NSA begs to differ, on both counts https://www.theguardian.com/us-news/the-nsa-files

CIA too https://wikileaks.org/ciav7p1/

I do not believe that Google is voluntarily handing over any sensitive customer data to the NSA without legal compulsion. I would not be surprised if intelligence agencies around the world including US based ones target Google's communications (probably in full accordance to each agency's authorization) but that would not be with Google's cooperation.

I believe that Google is taking steps to protect customer data from all bad actors, including Government agencies. One initiative that was underway around the time I worked at Google was to encrypt all the data-center to data-center traffic at Google in an attempt to frustrate anyone who was tapping Google's backbone links.

Why does it matter if it's under legal compulsion or not. At the end of the day they are handing over your data. They could choose not to store it, thus making it impossible to do, but they don't.

Because we are all obliged to follow the law.

B) They could organize it so that even when the law comes asking, they can't comply, but they don't.

What matters is that they are acting insecurely, and providing data that they shouldn't be storing/providing in the first place. The law is irrelevant here.

In the court system, not by disobeying.

Your view of 'what is unjust' is likely completely different from the view of others.

Particularly in this case, I don't have any problem with Google or FB handing over data for individuals under investigation, wherein a Judge had provided a warrant. This is 'legal' in every sense of the term and has been for some time.

As for 'mass surveillance' - well, this was a murkier area, and has been cleared up by the Supreme Court, and I don't suspect they are doing it.

If Google does not want to hand over data to officials producing warrants, they can take it up in court, and try to get an injunction against the process of handing over. If a judge feels there is merit to the case, they will grant the injunction while the case is being resolved.

"They could organize it so that even when the law comes asking, they can't comply, but they don't."

Nope. They can organize all they want, but if the Government is well within legal limits, Google et. al. would face some serious pain. Again for 'mass surveillance' stuff (i.e. legal ambiguity a few years ago), they'd have some legal footing to fight (i.e. try for injunctions), but for other things, not so much.

Which cannot be done, when any issues with these laws are discussed in "secret courts" [0], and where the individuals involved cannot reach out to experts in the field, because their hands are tied by gag orders.

The strength of the warrant becomes less when you recognise that FISA approves almost every request it gets. The warrant is little more than a proforma.

The structure of the current laws prevents a lawful answer to the situation.

I can't advocate breaking the law, that would be going against myself.

But neither can I advocate for the law, here, because it is failing to protect the people of the nation, from the power of the nation.

[0] http://edition.cnn.com/2017/03/08/politics/fisa-court-explai...

And that only about 1500 FISA requests are granted a year, which is a very small number for 300 M people, relating to another 7 Billion.

A single case might yield 5 or 10 warrants, ergo, possibly as few as 150 serious cases.

That's small.

That 'they are almost always granted' is not so bad in and of itself. If there's a 'known process' for getting warrants, and law enforcement knows what will be approved and what won't - well - then there shouldn't be too many that are denied.

Underlying the 'warrant' is not something 'pro forma' - it's a set of expectations and requirements upon the part of the overview system in place. The 'form' requires that the applicant fulfills some very important criteria.

I do think it's fair to be suspicious and that we should be vigilant about it, but I don't think that 1500 requests a year is too out of line.

I think the big concern is the 'mass surveillance' - or when local cops are making requests to do local-yocal small cases that don't have relevance to things like actual terrorism.

Those 1500 requests cover about 15 million people though, which skews the weighting. That gives me concern.

> If there's a 'known process' for getting warrants, and law enforcement knows what will be approved and what won't

Either that, or there is a culture that rejecting a warrant needs extenuating circumstances, in which case it becomes a large concern.

We can't know if the oversight is simply managerial, or actually effective. It's done with the utmost secrecy, with many punishments awaiting any who might speak out.

> I think the big concern is the 'mass surveillance' - or when local cops are making requests to do local-yocal small cases that don't have relevance to things like actual terrorism.

Unfortunately FISA enables mass surveillance. And the checks and balances seem heavily weighted against the individual, and in favour of a state they can't oppose.

> Nope. They can organize all they want, but if the Government is well within legal limits

You are misunderstanding what I mean here: Google can make it so that nobody except the user can read their data, but Google chooses not to. If they did this (read: the correct/secure way), then the government can ask all they want, and Google would be unable to comply.

Yet, their info got out. If they got hacked....

If the US government wants your data and it's being held in a US company, then IT security isn't the issue, it's the legal framework. No IT security will help when armed agents of the government legally enter your business and coerce you into handing over your data.

The US Government can equally detain you directly and coerce you into handing over all of your data if that's what the law allows.

Only people with security clearance can access government cloud facilities

Are you serious? Wasn't Google found to be sending data between their data centers in plain text?

https://www.theverge.com/2013/10/30/5046958/nsa-secretly-tap...

We most certainly cannot excuse them.

The fact that they have the best engineers and the best infrastructure, doesn't mean that they are able to find all vulnerabilities and fix them in time. The only way to do it, is to have a proof that system is secure which is beyond our reach today.

Accepting that statement at face value, I would still caution: today they do.

What happens in 10 years when the bloom is off of the rose, and either cannot attract top talent or have ignored the need to stay on top of their game?

That data's still there.

But the Google and Facebook security teams are particularly motivated to protect Google and Facebook, not me. If our interests happen to align, then I reap the benefits; but if they conflict, or even if they don't align particularly well, then the sterling quality of those teams becomes more or less useless to me.

That's a pretty significant hedge.

Also, how effective are Google's processes against dishonest employees? It would not be hard for, say, the Chinese government to plant a mole in Google's security team. (Actually, the real nightmare scenario is a Chinese mole in Intel or Apple's hardware team.)

A Google search didn't immediately clarify. What is 'SRE'? The most plausible de-abbreviation I could find was "site reliability engineer".

While data at Google is tightly protected, everything else at Google is fairly transparent. In particular, you can see who is using what resources. SREs, among other things, monitor and manage this resource usage. Large, abnormal usages ("Why is someone copying all this data off-site?") will be noticed, and some of the people who will notice won't take "because the NSA told us to" as an acceptable answer.

With many thousands of engineers it is totally possible for bad actors to have infiltrated Google. It's one of the reasons why there are such strict protocols for accessing customer data or production hardware. The idea is that by default no one has access to anything and that all accesses to data and production hardware are logged and audited.

I'm sure there're still opportunities for a rogue employee to do something bad but Google are way better at protecting access to their customer's data than many of the companies I've seen.

I can and do blame them without hesitation. They could choose not to store that data, or make it zero-knowledge-based, yet they choose not to.

Just because they've been compelled to hand over data via legal means does not excuse them for doing the wrong/insecure thing in the first place.

It's possibly true that Google doesn't intentionally share data. But a nonzero fraction of Google's employees are actually working for the intelligence services of various countries.

The fraction is debatable but it's naive/misleading to pretend that the big tech Co's aren't thoroughly penetrated by every halfway respectable intelligence outfit.

However, I was an Assistant Director (which is a senior tech / middle management kind of level) at first an intelligence agency, and then at a similar grade in a law enforcement organization and then later a security engineer at Google.

The idea that an intelligence agency (or law enforcement agency) would ask Google for help isn't far fetched, in fact when I was in law enforcement we'd ask private companies for help all the time. Some of the time they'd help, the rest of the time they tell us to come back with a warrant.

Google was famously in the second category, to the point where we'd not even bother asking. Even if we had a warrant we'd hesitate because we'd expect Google to challenge the warrant in court and it'd be a huge expensive hassle.

When I worked at Google it was the same, the idea of sharing private information with anyone was anathema. Engineers even being able to see private information without an audit trail and alarms going off was next to impossible.

The idea of a secret extra-legal conduit of information from Google to the US Government seems so far fetched to me that I have trouble even considering it. If there is a conduit for information it's there because the US Government has some legal instrument to compel Google to create it and that Google grudgingly has accepted the instrument as valid.

But what do I know, like I said, I wasn't the CEO of Google or DIRNSA. Maybe I just was never in the right rooms or policy meetings? Maybe everything I saw was staged for my benefit.

In reality, the explanation was even simpler: in the US, authorities either didn't bother asking, as you said, or put the effort in crafting a proper request.

Elsewhere, they assumed they could obtain anything (or remove anything about a local figure), just because they had a badge. In some cases, the requests were so ridiculous that they had to be educated about how the law worked in their own country. Over time, compliance increased in those countries as well.

It's also an open question how much data Google is compelled to share by law in the age of NSLs.