Nation's Biggest Spy Center Settles into Utah

By David Wallechinsky and Noel Brinkerhoff

 

Utah - Officially called the Utah Data Center, the enormous facility under construction will eventually house one million square feet of computers. Its mission will be to intercept, decipher, analyze and store large volumes of communications collected by the NSA from around the world.

 

Everything from private emails to cell phone calls to Google searches and more will be stored at the center, which is scheduled to operational in September 2013. It will also collect the details of financial transactions, big and small, secret communication of foreign governments, suspected terrorists and, perhaps, just about everybody else.

 

“It is, in some measure, the realization of the ‘total information awareness’ program created during the first term of the Bush administration—an effort that was killed by Congress in 2003 after it caused an outcry over its potential for invading Americans’ privacy,” according to James Bamford in an excellent article in Wired. Bush went ahead anyway, enlisting the aid of the telecoms, and the Obama administration has moved the strategy forward.

 

The Utah Data Center will also be a center for cryptanalysis—code breaking—since one of its primary targets will be password-protected and intricately encrypted information.

 

The Data Center is expected to have at least 200 full-time employees and cost $40 million a year to maintain.

DOJ Asks Court To Keep Secret Any Partnership Between Google, NSA

By Mike Scarcella

United States - The Justice Department is defending the government's refusal to discuss—or even acknowledge the existence of—any cooperative research and development agreement between Google and the National Security Agency.

The Washington based advocacy group Electronic Privacy Information Center sued in federal district court here to obtain documents about any such agreement between the Internet search giant and the security agency.

The NSA responded to the suit with a so-called “Glomar” response in which the agency said it could neither confirm nor deny whether any responsive records exist. U.S. District Judge Richard Leon in Washington sided with the government last July.

A three-judge panel of the U.S. Court of Appeals for the D.C. Circuit is scheduled to hear the dispute March 20.

EPIC filed a Freedom of Information Act request in early 2010, noting media reports at the time that the NSA and Google had agreed to a partnership following the cyber attacks in China that year against Google.
EPIC asked for, among other things, communication between the NSA and Google about Gmail and Google’s “decision to fail to routinely encrypt” messages before Jan. 13, 2010.

The NSA’s response to the request for records noted that the agency “works with a broad range of commercial partners and research associations” to ensure the availability of secure information systems. The agency, however, refused to confirm or deny any partnership with Google.

The security agency said it routinely monitors vulnerabilities in commercial technology and cryptographic products because the government relies heavily on private companies for word processing systems and e-mail software.

“If NSA determines that certain security vulnerabilities or malicious attacks pose a threat to U.S. government information systems, NSA may take action,” DOJ Civil Division lawyers Catherine Hancock and Douglas Letter said in a brief in the D.C. Circuit in January.

DOJ’s legal team said that acknowledging whether NSA and Google formed a partnership from a cyber attack would illuminate whether the government “considered the alleged attack to be of consequence for critical U.S. government information systems.”

NSA said it cannot provide documents—or confirm their existence—because the information would alert adversaries about the security agency’s priorities, threat assessments and countermeasures.

DOJ said media reports about the alleged Google partnership with NSA do not constitute official acknowledgement.

The Washington Post and The New York Times both reported that Google contacted the NSA after the Jan. 2010 cyber attack, which the company said was rooted in China and targeted access to accounts of Chinese human rights activists. The Wall Street Journal said NSA’s general counsel worked out a cooperative research and development agreement with Google.

EPIC’s attorneys, including Marc Rotenberg, the group’s president, said in court papers that the document request includes records that are not relevant to the NSA’s information assurance mission.

“The NSA mischaracterizes EPIC’s FOIA Request by stating that responsive documents would reveal ‘information about a potential Google-NSA relationship,’” Rotenberg said.

The crux of the records request, Rotenberg said, is Google’s switch to application encryption by default for Gmail accounts soon after the cyber attack. Google in 2008 began allowing users to encrypt mail passing through the company servers, EPIC said in its brief, but encryption was not provided by default.

EPIC’s brief said the failure of the NSA to conduct a search for records “deprives the court of the ability to meaningfully assess the propriety” of the agency’s response that it can neither confirm nor deny the existence of responsive records.

“Without first conducting the search, not even the agency can know whether there is a factual basis for its legal position,” Rotenberg said.

EPIC said its records request does not seek documents about NSA’s role to secure government computer networks. “Google provides cloud-based services to consumers, not critical infrastructure services to the government,” Rotenberg said.

Odd Stories: Prank Offer of Free Baby Lands Teen in Trouble

Clinton, Mississippi - A Clinton teen was pulling the leg of a friend when he advertised a free baby boy on Craigslist using the friend's cell number on the contact information, police say.

Police Chief Don Byington would not identify the youths involved, but said the posting was "a bad practical joke."

His department's investigation shows the 18-year-old student at Clinton High took a photo of an unknown baby boy from Google and placed the advertisement on Craigslist to give away - not to sell - the baby, Byington said.

Officers consulted with Craigslist and used the cell phone number to track down what happened, he said. The male student whose number was used without his permission "didn't know until his friends called it to his attention," Byington said.

Police contacted the family members of the student who placed the listing and allowed them to go get the student from school and bring him to the department Monday for questioning.

"We've talked to everyone involved, and we are consulting with the district attorney's office to see if there are any charges to be brought," he said. "We are exploring that."

Hinds County Assistant District Attorney Jamie McBride said the posting of such information on Craigslist can be prosecuted under state law that makes the "posting of messages through electronic media for the purpose of causing injury to another person" a felony.

A conviction carries up to five years in jail and up to a $10,000 fine, McBride said.

Youth offenders under 18 would not be prosecuted as an adult, but instead would fall under the jurisdiction of Youth Court, he said. "It would be considered a delinquency charge," he said.


Clinton schools Superintendent Phil Burchfield on Tuesday stressed the importance of proper behavior online.

Burchfield said the district will cooperate with law enforcement throughout its investigation. Disciplinary actions, if any, would be decided at the investigation's end, Burchfield said.

Working with the state attorney general's office, Clinton High recently hosted a Facebook Roadshow aimed at teaching students proper behavior and etiquette on social networking sites.

Byington said the student now understands his actions can be prosecuted.

"I think after speaking with him, he realized the magnitude of what took place when he placed it on there," the chief said. "It's a lack of maturity on his part."

Odd Stories: Frenchman Sues Over Google Views Urination Photo

Nantes, France - A Frenchman took Google to court Thursday over a photo published online by its Street View application showing him urinating in his front yard which he believes has made him the laughing stock of his village in rural northwest France.

The man, who is aged around 50 and lives in a village of some 3,000 people in the Maine-et-Loire region, is demanding the removal of the photo, in which locals have recognized him despite his face being blurred out.

He also wants 10,000 euros ($13,300) in damages.

"Everyone has the right to a degree of secrecy," his lawyer, Jean-Noel Bouillard, told Reuters. "In this particular case, it's more amusing than serious. But if he'd been caught kissing a woman other than his wife, he would have had the same issue."

Google Inc.'s Street View, covering some 30 countries and available in France since 2008, enables users of Google Maps to also view photos of streets taken by its camera cars, which have cameras hoisted on frames on their roofs.

The man thought he was hidden from view by his closed gate as he relieved himself in November 2010. But Google's lens caught him from above his gate as it passed by. Bouillard did not explain why the man chose to urinate outside.

Google's lawyer in the case, named by local daily Ouest France as Christophe Bigot, was not immediately reachable, but the newspaper said he was pleading that the case should be declared null and void.
The court, in the nearby city of Angers, is due to give its verdict on March 15.

Q&A: Google to Dig Deeper into Users' Lives

By Michael Liedtke

San Francisco - If you're amazed — and maybe even a little alarmed — about how much Google seems to know about you, brace yourself. Beginning Thursday, Google will operate under a streamlined privacy policy that enables the Internet's most powerful company to dig even deeper into the lives of its more than 1 billion users.

Google says the changes will make it easier for consumers to understand how it collects personal information, and allow the company to create more helpful and compelling services. Critics, including most of the country's state attorneys general and a top regulator in Europe, argue that Google is trampling on people's privacy rights in its relentless drive to sell more ads.

Here's a look at some of the key issues to consider as Google tries to learn about you.

Q: How will Google's privacy changes affect users?

A: Google Inc. is combining more than 60 different privacy policies so it will be able to throw all the data it gathers about each of its logged-in users into personal dossiers. The information Google learns about you while you enter requests into its search engine can be culled to suggest videos to watch when you visit the company's YouTube site.

Users who write a memo on Google's online word processing program, Docs, might be alerted to the misspelling of the name of a friend or co-worker a user has communicated with on Google's Gmail. The new policy pools information from all Google-operated services, empowering the company to connect the dots from one service to the next.

Q: Why is Google making these changes?

A: The company, based in Mountain View, Calif., says it is striving for a "beautifully simple, intuitive user experience across Google." What Google hasn't spent much time talking about is how being able to draw more revealing profiles about its users will help sell advertising — the main source of its $38 billion in annual revenue.

One reason Google has become such a big advertising network: Its search engine analyzes requests to figure out which people are more likely to be interested in marketing pitches about specific products and services. Targeting the ads to the right audience is crucial because in many cases, Google only gets paid when someone clicks on an ad link. And, of course, advertisers tend to spend more money if Google is bringing them more customers.

Q: Is there a way to prevent Google from combining the personal data it collects from all its services?

A: No, not if you're a registered user of Gmail, Google Plus, YouTube, or other Google products. But you can minimize the data Google gathers. For starters, make sure you aren't logged into one of Google's services when you're using Google's search engine, watching a YouTube video or perusing pictures on Picasa. You can get a broad overview of what Google knows about you at http://www.google.com/dashboard , where a Google account login is required. Google also offers the option to delete users' history of search activity.

It's important to keep in mind that Google can still track you even when you're not logged in to one of its services. But the information isn't quite as revealing because Google doesn't track you by name, only through a numeric Internet address attached to your computer or an alphanumeric string attached to your Web browser.

Q: Are all Google services covered by the privacy policy?

A: No, a few products, such as Google's Chrome Web browser and mobile payment processor Wallet, will still be governed by separate privacy policies.

Q: Is Google's new privacy policy legal?

A: The company has no doubt about it. That's why it's repeatedly rebuffed pleas to delay the changes since announcing the planned revisions five weeks ago. But privacy activists and even some legal authorities have several concerns.

The Electronic Privacy Information Center, a privacy rights group, sued the FTC in a federal court in an effort to force the FTC to exercise its powers and block Google's privacy changes. A federal judge ruled the courts didn't have the authority to tell the FTC how to regulate Google. The FTC says it is always looking for evidence that one of its consent orders has been violated.

Earlier this week, the French regulatory agency CNIL warned Google CEO Larry Page that the new policy appears to violate the European Union's strict data-protection rules. Last week, 36 attorneys general in the U.S. and its territories derided the new policy as an "invasion of privacy" in a letter to Page.

One of the major gripes is that registered Google users aren't being given an option to consent to, or reject, the changes, given that they developed their dependence on the services under different rules. In particular, people who bought smartphones running on Google's Android software, and signed two-year contracts to use the devices, may have a tough time avoiding the new privacy policy. They could switch to non-Google services, but those typically don't work as well on Android software. Or they could buy a different smartphone and pay an early-termination penalty.

Q: What regulatory power do government agencies have to change or amend the privacy changes?

A: The U.S. Federal Trade Commission gained greater oversight over Google's handling of personal information as part of a settlement reached last year. Google submitted to the agreement after exposing its users email contacts when it launched a now-defunct social networking service called Buzz in 2010. The consent order requires Google's handling of personal information to be audited every other year and forbids misleading or deceptive privacy changes.

Google met with the FTC before announcing the privacy changes. Neither the company nor the FTC has disclosed whether Google satisfied regulators that the revisions comply with the consent order.

Google's New Privacy Policy May Violate EU Rules

By  Gabriele Steinhauser

Brussels - Google's new privacy policy appears to violate the European Union's data protection rules, France's regulator said Tuesday, just two days before the new guidelines are set to come into force.

Google announced its new privacy policy with much fanfare last month. The rules, which are set to come into force on Thursday, regulate how the Web giant uses the enormous amounts of personal data its collects through its search engine, email and other services.

However, the EU's data protection authorities are concerned about the privacy effects of the policy and earlier this month asked French regulator CNIL to investigate them.

"Our preliminary analysis shows that Google's new policy does not meet the requirements of the European Directive on Data Protection," CNIL said in a letter to Google Chief Executive Larry Page. The letter was sent Monday and posted on CNIL's website Tuesday.

The agency said Google's explanation of how it will use the data was too vague and difficult to understand "even for trained privacy professionals."

The new policy makes it easier for Google to combine the data of one person using different services such as the search engine, YouTube or Gmail if he is logged into his Google account. That allows Google to create a broader profile of that user and target advertising based on that person's interests and search history more accurately. Advertising is the main way Google makes its money.

However, CNIL said data protection authorities in the EU "are deeply concerned about the combination of personal data across services," adding they had "strong doubts about the lawfulness and fairness of such processing."

Vivian Reding, the EU's Justice Commissioner who oversees the bloc's data protection rules, said she welcomed CNIL's letter and called on Google to delay its new policy.

Google argues that combining the data into one profile makes search results more relevant and allows a user to cross-navigate between different services more easily. It says the main purpose of the new policy is to combine the more than 70 different rules for Google's wide-ranging services into one that is simpler and more readable.

"We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles," Peter Fleischer, Google's global privacy counsel, wrote in response to CNIL's original letter, adding that users had more than a month to get familiar with the new rules.

Fleischer also rejected CNIL's reiterated request to delay the rollout of the privacy policy until all concerns have been cleared up.

"We have notified over 350 million authenticated Google users and provided highly visible notifications on our home page and in search results for our non-authenticated users," he wrote. "To pause now would cause a great deal of confusion for users."

The probe of the privacy policy is one of several battle lines between Google and the European Commission, the executive arms of the 27-country EU.

Google's search engine has a market share of more than 90 percent in the EU, with rival services like Microsoft's Bing gaining little traction.

The Commission is already examining whether Google uses this dominance to stop other search engines from entering the market. It is also investigating complaints from Microsoft and Apple into whether Motorola, which Google is in the process of taking over, is breaking EU competition rules in its aggressive enforcement of standard-essential patents.

Kim Dotcom Out on Bail; Megaupload Still Offline

Wellington, New Zealand - The founder of the site formerly known as Megaupload, Kim Dotcom, is out on bail after the presiding judge in his case found there was no reason to believe he poses a flight risk.

The judge came to his conclusion based off the fact Dotcom's accounts were frozen.

About the judgment an elated Dotcom said to reporters "I am relieved to go home to see my family, my three little kids, and my pregnant wife and I hope you understand that that is all I want to say right now."

Dotcom's company, the infamous Megaupload, was shut down after United States authorities raided his offices on the claim he's hosting millions of illegal downloads. The arrest happened the same day SOPA was delayed in Congress through actions of both internet activism and big corporations such as Google and Wikipedia. The United States is still seeking to extradite Dotcom and three of his partners for racketeering charges.