Risk
3/5/2013
03:56 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Government Google Data Requests: Scope Unclear

Google has begun disclosing limited information about U.S. government investigations that demand consumer data and, usually, silence from those cooperating.

Google Chromebook Pixel: Visual Tour
Google Chromebook Pixel: Visual Tour
(click image for larger view and for slideshow)
For the first time, Google has begun providing in its periodic Transparency Reports information about the number of National Security Letters it receives.

National Security Letters (NSL) are demands for information, issued to individuals or organizations by U.S. government agencies, primarily through the FBI, engaged in investigations that affect national security. The FBI uses these letters to obtain transactional information about phone calls and email correspondence from service providers, for example.

One of the things that distinguishes NSLs from other investigatory instruments such as subpoenas is that they typically come with a gag order that prohibits the recipient from revealing that a NSL was received.

Some NSLs have been successfully challenged in court, such as one issued to Brewster Kahle, founder of the Internet Archive, in 2007. But the courts have largely upheld the lawfulness of NSLs, which are supported under the Patriot Act.

[ Who says foreign IT workers are smarter? Read H-1B Workers Not Best Or Brightest, Study Says. ]

In order to reveal that it receives NSLs, Google obtained the consent of the U.S. government. "We're thankful to U.S. government officials for working with us to provide greater insight into the use of NSLs," said Richard Salgado, legal director of law enforcement and information security at Google, in a blog post.

However, Google's disclosure is deliberately vague. It is providing a numerical range of NSLs received rather than a specific number.

"This is to address concerns raised by the FBI, Justice Department and other agencies that releasing exact numbers might reveal information about investigations," explained Salgado.

Google says that it received somewhere between 0 and 999 NSLs each year from 2009 through 2012. Through this imprecise range of NSLs, U.S. authorities sought information about 1000 to 1999 user accounts each year except for 2010, when data about 2000 to 2999 accounts was demanded.

According to the U.S. Department of Justice, 24,287 NSLs were issued in 2010, a 64% increase from a year earlier.

Google declined to provide details about its discussions with government officials beyond noting that officials had been helpful in working with the company to allow limited disclosure. "We've been talking for a long time with the FBI and Department of Justice about how we can provide greater transparency, consistent with the law," a company spokesman said in an email. "They were thoughtful and cooperative in helping us achieve our goal of providing greater transparency about NSLs consistent with the law."

Google has been resisting overreaching government demands for information and censorship since 2005, when it fought the Justice Department's effort to obtain user search data. The company stood up against censorship in China and has continued to improve its Transparency Report over the past few years.

Eva Galperin, global policy analyst for the Electronic Frontier Foundation, said in a phone interview that although the EFF is excited that Google is providing NSL information for the first time, "the downside is that the aggregate numbers are so vague, it's really hard to tell if the number NSLs [Google is receiving] is rising or falling."

She added that the EFF continues to be concerned about NSLs because they're handled in such a secretive manner, with a complete lack of transparency and without sufficient checks and balances. "What you can really learn from this data is just how much we don't know about government surveillance," she said.

Galperin observed that although Google's leadership in transparency has inspired at least half a dozen other companies including Twitter and Sonic.Net, "there are still key players who don't even give us the most basic information about government requests." She said those key players include Facebook and Microsoft, which owns Skype.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.