Patriot Act Haunts Google Service 277
The Globe and Mail has an interesting piece taking a look at Google's latest headache, the US Government. Many people are suddenly deciding to spurn Google's services and applications because it opens up potential avenues of surveillance. "Some other organizations are banning Google's innovative tools outright to avoid the prospect of U.S. spooks combing through their data. Security experts say many firms are only just starting to realize the risks they assume by embracing Web-based collaborative tools hosted by a U.S. company, a problem even more acute in Canada where federal privacy rules are at odds with U.S. security measures."
Privacy is an illusion (Score:5, Insightful)
The war was fought. We lost. I don't blame people from other nations for being concerned but if they haven't already lost privacy where they live they soon will, and it isn't coming back.
How did google get singled out? (Score:5, Insightful)
Re:"Patriot" act (Score:5, Insightful)
All they have to do is shout "Think of the children" or "We need this to fight terrorism" and the majority who have no interest in delving into the consequences of any given action will line up behind them like good little citizens.
Re:Privacy is an illusion (Score:2, Insightful)
The only question is, WILL they fight?
Huh??? (Score:5, Insightful)
Google has fought when the US government wanted them to turn over customer records in the past. They do not seem to cooperate with the US government anymore than is required by law. Anytime you use a hosted service you loose some privacy. Once the data leaves your systems you have lost some privacy and control.
If you want to scream at Google for not living up to there "Don't be evil" line. I suggest that there following US laws it far less evil than their good relationship with China.
Tragically PGP is too hard to use (Score:5, Insightful)
Never mind the fact that almost no one except serious geeks have even heard of, much less actually understands, public key encryption.
database =! security (Score:4, Insightful)
Google isn't doing nearly enough to keeps its users informed about privacy issues. A press release saying "We're doing everything we can" isn't nearly good enough from the company that wants to organize all the world's information.
If anything, the federal law enforcement should be watching Google to ensure they aren't violating their user's privacy.
Part of me is hopeful that eventually the misguided people in government who think you can fight terrorism with a database will learn and change. Not everyone in the government is as evil as Bush/Rove/Cheney. If databases stopped terrorism, we wouldn't have had 9/11...at least one person on each of the 9/11 planes was on the terrorist watch list (in the database).
Re:Not good enough (Score:5, Insightful)
'Mark you out?' The fact of the matter is, everything we transmit outside of the firewall is subject to surveillance these days. And most companies have no clue how much of their data is crossing the firewall every day.
I don't know why people are getting their knickers in a knot over Google, when the main problem lies with the US backbone carriers, who - with only one known exception - have opened their networks to constant and widespread monitoring by US security agencies. Google at very least had the guts to fight a public legal battle with the Feds over release of even sanitised data.
The story here may be the danger to companies when they bring these companies inside the firewall, but again, refusing to trust Google is a funny place to start enforcing data integrity. The plain and simple fact is that the greatest threat of corporate data leaks is from staff who, whether through sins of omission or commission, carry sensitive data on laptops, thumb drives, CDs without any protections whatsoever.
I'd like to believe that data protection regimes are so advanced in these companies that the potential threat posed by Google and other online services is the main concern, but I find that impossible to do. I have to conclude, therefore that this is nothing more than a tiny kernel of truth wrapped in chocolatey FUD-ness that PHBs and corporate counsel love so much.
Re:"Patriot" act (Score:5, Insightful)
Re:Not good enough (Score:2, Insightful)
Re:Not good enough (Score:4, Insightful)
Point taken.
... And I'm really glad you're not in charge. 8^)
An example consequence (Score:4, Insightful)
No rule of law with data hosted in the US (Score:5, Insightful)
Here in Canada this has been a big deal now for the last couple of years. I've been at many IT meetings where tracking down what was hosted on US-based servers and removing it back to Canada has been on the agenda. We're not perfect here but we do have PIPEDA [privcom.gc.ca], the protection of privacy act, binding our ISPs. You need access to data, convince a judge and get a warrant. That's the rule of law.
That this US government data free-for-all has not been a big deal to American sysadmins has been a source of more than a little concern and confusion to us here north of the border. As long as there remains an Emperor in the White House rather than a President I guess there will be no movement on this.
Erased White House email, backups, and hard drives without penalty despite a legal court order? That's some government you guys have running there. You might want to do something about it.
Re:Time for google.ca? (Score:5, Insightful)
annex The Great White North
Be very careful! Look what happened the last time the US fell out with Canada! http://en.wikipedia.org/wiki/Burning_of_Washington [wikipedia.org]
Re:"Patriot" act (Score:4, Insightful)
I really think most people in Congress try to do the right thing. A police state, in theory, is SAFER than a free society. If we all lived in a supermax prison, had our nutritional balanced meals fed to us every day, had a mandated exercise program, forced healthcare and bars on the door we'd probably all live a lot longer.
Problem is this country was based on liberty, but freedom comes with a lot of risk and responsibilities. When people are free to do what they want there are a certain segment that will abuse those freedoms by blowing up buildings or shooting people in college classrooms. Unfortunately, most people don't want to be free, they want to be safe, and Congress tries to do what the people want. Historically, this is how cultures survived. Rulers came to power because they could protect their citizens. Sure, they got rich and powerful in the process, but why shouldn't they. They were protecting their people.
The Patriot Act is just another method to keep people safe. Until the average Joe decides he would rather be free than safe, the oppression will continue.
Re:Not good enough (Score:4, Insightful)
Who dat?
Ir surpasses understanding... (Score:5, Insightful)
Re:"Patriot" act (Score:5, Insightful)
Re:Tragically PGP is too hard to use (Score:5, Insightful)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hey dude, how's it going?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFH6CrifPJd VEzW7qwRAs8fAKCSg8j qWO8zfHpIrNKJ zBtrHF54UwCfQWhO
lGZk7Ys4hl e1OqxyEuHn1EY=
=izSS
-----END PGP SIGNATURE-----
If I sent this it a non-geek they'd probably go WTF? and tell me my email program is broken.
It would need to be transparently integrated into all popular email programs so that no one actually needs to see the code in their inbox. An argument could be made that in the long run PGP has actually made the problem worse by allowing email vendors to punt on the concept of encryption and just tell users "if you want encryption use PGP" instead of having to develop an integrated solution that actually works well enough for mass adoption.
Are they just NOW figuring that out? (Score:5, Insightful)
At some point, the rest of the world will tire of these policies and take step to make the U.S. less relevant.
we've seen this ourselves (Score:3, Insightful)
We have several customers who have dedicated servers with us where one of their deciding factors in choosing us was that we can offer them service out of our Vancouver data centre.
In some cases this is not just a 'nice to have' feature. For some customers, putting their data in the US would be illegal - the patriot act is not compatible with our privacy laws.
Re:Time for google.ca? (Score:3, Insightful)
Re:Not good enough (Score:3, Insightful)
Now the only public battle I saw between google and US agencies was, the very public battle that google fought so they did not have to give it away the valuable data they now own for free.
When it comes to securing a companies data, they of course mention the dominant provider of services, rather than rattling off a whole list. So why would any company allow external companies that also provide services to their competitors access to their companies data or their business communications. Whilst the certainly does put the carriers in the spot light and obviously require a complete review of their operations, it still makes google look far worse as they are the most infamous collectors and collators of other peoples information known on the net.
So really this is just the beginning, as privacy is catching up the the internet, and companies seek default secure communications and data enforced by law, so individuals will gain protection by those same laws, a major shift in privacy landscape, that google amongst many others will be forced to adjust to as the laws are updated.
Re:Only terrorists host files abroad! (Score:5, Insightful)
Re:Huh??? (Score:3, Insightful)
That's what we've been told...by Google. There's no way of knowing what they log, or what they hand over, while they supply plenty of dramatics to keep us distracted.
Re:No rule of law with data hosted in the US (Score:3, Insightful)
Sure sounds like a free-for-all to me. Laws work differently than that.
About someone else's point about people and data bypassing the US, it is already happening. You'll never see that on US news though so try reading non-US newspapers and non-US news sources.
Re:"Patriot" act (Score:4, Insightful)
you only want what they tell you to want
But really, you could decrease bombings, high-school shootings, and all of that shit, by not actively trying to destroy governments of foreign countries, and by instead spending that amount of money on fighting poverty and uneducation. People being too little educated as they are, they are easily convinced to believe the "let's invade and stop terrorism" stuff they are told.
As for "how cultures survived", I am not sure if you can give me the name of a culture that traded freedom for oppression that survived in a healthy way.
between government and a profit-seeking corporatio (Score:2, Insightful)
Government is watched by whom?
Private, profit-seeking corporation is watched by whom?
I don't think there is a good alternative.
Re:This could work (Score:3, Insightful)
That was really the most frightening part of the whole thing, although few people picked up on it (apparently--maybe those that did were just hustled off in the middle of the night and shot). With those provisions, we have absolutely no idea how often the act is being used or to what ends. Presumably the subpoenas you were issued weren't part of PATRIOT investigations, though.
Re:This could work (Score:4, Insightful)
I believe you were entirely within your rights to act as you did, Fyodor, but would be grateful if you'd take a moment to elaborate on why you chose your course of action.
From Securityfocus's account [securityfocus.com] and your own [seclists.org] it sounds like the FBI was trying to chase down a botnet that, as part of some process, downloaded Nmap 3.77. You emphasized that their requests were very narrowly crafted: a specific file requested via a specific user-agent within a specific five-minute window. It certainly didn't sound like a fishing expedition. If I had to guess, the requests were probably tied to the investigation of a specific criminal act or actor and they were trying to strengthen a case by establishing place-and-time.
My sleep-deprived analogy is this:
Meanwhile, you are the owner of Fyodor's Hardware, the busiest hardware store in three counties, and the tri-county area's only seller of Stihl chainsaws and accessories. You easily sell forty or fifty replacement chains a day.
So this morning the sheriff comes to you and asks if you sold or installed a 16" Stihl chain yesterday between 11:00 AM and 2:00 PM, and if so who did you sell it to. In fact, you sold ten, just like any other day.
Not a perfect analogy, I know, but seriously, what do you do? I mean, you could make him come back with a subpoena, but let's skip that step and get to the crux of the matter: You sold ten new 16" Stihl chains yesterday and it's the sheriff's opinion that one of them probably went to the chainsaw burglar. You, he and every defense attorney and Slashdotter all know there's always the chance the burglar got the chain somewhere else and that at least nine of your sales were to honest customers. If you tell the sheriff about all ten sales, to what extent (if any) have you violated the rights of all the non-criminal chain buyers? If on the other hand you refuse to cooperate, how do you justify the social cost of the continued burglaries against the rights of ordinary chain buyers?
I think it's an interesting dilemma. As I said, I certainly respect that you took a principled stand (or at least stayed slippery enough that you didn't have to), but not everything that law enforcement -- even the FBI -- does is a sinister conspiracy against civil liberties. Sometimes they really are just trying to catch a bad guy.
Re:Tragically PGP is too hard to use (Score:3, Insightful)
I can only say that I haven't had that happen. I've never even had anybody ask what it is, and this almost certainly includes people who know nothing about public key encryption. People are also probably used to superfluous attachments since, for example, email clients that send HTML emails usually send both an HTML and a plain text version together using MIME.