As you may know, there was quite a lot of buzz this week about Google potentially leaving China over the hacking of Google’s system. From MSNBC/Reuters:
Google, the world’s top search engine, said on Tuesday it might shut down its Chinese site, Google.cn, after an attack on its infrastructure it believed was primarily aimed at accessing the Google mail accounts of Chinese human rights activists.
Unlike ordinary viruses that are released into cyberspace and quickly spread from computer to computer, the type of attack launched against Google and at least 20 other companies were likely handcrafted uniquely for each targeted organization.
It appears to be a problem that is quite deep according to an in depth article in MacWorld:
Google, by implying that Beijing had sponsored the attack, has placed itself in the center of an international controversy, exposing what appears to be a state-sponsored corporate espionage campaign that compromised more than 30 technology, financial and media companies, most of them global Fortune 500 enterprises.
The U.S. government is taking the attack seriously. Late Tuesday, U.S. Secretary of State Hillary Clinton released a statement asking the Chinese government to explain itself, saying that Google’s allegations “raise very serious concerns and questions.”
But the Macworld article goes on to explain why the United States government may be taking this much more seriously than they let on:
“First, this attack was not just on Google. As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses – including the Internet, finance, technology, media and chemical sectors – have been similarly targeted,” wrote Google Chief Legal Officer David Drummond in a Tuesday blog posting.
“Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists.”
Drummond said that the hackers never got into Gmail accounts via the Google hack, but they did manage to get some “account information (such as the date the account was created) and subject line.”
That’s because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press.
“Right before Christmas, it was, ‘Holy s***, this malware is accessing the internal intercept [systems],’” he said.
Uh, “account information”, “subject line”, “search warrants” and “intercept systems”. That ring a bell? This appears to indicate that the state-sponsored Chinese hackers have hacked into the portion of the Google infrastructure that deals with government warrants, intercepts, national security letters and other modalities pertinent to the Terrorist Surveillance Program. That, if true, could be very problematic, one would think.
Now, this is based upon information and belief, but it is my understanding that Google doesn’t store any gmail data in China, which means that this search warrant/intercept machine was located in the US, likely in Mountain View California
That is, if Google’s Mountain View HQ search warrant search interface/computer was hacked, we are probably talking about the same computer used by the Google Legal Department to perform queries in response to DOJ warrants, subpoenas, national security letters, and FISA orders.
Yeah, if that is the case it could be a problem.