News for hackers. Stuff that matters.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by mcast on Tuesday September 12, 2017 @11:59AM (#15228371)
You're a little foolish to believe that some sensitive data within Google/Facebook/XYZ does not get shared outside with FVEY countries and intelligence agencies.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by arkem on Tuesday September 12, 2017 @12:05PM (#15228428)
As someone who has worked for a five eyes intelligence agency and at Google I can tell you that Google does not share sensitive data with the Government unless compelled to do so by law.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by lisper on Tuesday September 12, 2017 @12:13PM (#15228526)
> unless compelled to do so by law

That's a pretty significant hedge.

Also, how effective are Google's processes against dishonest employees? It would not be hard for, say, the Chinese government to plant a mole in Google's security team. (Actually, the real nightmare scenario is a Chinese mole in Intel or Apple's hardware team.)

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by saalweachter on Tuesday September 12, 2017 @12:25PM (#15228648)
Honestly Google is one of the few companies I know of which really considers internal threats and has taken precautions to reduce the likelihood that internal bad actors will have access, to reduce the scope of access to any bad actors that slip through, and to ensure that illegitimate accesses will be noticed, reducing the time a bad actor will have access.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by lisper on Tuesday September 12, 2017 @12:39PM (#15228806)
I believe you. But one still has to wonder who watches the watchmen.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by saalweachter on Tuesday September 12, 2017 @12:51PM (#15228947)
Crazy libertarian SREs. :-P
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by JadeNB on Tuesday September 12, 2017 @01:20PM (#15229224)
> Crazy libertarian SREs. :-P

A Google search didn't immediately clarify. What is 'SRE'? The most plausible de-abbreviation I could find was "site reliability engineer".

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by saalweachter on Tuesday September 12, 2017 @01:46PM (#15229474)
Site-reliability engineers is the correct de-abbreviation.

While data at Google is tightly protected, everything else at Google is fairly transparent. In particular, you can see who is using what resources. SREs, among other things, monitor and manage this resource usage. Large, abnormal usages ("Why is someone copying all this data off-site?") will be noticed, and some of the people who will notice won't take "because the NSA told us to" as an acceptable answer.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by klodolph on Tuesday September 12, 2017 @01:49PM (#15229503)
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by joshuamorton on Tuesday September 12, 2017 @01:27PM (#15229288)
That'd be the right abbreviation.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by arkem on Tuesday September 12, 2017 @12:34PM (#15228748)
Google fights against subpoenas and warrants all the time but sometimes they lose. At that point they have to comply or be held in contempt and I can't really blame Google for complying in that situation.

With many thousands of engineers it is totally possible for bad actors to have infiltrated Google. It's one of the reasons why there are such strict protocols for accessing customer data or production hardware. The idea is that by default no one has access to anything and that all accesses to data and production hardware are logged and audited.

I'm sure there're still opportunities for a rogue employee to do something bad but Google are way better at protecting access to their customer's data than many of the companies I've seen.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by CaptSpify on Tuesday September 12, 2017 @03:33PM (#15231217)
> Google fights against subpoenas and warrants all the time but sometimes they lose. At that point they have to comply or be held in contempt and I can't really blame Google for complying in that situation.

I can and do blame them without hesitation. They could choose not to store that data, or make it zero-knowledge-based, yet they choose not to.

Just because they've been compelled to hand over data via legal means does not excuse them for doing the wrong/insecure thing in the first place.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by evanlivingston on Tuesday September 12, 2017 @12:53PM (#15228963)
Do they fight against all subpoenas equally or do they make calls about which to fight and which to comply with? If they choose to comply with some, how do they make that call?
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by avn2109 on Tuesday September 12, 2017 @02:25PM (#15229990)
>> "...that Google does not share sensitive data with the Government..."

It's possibly true that Google doesn't intentionally share data. But a nonzero fraction of Google's employees are actually working for the intelligence services of various countries.

The fraction is debatable but it's naive/misleading to pretend that the big tech Co's aren't thoroughly penetrated by every halfway respectable intelligence outfit.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by psyc on Tuesday September 12, 2017 @12:11PM (#15228499)
Do you have the "pay grade" to be able to make this assertion credibly? One cannot, in general, see the forest for the trees. This adage is not merely a put-down.
Re:Forget Equifax. Facebook and Google Have the Data That Sh... by arkem on Tuesday September 12, 2017 @12:27PM (#15228663)
If you're asking whether I was the director of my agency or the CEO of Google then the answer is no. I have also not worked for the Government in about 6 years or Google in 4 years so maybe everything changed the moment I left.

However, I was an Assistant Director (which is a senior tech / middle management kind of level) at first an intelligence agency, and then at a similar grade in a law enforcement organization and then later a security engineer at Google.

The idea that an intelligence agency (or law enforcement agency) would ask Google for help isn't far fetched, in fact when I was in law enforcement we'd ask private companies for help all the time. Some of the time they'd help, the rest of the time they tell us to come back with a warrant.

Google was famously in the second category, to the point where we'd not even bother asking. Even if we had a warrant we'd hesitate because we'd expect Google to challenge the warrant in court and it'd be a huge expensive hassle.

When I worked at Google it was the same, the idea of sharing private information with anyone was anathema. Engineers even being able to see private information without an audit trail and alarms going off was next to impossible.

The idea of a secret extra-legal conduit of information from Google to the US Government seems so far fetched to me that I have trouble even considering it. If there is a conduit for information it's there because the US Government has some legal instrument to compel Google to create it and that Google grudgingly has accepted the instrument as valid.

But what do I know, like I said, I wasn't the CEO of Google or DIRNSA. Maybe I just was never in the right rooms or policy meetings? Maybe everything I saw was staged for my benefit.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by puzzle on Tuesday September 12, 2017 @01:02PM (#15229038)
I'm not sure if it's still the case, but there used be ample variability of compliance in Google's transparency report across the globe. Outsiders assumed that in the US the percentage was higher because Google was in bed with the FBI and co.

In reality, the explanation was even simpler: in the US, authorities either didn't bother asking, as you said, or put the effort in crafting a proper request.

Elsewhere, they assumed they could obtain anything (or remove anything about a local figure), just because they had a badge. In some cases, the requests were so ridiculous that they had to be educated about how the law worked in their own country. Over time, compliance increased in those countries as well.

Re:Forget Equifax. Facebook and Google Have the Data That Sh... by lisper on Tuesday September 12, 2017 @12:15PM (#15228534)
I worked for Google a long time ago and it's almost certainly true that this still official company policy. The real question is whether all Google employees always act in accordance with that policy. That is a much dicier proposition.

It's also an open question how much data Google is compelled to share by law in the age of NSLs.