Asking the U.S. to allow Google to publish more national security request data

A non-google-trusting way to do PGP with a better UI/UX would also be a nice feature for gmail. Just indicating "encrypted" at the message-list view or something. I have PGP working quite nicely in mutt, but a lot of people seem to prefer webmail.

2. I'd actually prefer a world where signals intelligence, outside extremely tactical intelligence, were impossible through technical means. I think we'll be there at some point, just because the cost of protection is dropping.

(confidentiality and message integrity should be feasible for any reasonable government defender at this point. traffic analysis/direction finding/etc. burns bandwidth and latency budgets, so that might be harder, but you can do arbitrarily well.)

The US (government and citizens/private industry) probably has more to gain from universally strong COMSEC vs. effective USG SIGINT.

Also, the fellow you replied to didn't specify what sort of spying needs to be stopped. He could have no issue with foreign signals intelligence (which presumably means spying on non-US folks).

This phrasing seems to suggest that the intended target of FISA 702 - the US cloud data of non-US-resident non-US-citizens - enjoys Fourth Amendment-based protections, such as the probable cause requirement, under FISA 702. But in fact it seems that (IANAL) FISA 702 is compatible with the Fourth Amendment (if it is) only in the sense that slavery was compatible with the Fifth Amendment: simply because the Fifth Amendment does not apply to slaves. If 702 envisaged non-resident aliens' US cloud data as being protected by the Fourth Amendment then it would presumably require the US government to establish probable cause at the FISC (or some other court). But in fact 702 doesn't seem to require the government to claim any kind of cause or suspicion or even state any purpose or motivation for the search to the FISC. The FISA 702 PowerPoints obtained by the ACLU under FOI make it clear that the US government understands FISA 702 as removing the probable cause requirement http://www.aclu.org/files/pdfs/natsec/faafoia20101129/FAAFBI... .

Again, i have seen this in argument after argument. Nobody has yet provided any legal authority that states it is constitutional or legal for the government to compel forced lies. They can compel silence, for sure.

There is plenty of authority in other contexts (IE not national security), that the government cannot compel you to speak misleading or non-truthful information.

I wish this idea that everyone must be lying because the government can legally, force them to, would stop.

I imagine someone started with the NSL gag orders, which compel silence, and then just started saying they compel you to lie instead (which they don't).

In fact, even the compel silence part of the NSL was found unconstitutional.

1. I am very irritated at inaccurate and sensationalized reporting.

2. I think the USG should have been much more open and forthcoming, at least in the aggregate, about how foreign signals intelligence was coming into contact with online services used mostly by citizens.

3. I think leaking details of signals intelligence programs should be a crime.

4. I hope Google picks a giant fight with the DoJ and wins it.

For me, I don't believe there is even a piece wise approximation between time investment and privacy value because the tools are so much different and the available actions being constrained. To illustrate where I get hung up on that reasoning, if you build a phishing page setup and contract a botnet to spam few hundred million people with phone phish-spam, you might get a lot of "income" for a relatively small time investment, similarly you can get greatly increase your privacy by investing in forged identity documents. So at the least we would have to constrain the hours invested in legitimate ways to enhance ones privacy and legitimate ways to enhance one's income.

Next there is an issue of facilitating the effort, so when company A sells me raw materials at a modest markup they facilitate my ability to make a living using them to provide said raw materials.If instead they were to charge an extortionate mark up, I might still be able to make a living but I might find the effort to do so requiring many many more hours of time investment. So at what point do the actions of my raw materials supplier work for or against my efforts at generating income. Similarly the provider of my tools can make it easier or less easy for me to maintain my privacy, so for example a Google Drive plugin which let me keep everything on their servers encrypted. If Google provides that then its a small number of hours invested to enhance my privacy, but if I have to rely on a third party who is acting without support from Google, then it takes many more hours for the same level of enhancement.

Given these built in and essentially intractable forces which affect the efficiency of hours invested needed to achieve the desired result, I am not persuaded by your claim that I can evaluate the 'worth' of privacy using your proposed reasoning.

Google can, and apparently does, to things like warrant notices where if you are suddenly asked to reconfirm your acceptance of their terms of service it's a signal that a warrant was served to them that they had to turn over your data. I think these sorts of things help them in the eyes of their users and are not illegal. They meet the letter of the law and so are not actionable, just as their transferring of rights around amongst their national subsidiaries is a completely legal way of not paying more tax.

My call to action was to try to think of ways that would make things like the PRISM data not useful to the NSA and yet meet their obligations under the law. I mentioned one (in cloud encryption with client side decryption) but I am sure there are others.

However, you do bring up an interesting point, it is indeed harder to do "useful stuff" when the store is untrusted and has no idea what it's holding, string searches et al become pretty much impossible generally speaking, big bummer there.

Perhaps this will be a good accelerant for the adoption of homomorphic encryption algorithms?

- NSA 2013

(genuinely interested, because I did not know this)

I think this was the biggest bullshit signal for me (also a Googler, although a recent addition). The high rate of change of Google's infrastructure is astounding when you consider the scale it operates at. The notion of trying to maintain a functional API in secret of the scope they're talking about is laughable without a pretty sizable team.

Impossible? No, probably not, but really ridiculously unlikely.

2. The link out to the NSA would need to be massive as well. Would be very difficult to keep that secret. A 4G modem is not going to cut it.

3. Sure, but I imagine the NSA would be happy to put in the maintenance effort required. The data would have high ROI from their perspective.

So what. The world has access to the Linux source code. If I told you there was code in there that sent every byte written to disk to some external entity could you find it? Even if it was clear enough for you to find it, you'd have to be looking for it.

Further, you said yourself that googlers have access to almost all source code. How do you know something else isn't injected in before deployment. Honestly, the vast majority of googlers would have no idea and no way to have any idea if something like this were going on. Especially if people's jobs/freedom depending on no one knowing.

Are all internal Google communications encrypted? Probably not, but even if they are if you work in network security you likely hold the keys to that encryption regardless. You probably have access to their PKI keys as well.

For the facts that do indeed turn out to be true, soapbox away.