HOT-201

Is Google Evil? Ira Winkler, CISSP Internet Security Advisors Group 4/22/09 | Session ID: HOT-201 Today Only! • Book Signing at 4pm at RSA Conference 2009 Bookstore!Bookstore! Insert presenter logo here on slide master 1 Agenda Why Ask What is GoogleWhat is Google Wh t D Y DWhat Do You Do Insert presenter logo here on slide master 2 Why AskWhy Ask Google Defending User Privacy? • A year or so ago, Google refused to give the FBI search historysearch history • They were hailed as standing up to the governmentgovernment • They didn’t have a prayer, but they were lauded for their effortsfor their efforts Insert presenter logo here on slide master 4 My Question Why did they have the information in the first place?information in the first place? Insert presenter logo here on slide master What Does Google Do? • Provide searches • Requires indexing of the billions of web pages around the world • Must search through indexes and provide results • Probably needs some data to optimize searches and provide test data • But does it really need 3-6 months of search data? Insert presenter logo here on slide master Are Searches Really Anonymous? • Google states it doesn’t keep PII • They do however keep source IP address and cookie tracking • You can turn of cookies, but you can’t turn off IP address Insert presenter logo here on slide master Does Not Saving PII Really Matter? • Gmail, youtube, Google Apps, Google Checkout, etc all enable cookies and require someetc, all enable cookies and require some personal information • They all require loginThey all require login • Does Google not have access to their own cookies?cookies? • Is Google incapable of putting basic information together?together? Insert presenter logo here on slide master Google vs. Microsoft Google • Provides services on their Microsoft • Wants their software to run• Provides services on their systems • All data on all apps is on their systems • Wants their software to run your life • Doesn’t target your data • They want you to buy theiry • Your data is stored on their systems • Tied to all aspects of life • They want you to buy their applications • They have limited efforts to target your data and your lifeTied to all aspects of life – E-mail, data, storage, interests • Knows where you visit Physically and virtually target your data and your life – Physically and virtually • Will know who calls you Insert presenter logo here on slide master Unlike Microsoft, Google is Loved • It seems like whatever Google does, it is embraced without thought by most peopleembraced without thought by most people • Google supporters tend to be loyal and fanatical • There is a focus on their innovation, without thought of the implications • Even when confronted with implications, people say, Google does no evil • Much like early Microsoft supporters Insert presenter logo here on slide master Google is Not Very Responsive • Japanese lawsuits • Mob in England • General privacy criticisms • Delisted Cnet for publishing Eric Schmidt’s info • They do it because they can type of attitude• They do it because they can type of attitude Insert presenter logo here on slide master Big Google Not Big Brother • When it comes down to it, Google has more real time information available than the governmenttime information available than the government • Consider what Google and it’s products can tell about you if they access the data you provideabout you if they access the data you provide them • That’s what I’m worried aboutThat s what I m worried about Insert presenter logo here on slide master 12 What isWhat is Google? It is Much More Than a Search Engine • Google is a brilliant business • Using it’s good will and profitability to grow and acquire new lines of business • They are reaching into all areas of life as a service Insert presenter logo here on slide master Google Keeps Searches • Searches tell a lot about a person’s interests and habitshabits • They have been used as evidence in many notable criminal suitsnotable criminal suits Insert presenter logo here on slide master Google Maps • Your searches indicate your intentions and your visitsvisits • Google Transit is a related technology of seeing your intent and contactsyour intent and contacts • Unfortunately this isn’t the worst part Insert presenter logo here on slide master Latitude • Tracking feature of Google mobile maps • Integrates with your cell phone GPS to track you • Always knows where your are • Constantly makes your location available to others Insert presenter logo here on slide master Google Street View • I will say Street View is appropriate for commercial locationscommercial locations • There is limited benefit for residential locations • For individuals, it puts them more at risk than provides benefits • Created lawsuits in Japan and mobs in England • Google persists Insert presenter logo here on slide master Google Checkout • Useful • Provides Google visibility into all relevant purchases • Only limited by vendors who accept Google Checkout Insert presenter logo here on slide master Google Apps • Cost effective for collaboration • All of your documents are stored on their cloud servers • Consider that all spreadsheets, documents, presentations, etc are available to Google • This is pretty much all of your sensitive documents • Security breaches already reported Insert presenter logo here on slide master Google Apps - Messaging • Gmail and other corporate mail N ith th dd d b fit f l ti t th ld– Now with the added benefit of geolocating you to the world • Calendar – provides all of your business intentions schedules meetings businessintentions, schedules, meetings, business contacts, etc. • Above acknowledges that your contacts are• Above acknowledges that your contacts are provided to Google Insert presenter logo here on slide master YouTube • Searches provide information on your interests, even more than search terms themselveseven more than search terms themselves • Putting things up on YouTube allows for searching by usersearching by user • Can be correlated between all of the other servicesservices Insert presenter logo here on slide master SketchUp • SketchUp provides for a facility to design and share 3D objectsshare 3D objects • Provides for intellectual property compromise • Puts together a bigger picture of organizational intentions and IP Insert presenter logo here on slide master Talk • IM utility • Provides for viewing supposedly private information exchanges Insert presenter logo here on slide master Picasa • Provides for the uploading and sharing of picturespictures • Pictures are assumed to be personal unless purposefully sharedpurposefully shared • Details your family, friends, trips, life in general Insert presenter logo here on slide master Google Health • Puts all your health records online • There is a useful purpose • Do I really have to go into the issues of now giving Google all your health records? • Implications of security compromise given compromise of Google Apps Insert presenter logo here on slide master Goog-411 • Free telephone information service • Tells Google who you are calling • Gives Google your spending habits and proclivities Insert presenter logo here on slide master Google Phone • Just when I thought the presentation couldn’t get better Google Phone was announcedbetter, Google Phone was announced • Google gives you a phone number that will call all of your phonesall of your phones • People call the number and then Google finds youyou • Google now knows who is calling you and then where you arewhere you are Insert presenter logo here on slide master Miscellaneous Others • SMS Bl• Blogger • Groups • Orkut • Translate • Reader • NotebookNotebook • Finance Insert presenter logo here on slide master What DoWhat Do You Do? Big Google? • They know everyone who knows you They know what you buy• They know what you buy • They know your perversions Th k di l diti• They know your medical conditions • They know your intellectual property • They always know where you are • They have your intellectual property • They know where you are going and when • They know you better than anyone else Insert presenter logo here on slide master Big Google? • The issue is that Google is becoming pervasive into all aspects of lifep • They are targeting profit and growth, but they are seeping into the most intrusive aspects of liour lives • People would be outraged of similar capability in the US governmentthe US government – Outrage is grossly understating it • Even Microsoft has not come close in the• Even Microsoft has not come close in the pervasiveness Insert presenter logo here on slide master I Admire This • From a business perspective, their strategies are brilliantbrilliant • They are profitable and growing • Their tools are tools of convenience Insert presenter logo here on slide master Unfortunately… • A compromise at Google can be worse than a compromise at the IRSp • Worse than a compromise at a hospital or pharmacy • All it takes is a small effort to consolidate the information, and there is • They have no responsibility for keeping your data private • They can use your data however they want to use it (except medical records hopefully) Insert presenter logo here on slide master Big Question #1 Just because they can, does it mean that they should? Insert presenter logo here on slide master Big Question #2 Where do you draw your line? Insert presenter logo here on slide master Where is Your Line? • Too many people don’t think of these issues • While Google is ok for now, we have no guarantees for the future • Should there be regulation to prevent the consolidation of data Insert presenter logo here on slide master Where is the Outrage? • People criticize the monopoly on software • Where is the criticism for a monopoly on information? Insert presenter logo here on slide master For More Information Insert presenter logo here on slide master For More Information Ira Winkler, CISSP, ira@isag.com +1-410-544-3435 Insert presenter logo here on slide master