Reported Google-NSA alliance sets off privacy alarms

Update: Google, NSA may partner on cybersecurity, Washington Post says

In a development that is already causing alarm among privacy advocates, search engine giant Google Inc. is reported to be enlisting the help of the National Security Agency to investigate recent cyberattacks that Google says originated from China.

The Washington Post, quoting unnamed sources, today said that the NSA and Google are in the process of finalizing an agreement under which the NSA will help Google better defend itself against future attacks. Under the deal, the NSA would not get access to users' search information or e-mail accounts and Google would not share any proprietary data, the source claimed.

Google approached the NSA shortly after the cyberattacks, which it said were launched from China. However, the deal will take time to hammer out because of the sensitive privacy issues involved. If the deal goes through, it will be the first time that Google has entered into a formal information-sharing relationship with the NSA, the Post quoted its source as saying.

In response to a request for comment, a Google spokesman pointed to a blog post dated Jan. 12 and written by David Drummond, Google's senior vice president and chief legal officer. Titled "A new approach to China," it explains Google's concerns over the attacks, which it said also affected at least 20 other companies.

In the post, Drummond said that after the attacks, Google took the "unusual step" of sharing attack information with a "broad audience." This information, Drummond said, "goes to the heart of a much bigger global debate about freedom of speech." Drummond's post did not say with whom the company shared the attack information.

In an e-mailed statement, an NSA spokeswoman said the agency does not comment on specific relationships it may or may not have with U.S. companies. "We can say as a general matter, however, that as part of its longstanding Information Assurance (IA) Mission, NSA works with a broad range of commercial partners and research associates," on cybersecurity related issues, the statement said.

Even so, the prospect of the world's largest search engine company teaming up with the country's largest spy agency is already setting off alarms within the privacy community.

Marc Rotenberg, executive director of the Washington-based Electronic Privacy Information Center, said any relationship between the two would be "very problematic."

"We would like to see Google develop stronger security standards and safeguards for protecting themselves," he said. "But everyone knows the NSA has two missions: One is to ensure security, and the other is to enable surveillance."

Whenever the NSA has entered the private security realm, there have been problems, Rotenberg said. In the 1990s, for instance, the NSA's role in network security resulted in weakened encryption standards all around. "We have had a long-running debate about the impact of NSA's role in the security realm," he said. A partnership with Google raises those questions all over again.

"We definitely need more information" on whether the rumored partnership will go through or not, said Ari Schwartz, deputy director of the Center for Democracy and Technology, a Washington-based think tank and advocacy group.

The information available is too sparse to determine if Google will abide by the promises it made in joining the Global Network Initiative if it does enter a partnership with the NSA, Schwartz said. The GNI is a coalition of companies including Google, Yahoo and Microsoft, and several leading human-rights organizations, academic institutions and advocacy groups.

As part of the group, Google is committed to protecting personal information and the privacy rights of users when confronted with government demands that appear unreasonable or overly broad, Schwartz said.

A Google partnership with the NSA will also need to be put into a broader perspective given Google's global footprint, Schwartz said. "It is natural for Americans to say, 'This is our law enforcement,'" he said. "But what is the standard and precedent going to be when other countries look at this? What if someone says, 'Well, you are cooperating with U.S. intelligence officials, why not with ours?'"

More information also needs to be made available on the NSA's involvement in domestic cybersecurity matters and how it is working with other law enforcement agencies, such as the FBI, he said.

However, James Lewis, director and senior fellow at the Center for Strategic and International Studies (CSIS), said that although not all details are available, it is unlikely that a Google-NSA partnership on cybersecurity will involve the sharing of personal data.

Google is more likely to only be interested in having the NSA take a look at its networks and help it identify potential weaknesses, he said. Any information sharing that happens will have nothing to do with intelligence gathering by the NSA, he said.

"I don't have any direct knowledge, but that is my assumption in this case," Lewis said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

FREE Computerworld Insider Guide: IT Certification Study Tips
Join the discussion
Be the first to comment on this article. Our Commenting Policies