Surprise! Google Allegedly Collaborates with Enforcement Authorities
October 21, 2020
Google collects user information to create customized, targeted ads. Google has stated more than once that it protects its users’ privacy, including search history. It might even seem impossible for Google to keep the entire world’s search history given the amount of space needed to store that information…but it is not. CNet shares that, “Google Is Giving Data To Police Based On Search Keywords, Court Docs Show.”
Police need a warrant to access someone’s digital information, but a loophole allows law enforcement to go around privacy laws. Instead of requesting a specific individual’s search history, law enforcement can go directly to Google and request data on anyone who searched for a specific term.
This recently happened in August 2020, when Florida police asked Google to disclose the identities of people who searched for a specific address. Michael Williams, an associate of singer and sex offender R. Kelly, was arrested for arson and witness tampering. Williams apparently set fire to a car that belonged to a witness in the ongoing R. Kelly sex offender case.
Google released the IP addresses of people who searched for the arson victim’s address and one of them led back to Williams. Williams used his phone to search for the victim’s address and that tied him to the crime.
While it is great that a bad actor like Williams is brought to justice, law enforcement could use a reverse order for Google information for evil purposes. The law enforcement could effectively become bad actors with a badge. The large search history information requests are a loophole to the Fourth Amendment:
“ ‘This ‘keyword warrant’ evades the Fourth Amendment checks on police surveillance,’ said Albert Fox Cahn, the executive director of the Surveillance Technology Oversight Project. ‘When a court authorizes a data dump of every person who searched for a specific term or address, it’s likely unconstitutional.’
The keyword warrants are similar to geofence warrants, in which police make requests to Google for data on all devices logged in at a specific area and time. Google received 15 times more geofence warrant requests in 2018 compared with 2017, and five times more in 2019 than 2018. The rise in reverse requests from police have troubled Google staffers, according to internal emails.”
Google states they support user privacy and support law enforcement. Google requires a search warrant for broad data requests and they only represent 1% of the total legal demands for user data the company receives.
Broad data requests are a growing concern. Legal professionals are challenging their validity, including Williams’s lawyer. Broad data requests do require probable cause like other search warrants. In Williams’ case, he did conduct other searches that includes the phrases: “where can i buy a .50 custom machine gun,” “witness intimidation” and “countries that don’t have extradition with the United States.” These search phrases were discovered when an individual search warrant for Williams was issued.
Broad search requests have positive results, but all it takes is one misinterpretation of the information to harm an innocent. It also does not take much to abuse this power too.
Whitney Grace, October 21, 2020
AI the New Battlefield in Cyberattack and Defense
October 19, 2020
It was inevitable—in the struggle between cybercrime and security, each side constantly strives to be a step ahead of the other. Now, both bad actors and protectors are turning to AI tools. Darktrace’s Max Heinemeyer describes the escalation in, “War of the Algorithms: The Next Evolution of Cyber Attacks” posted at Information/Age. He explains:
“In recent years, thousands of organizations have embraced AI to understand what is ‘normal’ for their digital environment and identify behavior that is anomalous and potentially threatening. Many have even entrusted machine algorithms to autonomously interrupt fast-moving attacks. This active, defensive use of AI has changed the role of security teams fundamentally, freeing up humans to focus on higher level tasks. … In what is the attack landscape’s next evolution, hackers are taking advantage of machine learning themselves to deploy malicious algorithms that can adapt, learn, and continuously improve in order to evade detection, signaling the next paradigm shift in the cyber security landscape: AI-powered attacks. We can expect Offensive AI to be used throughout the attack life cycle – be it to use natural language processing to understand written language and to craft contextualized spear-phishing emails at scale or image classification to speed up the exfiltration of sensitive documents once an environment is compromised and the attackers are on the hunt for material they can profit from.”
Forrester recently found (pdf) nearly 90% of security pros they surveyed expect AI attacks to become common within the year. Tools already exist that can, for example, assess an organizations juiciest targets based on their social media presence and then tailor phishing expeditions for the highest chance of success. On the other hand, defensive AI tools track what is normal activity for its organization’s network and works to block suspicious activity as soon as it begins. As each side in this digital arms race works to pull ahead of the other, the battles continue.
Cynthia Murrell, October 19, 2020
Domains Seized: What Companies Assisted the US Government?
October 13, 2020
The Straits Times’s article “US Seizes Iran Propaganda Websites” reported:
The US has seized 92 web domains used by Iran, including four which purported to be genuine English language news sites…Four of them, with the domain names “newsstand7.com”, “usjournal.net”, “usjournal.us”, and “twtoday.net”, were “operated by or on behalf” of Iran’s Islamic Revolutionary Guard Corps to influence United States domestic and foreign policy…
The article included an interesting factoid; to wit:
The sites were identified first with intelligence from Google and then also with help from Twitter and Facebook…
Interesting?
Stephen E Arnold, October 13, 2020
Facebook and Encryption
October 12, 2020
A number of experts have pointed to the information about Facebook’s contribution to child exploitation, human trafficking, and related activities. A good example is Robert David Steele’s “Betty Boop: Facebook Responsible for 94% of 69 Million Child Sex Abuse Images Reported by US Tech Firms.” DarkCyber notes “Five Eyes and Japan Call for Facebook Backdoor to Monitor Crime.” The point of that Nikkei Asia paywalled article is that encrypted messaging apps are conduits of information related to criminal activity.
Russia has taken some steps to deal with Telegram messaging traffic. Other countries, including Australia, Canada, England, New Zealand, and the United States express similar thoughts. Japan wants to “move closer” to these initiatives.
DarkCyber’s view is that the similarity of views among these countries is a response to a growing cyber crime challenge. The speed of instant messaging is one factor. The messaging apps’ growing robustness coverts what was Dark Web eCommerce within Tor to encrypted channels operating on the “open” Internet. Plus, the messaging apps allow users to create the equivalent of “chat groups” in which like minded individuals can share images and other information.
The call for a back door is getting louder. Providers of these software services may be reluctant to make changes. It is possible that change may be forced upon certain companies.
Stephen E Arnold, October 12, 2020
GSA Government Okays These Drones
October 12, 2020
The General Services Administration has given five manufacturers its blessing to sell their small unmanned aircraft systems (sUAS) to government agencies. GCN examines the development in, “US-Made Small Drones Added to GSA Schedule.” The Defense Innovation Unit (DIU) and the Army’s Short Range Reconnaissance program (SRR) have been working toward this approval for 18 months. That joint effort has developed drones equipped with situational awareness tools that can be deployed quickly. A related DIU project, Blue sUAS, focused on non-DOD applications of drones, like safety inspections, rescue missions, and fighting forest fires. Writer Stephanie Kanowitz informs us:
“The five companies whose products will be available are Altavian, Parrot, Skydio, Teal and Vantage Robotics. … Recognizing a need for drones that government agencies, including the military, could use, Vantage applied to be part of Blue sUAS and tweaked its Vesper unmanned aerial vehicle for federal agency use. Vesper, developed for DIU, differs from Vantage’s first-generation drone, Snap, in that it is ‘substantially more advanced in just about every way,’ including sensors, flight capabilities, security and materials, said Vantage CEO Tobin Fisher. ‘To be specific, on the sensor side, we developed a camera that can see in the dark in 4K and integrated a thermal sensor as well as 18x zoom,’ Fisher said. Additionally, Vesper can fly for 50 minutes and features an extended radio range with an AES 256-encrypted 5-mile link. Vesper is made with components from trusted sources, which Fisher said includes Qualcomm for the onboard processor, Microhard for the radio and SigmaTron International for assembly.”
Impressive. It was crucial that any component that touched data in any way be from a non-Chinese source. For security reasons, the 2020 National Defense Authorization Act prohibits government agencies from purchasing or using drones made in China. The effort goes beyond government agencies, though. Those eye-popping capabilities will soon grace commercial drones, as well. The article quotes the DIU’s Chris Bonzagni:
“These companies have been able to leverage the roughly $18 million in DOD investments to develop spinoff enterprise solutions to offer secure, domestically produced options to enterprise customers worldwide, ultimately adding a much-needed boost to the U.S. sUAS industrial base.”
Ready or not, drones are here to stay and only getting more capable and numerous. Chinese drones are interesting too, but some may phone home.
Cynthia Murrell, October 12, 2020
The Ultimate Private Public Partnership?
October 7, 2020
It looks as though the line between the US government and Silicon Valley is being blurred into oblivion. That is the message we get as we delve into Unlimited Hangout’s report, “New Pentagon-Google Partnership Suggests AI Will Soon Be Used to Diagnose Covid-19.” Writer Whitney Webb begins by examining evidence that a joint project between the Pentagon’s young Defense Innovation Unit (DIU) and Google Cloud is poised to expand from predicting cancer cases to also forecasting the spread of COVID-19. See the involved write-up for that evidence, but we are more interested in Webb’s further conclusion—that the US military & intelligence agencies and big tech companies like Google, Amazon, Microsoft, and others are nigh inseparable. Many of their decision makers are the same, their projects do as much for companies’ bottom lines as for the public good, and they are swimming in the same pools of (citizen’) data. We learn:
“NSCAI [National Security Commission on Artificial Intelligence] unites the US intelligence community and the military, which is already collaborating on AI initiatives via the Joint Artificial Intelligence Center and Silicon Valley companies. Notably, many of those Silicon Valley companies—like Google, for instance—are not only contractors to US intelligence, the military, or both but were initially created with funding from the CIA’s In-Q-Tel, which also has a considerable presence on the NSCAI. Thus, while the line between Silicon Valley and the US national-security state has always been murky, now that line is essentially nonexistent as entities like the NSCAI, DIB [Defense Innovation Board], and DIU, among several others, clearly show. Whereas China, as Robert Work noted, has the ‘civil-military fusion’ model at its disposal, the NSCAI and the US government respond to that model by further fusing the US technology industry with the national-security state.”
Recent moves in this arena involve healthcare-related projects. They are billed as helping citizens stay healthy, and that is a welcome benefit, but there is much more to it. The key asset here, of course, is all that tasty data—real-world medical information that can be used to train and refine valuable AI algorithms. Webb writes:
“Thus, the implementation of the Predictive Health program is expected to amass troves upon troves of medical data that offer both the DIU and its partners in Silicon Valley the ‘rare opportunity’ for training new, improved AI models that can then be marketed commercially.”
Do we really want private companies generating profit from public data?
Cynthia Murrell, October 7, 2020
A Challenge for Federal Records Management
October 6, 2020
Federal agencies are facing a mandate without adequate funding. This is sure to go smoothly. GCN explains why, for these entities, “Records Management Is About to Get Harder.” The White House’s Office of Management and Budget is requiring federal agencies to completely shift to electronic recordkeeping by the end of 2022, after which the National Archives and Records Administration shall accept no new paper records. The directive presents two challenges which overlap: digitizing existing records and providing a process whereby new records are created digitally in the first place. Officials plan to begin at the intersection of those requirements, invoking a Venn diagram. They must be as efficient as they can because, we’re told, Congress is reluctant to loosen purse strings enough to sufficiently fund the project.
The article cites a recent discussion among federal records management specialists regarding the transition. Reporter Troy K. Schneider writes:
“Although agencies’ readiness levels varied widely, most participants said they were on track to meet the M-19-21 deadlines. Yet whether the available tools and resources are sufficient, however, is another matter. ‘There never are enough resources,’ one official said. ‘We’ve got great resources to the extent that we have them,’ referring to the staff and the record schedules that have been developed, but the work will outstrip them — and this year’s telework-driven embrace of collaboration tools has only increased the degree of difficulty….“Complicating that resource challenge in terms of staff and money is the rapidly growing suite of communication tools agencies use. Too often, participants said, the adoption and deployment of those tools is happening before Federal Records Act requirements are accounted for.”
SharePoint and Office 365 are but two examples of software in which agencies have invested much that may not be able to keep pace with current governance needs and a greatly increased cloud-centered user base. One suggestion is to mimic the Continuous Diagnostics and Mitigation Program now used by the Department of Homeland Security and the General Services Administration for their approved product lists, reporting requirements, and cybersecurity funding. Whatever the solution, we’re told:
“Ultimately, the group agreed, fundamentals are more important than specific technologies. ‘What I’ve seen in looking at my compatriots in other agencies is they spent incredible sums of money to deploy a technology,’ one participant said. ‘And those solutions have not been nearly as effective as they have been sold as because some of the fundamentals hadn’t been done — like understanding your record schedule and the organizational and institutional changes around processes and capabilities that really need to be in place to feed the right records.’”
Indeed, rushing to choose a solution before closely examining one’s needs is a recipe for waste and disappointment. Let us hope decision makers think things through and spend the limited funds wisely. If they do not, our nation’s records are bound to become a huge, paperless mess.
Cynthia Murrell, October 6, 2020
When Regulation Fails: A Snapshot of the Google
October 5, 2020
An entity called SEOButler published “The End of Google?” This is a good question like one of those easy ones on a mid term exam in Art History 105. The essay is longer, and it includes data about the size of the Google. Here’s a passage DarkCyber noted:
Google, Facebook, Apple, and Amazon have amassed wealth and power never before seen in human history. Given their almost limitless resources, the Big 4 can likely avoid, or at least delay, significant changes to the way they do business for years to come… But there’s little doubt that the impetus for governments worldwide to take meaningful action to curb the big tech monopolies is growing. Both political will and public opinion increasingly demand it.
What’s interesting is that the data have been gathered by a search engine optimization firm. These companies, despite their ubiquity, have faced an increasingly steep climb. The fiddling with text and tags in order to snooker the Google search results is a hit and miss business. If someone wants traffic, it is pay to play time; that is, buy advertising. Mother Google requires cash to pay for the almost uncontrollable costs of operating its “system.”
The answer to the question, in DarkCyber opinion, is, “No.” After decades of ineffectual regulation, Googzilla is quite happy having the world as its personal hunting ground. One can check the territory with a Google search or using Google Local.
Stephen E Arnold, October 5, 2020
TikTok Measures Mark a Sharp Turn for U.S. Policy
October 5, 2020
In a severe departure from our previous course, the United States seems to be embracing data localization laws. Nextgov declares, “On TikTok, the Trump Administration is Adopting China’s Own Vision for the Internet.” Though the Administration’s opening demands on the issue have not come to pass, the compromise does mean the data of U.S. TikTok users must be stored in this country on Oracle’s servers. Writer, and GMF Digital director, Sam duPont observes that the administration’s claim it acted out of security concerns does not hold water—the privacy risks of using TikTok, though considerable, are present with many apps. Targeting one company makes little sense. It looks more like a move to assert digital sovereignty and block the free flow of data. DuPont writes:
“On the other hand, requiring domestic data storage as a solution to the risks presented by TikTok is right out of China’s own playbook for the internet, which it has been advocating around the world. Governments in Russia, Indonesia, Saudi Arabia, Turkey, Vietnam and elsewhere have imposed or considered replicating data localization requirements akin to China’s own. Until recently, the United States has been a staunch opponent of these laws. And for good reason. Data localization requirements do little to improve the privacy or security of data, but they come with significant economic costs. Data storage and processing is a scale business. When a small Korean company can take advantage of cloud computing services provided by a U.S. company with servers located in Singapore, everybody wins. But where data localization laws require redundant data storage and processing facilities in every market, the economic advantages of digitalization diminish rapidly. Like all wars, the U.S.-China digital trade war has come with casualties, and chief among them is the U.S. commitment to an open, global internet.”
We’re reminded of the administration’s “Clean Network” program, an effort to sever all cyber connections between China and the U.S. This digital isolationist posture is similar to that of China itself and, if enough countries follow suit, will endanger the free-flowing internet that connects people around the world both personally and professionally.
Cynthia Murrell, October 5, 2020
Google Will Not Play Baseball with a Mere Nation State
September 29, 2020
DarkCyber spotted an interesting article called “Google Slams Arbitration System in Australia’s New Media Code.” We have heard that Googlers are fans of college basketball, specifically the NCAA tournament. And some Googlers are true fans of cricket. Baseball? Those crazy rules. No thanks.
The write up reports:
The system being proposed is called ‘binding final-offer arbitration’, referred to in the US as ‘baseball arbitration’.
DarkCyber thinks baseball arbitration works like this:
- Side A and Side B cannot agree
- Each side writes up a best and final offer
- An objective entity picks one
- The decision is binding.
Google’s view is that the system is not fair. The write up includes this passage:
Google said it is happy to negotiate fairly and, if needed, see a standard dispute resolution scheme in place. “But given the inherent problems with ‘baseball arbitration’, and the unfair rules that underpin it here, the model being proposed isn’t workable for Google”. [The Google voice is that of Mel Silva, VP, Google Australia and New Zealand.
The issue seems to be that a US company is not going to play ball with a country. Which is more important for citizens of Australia?
Google appears to adopt the position that its corporate interests override the nation state’s. The country — Australia in this case — seems to hold the old fashioned, non Silicon Valley view that its interests are more important.
DarkCyber believes that Googlers will perceive Australia’s intransigence as “not logical.” Google is logical as evidenced by this article “Alphabet Promises to No Longer Bung Tens of Millions of Dollars to Alleged Sex Pest Execs Who Quit Mid-Probe.” Logical indeed.
Stephen E Arnold, September 29, 2020
-
- Subscribe to Beyond Search
Feature archive
News archive
-
