its the same thing as fighting and dieing for your freedom from an empire who taxes you without representation.

Re:Becoming uncivilized

[the eric conspiracy]

That seems rather wrong to me. Civilization is defined as the development of the city, along with writing and a shared ceremonial center.

Cities clearly require interaction between people on a larger scale than in a pre-civilized culture. With that larger scale goes loss of anonymity across that larger scale.

While in a band man is only known by other men in the band, and that's it. On a global civilization connected by the internet the scale is the planet.

Re:Becoming uncivilized

[Samantha Wright]

It's a good soundbite, the idea of mutual respect as a civilized accomplishment—but Rand oversteps. The very cornerstones of civilization are the same as the rules of that tribe; without it, you have something entirely more primitive: solitary animals and the complete abolishment of culture. It is alas a rather tawdry thought that betrays Rand's education, no matter how elaborate the clothes.

Strive for a balance. It's no more unattainable an ideal than an extreme like total freedom or total cooperation. There are, believe it or not, ways in which complete privacy is not optimal. Some small degree of intrusion is always necessary, both psychologically and for safety.

In this case, I am completely on the side of recovering privacy, as these violations are gross and driven by ignorance, paranoia, and greed. They are massively inexcusable, and if I were south of the border I would probably have turned to a career of being a crazy social activist when I was an undergrad.

Schneier hit the nail on the head last week when he pointed out the real issue, though, and I hope you'll agree with me that it is a much bigger priority than the collateral privacy loss itself. Bureaucratic and political need to save face and to manage risk has grown out of control. The post-9/11 culture of safety has led to oppression in every conceivable security-related corner, as well as moves of "me-too" safety fetishism in totally unrelated areas.

The enemy here isn't just a big government, though; it's the individuals in these organisations, departments, and legislative bodies trying to protect themselves and their careers. It's an insurrection of selfishness, regardless of who the campaign promises are designed to appeal to. Without arguing over the rightness of the system, it is at least plain that these people are horrifically mismatched to the jobs they hold, and they need to be very specifically shamed if the fundamental shift they caused is to be reversed. An Edward R. Murrow would really fit the bill right about now.

Re:Becoming uncivilized

[Neo-Rio-101]

There are, believe it or not, ways in which complete privacy is not optimal. Some small degree of intrusion is always necessary, both psychologically and for safety.

Such as?

I think the point was it should be an agreement between two parties as to how "intrusions" are used to fulfil a specific need or goal.
Typically these show up in privacy policies and wordy EULAs, in the digital realm.

We're talking about a large government entity intruding for it's own reasons with no mutual agreement. Is *that* intrusion always necessary?
I think not.

Re:Becoming uncivilized

[Samantha Wright]

I was thinking more along the lines of "obtaining a warrant to search for evidence of what happened to all those prostitutes who keep disappearing on or around your property" or "making sure you don't become a total recluse." As I said further down in my post, this situation is completely unacceptable and needs to be destroyed. Necessity, unfortunately, is subjective; they'd argue it's necessary, no matter how much we opine otherwise. Thus we need to re-educate them and shame them for thinking it's necessary.

Re:Becoming uncivilized

[Samantha Wright]

I think it would be better if we could create an environment where no one felt a need to become a recluse in response to social or developmental troubles. Hiding as a coping mechanism means there's something wrong.

Just to be clear: I didn't mean to suggest that spending a large part of your day alone is an issue. (I do that!) I'm talking about total self-isolation—recluses in the proper sense. Not genetic oddities with an inborn disposition against any social contact, just the garden variety hermit.

Avoiding all social contact in such cases might be evidence of a bad situation, dissimilar friends, or a traumatic experience. Some people can handle and recover from these situations, others can't. The same goes for depression and many other mental disorders; they're are difficult topics that most people can't really self-diagnose and handle properly on their own. And yet, they can be solved trivially if someone else is around and looking for signs of discomfort.

Ultimately, this comes down to a safety concern; I don't think that privacy should not extend to mental health problems that aren't self-correcting or easily manageable. There are over a million young people in Japan who are recluses because they can't keep up with academic and social expectations, and this group has a notably higher suicide rate. Being a recluse means no one can reach out to you. No one can be there to help you stop yourself.

And maybe it isn't outright suicide—maybe the cost is something else, like your creativity or intelligence going underutilized. Even Ayn Rand thinks that's wrong.

Re:Becoming uncivilized

[Neo-Rio-101]

The idea of a complete singularity between humans and each other where privacy is completely torn away so that a computer system can regulate and respond to all human impulses and make life better for everyone has been done before in science fiction (notably the Deus-Ex series of games, particularly the second "Invisible War" game in which one of the endings had this exact scenario)

Of course, you need everyone's permission to sign on for such a system.

The NSA didn't get everyone's permission, therefore it is wrong.

It doesn't matter if you use the argument "This is what's best for you" to bust down hermit's doors to rescue them. It's condescending, confrontational, and "holier-than-thou", regardless of whether you meant well or not. You can only ask people if they need help. You can't force it upon them without resentment.... even if you could actually help them. Otherwise you take the first steps into tyranny..... all with good intentions (that pave the way to hell, of course)

Re:Becoming uncivilized

[N1AK]

Cities clearly require interaction between people on a larger scale than in a pre-civilized culture. With that larger scale goes loss of anonymity across that larger scale.

Anonymity can't be measured that simplistically. If I lived in a city then hiding an affair is far simpler than in a village where everyone knows everyone. I could walk into 5 different hardware shops and buy bomb making supplies with cash and it would be far less likely to be spotted than in a small village with only one shop. If I go away for a couple of days no one in my city would bat an eyelid, in a village an unexplained absence of one of the small population would be noticed.

Conversely, living in a city means that what I am doing is being observed by far more people. Currently that is largely meaningless as the information isn't tied together, however as linking that information together and to me as an individual the balance changes entirely.

I suppose what I am saying is that in a village you are less observed but less anonymous. In a city you are more observed but also more anonymous, until someone has a reason to put the work in to tie the observations together (and the observations continue to increase and tying it together is becoming easier).

Re:Becoming uncivilized

[Samantha Wright]

You may want to read the Culture series by Iain M. Banks (recently deceased) for an alternative perspective. The system therein is both fully consensual and condescendingly holier-than-thou. It's generally fun to read about, although its villains (in the form of evil empires) tend to be cartoonish in their grotesqueness. Excession, despite widely being considered the most boring novel in the set, spends a great deal of time dwelling on this sort of thing precisely. Despite being a socialist utopia that offers all these things, people are still free to leave if they wish.

That being said, though, mental health matters can make getting permission a tricky task. There are plenty of situations in which a person may not be able to make informed consent, after all. Because of this I think such a system would have to be opt-out in order to achieve its goals. In addition to all of the usual arguably-impossible requirements about incorruptible and sentient computing.

Re:Becoming uncivilized

[the eric conspiracy]

How are you anonymous when you have all sorts of documents that trace every major aspect of your life, starting with your birth certificate and ending with your headstone? You aren't even anonymous after death.

Sorry, but Ayn Rand had some interesting ideas, but this is NOT one of them.

It's a PR effort

[Anonymous Coward]

"Eric Grosse, vice president for security engineering at Google, told The Washington Post: 'It's an arms race.'"

No it isn't. China wanted you to backdoor in China and you left China, USA wanted you to backdoor in the USA and you complied Eric. It's not an arm race when a secret letter is all it takes to get your data. Just after PRISM leaks, we learned they started to demand the keys too. In effect expanding surveillance of your services to 100% coverage while reducing the use of PRISM. Is *that* an arms race? No, it's a PR scam. It would let you Google, Microsoft, Facebook, Yahoo pretend surveillance had reduced (in PRISM) when in fact it had become total (via intercept).

Also don't kid us that it's only for terrorism. All the NSA does when it wants to spy on anyone, is stick an agent provocateur on the form to post a threat. That gives it the excuse it needs to then spy on everyone in the forum, and their friends and families using the 3-steps deep rule. Twenty million queries a month!

How about you come clean on Cloud Print? That data goes through your servers and can be matched to users data, I bet you give NSA that too?

It's entirely about PR, trying to regain lost trust, WHILE THE STASI ARE STILL LIVING IN YOUR HOUSE. The best defense is to not visit your house!

I will believe ...

[Taco Cowboy]

I will believe Google is genuinely against NSA's encryption breaking scheme only when Google moves ALL their servers OUTSIDE of the United States of America.

No point of talking about "upping the stakes" when the same old thing - a secret warrant demanding full disclosure - can happen anytime.

Re:I will believe ...

[Anonymous Coward]

Oceanic fiber isn't free. There's no way they could move them all outside.

Re:I will believe ...

[Dishevel]

I believe that Google already has craploads of servers local to their customers. That is how they work. They have servers in America for ... Americans. They have them in Europe and many other places as well.

Only a fucking third world shithead pretending to be second world thinks America has no place in the world. Fuck off and go live in North Korea.

Re:I will believe ...

[niftymitch]

I will believe Google is genuinely against NSA's encryption breaking scheme only when Google moves ALL their servers OUTSIDE of the United States of America.

No point of talking about "upping the stakes" when the same old thing - a secret warrant demanding full disclosure - can happen anytime.

Google has seen so very many attacks on its infrastructure that all links are now or will soon be encrypted.

Rumors are that Google is also large enough to distribute secret keys to the end point devices and can even
manage building to building and room to room encrypted data links.

I am of the opinion that Google is under pressure from TLA organizations to protect its resources as a mater of national
security. i.e. penetration from China, Iran, Korea, Cuba needs to be stopped. The capability to stop industrial
and international agents has the side effect of stopping or slowing down US agencies.

Those agencies are well armed with paper and via legal process can get that which is needed.

There is a lesson here. Do not obstruct US national TLAs but protect fully from international and industrial
attacks and you will be in as good a legal situation as possible. Secret orders are a tangle. Validating
that a secret order is a valid order risks divulging the secret order to the degree that it pays to not act on
or acknowledge the order that cannot be verified as it may well be an elaborate phishing attack by a foreign
agency with deep pockets. OK that may not be practical but the point is that becoming the target of
international agents unfriendly to the US is very possible and astoundingly possible. Physical, technical
and social attacks are very possible...

Since I am not an attorney none of what I said can be construed as advice. Do get advice in
advance of the need for advice when adversarial stuff is flying hither and yon and clear thinking
and communication is impossible.

Re:I will believe ...

[hutsell]

I believe that Google already has craploads of servers local to their customers. That is how they work. They have servers in America for ... Americans. They have them in Europe and many other places as well.

Google does have crap-loads of servers worldwide, localized into 7 different regions, 2 in North America; an eight region was recently activated during the last year or so. IIRC, the regionalization allows the data centers as a whole to never experience a sunset; also, the data itself being redundant, is optimized locally to minimize delays.

Re:I will believe ...

[rvw]

I will believe Google is genuinely against NSA's encryption breaking scheme only when Google moves ALL their servers OUTSIDE of the United States of America.

No point of talking about "upping the stakes" when the same old thing - a secret warrant demanding full disclosure - can happen anytime.

They would make a good start by setting up and funding an organisation outside of US jurisdiction, so completely independent of Google. If that organisation would create this new encryption software, protocol or standard, that would be a good sign to the rest of the world about Google intentions.

Re:I will believe ...

[Anonymous Coward]

So now they just have to partition the data.

US customer data is present ONLY on US based servers.

Non-US data is not ever touching the US servers.

NSA can go snoop the US servers as much as the US citizens allow. I couldn't care less.

NSA can try to snoop out-of-US servers as much as local govt. allows but most likely can't just waltz in invoking national security yadda yadda.

Not expecting them to do this. And they really cannot prove that they would be doing this, even if they claimed so.

Any company that has any server presence inside US is currently going to be assumed to be leaking all that data directly to US spooks. Enjoy. US = Nazi Germany.

Re:I will believe ...

[Clsid]

This, until Google does that all they are trying to be is try to appear like the good guys. It would be really bad for the US govt if major corporations start moving operations overseas so they cannot be forced into stuff like that.

Another solution is to have major datacenters in each region, but legally they would be independent of each other. That way only the local governments get to mess with their own traffic.

Re:I will believe ...

[Zontar The Mindless]

As a US citizen living (more or less permanently) overseas, that sure works out for me real well...

Re:I will believe ...

[knarf]

To paraphrase an often used construction, 'if they do that, the terrorists have won'. You have a constitution, use it. Even though it is not really for me to worry about your future, being European and all, I'd think it a waste of a good idea if the USA were to give in so easily.

Google should keep their infrastructure right where it is. If anything needs moving it is the politicos who allow it to come this far. They could start enforcing that constitution they swore to uphold.

Re:I will believe ...

[F.Ultra]

Main problem is that since Google is a US company the US can probably legally require Google to hand over data from it's overseas data centers.

Re:I will believe ...

[usuallylost]

Moving their data, or your data, outside of the US isn't going to work. First off Google is a US company. The US Government has a very long history of, successfully, asserting their authority over US citizens and companies no matter where they are. The second is that the NSA isn't a law enforcement agency. They are an intelligence agency. Local standards, laws and practices in these other countries won't even slow them down. In fact virtually all of the restrictions they face are only targeted at US citizens and organizations located in the US. Outside of the US you don't even get the minimal protection that the FISA court provides. You may gain that the companies don't actively cooperate as much but as far as I can tell that cooperation is just a convenience to them. If they don't have it they get it via other means.

Re:I will believe ...

[denis-The-menace]

The only way to prevent this is for Google to spin-off an unaffiliated company ONLY for the US complete with it's own stock ticker and everything.

Maybe call it GoogleNSA.

But the NSA has friends in the other 5-eyes countries so this might be moot.

Re:I will believe ...

[slash.jit]

Right.. they should move them to Iceland

Re:I will believe ...

[cbope]

The problem with that is, EU data protection/privacy laws won't let Google just hand over user data stored in the EU to the US. As a US citizen living in the EU, with a Google datacenter in my current home country, I find this ironic.

Re:I will believe ...

[josephtd]

Here's the problem with your argument.... In most cases it is becoming apparent that data is being collected outside the established rules of the road. You are quite naive if you believe that intelligence and law enforcement agencies are somehow "better" in the EU member states. Just to refresh your memory, some of those same EU member states accepted prisoners for enhanced interrogation methods.

Re:I will believe ...

[Notabadguy]

It would be really bad for the US govt if major corporations start moving operations overseas so they cannot be forced into stuff like that.

Why? Major corporations generally "exist" outside the U.S. Usually in Ireland, the Bahamas, or another tax haven.

Re:I will believe ...

[Cordus Mortain]

IANAL but surely if they are actually separate legal entities, they can't?

Re:I will believe ...

[Zero__Kelvin]

The vast majority of Americans are Google users. For you to think that they might even think of walking away from that kind of cash shows that we may be American, but you lack a basic knowledge of business practice.

Re:I will believe ...

[FatLittleMonkey]

Maybe call it GoogleNSA.

Ticker code GOON?

Re:I will believe ...

[Zontar The Mindless]

Engage your sarcasm detector, and try again.

Re:I will believe ...

[F.Ultra]

Of course they can, all they have to do is tighten the screws of the US part of the company until it ponies up the data from overseas. Yes they may not be able to legally tell Google Germany to hand over the data but they most certainly could tell Google USA to hand over the German data, or else.

Re:I will believe ...

[F.Ultra]

And what would that solve, the NSA would still tell Google USA to hand over the data. Since this is all done outside of the normal court system there is no need for the NSA to bother with such petty things as jurisdiction or legal entities.

Re:I will believe ...

[nobodie]

OK, I have a global solution that will please everybody I am sure:
First, we agree that the government is going to not just put their greedy mitts on the meta-data, we accept that they will have access to the whole kit and kaboodle. However, instead of some dinky government agency using funky old algorithms to find unpleasant information, the government is required to hire the unemployed to filter information (tweets, FB posts, Skype chats and calls, email, etc, etc) and pay them minimum wage to read, listen to and otherwise understand what is being shared. The "workers" will have a shift goal of a certain number of "information units" per 4 hour shift ( or two hour or one, I don't care) and have to provide the government overseers with any "unacceptable" communication for further "study." Accepted "unacceptables" will mean a bonus for the worker!

In this way we can provide jobs for all the unemployed, use humans to actually check whether things are acceptable or not and have some backup for the filtering: all human. Just think how positively this will affect the economy! Hundreds of thousands can work part time from their home together with their MickeyD job to supplement their income. The government can blame it on "human failure." The right and the left can complain about intrusive government, the tax base will grow quickly and everything will be rainbows and unicorns.

I am copyrighting this idea, so when you try to implement it in your official campaign platform remember that you'll have to pay me off. Wait, what do you mean I can't copyright it, China already does it???? Then why don't we just copy them and give it a new name. What do you mean algorithms are cheaper!? I'm trying help the economy!!
Sheesh

Re:Certain content delivery networks already do th

[AHuxley]

A lesson from the consumer OS side - Lower cost and usable by not adding expensive features like good encryption until a real issue makes the press.
Some regimes, monarchies and communist countries might have been swayed by that aspect too - trunk telco network has local rules and no encryption was allowed.
Rapid global uptake of the brand is protected..

The encryption isn't for the NSA

[Anonymous Coward]

The NSA can force Google to give them access. The encryption isnt to prevent NSA access. The encryption is to reestablish customer confidence. Also maybe to provide better security against other countries such as China.

Castle?

[Acapulco]

What is the point of having a big castle, with a moat, several feet inch walls and all that stuff if you then, quite literally, give away the keys to the castle?

Re:Castle?

[flayzernax]

Might as well live in a tent in the wilderness where no one is going to take interest in your big shiny castle. Not justifying the hordes of spies out there. But its the only way to escape the trap of being spied on.

Since we live in such an oppressive society. That basically means living an oppressively dull life out in the open.

Re:Castle?

[flayzernax]

Without any dignity.

Necessary for Google's Survival

[aaarrrgggh]

If the NSA remains vigilant and Google does nothing to avoid it, they will slowly stagnate as users switch to smaller "networks." Google is all about the network effects of their products, and that same network is highly valuable to the NSA and its ilks. The only real way to defeat it is to compartmentalize the networks into much smaller segments such that associations are much harder to make.

Much more difficult to do once the cat is already out of the bag, and it destroys much of the collectivism that makes the internet (and /.) a fun place to go, but hey... it's a nice day outside...

Meaningless

[comrade1]

As long as the data is in the u.s. and subject to government subpoena this is meaningless. Depending on how google is structured they could move their data centers outside the u.s. and not have it subject to secret orders. Switzerland would be a great place as they have strict data protection laws.

but the crooks said all that encrypted data must b

[raymorris]

But Google CAN'T be encrypting a lot of data and rolling out SSL on all of their services.

Just last night here on Slashdot the crooks informed us that while "3 strikes" laws reduced torrent traffic, all those stolen movies and software must have moved to SSL. The increased SSL traffic can't be because the #1 internet company in the world expanded it's use of SSL. It HAS to because penalties for unlawful actions dont work. That's what fits the storyline they want to tell!

Fuck Google, Fuck "CWmike"

[oldhack]

I wish I could be more articulate, but I'm too drunk at the moment.

Cocksucking bastards.

Who watches the watchers?

[gmuslera]

The real point here is not Google giving the NSA your information or not, they are an US based company, they must comply and give all the information requested by the NSA. And, if the used internal encryption is good enough, the only way to get that information will be directly from Google, then Google's will know what the NSA got from them, and they could eventually control (delaying, giving partial or even fake information) what they NSA gets, or store that information for future use (in the case that law gets curious about what is that justice that is everyone talking about)

That don't make Google a friend, but at least a potential enemy of our biggest enemy, and is something to be respected.

Re:Who watches the watchers?

[cold fjord]

they could eventually control (delaying, giving partial or even fake information) what they NSA gets,

Only if they want to go to jail, which I doubt. That goes especially for the "fake" information, that would be especially difficult to explain to a prosecutor and judge.

Re:Who watches the watchers?

[gl4ss]

they could claim that they were forced by a double-secret court to do it..

Re:Who watches the watchers?

[gmuslera]

The point is not that they won't, but that they could, thats the key of being in control of the information. If that information could be gathered also in another way it would be checked out, Will them be willing to do it? I doubt it.

In the other hand, when the NSA is ordered to give key parts of its information, they lie, no matter what prosecutors and judges say, in fact when they lied to the congress (that should be worse), didn't ended in jail, in fact, got even more control over possible threats on them. So there is not even the "would be unfair to them" moral concern on releasing faithful information to them that only you control and can tell if is the right one or not. Regarding the terrorism part, the NSA admitted that none of this surveillance ever prevented a terrorist attack, while they clearly targetted Google, Petrobras and others, this is by far more about protecting and empowering corporations (by stealing trade secrets, or even sabotaging, competition) than caring about people.

Am I missing something?

[Anonymous Coward]

If my taxes pay for the NSA and using encryption will cost the NSA more money to decrypt. Then I'll have to give up more of my money to them decrypt my messages?

Re:Am I missing something?

[Monsuco]

If my taxes pay for the NSA and using encryption will cost the NSA more money to decrypt. Then I'll have to give up more of my money to them decrypt my messages?

"Be thankful we're not getting all the government we're paying for." ~Milton Friedman

Frankly I'm more worried about Google

[Anonymous Coward]

and what they will do with what they know about me from about 1000 different channels, digital, clickstream, email text, inbound, outbound, print, video, audio, call records, transaction histories, demographic data, geneological histories, all carefully indexed and archived and MapReduce'd and data mined for moment-by-moment behavorial patterns.

Have you ever bought anything from Google as a consumer? No? Then how do you think they keep 35,000 pampered employees on the payroll with a million servers running 24x7 answering search queries from around the world?

The NSA, after all, is a bunch of guys with comfortable guaranteed (?) lifetime careers working for the Federal Government. How good can they be?

Re:Does it matter?

[james.mcarthur]

$300 to sign a certificate, where the NSA has probably back-doored it already. One certificate for you, a copy of it for them..

BREACH SSL attack bandwidth vs security

[gklyber]

I find it interesting that there was a general consensus that the BREACH SSL attack had no simple fix because the Internet could not handle the load if everyone turned off gzip HTML compression. While acknoewleding that bandwidth and computation resources are different, I am surprised that a simple fix for BREACH was dismissed, yet hoards of resources are being thrown at transport encryption.

This is not about technology. Its about trust.

[openthomas]

The NSA keep trying the same old trick. They want to orchestrate mass adoption of a system that appears secure but isn't. Somewhere in the technology stack there's a backdoor allowing the NSA access to the plaintext. We know what the NSA's two agendas are and its a huge conflict of interests for them to release a encryption system that they cannot themselves break. Even if the code appears secure they have rigged modern hardware to leak keys through side channels. _Of course_ Google's new system will be backdoored and _of course_ Google will be gagged. Google can never be trusted again. No matter what they say. The NSA are behind this. They are trying to provide a solution through Google because they fear people will move to develop a variety of encryption algorithms and products which will be expensive to analyze and break and automate surveillance of. Obscurity != Security but its fucking expensive.

PR effort

[Reliable Windmill]

This must be a PR effort. How can the NSA order Google and others to let them in and have the data they want, but then just let Google go ahead and freeze them out again? It makes no sense.

The only way to guarantee your privacy is to use open source end-to-end encryption software on open operating systems. All closed systems with physical ties to the U.S will eventually be compromised by NSA and other gov branches.

PRISM compliant

[DigiShaman]

All it takes is for congress mandating PRISM compliance and certification all under the guise of reducing the burden of the tax payer. Mark my words. What Google is attempting to do will backfire!!! Government = demigod. Nothing is more powerful than Government in an age of men and their organizations; including corporations.

Soon we will all see a citizens accept EULA for all new smartphones that their device has been branded PRISM compliant with a super fast NSA backdoor for enhanced performance and protecting the homeland. Thank you for your cooperation. NEXT -->

Re:PRISM compliant

[AHuxley]

Make a "PRISM compliant" sticker :)

Trying to win back users trust?

[LostMonk]

This is good business for Google.
If matters stay as they are now, users will leaving by droves when a non-american alternative present itself (and it will appear. people will not miss this opportunity). Rather than trying to defend it's data, Google must win back users trust or it wont stay in business for long.
The same can be said for most big american software and internet companies.

I'm putting all my money into...

[Jimbookis]

... factories that make $5 wrenchs. I heard they are set to make a killing soon.

Yeah, right.

[govett]

Google is going to confuse the NSA?

Google is in partnership with the NSA

[seandiggity]

This is a joke and amounts to nothing but a smoke screen. We now know that Google is an active partner of the NSA and the U.S. government...we should treat them *as* the NSA. What does any of this matter when Google has whole division(s) dedicated to preparing data for use by the NSA. They'll give keys, they'll give data, they'll give metadata, they'll give educated guesses, they'll prepare 3D topographic maps about that data.

Re:Google is in partnership with the NSA

[swillden]

We now know that Google is an active partner of the NSA and the U.S. government

We do? I don't. In fact I see no evidence of that whatsoever. There was one slide showing that the NSA was collecting data from Google back before Google started using SSL for everything. That's it.

From my perspective as a Google employee, I also see no evidence from the inside of any partnership with the NSA, and I see a whole lot of cultural opposition and pragmatic difficulties with doing any such thing and successfully hiding it from the employees (like me) who build Google's security infrastructure.

Re:Google is in partnership with the NSA

[fulldecent]

>> From my perspective as a Google employee, I also see no evidence from the inside of any partnership with the NSA.

And do you have an SCI clearance? If not, do you ever ask questions at the office and get the answer "I'm not at liberty to say"?

Re:Google is in partnership with the NSA

[Monsuco]

We now know that Google is an active partner of the NSA and the U.S. government...we should treat them *as* the NSA.

No, Google is in compliance with the law. There's a big difference between complying and supporting. Google's CEO and management don't have to like it, they just have to do it.

The thing is, Google can't be trusted but open source code produced by Google can. If you can view the source, you can quickly see any backdoors in the code. The NSA itself produced security enhanced Linux. Despite all the controversy that we've had surrounding the NSA, nobody points a finger at SE Linux because the code is public.

Re:Google is in partnership with the NSA

[seandiggity]

Replying to my own thread, which I realize is bad manners...I want to avoid a flamewar joined by Google employees and I refuse to respond to them individually (I also wouldn't reason with the Stasi). The parent post is upvoted by my peers for a reason...we're living in a totalitarian surveillance network in which Google is the primary player and I think we're finally realizing how much the most public advocate of FOSS has become a spook agency in conjunction with the NSA. Let's shun them as we should, for embracing (and making piles of money off of) FOSS and then acting against the interests of freedom. As the weeks go by, we'll continue to learn how Google has betrayed even our most basic freedoms. Beyond that, they've done some work on the ground, the same work a spy agency would have done in the past. Who's holding the shit-bag now?

You're solving the wrong problem

[Anonymous Coward]

The real problem is how to make sure that the "good guys" get access to top-of-the-line technologies and the "bad guys" seeking 72 virgins don't get access to them. The only reason the NSA can justify its actions is because you are spending all this time fighting the NSA instead of making it easier to lock on the "bad guys" without infringing on the rights of the "good guys".

Frankly, I think people spend way too much time bashing their own government which (at the end of the day) does have legitimate reasons for needing to intercept a lot of this traffic. If you don't trust what they do with that data, solve *that* problem, but making it more difficult for anyone (even if they're trustworthy) to protect our citizens is a bad idea. Period.

Bullshit

[AbRASiON]

You can encrypt all you like, if there's a backdoor made for people to access, it's meaningless.

Running businesses ....

[jotaeleemeese]

... should be left in the capable hands of bankers, insurers, airline operators, tech geniuses (specially if they have any experience running companies about 2000) and all other shrewd business people.

Lest not forget farmers which are great at administering subsidies and other varied industries that have become very adept at pork barrel politics, ensuring juicy subsidies and bailouts from the incompetent government come their way as soon as this is needed to boost their bonuses.

So is the company mandating real names in G+...

[jotaeleemeese]

... going to fight the surveillance state?

In *our* behalf?

Allow me the following outburst. Ha,ha,ha.

Re:When has it not been a arms race?

[rvw]

This has been going on FOREVER... There is always a better mouse trap .. or cheese ;-)

Limburg Cheese Encryption - smells so bad that even the NSA runs away

Protect their markets...

[Kazoo the Clown]

If people are inclined to choose other more secure options for email, Google could lose customers. Furthermore, if Google isn't privy to your unencrypted traffic in some way, there's no info to collect for targeted advertising. So Google has some motivation to take charge of the encryption...

You do. Chelsea Manning. Snowden. Assange.

[Anonymous Coward]

You know, all those people who are vilified for being traitors and warrant summary execution for their crimes of spying on the US government.

Technique works - is it acceptable?

[Roger W Moore]

Criminals and terrorists do not have a problem getting around the NSA

No, intelligent criminals and terrorists do not have a problem getting around the NSA. The fact remains that many are not intelligent because in many societies intelligent people can do better for themselves by working as part of society and even the intelligent crooks and terrorists probably have to work with incompetent ones so their plans will probably become accessible to the NSA.

The issue with NSA surveillance is not that it doesn't achieve its stated aim - it undoubtedly does - the issue is whether this is an acceptable means to achieve that aim - and for many of us it is most certainly not.

Re:Technique works - is it acceptable?

[F.Ultra]

The problem with that is however that the non-intelligent criminals is easily caught by the normal means, i.e normal police work. So you have a) criminals that are to dumb to warrant this surveillance and b) criminals that are to smart for the surveillance to work. The really paranoid criminals like Hells Angels (they operate like the mob in my country) have always assumed that they are monitored so they have always banned cellphones from their meetings and if one leader wants to talk to another leader he simply sends one of the prospects to deliver the information orally regardless of distance.

Re:Certain content delivery networks already do th

[delt0r]

So what if its encrypted, if you have the keys are are legally required to hand them over when asked to?

It's a business necessity

[Tridus]

While Americans might be pissed off about this, they're not doing much about it. The rest of the world is looking on and asking hard questions about how much reliance we want on American based companies, given what that means for our data and the US Government's desire to spy on it.

Google doesn't have much of a choice but to try and fight this - to roll over is just to do serious damage to their international business interests. Same for any big service provider. If you're in Europe and you need to do something securely, would you even think about getting services from an American company anymore?

Not a chance. If they're not careful, the NSA is going to destroy the competitiveness of some very big companies.

Re:It's a business necessity

[Monsuco]

While Americans might be pissed off about this, they're not doing much about it. The rest of the world is looking on and asking hard questions about how much reliance we want on American based companies, given what that means for our data and the US Government's desire to spy on it.

Google doesn't have much of a choice but to try and fight this - to roll over is just to do serious damage to their international business interests. Same for any big service provider. If you're in Europe and you need to do something securely, would you even think about getting services from an American company anymore?

Not a chance. If they're not careful, the NSA is going to destroy the competitiveness of some very big companies.

Oh please. France, Germany & the UK snoop on their citizens too. At least America, in theory, has some degree of 4th amendment protection. The UK has essentially no constitutional limits other than what common law tradition dictates and France and Germany generally offer weaker protections than the USA against searches. I realize Europeans love feeling snobby and superior, but there certainly is no shortage of privacy violations on the other side of the pond.

Hell, if you want to talk about spying, talk about China. The Chinese have no qualms with spying on their citizens and, unlike the USA, they will imprison anyone who they think might challenge them. China's government colludes with its companies to engage in corporate espionage in order to steal trade secrets from American and European companies. I don't see companies pulling out of China in droves.

I'm not saying the NSA's not creepy. They are. I'm just saying the idea that companies will flee America in significant numbers because of it is ridiculous.

that changes everything

[mooingyak]

Gotta love a proofread summary:

'It's an arms race.' The crux of the issue with Google making the NSA dragnet harder (knowing if the government wants in, it will get in) is that the NSA evaluates the tactic it uses by weighing the cost with the value of the information obtained.

Ok, that makes sense...

However, the agency does evaluate the tactic it uses by weighing the cost with the value of the information obtained.

Whoa. That changes everything. Damn.

Orwell's 1984

[ikhider]

This strategy was already deployed in Orwell's book where Winston thought he was acquiring subversive materials but was really following the party surveillance plan. We trust google because...? They are a for profit company with massive marketshare. Google is merely providing the illusion of due diligence.

Re:Certain content delivery networks already do th

[F.Ultra]

Security theater

Google vs. Government

[brunes69]

Google will use its information on you to serve you ads for Toyota.

The Government will use its information on you to profile your behaviour to determine if your views are a threat to whatever political policy is in play at the time, and if so you will be deemed a "radical" and be placed on watch lists.

Yes and no

[Weezul]

Google is against anything that makes people not trust Google, including the NSA. Google would happily keep all your data secret, except from their own advertising algorithms. but Google would also sell your data to the NSA for what they consider "fair market value", which given the preceeding is a lot higher than the NSA wants to pay for it.

Google pays a computational price for encrypting your data, but it's worth it if either
(a) the NSA is now forced to buy your data from Google, instead of stealing it like they currently do, or
(b) people trust Google more as a result.

Google wants to publish the number of NSLs it receives to (a) make people feel more confident and (b) make the NSA, DEA, FBI, etc. evaluate more carefully the data they request. Why is (b) good for Google's bottom line? I think, if the agencies are spending more personnel time on the data they request, that data appears even more important, so Google can charge more for the data the agencies really want, while incurring less risk.

Google is still a company, but it's a company run by a founder. Founders almost always make them behave much less like psycopaths than Wall St CEOs.

Network Layer Encryption

[ironicsky]

I've never understood why encryption isn't already built in to everything we do in modern technology. As far as I am concerned the network card in your computer should generic a one-time public/private key pair for EACH connection it is making or receiving. The public key is transmitted to the other network device which uses it to encrypt the data to get sent back. Once a connection is closed the keys, salts, and other information is destroyed.

It would take a little extra computation on the hardware to make it happen, but the storage requirements for keeping the keys is minimal since each key would, in theory on exist for a few minutes before a connection is closed, and in the case of web traffic, a few seconds.

We could do a way with all sorts of things, like OS level encryption if it was built in by default - or keep it, and add a 2nd level of complexity to the data.

Re:Network Layer Encryption

[phorm]

To some extent, it's still computationally expensive.
Nowadays it's not too bad to encrypt your home directory and general web traffic, but full end-to-end encryption is still going to come with a lot of overheard. Also, too much encryption can lead to data fragility. Many types of data are somewhat resilient to corruption/rot, but if they're encrypted then a few bad bits might cause more issues.

Beyond that, encryption only helps you if undesirables don't have your crypto keys (or vulnerabilities that work well enough)... which apparently the NSA does in many cases.

Re:Network Layer Encryption

[WuphonsReach]

I've never understood why encryption isn't already built in to everything we do in modern technology.

Because encryption is easy, but key management is HARD.

How do you know that the key which you are using to encrypt the stream of data is the right key? And not Eve's key?

The current answer with SSL/TLS is that your application has to trust *someone* (the CAs) to give you proof that you are talking to Bob and not Eve.

But SSL certs signed by CAs are expensive, and some of the CAs are bad actors who will sign anything at all, even for hostnames that you do not actually own.

The next step forward is probably going to be roll-out of DNSSEC, and then storing your keys in the DNS system (see DANE). Which removes dependency on the CAs and limits the potential damage of a bad actor.

Re:Granny Weatherwax has the right idea.

[Samantha Wright]

I'm not sure who or what "TP" is. Could you be more specific?

NoScript upgrades

[phorm]

Valid question, especially since every upgrade also dumped you with a tab to noScript's homepage.
I haven't had that happen for some time now though, so - assuming my updater isn't broken - it seems they've cut back on the upgrades.

Re:Granny Weatherwax has the right idea.

[Samantha Wright]

...Right, Pratchett. Yes. Agreed!