Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google handed over years of e-mails belonging to WikiLeaks chatroom admin

arstechnica.com

Post reply on HN
Print view View original

31–40 of 85 posts

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#31

Post by betterunix »

superuser2 wrote: post #4
ferdo wrote: post #2

I've never owned a gmail account but have sent to plenty. Gmail is like the 21st century party landline but only a relative few people can listen in. > Because I talked to Julian Assange, all information held by Google relating to my user account with them can be handed over to US prosecutors—not just the contents of my conversations with Julian. There it is: If you have online contact with someone that's of interest…

Have you considered the possibility that we hear about surveillance of GMail accounts only because so many people happen to use GMail? Is there any particular property of Google that makes it more likely to cooperate with government than any other email provider? Or, if you're in the "host your own email" crowd, what makes you think your ISP won't cooperate with the government just like Google does?

Here is the difference between GMail and a self-hosted email system: when you delete messages over IMAP, they do not get deleted in GMail. "All Mail" keeps all your mail, forever, unless you log in via the web interface and delete it manually. You could always use the web interface, but now encrypting your messages is much harder.

These are the sort of design decisions that can have far-reaching implications. Google was not thinking about protecting its users from government surveillance when it designed GMail.

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#32

Post by betterunix »

superuser2 wrote: post #24
thrownaway2424 wrote: post #16

Earlier quoted context omitted.

If your email server were under your bed, the FBI would just serve the warrant on you in person, seize your computer and all other computers in the same building, any spare disk drives, routers, appliances, and whatnot laying around, and probably half of the rest of your belongings besides. For those of you outside the USA, the NSA/DIA will just hack into your server and take your email.

It is worth noting that they often choose to do this the "loud" way, but the FBI has been granted warrants to pick people's locks and copy their hard drives without leaving traces. Alarm monitoring companies are also subject to the jurisdiction of the United States, so that won't help you either.

It is also worth noting that the problem here is how easily the FBI can access your mail from GMail. Sneaking into a house requires sending agents into the field, watching a person to make sure they are not going to walk in on you, being very careful not to leave a trace or wind up on a security camera they set up, etc. The FBI only has so many people it can dedicate to these sorts of activities. They are not going to be able to do this to you, and your friends, and their friends; it's too costly and runs too high a risk of tipping off the target.

With GMail, the agents do not even need to leave their desks. Just fax the court order to Google, and a few hours later you have thousands of emails waiting for you to read. Want to read the emails of the targets' acquaintances? Just send another fax! Nobody has to know, just call it a national security matter!

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#34

Post by breck »

jholman wrote: post #30
breck wrote: post #9

Earlier quoted context omitted.

Push back more on the request? The 4th amendment includes this part: "particularly describing the place to be searched, and the persons or things to be seized" Describing what you want as " all e-mails " is exactly the type of description this part of the amendment is meant to prevent. It's way too broad.

Google has a legal team whose full-time job is pushing back on these requests. At some point, they have to either obey the law, or go to prison themselves. Get off your high horse. It feels like some people won't be satisfied unless Google says "well, our existence has many benefits, but it also makes it slightly easier for the government to spy on people, so we're closing up shop".

I think Google is doing a great job. I was offering a suggestion of one angle they could play.

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#35

Post by thrownaway2424 »

betterunix wrote: post #23
thrownaway2424 wrote: post #14

Earlier quoted context omitted.

There is a 10-bullet list of the particular things to be seized. How would you have made it more specific?

By not having such broad categories of things to be seized. It is not "specific" to seize "every email message he sent to anyone ever."

I'm sure that will be of great interest if this person is ever charged with a crime. Until then, he has neither venue nor standing to challenge the warrant.

Imperfect warrants are a problem for the state at trial. Outside of trial, any old warrant will do.

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#36

Post by jholman »

Wilya wrote: post #25
thrownaway2424 wrote: post #16

Earlier quoted context omitted.

If your email server were under your bed, the FBI would just serve the warrant on you in person, seize your computer and all other computers in the same building, any spare disk drives, routers, appliances, and whatnot laying around, and probably half of the rest of your belongings besides. For those of you outside the USA, the NSA/DIA will just hack into your server and take your email.

The NSA isn't the almighty spirit of the internet. They can't just clap their hands and magically get access to any server on earth. And even if they can, it certainly doesn't make the evidence obtained that way acceptable in court. I don't like this argument that since the NSA is almighty, avoiding Gmail for security reasons is stupid. For the US government, accessing emails stored under my bed may not be impossible…

Yes and no. In some circumstances I agree with you, in other circumstances I think you have it backward.

I shall enumerate some cases (note that US citizens always count as "inside the US" in this case breakdown):

* inside the US, old-school warrant exists * inside the US, secret warrant exists * inside the US, no legal authority * outside the US, no legal authority * outside the US, weird US-logic legal authority

1) If you're inside the US, and the cops have a non-gag-order warrant, you're no safer with your own server. With your server, they serve you, you know about it; with gmail, they serve Google, and Google tells you about it. No difference.

2) If you're inside the US, and they use a secret warrant, in this case your own server might be better. They can probably still do something tricky to you, without you knowing, but using GMail makes it slightly easier for them to get your information without your knowledge.

3) If you're inside the US, and they have no legal authority, then you're fine in both cases. Unless they break into your server illegally. In this case, their job will be orders of magnitude easier if you run your own server.

4) If you're outside the US, and they have no legal authority at all, same as the previous point: if they try to break in, their job will be orders of magnitude easier if you run your own server.

5) If you're outside the US, they might get FISA clearance to get your stuff. In this case, I think you're better off with your own server. This is comparing Google's legal pushback vs breaking into your server. It's totally possible that breaking into your server is orders of magnitude harder than convincing Google that they have legal authority.

In an ideal world, this last case would only apply to political enemies of the US. You'd be able to figure out for yourself if it applied to you, and act accordingly. What kind of idiot uses a US company to plan terrorist attacks on US interests, amirite? Or to leak things to wikileaks (categorize that however you like). But what is much much less clear is whether the US does in fact use this type of surveillance to unethically benefit US corporations, for example. We've heard unsubstantiated accusations to that effect; nothing in my life experience helps me to know if I do or do not live in that kind of world.

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#37

Post by betterunix »

cinquemb wrote: post #29
superuser2 wrote: post #24

Earlier quoted context omitted.

It is worth noting that they often choose to do this the "loud" way, but the FBI has been granted warrants to pick people's locks and copy their hard drives without leaving traces. Alarm monitoring companies are also subject to the jurisdiction of the United States, so that won't help you either.

Someone could rig up their own system to notify themselves which is very doable. I can see the situation where someone gets notified, then emails their server to backup offsite, and wipe the hard drives (and for those well versed in demo, there's always that option…).

Why wipe the hard drives? Use WDE, and have the alarm (a) unmount the drive, (b) overwrite the system's RAM with 0s (or at least the portion of RAM where the keys are stored), and (c) power down the system. That is a lot faster that making a backup and wiping the drives; by the time an agent has snuck in and located the computer, the process should be over.

Also, it might help to install a security camera, so you can tell the difference between a rat triggering the alarm and an FBI agent (I'll leave it to the audience to make a few jokes). Alarm is triggered, the camera starts sending pictures of the intruders to your smartphone or to Usenet (encrypted, using a key you keep on a smartcard) or whatever.

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#38

Post by throwaway10001 »

jholman wrote: post #30
breck wrote: post #9

Earlier quoted context omitted.

Push back more on the request? The 4th amendment includes this part: "particularly describing the place to be searched, and the persons or things to be seized" Describing what you want as " all e-mails " is exactly the type of description this part of the amendment is meant to prevent. It's way too broad.

Google has a legal team whose full-time job is pushing back on these requests. At some point, they have to either obey the law, or go to prison themselves. Get off your high horse. It feels like some people won't be satisfied unless Google says "well, our existence has many benefits, but it also makes it slightly easier for the government to spy on people, so we're closing up shop".

Google has a legal team whose full-time job is pushing back on these requests. At some point, they have to either obey the law, or go to prison themselves. Get off your high horse.

Google has a business model whose entire premise is to push the envelope on privacy and to collect as much as possible and hold it forever--to make a few extra pennies per user. Get off your high horse. Google (and FB) is /are a menace to us all, even if only because they gather so much private data about us.

Re: Google handed over years of e-mails belonging to WikiLeaks chatroom admin

#40

Post by thrownaway2424 »

betterunix wrote: post #20
Jabbles wrote: post #3

What could Google have done better? (Specifically in regards to this case. And assuming they pushed back on orders like this, like they claim to do.)

The way I see it, Google set up a system that is easy to conduct surveillance on. Gigabytes of storage, no way to actually delete messages over IMAP or POP3, and in various subtle ways GMail discourages the use of encryption. This is all probably inadvertent, but it indicates that protecting users from this sort of surveillance is not a priority.

I believe you made this claim twice in this thread. Kindly visit your gmail settings, which offers these choices:

When a message is marked as deleted and expunged from the last visible IMAP folder:

* Archive the message (default)

* Move the message to the Trash

* Immediately delete the message forever

Ok then.

Post reply on HN