Timothy B. Lee’s “Google Attacks Highlight the Importance of Surveillance Transparency”
posted by Deven Desai
The Google China news deserves some thought for a range of reasons. The questions about democracy, censorship, and more that swirled around Google and China’s relationship are important. One issue that is easily lost is the relationship between the claimed reasons for Google’s leaving China and policies about surveillance. My colleague at CITP, Timothy B. Lee, wrote an excellent piece at Freedom to Tinker about this issue. Ordinarily I would summarize and point folks to the post. It captured my attention so much, however, that I asked Tim whether I might repost it in full here. I am happy that he has agreed.
Google Attacks Highlight the Importance of Surveillance Transparency
by Timothy B. Lee
Ed posted yesterday about Google’s bombshell announcement that it is considering pulling out of China in the wake of a sophisticated attack on its infrastructure. People more knowledgeable than me about China have weighed in on the announcement’s implications for the future of US-Sino relations and the evolution of the Chinese Internet. Rebecca MacKinnon, a China expert who will be a CITP visiting scholar beginning next month, says that “Google has taken a bold step onto the right side of history.” She has a roundup of Chinese reactions here.
One aspect of Google’s post that hasn’t received a lot of attention is Google’s statement that “only two Gmail accounts appear to have been accessed, and that activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves.” A plausible explanation for this is provided by this article (via James Grimmelmann) at PC World:
Drummond said that the hackers never got into Gmail accounts via the Google hack, but they did manage to get some “account information (such as the date the account was created) and subject line.”
That’s because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press.
Obviously, this report should be taken with a grain of salt since it’s based on a single anonymous source. But it fits a pattern identified by our own Jen Rexford and her co-authors in an excellent 2007 paper: when communications systems are changed to make it easier for US authorities to conduct surveillance, it necessarily increases the vulnerability of those systems to attacks by other parties, including foreign governments.
Rexford and her co-authors point to a 2006 incident in which unknown parties exploited vulnerabilities in Vodafone’s network to tap the phones of dozens of senior Greek government officials. According to news reports, these attacks were made possible because Greek telecommunications carriers had deployed equipment with built-in surveillance capabilities, but had not paid the equipment vendor, Ericsson, to activate this “feature.” This left the equipment in a vulnerable state. The attackers surreptitiously switched on the surveillance capabilities and used it to intercept the communications of senior government officials.
It shouldn’t surprise us that systems built to give law enforcement access to private communications could become vectors for malicious attacks. First, these interfaces are often backwaters in the system design. The success of any consumer product is going to depend on its popularity with customers. Therefore, a vendor or network provider is going to deploy its talented engineers to work on the public-facing parts of the product. It is likely to assign a smaller team of less-talented engineers to work on the law-enforcement interface, which is likely to be both less technically interesting and less crucial to the company’s bottom line.
Second, the security model of a law enforcement interface is likely to be more complex and less well-specified than the user-facing parts of the service. For the mainstream product, the security goal is simple: the customer should be able to access his or her own data and no one else’s. In contrast, determining which law enforcement officials are entitled to which information, and how those officials are to be authenticated, can become quite complex. Greater complexity means a higher likelihood of mistakes.
Finally, the public-facing portions of a consumer product benefit from free security audits from “white hat” security experts like our own Bill Zeller. If a publicly-facing website, cell phone network or other consumer product has a security vulnerability, the company is likely to hear about the problem first from a non-malicious source. This means that at least the most obvious security problems will be noticed and fixed quickly, before the bad guys have a chance to exploit them. In contrast, if an interface is shrouded in secrecy, and only accessible to law enforcement officials, then even obvious security vulnerabilities are likely to go unnoticed and unfixed. Such an interface will be a target-rich environment if a malicious hacker ever does get the opportunity to attack it.
This is an added reason to insist on rigorous public and judicial oversight of our domestic surveillance capabilities in the United States. There has been a recent trend, cemented by the 2008 FISA Amendments toward law enforcement and intelligence agencies conducting eavesdropping without meaningful judicial (to say nothing of public) scrutiny. Last month, Chris Soghoian uncovered new evidence suggesting that government agencies are collecting much more private information than has been publicly disclosed. Many people, myself included, oppose this expansion of domestic surveillance grounds on civil liberties grounds. But even if you’re unmoved by those arguments, you should still be concerned about these developments on national security grounds.
As long as these eavesdropping systems are shrouded in secrecy, there’s no way for “white hat” security experts to even begin evaluating them for potential security risks. And that, in turn, means that voters and policymakers will be operating in the dark. Programs that risk exposing our communications systems to the bad guys won’t be identified and shut down. Which means the culture of secrecy that increasingly surrounds our government’s domestic spying programs not only undermines the rule of law, it’s a danger to national security as well.
Update: Props to my colleague Julian Sanchez, who made the same observation 24 hours ahead of me.
January 15, 2010 at 2:05 pm
Posted in: Criminal Procedure, Google & Search Engines, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Technology
Print This Post
Responses (2)
Frank - January 15, 2010 at 8:47 pm
This is very insightful. I completely agree that “rigorous public and judicial oversight of our domestic surveillance capabilities in the United States” is essential. At the very least, an immutable audit log of surveillance activities needs to be archived (as Zoe Baird of the Markle foundation has recommended).
On the other hand, such a log itself could be misused once it is disclosed. Not everything is as obviously bad as Cointelpro’s pursuit of MLK. It is often unclear whether surveillance of certain activities discredits the people engaging in them, or the spies. The Maryland fusion center spied on anti-death penalty activists–but as far as I know suffers zero negative consequences for that (while I’m sure anyone who hears that story will think twice about becoming an anti-death-penalty activist.) These are incredibly difficult issues.
My worry is that search engines essentially become instrumentalities of the state, ala the Birnhack/Elkin-Koren “invisible handshake,” the Hoofnagle “big brother’s little helpers” theory, or the Jon Michaels’ “all the president’s spies” approach. As that integration of state and corporate power continues, corporations need to be subject to the same type of APA/due process/openness rules now constraining the state. Sadly, the opposite appears to be happening–corporations are using expansive notions of trade secrecy to hide their actions from scrutiny, reminiscent of the “state secrets” privilege described here:
http://www.onthemedia.org/transcripts/2009/09/25/03
第五天：google.cn“中国四大发明”logo意义解读 | 文通博客 - January 16, 2010 at 3:08 am
[...] Posted by Kyle Aevermann at 13:12 Concurring Opinions » Timothy B. Lee’s “Google Attacks Highlight … [...]
Leave a Reply