Google Takeout means something else in light of PRISM
rachelbythebay.com
rachelbythebay.com
Google takeout most likely has nothing whatsoever to do with PRISM or any other NSA programme, why go through a clunky one-user-at-a-time batch process when you can be comfortably sitting right where the action is, where updates are incremental and where information is available when it happens instead of when you ask for it.
Push over pull any day for the NSA and the likes.
NSA might tap every single bit of communication worldwide but getting structured data for users of specific interest directly from Google etc. is still much easier.
There just simply is no tie-in between google checkout and PRISM as the article alleges as far as I can see.
On top of that google take-out is just google but a lot of other companies are listed as well. So, all things taken into account the two most likely have nothing to do with each other.
Rachelbythebay does not let any chance go by to diss her former employer and that's fine by me as long as it is based in fact, not in speculation. If she knows for a fact that this is the case that would change things considerably but from where I'm sitting this looks like speculation to me.
And just because systems like PRISM are in use, doesn't render data export for specific users useless:
PRISM might for example identify some users of specific interest. As a result, NSA might access all Google data in relation to this user in structured form. Legal interception ports in hardware and software have been known for years, they are mandatory in many countries. And while live surveillance can be important too, most results are gathered from structured user data and meta data. And in any case, why should the same work be done twice? Why should NSA do work that has already been done by Google etc.?
A couple of months ago I was on an education business fair in Germany and the first thing I heared at the booth of many data-handling businesses was: "We don't store anything in the United States. All our servers are in Europe/Germany."
I now wonder if next year, some will advertise that they don't even have a US subsidiary and are thus not under US jurisdiction.
Google, Apple, Facebook and friends go to great lengths to evade taxes. When it comes to tax matters, those companies have no hesitation to use all the tricks available to a trans-national company. And they pay very smart people to invent schemes that ensure a maximum amount of money is kept out of the US IRS hands.
If Google, Facebook and friends were truly serious about protecting their users' privacy, they would. They would pay very smart people to invent schemes that ensure a maximum amount of user data is kept out of the US NSA hands.
But they don't.
1. By law all European telecom providers, including ISPs, are required to provide a backdoor for everything that goes on on their networks (the infamous Data Retention Directive)
and
2. All European security agencies cooperate quite willingly with their American counterparts. Some more so than others (the ones from the former Eastern Block are particularly notorious in this regard) so if an American three letter agency wants your data, it'll get it.
It's simple: if it's passed through the USA, if you store it on a server in the USA or if it contains tags served from the USA you can bet that it's being tracked by one or more three letter agencies. To assume anything less would be folly given the amount of smoke that has been generated to date. To infer there is a fire somewhere is no feat of deduction.
The fact that there is now proof that at least some of these programs are real is only going to convince the last hold-outs, or at least, so I'd hope.
There is a very simple reason why that is a marketing point, and any of those vendors would have been happy to expand on it, and probably do on their websites. That reason is that compliance with German law requires certification that all steps you take with data comply with German law, which is much easier to do with a vendor which exists in a jurisdiction that has similar data privacy laws, and is easiest if that vendor is German.
For a random example, see http://www.perspecsys.com/how-we-help/cloud-data-privacy/ger....
Now before you cheer Germany for this stance, stop and think. Normally HN is very supportive of anything that reduces red tape barriers to small startups trying to innovate. The kind of regulations that we're talking about both protect users, and make life a lot harder for startups.
If your servers are in Germany, then they are the subject of German law - and all of their similar, respective search and data laws.
If you weren't aware of this before, you either weren't large enough for anyone to ask for your data, you were lucky enough to never have to deal with this request (or your software isn't really used for communication or data storage), or you were simply ignorant of the legal situation
That's no small feat, and it certainly requires explicit engineering effort, but it's not a hugely complex undertaking either. Maybe the infrastructure of Takeout can also be used to do that, but the data transmission itself would have to work differently. Again, I believe it has to be basically a data pipe that replicates every user action, probably in real time.
The three questions which remain open are 1) just how many individuals are getting FISAed - and has it gone up sharply thanks to the shiny new infrastructure for streamlining the request process? 2) do the FISA requests being acceded to now also include "broad sweep[s] for intelligence" in addition to those "specific orders about individuals" which the Internet companies have acknowledged (and which everyone knew about already) and 3) to what extent are the CEOs still fully aware of the nature and extent of the FISA inquiries now that the nice semi-automated processes are in place?
The NYT article that so incensed Michael Arrington, for example, exclusively refers to the FISA procedure, which Google has more or less already admitted that they comply with (lawyered requests for specific individual/groups data).
The only part of the NYT article that sounds like the alarming scenario outlined in the PowerPoint slides is this:
http://www.nytimes.com/2013/06/08/technology/tech-companies-...
> In one recent instance, the National Security Agency sent an agent to a tech company’s headquarters to monitor a suspect in a cyberattack, a lawyer representing the company said. The agent installed government-developed software on the company’s server and remained at the site for several weeks to download data to an agency laptop
There's no mention that the company here is Google and there's really no reason to believe that it is Google (in this instance)...I mean, because if it was, then the procedure described here has vast implications about Google's software stack that would seem untenable for a company with Google's kind of infrastructure
(It's possible that the procedure described here is inaccurate, as it is third hand, but that only underscores the vagueness of this whole thing)
Did it really? It seems that PRISM is the software support etc. to semi-automate the FISA procedure at the Internet companies. Google claimed never to have heard the term 'PRISM' but that could easily be true-but-insignificant.
(It's possible that the "PRISM" name is also being used by the NSA to cover old-fashioned wiretapping of emails etc., but that wouldn't involve the Internet companies as opposed to ISPs.)
> > First, we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers. We had not heard of a program called PRISM until yesterday.
That's a broad flat out denial. And in my opinion, it includes such options as reserving an omni-admin account for the government, and if such an arrangement exists, then Larry Page should be pilloried for issuing a lie. But until such an arrangement can be shown (and why couldn't it? If there's a NSA official who can leak about it successfully, why is it impossible to imagine that google has at least one such conscientious objector?), it seems a little unfair and counter productive to judge Google with inescapable circular logic.
There; no "back door", no "direct access", no "PRISM", not "broad", as said elsewhere in the release.
Maybe I read it wrong but Verizon was ordered by the court to do just that and to shut up about it. I doubt they were asked to accept, just the court ordered it and it is so because it became a 'legal request.' I have to wonder what Google, Microsoft and Facebook were asked to provide to NSA in large scale. If they can have all calls to see if anyone calls certain "terrorists," why not get a log of all Skype calls, FB likes, messages, Google searches etc to see if anyone is linked to "terrorists" or searching for related materials?
Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false.
Now that could conceivably be a bald lie - or I suppose they could just conceivably have lost awareness of what their FISA/NSL/warrant-handling lawyers were approving, to a spectacular extent - but otherwise they aren't handling any Verizon-scale FISA warrants. However, you're right: there's a big grey area between Verizon-scale "megawarrants" and the "specific orders about individuals" the tech companies say they process. NYT said "FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms" while the tech companies largely reasserted that they only process "specific orders about individuals". It seems that only one source can be accurate here.
BTW I assume that Verizon wasn't really just forced into handing over all its metadata: there was probably a bit of a gentleman's agreement in the government producing an omnibus FISA order and Verizon agreeing not to contest its legality. Everyone spends less time processing FISA orders, the government gets all the metadata it wants, and Verizon gets a sicknote to cover it legally.
It's actually trivial if you really think about it.
[1] https://developers.google.com/google-apps/email-audit/
Sometimes bad guys kill people and use the shovels from Home Depot to bury the bodies.
There was this really great Zombie movie from 1985, Return of the Living Dead, that took place in a funeral home. I'm not going to give any spoilers, but you really need to see it.
Shovels mean something else in light of this discovery. Sorry Home Depot, I think your shovels have been co-opted.
What is more likely than not is that the majority of employees at Google have no idea how the surveillance system that Google would need to have worked and were ignorant that it existed.
Oh, and you can't delete your Skype account either. Not even in the UI.