51–60 of 85 posts
Earlier quoted context omitted.
By not having such broad categories of things to be seized. It is not "specific" to seize "every email message he sent to anyone ever."
Exactly. "All emails" negates all bullet points. It's like asking for 9 specific items in a real world warrant, and then point #10 is "and your whole house and everything in it".
Earlier quoted context omitted.
There is a 10-bullet list of the particular things to be seized. How would you have made it more specific?
By not having such broad categories of things to be seized. It is not "specific" to seize "every email message he sent to anyone ever."
In this case, the problem is not investigators overreaching the law. The problem is the amount of information consolidation modern technology enables and encourages.
Earlier quoted context omitted.
Here is the difference between GMail and a self-hosted email system: when you delete messages over IMAP, they do not get deleted in GMail. "All Mail" keeps all your mail , forever, unless you log in via the web interface and delete it manually. You could always use the web interface, but now encrypting your messages is much harder. These are the sort of design decisions that can have far-reaching implications. Google…
As others have noted elsewhere, that's not true: you can have it delete emails on delete, but you do have to turn that on yourself. It's not the default, and defaults matter, but it is an option that appears as soon as you click "enable IMAP" in gmail (go ahead and try it in your gmail settings). You'll have to read the options, yes, but considering the whole UX thing for gmail has been "never have to delete an email…
Really though, the point still stands: Google was not considering protecting its users from government surveillance to be a priority here. They probably had other reasons, maybe even well-justified reasons, for the defaults they chose, but those reasons only make sense in the context of their engineering requirements.
"Also, I hope your email client does secure deletes on local disk by default."
I do something better: whole disk encryption. Actually, since I use an SSD now, "securely deleting" anything is non-trivial; it is better to just negate the need for it by never storing plaintexts anywhere.
What could Google have done better? (Specifically in regards to this case. And assuming they pushed back on orders like this, like they claim to do.)
The way I see it, Google set up a system that is easy to conduct surveillance on. Gigabytes of storage, no way to actually delete messages over IMAP or POP3, and in various subtle ways GMail discourages the use of encryption. This is all probably inadvertent, but it indicates that protecting users from this sort of surveillance is not a priority.
Earlier quoted context omitted.
Someone could rig up their own system to notify themselves which is very doable. I can see the situation where someone gets notified, then emails their server to backup offsite, and wipe the hard drives (and for those well versed in demo, there's always that option…).
Evidence tampering is a federal felony. In this case it doesn't matter how well you covered your tracks - if they can prove you rigged a failsafe, you're going to jail anyway.
Because if someone is willing to go to those lengths on their own system, there's no possibility for the odds to be stacked in their favor…
Can someone clarify if Google had to reveal they had done this? The article implies that they did not, and thus the reveal was a "not evil" gesture of transparency. But I'm wondering if they may have known it would get out anyway and they are just getting in front of it. Anyone have more information?
Your wording implies that you think Google has something to hide or to be embarrassed about releasing the data, and that is not the case. The government asks for people's data all the time, and Google is legally obligated to provide the requested data. They then go the extra step and tell the users as soon as they are allowed to. There's nothing here to "get in front of."
Anyway sounds like it's generally a good guy move, just wanted to check what others thought.
Earlier quoted context omitted.
You don't know that actually deletes anything, and defaults matter. Also, https://news.ycombinator.com/item?id=5929421
If you don't believe that they delete it when you tell them to delete it, then using Gmail is already a non-starter. Also, yes, defaults do matter: the outcry from users from not being able to undelete an email would be much louder than those wanting instant deletion.
[citation needed]
Seriously, I have trouble believing that anyone would complain about "delete" carrying any meaning other than "delete." I also find it hard to take such people seriously, given the existence of a Trash folder as a first stop for deleted messages, and All Mail as a second stop (and what is the default for deleting from All Mail? Having the message come right back to All Mail! Brilliant...).
Thanks for the tip on how to fix this behavior. It is an easy option to miss...
Earlier quoted context omitted.
Push back more on the request? The 4th amendment includes this part: "particularly describing the place to be searched, and the persons or things to be seized" Describing what you want as " all e-mails " is exactly the type of description this part of the amendment is meant to prevent. It's way too broad.
Google has a legal team whose full-time job is pushing back on these requests. At some point, they have to either obey the law, or go to prison themselves. Get off your high horse. It feels like some people won't be satisfied unless Google says "well, our existence has many benefits, but it also makes it slightly easier for the government to spy on people, so we're closing up shop".
That's reasonable. A blanket warrant impacting all emails since the beginning of time is not reasonable.
If the cant name a crime and give a date or dates then they shouldn't be asking for a warrant.
Earlier quoted context omitted.
The way I see it, Google set up a system that is easy to conduct surveillance on. Gigabytes of storage, no way to actually delete messages over IMAP or POP3, and in various subtle ways GMail discourages the use of encryption. This is all probably inadvertent, but it indicates that protecting users from this sort of surveillance is not a priority.
I don't follow this stream of logic. If you have to build technical systems, the sole purpose of which is to sidestep laws, in order to be good then aren't the laws at fault here? I find the acceptance that governments will do whatever this wants, we will just use end to end encryption , TOR and Bitcoin defeats the purpose we have regulated currencies, governments and democracies. If there is an action item on the li…
Nobody is talking about sidestepping laws. You are not breaking laws, nor breaking the spirit of the law, if your users cannot store many years of their personal communications on your server. Encouraging people to delete mail would have the effect of limiting the government's surveillance power, in an entirely legal fashion.
"aren't the laws at fault here?"
It is not that simple. The relevant laws were written at a time when mail quotas were commonly measured in megabytes, when people had to delete their mail in order to stay under the limit. Back then, if a few personal messages happened to be on the server when a court order was received, it was not such a big deal; those messages probably pertained to very recent things anyway. Now, when a court order for "all of Joe's email" is received, that will very likely include messages dating back years, long before whatever crime Joe is suspected of was even committed. The laws have not been updated in light of these new privacy implications.
"If there is an action item on the list, it should be to change unjust laws not to circumvent them. The latter is both defeatist and useless."
Why not do both? Why should we suffer while we wait for the deliberately slow wheels of government to turn? Neither action excludes the other, you can both circumvent unjust laws and work to take those laws off the books.
Earlier quoted context omitted.
As others have noted elsewhere, that's not true: you can have it delete emails on delete, but you do have to turn that on yourself. It's not the default, and defaults matter, but it is an option that appears as soon as you click "enable IMAP" in gmail (go ahead and try it in your gmail settings). You'll have to read the options, yes, but considering the whole UX thing for gmail has been "never have to delete an email…
Frankly, I missed the option, and usually I am pretty good with noticing if the defaults are what I want. The only reason I even noticed that "delete" was not actually deleting mail was that I had to search through All Mail one day, and I noticed some messages that I was sure I deleted. What makes this worse is the completely counterintuitive nature of deleting messages from All Mail: they just come back. I suppose i…
However, because of the historical lack of an "archive" IMAP function, it's still not clear that the default isn't the correct one for the average user, just like PGP on by default with private keys managed by the user wouldn't be the correct default because most users would be locked out of their own email within the week.