Tuesday, January 26, 2010

Hacking Google

Who hacked Google? Gmail accounts were the targets, as far as public press releases show. Google says the hackers were Chinese, as does the US government. China responds that its government had nothing to do with it, and how dare you say it did?

We only know that Google was hacked because it says so. Google also says that Chinese dissidents were the ones targeted. Let's assume that they are telling the truth as far as they know it. Do governments have teams of computer hackers busily preparing for cyber-war and testing their abilities in the meantime? One assumes that they do, and Americans would be dismayed to learn that their government wasn't doing just that. The way you learn to break into computer networks is by breaking into computer networks, the tougher the better.

Internet security companies are also busily probing for security holes, as are fascinated amateurs, professional sleuths and criminal gangs. The complexity of modern software and the worldwide distribution of its creation and manufacture pretty much guarantee that there will always be security holes. Any computer network is as secure as its weakest link, and one unpatched computer is all it takes to let in the bad guys.

So who hacked Google? Writers have been pointing out that there are many people and groups who could benefit from successfully hacking those Gmail accounts. Google's competitors in China would certainly benefit if Gmail seemed insecure, and for that matter Google's competitors outside China would also benefit. Google has been getting steadily bigger and its reach into new markets and technologies is astounding. As it moves more people into the cloud computing realm the market for free-standing individual software goes down.

Already anyone with a decent internet connection can avoid buying any software and still be productive. Google even has a free operating system for you, and it isn't alone. How do you stop the Google juggernaut? If people's faith in the security and stability of Google's applications is compromised, what will happen?

Google has a lot to lose in this whole hacking scandal, and many people and groups benefit from its loss. For us end-users the moral of the story is simple: no electronic communication is safe from prying eyes. Even strong encryption is only as secure as its password, which can be obtained by cleverness, deception or stealth in many cases. We can only be secure from casual trespassers, not unlike a locked house. As with a locked house, our online financial transactions can be burgled. We have insurance for both since neither can ever be completely secure.

I take reasonable precautions, patching my software and keeping my anti-virus software up to date. I also don't wander around in bad internet neighborhoods. I have still been a victim of cyber theft, which I only discovered by checking my credit card statements. I know that the IT staff can read my mail, so I don't send anything I don't want read. My greatest risk is an unplanned "reply all." We are probably better off thinking of the internet as a party-line phone, and using it accordingly.

So who hacked Google? It doesn't matter, and no one can ever know for sure anyway. If Google decides not to compete in China that is their business decision. Some people got a wake-up call from the event, and that may be a good thing for all of us.