Google users in Hong Kong hold a banner saying, "Say no to internet censorship: Google, well done!"

Google users in Hong Kong hold a banner saying, "Say no to internet censorship: Google, well done!"
STORY HIGHLIGHTS
Google says hackers from China got into its Gmail system
Bruce Schneier says hackers exploited feature put into system at behest of U.S. government
When governments get access to private communications, they invite abuse, he says
Government surveillance and control of Internet is flourishing, he says
Editor's note: Bruce Schneier is a security technologist and author of "Beyond Fear: Thinking Sensibly About Security in an Uncertain World." Read more of his writing at www.schneier.com.
(CNN) -- Google made headlines when it went public with the fact that Chinese hackers had penetrated some of its services, such as Gmail, in a politically motivated attempt at intelligence gathering. The news here isn't that Chinese hackers engage in these activities or that their attempts are technically sophisticated -- we knew that already -- it's that the U.S. government inadvertently aided the hackers.
In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access.
Google's system isn't unique. Democratic governments around the world -- in Sweden, Canada and the UK, for example -- are rushing to pass laws giving their police new powers of Internet surveillance, in many cases requiring communications system providers to redesign products and services they sell.
Many are also passing data retention laws, forcing companies to retain information on their customers. In the U.S., the 1994 Communications Assistance for Law Enforcement Act required phone companies to facilitate FBI eavesdropping, and since 2001, the National Security Agency has built substantial eavesdropping systems with the help of those phone companies.
Systems like these invite misuse: criminal appropriation, government abuse and stretching by everyone possible to apply to situations that are applicable only by the most tortuous logic. The FBI illegally wiretapped the phones of Americans, often falsely invoking terrorism emergencies, 3,500 times between 2002 and 2006 without a warrant. Internet surveillance and control will be no different.


RELATED TOPICS
Google Inc.
China
Internet
Official misuses are bad enough, but it's the unofficial uses that worry me more. Any surveillance and control system must itself be secured. An infrastructure conducive to surveillance and control invites surveillance and control, both by the people you expect and by the people you don't.
China's hackers subverted the access system Google put in place to comply with U.S. intercept orders. Why does anyone think criminals won't be able to use the same system to steal bank account and credit card information, use it to launch other attacks or turn it into a massive spam-sending network? Why does anyone think that only authorized law enforcement can mine collected Internet data or eavesdrop on phone and IM conversations?
These risks are not merely theoretical. After September 11, the NSA built a surveillance infrastructure to eavesdrop on telephone calls and e-mails within the U.S. Although procedural rules stated that only non-Americans and international phone calls were to be listened to, actual practice didn't match those rules. NSA analysts collected more data than they were authorized to and used the system to spy on wives, girlfriends and notables such as President Clinton.
But that's not the most serious misuse of a telecommunications surveillance infrastructure. In Greece, between June 2004 and March 2005, someone wiretapped more than 100 cell phones belonging to members of the Greek government: the prime minister and the ministers of defense, foreign affairs and justice.
Ericsson built this wiretapping capability into Vodafone's products and enabled it only for governments that requested it. Greece wasn't one of those governments, but someone still unknown -- A rival political party? Organized crime? Foreign intelligence? -- figured out how to surreptitiously turn the feature on.
And surveillance infrastructure can be exported, which also aids totalitarianism around the world. Western companies like Siemens and Nokia built Iran's surveillance. U.S. companies helped build China's electronic police state. Just last year, Twitter's anonymity saved the lives of Iranian dissidents, anonymity that many governments want to eliminate.
In the aftermath of Google's announcement, some members of Congress are reviving a bill banning U.S. tech companies from working with governments that digitally spy on their citizens. Presumably, those legislators don't understand that their own government is on the list.
This problem isn't going away. Every year brings more Internet censorship and control, not just in countries like China and Iran but in the U.S., the U.K., Canada and other free countries, egged on by both law enforcement trying to catch terrorists, child pornographers and other criminals and by media companies trying to stop file sharers.
The problem is that such control makes us all less safe. Whether the eavesdroppers are the good guys or the bad guys, these systems put us all at greater risk. Communications systems that have no inherent eavesdropping capabilities are more secure than systems with those capabilities built in. And it's bad civic hygiene to build technologies that could someday be used to facilitate a police state.
The opinions expressed in this commentary are solely those of Bruce Schneier.

A Conversation With Sergey Brin And Eric Schmidt

A Conversation With Sergey Brin And Eric Schmidt


Share
by Erick Schonfeld on October 7, 2009


Google co-founder Sergey Brin and CEO Eric Schmidt are holding an audience this morning with a roomful of journalists in New York City. They talk about the Google Books settlement, antitrust scrutiny, Android, Chrome, innovations in search and the “evil room.” Below are my live notes (I’ve bolded parts for emphasis).

Sergey Brin: We have had a number of interesting activities. A bunch of you saw the verizon announcement, android, software platform, more enhancements in terms of faster software, better software. A number of devices are coming out as a trickle, many more we expect. Google Books, a hearing today, but generally that is something I am very proud of, to make the world’s books accessible. Have written a little piece I hope comes out as an op-ed.

Eric Schmidt: It seems like Sergey has jumped the gun. We should focus mostly on search, and some of the ideas Sergey has. We are having our global sales meeting here, we brought senior sales executives. The mood was very, very positive. We told them that the worst is behind us and we are clearly seeing aspects of recovery, what is notable is we are seeing aspects of recovery not just in the US but in Europe. I thought it was going to be US first, Europe second, Asia we never saw a hit. We are increasing our hiring rate and investment rate in anticipation of a recovery.

Sergey: There are a bunch of things that have come out recently, you can now get more commercial results or less commercial results. There are other controls that are coming down the pike. I will highlight now, today you can restrict things by date, but that is based on dates mentioned in the text, cannot restrict based on the date the text was authored.

Steven Levy: You have more activity from your competitor in Redmond, rolled out a branded search engine. Historically when one competitor steps up it opens up innovation. Do you feel this increased competition will ramp up your innovation, or is it just business usual?

Sergey: I think it is healthy for the industry to have many competitors. You’ve seen search engines such as Cuil and Powerset that MSFt acquired. MSFT has made its contributions. We are working as hard as we can, but I do think having all of those competitors out there generally helps the health of that industry.

Q: Do you think Bing is something different or a rebranding?

Sergey: I don’t want to speak about our competitors

Schmidt: Better for you to judge. We like to focus on our customers. We have been criticized

Ed Baig; where do you stand with Android?

Sergey Brin: At the outset, we started to focus on Android because phones basically lacked powerful browsers and phones also lacked the ability to easily run applications. I think Android has really addressed that really well, but it has also pushed the rest of the market. I am pretty excited for the future of mobile phones because they are increasingly getting quite capable. You can write an application across five phones, we plan to push the state of the art with Android. I might be overstating it a bit, but having the software platform has freed the hardware makers from software platforms, now they are reinvigorating hardware design

Q: Enterprise market?

Sergey: definitely a market I am very excited about, born from an internal need, being able to handle many hundreds of thousands of emails. At the time that we started and launched in 04, Webmail offerings at the time [were limited] we wanted something that would work in an enterprise, and made it available to consumers, pushed things further [than our competitors].

We feel we are further ahead, for you to judge, in email capability and collaborative document editing. Sites All of those would be available to enterprises and consumers. And I think ultimately the cloud model is a better model.I think this install-less system of the cloud is better.

Stephanie Mehta: can you characterize future investments Google needs to make for medium to larger enterprise?

Ken Auletta: If the judge says why should I not be concerned about your concentration of power, what would you say to him?

Schmidt: It is an error to answer hypothetical questions from a journalist. The question you posed is not actually a question that will occur.. Book search, we thought we were doing something appropriate. We were sued by a bunch of publishers, and now it has come before a judge. We don’t want to change it unless we need to. The hearing is going on right now. My guess is in this hearing there will be a date for another hearing. Does putting the books in the hands of someone like Google who has other strategic resources a problem? It is possible for another company to do what we are doing. And the rights registry, which we would administer is something we would do for the orphan works. The scenario that is in front of us is probably the best outcome for someone who is looking for information that is not otherwise available.

Sergey: regardless of the settlement we want to make more books available online.

Q: You keep adding to Chrome and nobody seems to be paying attention. If that is one of the places where the battle is fought you seem pretty far behind.

Sergey: Perhaps that is true in media . . .

Schmidt: let me, some of your assumptions about Chrome adoption are wrong. The adoption rate of Chrome is [very strong]. We are going to do a better job of getting that message out.

Schonfeld: Steve Ballmer calls it a rounding error, is it?

Schmidt: I don’t respond to Steve Ballmer questions. Next question?

The fundamental aspect of Chrome is speed. People who go to Chrome have a hard time moving back. Two months ago we announced Chrome OS. Everything is linked together, Chrome, Chrome OS, the cloud

Sergey: There is also the security aspect. In a recent hacker competition, Chrome was the only one to escape unscathed in terms of security vulnerabilities. And more stable.

Tom Post, Forbes: Lately there seems to be a revisiting of settlements with core media where you seem to be taking a new approach. Leading question is not is Google too big and mean, rather is Google being nice? Do you have a new product out called Google Remorse?

Schmidt: In many ways we always wanted to be this Google, rather than the one we were perceived of last year. I am really proud about relationship with advertising agencies. In the media industry, the success of YouTube. We have always wanted to have these partnerships. We are learning how to do it in a way that they win too.

Sergey: People have always equated Google with the Internet, which is disrupting businesses.

Schmidt: Google is an innovator, the innovations in the internet are causing collisions. Innovation plus collisions equal opportunity. The fact that Verizon has adopted the open principles we articulated five years ago is shocking. This is Verizon. It happened over time.

AP: AP’s president said that big news sites might be willing to pay for news if they get it as an exclusive for 20 or 30 minutes. How does that sound to you?

Schmidt: We have a contract with the AP. I don’t want to talk about a proposed services where we pay more. We have to be very careful not to favor one publisher over another. We are not trying to get into the content business.

Q: What are the most attractive areas for acquisitions?

Schmidt: we turned off M&A down, we didn’t want an additional expense streams without [additional revenues] We’ve turned it back on again. One day Larry and Sergey bought what became Android, and I didn’t even know about this. They said this is really interesting. I didn’t think about that, but now think about the strategic opportunities that created.

Schonfeld: Would you make a YouTube-sized acquisition again?

The problem at buying at those levels. With a little one you can afford [to make mistakes]. Youtube and Doubleclick those will prove the best spending of money. They are harder. Any large acquisition we do will have a second review. We deal with a different world now than we did a few years ago. We bought that then MSFT has largely got out of that after their acquisition of aQuantive didn’t work out, so there.

Q: FCC?

Schmidt: I just met with the chairman, this broadband plan is what they are really focused on. We are incredibly sensitive to roll out of broadband, the number of searches we get, the revenue, without broadband there is no cloud computing.

Q: So what policy suggestions did you give him?

Schmidt: More broadband. I think we are on our way to getting a national broadband plan for America. It is one of the best things the government can be doing.

Q: Do you ever worry Google is growing too fast?

Schmidt: No.

Q: how do you manage the growth?

Schmidt [jokes}: As you can see, not very well. In technology markets, you either grow or die.

Sergey: hardware is getting incredibly capable. It used to be that most of your money in a computer went to the display. Your costs now are dominated by broadband connection. I think that is an interesting trend. Wide broadband availability, when you think about your phone, you are probably paying $40 to $50 a month for it. Your device cost is negligible compared to your access cost. I think certainly there are changes on the horizon.

Schmidt: we provide the infrastructure below what you are talking about. Think about a Kindle two to three years from now, what will it look like? Better screens, more features, and there will be many Kindles. The iPhone has proven that you can sell a phone with a subscription. The contract cost is greater than the cost of the phone. So what do you think, do those prices remain higher from AT&T and those guys, does the hardware become free?

Sergey: From a consumer point of view, I think it will be better if you end up with devices that are not locked down to a service, like Kindle is locked down to Amazon or iPhone to AT&T. I think it is better if the consumer can pick the devices and services they want.

Danny Sullivan: I can go through and fund really bad results. You seem to be rewarding a site’s authority and a site’s age. Also something Eric has said about signals, like intent to purchase from Google CheckOut. You seem to have data other people cannot get because you give away free tools. other people can tap into Google Analytics to see conversion

Schmidt: every one of these has a competitor. Google is an advertising company, we don’t have cross-subsidization

Danny: There is a closed loop in . . .

Schmidt: Well there is no closed loop, there are competitors and we make it possible for you to get out

Sergey: In analytics, we just noticed that when advertising partners start using analytics they spend more on our site because all of these stats become apparent to them. If I spend $1,000 a month more on Google, I will make X more profit. So we realized that we should make analytics

Q: When the phone companies had to deal with this, maybe the solution is that when a competitor comes into the market they have to lease Checkout data at a reasonable rate?

Schmidt: It is a false analogy. One, antitrust law does not cover it, two?, three the information we make available to consumers.

Segey: You could argue that Paypal and Amazon data is more valuable, so they should make it available first.

Q: coming back to Google book settlement,

Schmidt: In the book settlement, everyone has raised a lot of issues. The question is not whether they are interesting, but whether they have legal standing in the settlement.

Sergey: the companies that are making objections about out of print books are doing nothing for out of print books, MSFT and Amazon. I guess they scanned 15 books. These objections that Google will be the only one.

Schmidt: make an alternative proposal that solves the problem

Schonfeld: Would it be possible to extend the terms of the settlement for orphan works to other companies?

Sergey: It would be legally impossible. You are looking at this as an either/or. Does not preclude other settlements, will make legislation more likely. The companies complaining now, if they were engaged in the digitization process we were doing, digitizing 10 million books, there would be nothing stopping them from achieving the same thing.

Schmidt: the goal is to get all the books available and make sure the authors are compensated. The settlement was not a total solution, it was the best we could do.

Q: How do you plan to promote this in places that don’t have libraries?

Sergey: In respect to the settlement, it can apply to all books in all languages, but unfortunately it only affects U.S. readers which is a really sad thing. One of the great things about the U.S. is the fair use aspect. Which other countries don’t have.

Q: Why is there not a danger you will be bringing consumers into closed loop in the future?

Schmidt: there are many reasons why we will not be like MSFT. The first has to do with the culture and the founders. The other is the ease of moving out of these online services. Having taken such a strong position a a company. If we went into a room and were exposed to evil light and came out and announced evil strategies, we would be destroyed. The trust would be destroyed. Fourth, none of us want to go through the legal proceedings.

We have not yet found the evil room in our campus.

Sergey: Chrome OS, if you want to use it on your Mac, every change is available, all the source code is available.

Schmidt: Today we have zero market share in Chrome OS because it is not shipping. Imagine a scenario where we got to 80% market share with a free product, which I think is unlikely. Let’s say we go into the evil room and decide to start charging. A competitor would be able to take the code that we had and continue to offer our business model, while our new business model runs us into the ground. That is why open source provides a protection.

Peter Kafka: Will you make another stab at moving into other platforms (TV,radio)

Sergey: We are still optimistic on the TV front. Radio and print did not work out as we had hoped,. Television has a lot of similarity to Internet advertising in the sense of its much better measurability via settop boxes. You can see immediately how [many people are watching].

Schonfeld: Is PageRank long in the tooth, are links the still the best metric?

Sergey: No they are not and we decided that in 1999. We use various link algorithms, including what pagerank has evolved to, links are 1%, 100 other factors we look at. Yes,there is spam, and the web changes. We are able to do better and better, can do a much better job ranking than we could a decade ago, if we had rested on our laurels and just stayed with what was in our paper we published in 1998 we would be in pretty bad shape right now.