NSA begs to differ, on both counts https://www.theguardian.com/us-news/the-nsa-files
CIA too https://wikileaks.org/ciav7p1/
I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion. I would not be surprised if intelligence agencies around the world including US based ones target Google's communications (probably in full accordance to each agency's authorization) but that would not be with Google's cooperation.
I believe that Google is taking steps to protect customer data from all bad actors, including Government agencies. One initiative that was underway around the time I worked at Google was to encrypt all the data-center to data-center traffic at Google in an attempt to frustrate anyone who was tapping Google's backbone links.
Why does it matter if it's under legal compulsion or not. At the end of the day they are handing over your data. They could choose not to store it, thus making it impossible to do, but they don't.
Because we are all obliged to follow the law.
B) They could organize it so that even when the law comes asking, they can't comply, but they don't.
What matters is that they are acting insecurely, and providing data that they shouldn't be storing/providing in the first place. The law is irrelevant here.
In the court system, not by disobeying.
Your view of 'what is unjust' is likely completely different from the view of others.
Particularly in this case, I don't have any problem with Google or FB handing over data for individuals under investigation, wherein a Judge had provided a warrant. This is 'legal' in every sense of the term and has been for some time.
As for 'mass surveillance' - well, this was a murkier area, and has been cleared up by the Supreme Court, and I don't suspect they are doing it.
If Google does not want to hand over data to officials producing warrants, they can take it up in court, and try to get an injunction against the process of handing over. If a judge feels there is merit to the case, they will grant the injunction while the case is being resolved.
"They could organize it so that even when the law comes asking, they can't comply, but they don't."
Nope. They can organize all they want, but if the Government is well within legal limits, Google et. al. would face some serious pain. Again for 'mass surveillance' stuff (i.e. legal ambiguity a few years ago), they'd have some legal footing to fight (i.e. try for injunctions), but for other things, not so much.
> Nope. They can organize all they want, but if the Government is well within legal limits
You are misunderstanding what I mean here: Google can make it so that nobody except the user can read their data, but Google chooses not to. If they did this (read: the correct/secure way), then the government can ask all they want, and Google would be unable to comply.
Which cannot be done, when any issues with these laws are discussed in "secret courts" [0], and where the individuals involved cannot reach out to experts in the field, because their hands are tied by gag orders.
The strength of the warrant becomes less when you recognise that FISA approves almost every request it gets. The warrant is little more than a proforma.
The structure of the current laws prevents a lawful answer to the situation.
I can't advocate breaking the law, that would be going against myself.
But neither can I advocate for the law, here, because it is failing to protect the people of the nation, from the power of the nation.
[0] http://edition.cnn.com/2017/03/08/politics/fisa-court-explai...
And that only about 1500 FISA requests are granted a year, which is a very small number for 300 M people, relating to another 7 Billion.
A single case might yield 5 or 10 warrants, ergo, possibly as few as 150 serious cases.
That's small.
That 'they are almost always granted' is not so bad in and of itself. If there's a 'known process' for getting warrants, and law enforcement knows what will be approved and what won't - well - then there shouldn't be too many that are denied.
Underlying the 'warrant' is not something 'pro forma' - it's a set of expectations and requirements upon the part of the overview system in place. The 'form' requires that the applicant fulfills some very important criteria.
I do think it's fair to be suspicious and that we should be vigilant about it, but I don't think that 1500 requests a year is too out of line.
I think the big concern is the 'mass surveillance' - or when local cops are making requests to do local-yocal small cases that don't have relevance to things like actual terrorism.
Those 1500 requests cover about 15 million people though, which skews the weighting. That gives me concern.
> If there's a 'known process' for getting warrants, and law enforcement knows what will be approved and what won't
Either that, or there is a culture that rejecting a warrant needs extenuating circumstances, in which case it becomes a large concern.
We can't know if the oversight is simply managerial, or actually effective. It's done with the utmost secrecy, with many punishments awaiting any who might speak out.
> I think the big concern is the 'mass surveillance' - or when local cops are making requests to do local-yocal small cases that don't have relevance to things like actual terrorism.
Unfortunately FISA enables mass surveillance. And the checks and balances seem heavily weighted against the individual, and in favour of a state they can't oppose.
Yet, their info got out. If they got hacked....
If the US government wants your data and it's being held in a US company, then IT security isn't the issue, it's the legal framework. No IT security will help when armed agents of the government legally enter your business and coerce you into handing over your data.
The US Government can equally detain you directly and coerce you into handing over all of your data if that's what the law allows.
Only people with security clearance can access government cloud facilities