Hacker News Reader

Comment by abbadadda | Hacker News Reader

Queue the Google alternative posts. This is some terrifying stuff.

> not just emails but also drafted and deleted messages; any files in their Google Drive cloud storage services; any Google Voice texts, calls and contacts; search and web browsing history; and location data.

View on HN

The scariest part is that this amount of data access can be very effectively weaponized to build a strong case against anyone. All of us are inadvertently breaking some law or the other all the time. If the government doesn't like you for any reason they are one court order away from blackmailing you or putting you away.

Including Google. There was a well-publicized case in which they were "hoist on their own petard" a few years back.

What happened, basically, from memory, is that someone was arguing that Google did something wrong (I forget, but it might have been the collusion to keep down employee wages or something) and so there was discovery of emails by Google, and they eat their own dogfood so it was gmail.

So Google smugly said "hah, there aren't any incriminating emails", but then it turned out that the autosaved drafts of some of their emails were incriminating, and were preserved, and ended up being produced in court.

So remember that the next time you type an email or a forum or facebook post, and you revise it extensively before hitting the button to send it.

It's incredibly interesting that unsent emails were used to support a case. Were they used to prove intent of some kind?

Well, after...Googling...it, there's a little more to the story. It was actually a fight with Oracle about the usual stuff (Java patents), and the email itself was covered by attorney-client privilege, and therefore didn't have to be shown to the other side, but the drafts slipped through by accident because, you know, the subject didn't actually say "Attorney work product - confidential" until almost the final version. And although there is something called a "clawback", the judge ruled that their attempt was too little and too late. "Your honor, it's devastating to my case!"

Basically, Google relied on an algorithm/search engine to screen for privileged documents instead of having lawyers review things the old-fashioned way and they got bit by that.

Agree. Why giving it all away to google then? I don’t get people who complain about privacy though insist on using a gmail email, chrome and make all their search on google, not clearing cookies regularly and using adblockers.

> they are one court order away

The implication being that the courts are corrupt?

If that's the case I think you have way worse things to worry about than "data access", the courts have much greater powers than that.

The scale of it is what is of most interest.

If the court gave a similar order to retrive similar amounts of physical (eg paper) information from your house, and anyone you happened to correspnd with it would be extremely notable and expensive as well as creating dramatic television pictures. Some of that is a deterrant to its abuse.

"Google, fetch" the scale, ease and speed of that is worrying. How is its abuse to be stopped?

Courts may or may not be corrupt, but regardless of that it hasn't historically been very difficult for authorities to find a judge to sign off on a very wide-reaching warrant (like this very case).

Yeah. We voluntarily give info to Google (most of us don't think about it that way, but we do). Google winds up with all this data. In theory, I don't have a problem with the authorities being able to get their hands on it, after getting a warrant. In practice, "getting a warrant" doesn't seem to be as high a bar as it should be.

> The implications being that the courts are corrupt?

You don’t have to be corrupt to be ineffective. Have you been following patent rulings? Or FISA?

It should be queue the reduce use of electronic communications posts.

This isn’t a phenomenon unique to Google. Google just attracts attention because of the broad scope of what they do.

Everyone, it's cue, not queue.

And live how? Anything you use these days leaves a trail. You could be carrying a basic feature phone with nothing but email, use duck duck go, and still get hit by this.

Keep in mind that instant messages and voicemails, for instance, get produced in court all the time, and that has nothing in particular to do with Google. Calls made from jail are another thing that comes to mind.

(I am not a lawyer but) AFAIK there's no particular form of communication that's immune to discovery but for Google.

What's the difference between this and a normal warrant, where they take every scrap of paper and electronic equipment in your house?

If your objection is that it's weird Google has kept that data, sure. I get it, I use DuckDuckGo, Firefox, and I host my own email server on a VPN. I'm struggling to understand why this particular aspect is weird though. It seems totally normal that the government would seek this information as part of a criminal probe.

The difference is that this absurd amount of data exists, with no useful distretention policy.

Remember that the govt seizes this info about you to prosecute you, but you don't get this info about them for all their suspected crimes.

> Queue the Google alternative posts.

How would that help? They'll just get a warrant for those.

> This is some terrifying stuff.

You have a strange definition of terrifying. This is how the law is supposed to work.

You do realize they can also go in his house and search through his things? Or order his friends to talk? That's what search warrants are.

> How would that help? They'll just get a warrant for those.

In terms of e-mail, any service that encrypts at rest and doesn't maintain the key can only hand over encrypted data. ProtonMail would be one example.

>How would that help? They'll just get a warrant for those.

If the business is not based in the US, it will make getting a search warrant much more difficult. Your (e.g.) Protonmail account is less likely to be subpoenaed than your Gmail.

Even if user data were seized, it would be impossible to decipher because of ProtonMail's encryption. Unlike Gmail or Outlook, email you send with ProtonMail is encrypted before it's sent to the ProtonMail servers.

Then they would seize his phone and use that to decrypt the email.

Or order him to turn over his own email.

> Or order him to turn over his own email.

Which they could have done in this case. So why subpoena Google?

Apparently some concern he might accidentally click delete instead of duplicate. Non technical user and all. Google staff have more training.

Reply on news.ycombinator.com