Google's alleged tie-up with NSA raises concerns

Feb 05, 2010

Google  has declined comment on a Washington Post  report that it has asked the  National Security Agency to help track down the cyberattackers who recently breached its databases.

Reporter Ellen Nakashima's front page story on Thursday rekindled concerns about corporations collaborating with government sleuth agencies. You might recall the alarm raised by privacy and civil liberties advocates in 2006 after a USA TODAY investigation revealed how the NSA secretly analyzed phone records of tens of millions of Americans.

At the time, public backlash was directed mainly at telecom giants AT&T, Verizon and BellSouth for so readily giving up their customers' private phone records to a government agency.

In a similar vein, Google, the world's dominant search service, amasses data on the surfing habits of most Internet users, and stores vast amounts of sensitive data belonging to users of its popular Gmail and Google Apps online services, says Amrit Williams, CEO of security firm Big Fix.  Because the NSA is an "opaque intelligence organization . . .the potential for abuse of private information at the intelligence or government level is very high," he says.

Google CEO Eric Schmidt did little  to allay the fears of privacy and civil liberty advocates in this interview last December with CNBC financial reporter Maria Bartiromo. Schmidt says on camera:

The reality is that search engines, including Google, do retain this information for some time and it's important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities.

It's understandable that corporations  might covet  the NSA's expertise about quelling cyberattacks; the agency possess unsurpassed intelligence gathering know-how, says Jody Westby, CEO of consulting firm Global Cyber Risk and a distinguished fellow at the Carnegie Mellon CyLab think tank.

Yet the cyberattackers who breached Google's network,  and some 30 other tech, financial and media corporations, used conventional messaging trickery and infection methods. And since top-notch cyber forensics investigators and state-of-the-art network defense systems are  readily available on the commercial market, it's  not clear why Google might seek the NSA's assistance, says Westby.

 "Companies don't usually run and ask the government to get involved in their business," she says. "These attacks may be more sophisticated than we think. I think they (Google) are  really trying to preserve their brand."

Gunter Ollman, head of research at security firm Damballa, says there is a " high probability" that Chinese nationals were involved in the attacks on Google and the other corporations. However, definitively proving involvement by the Chinese government is very difficult.  Cyberattacks on Western corporations that can be traced back to China are usually considered to be  "state-sponsored, state-endorsed or, at the very least, ignored by the Chinese government," says Ollman.

All of that said, Jeff Chester, executive director of the Center for Digital Democracy, wonders what Google, a commercial search service, might possibly stand to gain by turning to a U.S. spy agency for security help. Pointing to  job openings at Google's Washington D.C. offices, Chester says the search giant may be "working to curry favor with the NSA, CIA, DoD and others in order to sell its services (to the government) and make greater profits."

A Google spokesperson pointed to the company's Jan. 12 public statement about cyberattacks and censorship in China and declined any further comment.

"What is most troubling about this event," says Big Fix CEO Williams, "is that we continue to become insensitive to infringements on our civil liberties, which allows more egregious violations to become acceptable practice."

By Byron Acohido