Skating on Stilts

Are you a Google-certified public figure?

I am not a big fan of the EU's "right to be forgotten," but it has one silver lining.  I was noodling around with Google's ever-more-baroque implementation of the principle this weekend, and I discovered that it offers a quick and cheap way to discover just how famous Google thinks you are.  

To understand how Google got in the "famous or not" business requires a dive into the search engine's stutter-step implementation of the EU requirement.  In China, of course, when Google is required to suppress a link, it includes a warning on the results page, saying in essence that the results have been censored.  Google originally planned to do the same in response to European censorship.  But the European data protection censors didn't like that kind of transparency.  They thought that the notice, even if it didn't actually say what had been suppressed, would stigmatize Europeans who invoked the right to be forgotten. (That, and it might remind searchers that their access to data was being restricted by European law.)

Google caved, mostly.  But it left in place a vestige of its original policy. Now, it includes the following warning on its European results pages whenever any name is searched for:  "Some results may have been removed under data protection law in Europe. Learn more." 

But that policy isn't implemented across the board.  As Google's global privacy counsel explained a month ago, “Most name queries are for famous people and such searches are very rarely affected by a removal, due to the role played by these persons in public life, we have made a pragmatic choice not to show this notice by default for known celebrities or public figures."

So there you have it.  Somewhere, Google has an algorithm for deciding who is a celebrity or public figure and who is not.  To find out whether you made the grade, all you have to do is go to Google.co.uk, and type in your name. Then look at the bottom of the page for the tag that says, "Some results may have been removed" etc.  If it's not there, apparently you're a public figure in Google's eyes.  If it is, well, you'd better get working on your SEO techniques.

I found this when I searched for myself and didn't see the "some results" tag-of-ignominy. I thought that was weird, so I ran a few other names.  And it looks as though Google is making a cut based on number of name searches, but as Google's counsel more or less admitted in his letter, the system is still pretty rough.  Maybe it will get better.  But why wait until it comes out of beta?  Knowing Google, that could be years.  

Let's ask now who makes it past Google's equivalent of the red velvet rope.  Here's my quick census:

Google-Famous: Stewart Baker, Ben Wittes, Eugene Volokh, Jack Goldsmith, Orin Kerr, Kent Walker, Nicole Wong, Declan McCullagh, Peter Swire, Annie Anton, Dan Geer (cybersecurity guru), Jim Lewis (ditto), Raj De (NSA's GC), Dianne Feinstein(Senate intelligence committee chair), David Hoffman (upcoming guest on the Steptoe Cyberlaw Podcast), Chris Soghoian, James X. Dempsey (CDT senior counsel, member of Privacy and Civil Liberties Oversight Board).

Not Google-Famous:  Nuala O'Connor (head of CDT), Michael Daniel (White House cybersecurity czar), Bob Litt (DNI's general counsel), John P. Carlin (Assistant AG for National Security), Michael J. Rogers (chair of House intelligence committee), David Medine (chair of Privacy and Civil Liberties Oversight Board),Michael Vatis (cohost of the Steptoe Cyberlaw Podcast), Jason Weinstein (ditto), Ellen Nakashima (astonishingly prolific Washington Post national security reporter). 

It's pretty clear that Google is struggling with the old saw, "On the Internet, everyone is famous for fifteen people."  But it's still hard to see exactly where the line is being drawn.

For further irony, consider Max Mosley, who is internet-famous mainly for the video of his multi-hour, multi-hooker, sadomasochistic orgy and for his successful campaign to force Google to suppress links to those pictures.  His search results are being censored.  But he's now so famous that Google gives us no warning -- not even that they might be bowdlerized.  That can't make sense.

But why should I have all the fun?  Why not google yourself first (don't pretend you won't) and then your friends and acquantances?  Then list any additional surprises in the comments.

As evidence mounts, it's getting harder to defend Edward Snowden

The evidence is mounting that Edward Snowden and his journalist allies have helped al Qaeda improve their security against NSA surveillance. In May, Recorded Future, a predictive analytics web intelligence firm, published a persuasive timeline showing that Snowden's revelations about NSA's capabilities were followed quickly by a burst of new, robust encryption tools from al-Qaeda and its affiliates: 

This is hardly a surprise for those who live in the real world. But it was an affront to Snowden's defenders, who've long insisted that journalists handled the NSA leaks so responsibly that no one can identify any damage that they have caused.

 In damage control mode, Snowden's defenders first responded to the Recorded Future analysis by pooh-poohing the terrorists' push for new encryption tools. Bruce Schneier declared that the change might actually hurt al Qaeda: “I think this will help US intelligence efforts. Cryptography is hard, and the odds that a home-brew encryption product is better than a well-studied open-source tool is slight.”

Schneier is usually smarter than this. In fact, the product al Qaeda had been recommending until the leaks, Mujahidin Secrets, probably did qualify as “home-brew encryption.” Indeed, Bruce Schneier dissed Mujahidin Secrets in 2008 on precisely that ground, saying “No one has explained why a terrorist would use this instead of PGP.” 

But as a second Recorded Future post showed, the products that replaced Mujahidin Secrets relied heavily on open-source and proven encryption software. Indeed, one of them uses Schneier's own, well-tested encryption algorithm, Twofish.

Faced with facts that contradicted his original defense of Snowden, Schneier was quick to offer a new reason why Snowden's leaks and al Qaeda's response to them still wouldn't make any difference:

Whatever the reason, Schneier says, al-Qaida's new encryption program won't necessarily keep communications secret, and the only way to ensure that nothing gets picked up is to not send anything electronically. Osama bin Laden understood that. That's why he ended up resorting to couriers.

Upgrading encryption software might mask communications for al-Qaida temporarily, but probably not for long, Schneier said...."It is relatively easy to find vulnerabilities in software," he added. "This is why cybercriminals do so well stealing our credit cards. And it is also going to be why intelligence agencies are going to be able to break whatever software these al-Qaida operatives are using."

So, if you were starting to think that Snowden and his band of journalist allies might actually be helping the terrorists, there's no need to worry, according to Schneier, because all encryption software is so bad that NSA will still be able to break the terrorists' communications and protect us. Oddly, though, that's not what he says when he isn't on the front lines with the Snowden Defense Corps. In a 2013 Guardian article entitled “NSA surveillance: A guide to staying secure,“ for example, he offers very different advice, quoting Snowden:

"Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on."

Scheier acknowledges that hacking of communication endpoints can defeat even good encryption, but he's got an answer for that, too:

Try to use public-domain encryption that has to be compatible with other implementations. ...Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about.…

The NSA has turned the fabric of the internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible.

Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it. That's how you can remain secure even in the face of the NSA.

It sounds as though al Qaeda took Bruce Schneier's advice to heart, thanks to leaks from Edward Snowden -- even if Schneier is still doing everything he can to avoid admitting it.

UPDATE: The description of Recorded Future was changed at the request of the company, which said, "While this may seem like splitting hairs, in the world of data analysis software "predictive analytics" has specific technical meaning which implies something different. We use the term web intelligence to reduce this confusion."