Risk
3/5/2013
03:56 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Government Google Data Requests: Scope Unclear

Google has begun disclosing limited information about U.S. government investigations that demand consumer data and, usually, silence from those cooperating.

Google Chromebook Pixel: Visual Tour
Google Chromebook Pixel: Visual Tour
(click image for larger view and for slideshow)
For the first time, Google has begun providing in its periodic Transparency Reports information about the number of National Security Letters it receives.

National Security Letters (NSL) are demands for information, issued to individuals or organizations by U.S. government agencies, primarily through the FBI, engaged in investigations that affect national security. The FBI uses these letters to obtain transactional information about phone calls and email correspondence from service providers, for example.

One of the things that distinguishes NSLs from other investigatory instruments such as subpoenas is that they typically come with a gag order that prohibits the recipient from revealing that a NSL was received.

Some NSLs have been successfully challenged in court, such as one issued to Brewster Kahle, founder of the Internet Archive, in 2007. But the courts have largely upheld the lawfulness of NSLs, which are supported under the Patriot Act.

[ Who says foreign IT workers are smarter? Read H-1B Workers Not Best Or Brightest, Study Says. ]

In order to reveal that it receives NSLs, Google obtained the consent of the U.S. government. "We're thankful to U.S. government officials for working with us to provide greater insight into the use of NSLs," said Richard Salgado, legal director of law enforcement and information security at Google, in a blog post.

However, Google's disclosure is deliberately vague. It is providing a numerical range of NSLs received rather than a specific number.

"This is to address concerns raised by the FBI, Justice Department and other agencies that releasing exact numbers might reveal information about investigations," explained Salgado.

Google says that it received somewhere between 0 and 999 NSLs each year from 2009 through 2012. Through this imprecise range of NSLs, U.S. authorities sought information about 1000 to 1999 user accounts each year except for 2010, when data about 2000 to 2999 accounts was demanded.

According to the U.S. Department of Justice, 24,287 NSLs were issued in 2010, a 64% increase from a year earlier.

Google declined to provide details about its discussions with government officials beyond noting that officials had been helpful in working with the company to allow limited disclosure. "We've been talking for a long time with the FBI and Department of Justice about how we can provide greater transparency, consistent with the law," a company spokesman said in an email. "They were thoughtful and cooperative in helping us achieve our goal of providing greater transparency about NSLs consistent with the law."

Google has been resisting overreaching government demands for information and censorship since 2005, when it fought the Justice Department's effort to obtain user search data. The company stood up against censorship in China and has continued to improve its Transparency Report over the past few years.

Eva Galperin, global policy analyst for the Electronic Frontier Foundation, said in a phone interview that although the EFF is excited that Google is providing NSL information for the first time, "the downside is that the aggregate numbers are so vague, it's really hard to tell if the number NSLs [Google is receiving] is rising or falling."

She added that the EFF continues to be concerned about NSLs because they're handled in such a secretive manner, with a complete lack of transparency and without sufficient checks and balances. "What you can really learn from this data is just how much we don't know about government surveillance," she said.

Galperin observed that although Google's leadership in transparency has inspired at least half a dozen other companies including Twitter and Sonic.Net, "there are still key players who don't even give us the most basic information about government requests." She said those key players include Facebook and Microsoft, which owns Skype.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?