Risk
3/5/2013
03:56 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Government Google Data Requests: Scope Unclear

Google has begun disclosing limited information about U.S. government investigations that demand consumer data and, usually, silence from those cooperating.

Google Chromebook Pixel: Visual Tour
Google Chromebook Pixel: Visual Tour
(click image for larger view and for slideshow)
For the first time, Google has begun providing in its periodic Transparency Reports information about the number of National Security Letters it receives.

National Security Letters (NSL) are demands for information, issued to individuals or organizations by U.S. government agencies, primarily through the FBI, engaged in investigations that affect national security. The FBI uses these letters to obtain transactional information about phone calls and email correspondence from service providers, for example.

One of the things that distinguishes NSLs from other investigatory instruments such as subpoenas is that they typically come with a gag order that prohibits the recipient from revealing that a NSL was received.

Some NSLs have been successfully challenged in court, such as one issued to Brewster Kahle, founder of the Internet Archive, in 2007. But the courts have largely upheld the lawfulness of NSLs, which are supported under the Patriot Act.

[ Who says foreign IT workers are smarter? Read H-1B Workers Not Best Or Brightest, Study Says. ]

In order to reveal that it receives NSLs, Google obtained the consent of the U.S. government. "We're thankful to U.S. government officials for working with us to provide greater insight into the use of NSLs," said Richard Salgado, legal director of law enforcement and information security at Google, in a blog post.

However, Google's disclosure is deliberately vague. It is providing a numerical range of NSLs received rather than a specific number.

"This is to address concerns raised by the FBI, Justice Department and other agencies that releasing exact numbers might reveal information about investigations," explained Salgado.

Google says that it received somewhere between 0 and 999 NSLs each year from 2009 through 2012. Through this imprecise range of NSLs, U.S. authorities sought information about 1000 to 1999 user accounts each year except for 2010, when data about 2000 to 2999 accounts was demanded.

According to the U.S. Department of Justice, 24,287 NSLs were issued in 2010, a 64% increase from a year earlier.

Google declined to provide details about its discussions with government officials beyond noting that officials had been helpful in working with the company to allow limited disclosure. "We've been talking for a long time with the FBI and Department of Justice about how we can provide greater transparency, consistent with the law," a company spokesman said in an email. "They were thoughtful and cooperative in helping us achieve our goal of providing greater transparency about NSLs consistent with the law."

Google has been resisting overreaching government demands for information and censorship since 2005, when it fought the Justice Department's effort to obtain user search data. The company stood up against censorship in China and has continued to improve its Transparency Report over the past few years.

Eva Galperin, global policy analyst for the Electronic Frontier Foundation, said in a phone interview that although the EFF is excited that Google is providing NSL information for the first time, "the downside is that the aggregate numbers are so vague, it's really hard to tell if the number NSLs [Google is receiving] is rising or falling."

She added that the EFF continues to be concerned about NSLs because they're handled in such a secretive manner, with a complete lack of transparency and without sufficient checks and balances. "What you can really learn from this data is just how much we don't know about government surveillance," she said.

Galperin observed that although Google's leadership in transparency has inspired at least half a dozen other companies including Twitter and Sonic.Net, "there are still key players who don't even give us the most basic information about government requests." She said those key players include Facebook and Microsoft, which owns Skype.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant