Guest post: Government Gmail use following Google's China news
Summary: Paul Strassman outlines some of the technical issues raised for government agencies using Gmail in light of the China cyberattack on Google.
Paul Strassmann is a Distinguished Professor of Information Sciences at George Mason University's Center for Secure Information Systems. He's also a long-time technology executive in the private sector and government. In 2002, he served as acting CIO of NASA. Here's his take on the Google-China showdown and some of the technical issues the incident raises.
Updated: A Google spokesman responds with the following: The premise of Mr. Strassmann's post is without merit: There's no need to withdraw servers that store Gmail information from China because there aren't any there.
Federal Chief Information Officer Vivek Kundra has been a consistent advocate of increasing the government's use of commercially available technologies, such as Gmail. In fact, as the District of Columbia's chief technology officer, Kundra implemented Google Apps, including Gmail, for all District employees.
A number of Department of Defense (DoD) organizations are already using Gmail. Meanwhile, Google has made secure Gmail the default choice in light of the cyberattack the company detailed on Tuesday.
Related: Google’s showdown with China: Does it make sense? · Google threatens China pullout after cyberattack · Adobe confirms ’sophisticated, coordinated’ breach · Bravo! Google takes a stand for human rights in China · The Google escalation and open source · Google on the defensive and vulnerable
Since there are DoD organizations that have already advocated the adoption of Gmail, the following advisory is offered.
The most probable, and easiest way, would be for Chinese agents with physical access to Google servers to insert physical wiretaps. A modified version of a Cisco switch with an extra optic fiber leading off to the police would be easy to hide. It would be reasonable to assume that Google does not encrypt traffic sent between machines in the same subnet (i.e. in the same physical cabinet).
Once you can wiretap, you can eventually figure out how to distinguish Gmail traffic from other traffic, and reverse engineer how Gmail data is replicated across servers.
There is no defense against a hostile party with full physical access to your server room. That is why Google's only logical option is to withdraw all physical servers from China.
There are two Google data centers in China, almost surely co-hosted on shared facilities and not owned by Google. Similarly, there is a co-hosted facility in Russia. Unless a facility is owned and operated by Google it would be always suspect, and even then it would not qualify to operate DoD classified mail.
DoD should therefore not consider Gmail as a viable option because it cannot be trusted. Only a secure DoD Private Cloud, isolated from the Internet, can be seen as an acceptable option.
Ed note: Google said it doesn't have servers that hold Gmail data within China. Strassmann maintains his reservations about cloud applications within the DoD.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
DoD using Gmail?!?
If you have no physical control over a network ...
I totally agree
I think not: It appears that they could not even protect their own information and code.
Only problem with your reasoning is that ALL email servers are connected to
the others, and there are very few companies that
have the resources to do it better than Google.
Yes, but the DoD employs ...
Private clouds have no such assurance of better security. There are few
email safer than Google (or other large
providers) let alone justify the cost of hosting
their own email. You just can NOT match the
ability of a large provider to have people 24x7,
and all of the constant research into how email
systems are being attacked.
The difference in attack surface is negligible
as the servers are all connected to the internet
in any case.
I think the Government, and more so the Military
Or do you think the Military only fights 9-5?
By the way, this [i]is[/i] intersting -
http://blogs.zdnet.com/Foremski/?p=1047&tag=wrapper;col1
Well, yes, the military could waste a lot of taxpayer money managing email
extremely expensive to install servers at each
location and manage them. They could do the same
thing that Google is doing and centralize the
servers, but, then they are just doing the same
thing as Google, and have all the same
vulnerabilities, AND, it would just end up costing
more, a LOT MORE - which TAXPAYERS would be
paying.
Doesn't sound like experience talking
You also have the additional point of attack from within the public cloud itself. If someone at Google decides to get a little shady and look into what you have stored on your cloud or in your email they can and you have no knowledge unless Google happens to discover it. Basically you have no control over the processes, procedures, logging, and controls they have in place or background checking their employees. There is a HUGE difference between the two and the reason most regulated organizations are starting to bring more and more in house.
Real world mail servers....
All of them are protected by firewalls, some (=large corporations) have external and internal smtp servers, so that internal mail is not routed to the internet.
External smtps are routinely brought down, patched and brought up. All external smtps are round-robin dns MX records, no downtime occurs.
DoD, and all US Government Offices, Self-Host
Government is not always as foolish as MSNBC would lead us to believe.
Agree with you 100%
End of discussion !
- Admin
Not exactly, for non critical activities, Google can do it a lot cheaper
could do it internally.
For very critical communications, the DoD should
not use email at all really.
Double, Triple Fails all around........
Who the heck is this CIO because he is a joke. We really are becoming a laughing stock to the world and I can't wait until 2012 and this garbage of an administration will be gone. Makes the Bush admin look like the good guys. There has always been problems in government IT security and this one just ranks right up at the top of the fail list along with P2P being allowed on government systems.
Stupid is as stupid does. Good work America for being foolish idiots.
Sending email on the public Internet is not acceptable for critical
servers. But, for non-critical communications (of
which there are many in the DoD) Google can do it
better and cheaper than they could internally.
Not every email contains nuclear secrets.
Its about.....
Yes, it IS about trust, and how much can a small company or government
better to use a large provider that CAN afford
to trustworthy people 24x7, and also research
groups constantly reviewing security and looking
for any gaps.
And, if you can not even trust the employees to
use approved communication methods for critical
information, you have a much bigger problem than
the email provider!!!!!!!!
You can defend Google all you want
Who watches the watchers?
Prove to me that Google hasn't been hacked, and DoD emails intercepted and read.
You can't.
This is not just about Google, it is about large email providers that have
they can be hacked, that is not the question. The
question is could you do it better yourself. There
are very few companies big enough to hire the
required professionals needed 24x7 to even have it
at the same level of what a large provider can do.
Wow ... you sure got them all up in a tizzy with this.
I would be best if they didnt have internet access on the same machines that classified information was on... but thats just my opinion.