Google’s Shareholder Theater

Scanning over the headlines of the New York Times this past Saturday, June 6^th, the public relations team at Google scored a splashy front page spot which confidently boasts that the company is working hard to impede the NSA (e.g. to “erect barriers”) by comprehensively encrypting data in transit through Google’s networks[1]. Other hi-tech companies, like Yahoo, have implemented similar measures[2]. Of course, there are a number of particulars that this story fails to acknowledge…

Encryption is Not a Panacea

One thing Google’s PR team fails to acknowledge is that encryption represents little or no defense against hi-tech subversion. Specifically, hardware and software bugs (accidental or otherwise) as back doors trump encryption every time. As witnessed in both the cases of the Heartbleed bug[3] and the malware used in the recent breach of Target[4], if an attacker can leverage buggy code to compromise a computer and scrape its memory for cryptographic keys (i.e. passwords) it doesn’t matter how strong the encryption is; attackers can walk right through digital bulwarks and sink your battleship.

Oh, and get this, thanks to Ed Snowden we know that one of the NSA’s strategic goals is to industrialize the process of subversion: to launch mass attacks on millions of computers simultaneously using a system codenamed TURBINE and install software implants (also called rootkits, something your author is intimately familiar with[5]) that allow the government to maintain a concealed presence and covertly collect data[6]. The new director of the NSA, Vice Adm. Michael S. Rogers, has openly advocated this technology[7]. Does this sound like a tenable countermeasure for ubiquitous encryption?

It’s part of the public record that hi-tech companies have placed back doors in their products as part of an industry-wide effort conducted by the NSA known as the Signal Intelligence Enabling Project. A document published by the Guardian states that[8]:

“The SIGINT Enabling Project actively engages the US and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs. These design changes make the systems in question exploitable”

Please understand, this mindset emphasizes security for the 1%, where society’s collective security is completely undermined on behalf of a small cabal of spies.

Though Microsoft stridently claims that it does not insert back doors for the NSA[9] there is evidence to the contrary. For instance, it’s been revealed that Microsoft provides the NSA with early access to zero-day exploits (unpatched bugs) that arise in products like Windows[10]. After all, Microsoft recently signed a $617 million contract with the Department of Defense[11]. Don’t think that this sort of gift comes without strings.

Never Mind The Corporate Spying…

Another subtle manipulation that’s being employed is to frame the narrative so that focus is placed entirely on government surveillance. This is the same caveat that haunts surveillance reform efforts like “Reset the Net.” Pando Daily’s Yasha Levine spells it out[12]:

“Reset the Net is deeply flawed. The reason: the campaign is not against online surveillance, just government surveillance. It has nothing to say or critique about the massive for-profit dragnet operations run by telecoms and Silicon Valley megacorps that target every woman, man and child in the United States and beyond”

In contrast to the inflated fanfare about disrupting terrorist plots[13] the global surveillance apparatus is essentially being driven by powerful corporate interests[14]. This is the elephant standing in the corner that no one (especially hi-tech companies like Google) wants to talk about. Roughly 70 percent of the intelligence budget, which is in the neighborhood of 70 billion dollars, goes to the private sector[15]. So most of what we think of as government surveillance actually transpires in the private sector. How, exactly, do you think a Booz Allen Hamilton consultant named Ed Snowden got all of those classified documents? The NSA is a mere appendage of a much larger private sector data aggregation panopticon that rakes in $200 billion every year[16].

Though Eric Schmidt has railed against government surveillance in public[17], Google has extensive long-standing connections with the defense industry[18]. Not to mention that WikiLeaks has released cables that describe some rather odd dealings between Google, the State Department, and the U.S. Military. Trips to the border of Iran[19] and signal intelligence in Afghanistan[20]. Google and the government are far more tightly linked than most people suspect. Is it any wonder that Google now spends more than Lockheed Martin and Boeing to lobby for influence in D.C.[21]? Something on the order of $16 million in 2013.

Denouement

Google has exerted a lot of effort into creating the impression of revolt. But Google hasn’t switched sides. Remember, the strategic goal of Google’s public relations effort isn’t necessarily to stymie government spies, but rather to give voice to the general sense of public betrayal and at least offer the perception that Google has switched sides; to courageously fend off the big bad government on behalf of irate users. More susceptible members of the audience who believe this storyline will continue to use Google services. This will reinforce the bottom line and subsequently reassure investors. Google will do what it’s always done: follow its fiduciary responsibility to generate profits. The public be damned!

Bill Blunden is an independent investigator whose current areas of inquiry include information security, anti-forensics, and institutional analysis. He is the author of several books, including The Rootkit Arsenal , and Behold a Pale Farce: Cyberwar, Threat Inflation, and the Malware-Industrial Complex. Bill is the lead investigator at Below Gotham Labs.