Risk
3/5/2013
03:56 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Government Google Data Requests: Scope Unclear

Google has begun disclosing limited information about U.S. government investigations that demand consumer data and, usually, silence from those cooperating.

Google Chromebook Pixel: Visual Tour
Google Chromebook Pixel: Visual Tour
(click image for larger view and for slideshow)
For the first time, Google has begun providing in its periodic Transparency Reports information about the number of National Security Letters it receives.

National Security Letters (NSL) are demands for information, issued to individuals or organizations by U.S. government agencies, primarily through the FBI, engaged in investigations that affect national security. The FBI uses these letters to obtain transactional information about phone calls and email correspondence from service providers, for example.

One of the things that distinguishes NSLs from other investigatory instruments such as subpoenas is that they typically come with a gag order that prohibits the recipient from revealing that a NSL was received.

Some NSLs have been successfully challenged in court, such as one issued to Brewster Kahle, founder of the Internet Archive, in 2007. But the courts have largely upheld the lawfulness of NSLs, which are supported under the Patriot Act.

[ Who says foreign IT workers are smarter? Read H-1B Workers Not Best Or Brightest, Study Says. ]

In order to reveal that it receives NSLs, Google obtained the consent of the U.S. government. "We're thankful to U.S. government officials for working with us to provide greater insight into the use of NSLs," said Richard Salgado, legal director of law enforcement and information security at Google, in a blog post.

However, Google's disclosure is deliberately vague. It is providing a numerical range of NSLs received rather than a specific number.

"This is to address concerns raised by the FBI, Justice Department and other agencies that releasing exact numbers might reveal information about investigations," explained Salgado.

Google says that it received somewhere between 0 and 999 NSLs each year from 2009 through 2012. Through this imprecise range of NSLs, U.S. authorities sought information about 1000 to 1999 user accounts each year except for 2010, when data about 2000 to 2999 accounts was demanded.

According to the U.S. Department of Justice, 24,287 NSLs were issued in 2010, a 64% increase from a year earlier.

Google declined to provide details about its discussions with government officials beyond noting that officials had been helpful in working with the company to allow limited disclosure. "We've been talking for a long time with the FBI and Department of Justice about how we can provide greater transparency, consistent with the law," a company spokesman said in an email. "They were thoughtful and cooperative in helping us achieve our goal of providing greater transparency about NSLs consistent with the law."

Google has been resisting overreaching government demands for information and censorship since 2005, when it fought the Justice Department's effort to obtain user search data. The company stood up against censorship in China and has continued to improve its Transparency Report over the past few years.

Eva Galperin, global policy analyst for the Electronic Frontier Foundation, said in a phone interview that although the EFF is excited that Google is providing NSL information for the first time, "the downside is that the aggregate numbers are so vague, it's really hard to tell if the number NSLs [Google is receiving] is rising or falling."

She added that the EFF continues to be concerned about NSLs because they're handled in such a secretive manner, with a complete lack of transparency and without sufficient checks and balances. "What you can really learn from this data is just how much we don't know about government surveillance," she said.

Galperin observed that although Google's leadership in transparency has inspired at least half a dozen other companies including Twitter and Sonic.Net, "there are still key players who don't even give us the most basic information about government requests." She said those key players include Facebook and Microsoft, which owns Skype.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4720
Published: 2014-12-27
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2012-1203
Published: 2014-12-27
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.

CVE-2013-4663
Published: 2014-12-27
git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function.

CVE-2013-4793
Published: 2014-12-27
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

CVE-2013-5958
Published: 2014-12-27
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a si...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.