Google on NSA: No server access, no back door, no drop box, no free-for-all

I'm still leaning toward the idea that if this is happening at all, it's happening at the ISP/Backbone level. Which would mean none of these companies are lying- but still that the Government is way overstepping, by leaps and bounds.

There's also the distinct possibility this is all bullshit. There have been a lot of holes and misinformation on Snowden's side("They can watch your thoughts form as you type", when none of the services except for GMail send textual data at real-time, etc), and the Q&A either doubled down some of them or was trying to be misleading.

I'm still waiting for the Guardian to stop milking this and just give us the rest of the slides, the rest of their evidence. At this point, my confidence in the story is shaken enough that I want more if I'm gonna go Pitchfork in hand at the NSA with all of this.

I'm sorry, but I can't take these statements at face value. Those PRISM slides have not exactly been disavowed by the NSA, and they make it quite clear that there is some kind of "program" that Google (and others) are part of. I don't buy that it's no more than "you send us a court order and we send you the data" because that wouldn't justify having a name ("PRISM") and a list of "join dates" for the various companies, etc.

Simply put, I think Google, Yahoo, Apple, MS, etc. are all lying about their involvement in all this, to some extent. Maybe the NSA does or doesn't have "direct" access (whatever you think that means) but I believe there is something going on, beyond the run of the mill request/response scenario.

Given that it's from a lawyer also, who no offence are often skilled at lying by telling only the truth, it does make me a little hesitant to accept this. I'd rather hear it directly from the CEO or some senior engineer, in the hope that they'd know there's not some legal loophole they have to tread carefully around as they speak.

Great that Google are saying this though. Let's fix the politics, stop the secret court rulings and gag orders and have them say it one last time, along with the approximate number of users effected by all requests ever.

Yahoo fought Prism and failed: http://www.newyorker.com/online/blogs/closeread/2013/06/yaho....

Yahoo now wants us to believe that this was a court order saying, in effect, Yahoo must comply with court orders to turn over specific user data. WTF? Yahoo also wants its users to believe that Prism is nothing to worry about, even though it tried to fight it back in 2008. "Notwithstanding the parade of horribles trotted out by the petitioner ... Little more than a lament about the risk that government officials will not operate in good faith." Nothing to see here folks, move along!

At this point, it seems more plausible to me that Google is telling the truth here and the Prism slides are either inaccurate or refer to DPI reconstruction or just a live hosting/presentation environment for conventionally-delivered dossiers. I can't see Google intentionally making statements which are both incorrect and falsifiable to this degree, especially since it looks like more leaks are coming, or actual official declassifications.

There is absolutely some horrible shit going down -- backbone sniffing and DPI, mass telephone metadata (and either OTA or carrier-delivered copies of content for "interesting" numbers and maybe areas), etc. And, there are serious future trust issues with cloud computing. But, at this time, I don't think NSA has pervasive access at Google -- I'm sure they (and the Chinese, Israel, and others) have Google staff who they know are likely to be "friendly" if they actually did need to do something (much much more applicable to non-US agencies), but even that doesn't need to be formalized until used.

Because NSA has so many other tools (legal and technical) to use, I don't think they do high-odds-of-being-detected stuff, certainly not on a widespread basis. Active MITM of connections, or really intrusive requests to companies, seems unlikely.

This is not the case for China, Israel, etc., so they are far far more likely to use external or internal attacks (other than legal) to get data from companies. And, guess what -- look at the news or your own networks -- lots of attacks from China, some quite sophisticated and successful.

I'd actually say there are higher odds of a given Google SRE being purely commercially evil and selling access to crime organizations than that NSA is doing this actively against Google.

This all means the threat is every bit as real as if NSA were doing it pervasively if you're likely to be a target. I don't think we ever thought NSA was using its pervasive monitoring for anything other than ultimately going after some specific targets, not for general law enforcement risk, so the situation is no different either way -- you can mostly trust Google if you blend in, but can't if you're "interesting".

Against some kind of pervasive secret program involving many people: The odds of a single Googler on any team being a "whistleblower" are far higher than the odds at NSA, and we've had a lot of espionage leaks over the years, plus actual leakers.

Occam's razor is that Google is telling the truth here.

I believe these statements are sidestepping the facts. Explicit requests for user data and backdoor access are a separate issue. If Prism involves capturing and storing packets at major Internet backbones (perhaps just upstream from private networks like Google's), anything plaintext could be searched and extracted after the fact - email messages, web browsing, chat, etc. To this day, a significant amount of communication related Internet traffic is not encrypted. I've worked on software that does exactly this. Here is a public marketing writeup:

"Every packet is recorded, classified, and indexed, making quick discovery, reconstruction, and delivery of files in their original formats easy and intuitive. Reconstruct email attachments, windows file transfers, PDF, Word, PowerPoint, Excel, and more, giving you full visibility into everything on your network.... Show all activity over time for a single user or all file-type activity over time for all users."

NSA could apply simple port based filtering to limit capture to only those packets related to communication, thereby streamlining storage requirements. If this was the Prism architecture, then these company statements would be truthful, but misleading. The NSA does not have direct access to their systems or user data, but if the NSA is allowed to record user traffic before it enters, or after it leaves their doors, then the end result is similar.

The problem is that Google's business model fundamentally makes it into a liability for a free society. The more they stockpile data on people, the more dangerous they become.

Unless we have a change in the constitution that spells out a clear limit on the government's right to access this data (and for that matter, limits google's own rights to use it), the risk of misuse will only grow. Even if the NSA's access today is somewhat limited, the risk won't get any less.

Google is like a fireworks factory waiting for a stray spark.

Of course, the one thing we know for certain is that to the extent that a company is required to assist with extra-Constitutional surveillance efforts, they are also required to lie about it if asked.

So this is yet another zero-information thread on the subject.

It seems strange that they didn't just say this in the first place.

Doesn't the government have the capability to force corporations to lie about matters of national security (of which the most benign form is a gag letter)? Or is that just FUD?

Why would the NSA be building a facility large enough to store a big chunk of the planet's digital info if they'll have data for only a few thousand Google users?

Qualifying Phrases of this decade:

"Under this program"

"That we know of"

"Not willfully"

They are like a get-out-of-jail-free card.

"No more illegal wiretapping of all US citizens like under Bush" (we'll just make it legal instead).