I'm ambivalent about NSA's need to request potentially large amounts of data from Google about broadly targeted foreign intelligence targets. I see the long term sinister possibilities while generally believing that the data isn't being misused today, and what immediate problems I see have more to do with ineptitude and laziness than with the belief that Internet surveillance is fundamentally evil.
But coercing Google into handing over TLS keys is unequivocally bad; indefensible, I think. It's one thing to legally compel Google to grant access to data, but another thing entirely to rewire Google itself:
* It provides NSA with a technical capability they do not currently have, enabling them to shoot first and answer questions for a court later, and eliminates a due process element that other providers (notably Yahoo) have been able to avail themselves of.
* If provides the USG with capabilities beyond simple surveillance, for instance by allowing them to spoof Google pages. There can't be any legitimate reason to provide them that blanket authority.
I appreciate the effort and expense it must take for companies like Google to resist these requests.
But coercing Google into handing over TLS keys is unequivocally bad; indefensible, I think. It's one thing to legally compel Google to grant access to data, but another thing entirely to rewire Google itself:
* It provides NSA with a technical capability they do not currently have, enabling them to shoot first and answer questions for a court later, and eliminates a due process element that other providers (notably Yahoo) have been able to avail themselves of.
* If provides the USG with capabilities beyond simple surveillance, for instance by allowing them to spoof Google pages. There can't be any legitimate reason to provide them that blanket authority.
I appreciate the effort and expense it must take for companies like Google to resist these requests.