It means that Google itself can tap into Hangout sessions when it receives a government court order instructing it to do so. This is unlike other services that utilize end-to-end encryption, such as Apple’s FaceTime, which can’t be tapped — even by the company that offers the service, 9to5 Google reports
Google has been pretty vague about the level of encryption used on Google Hangouts, Motherboard reports. When the company was questioned by Christopher Soghoian, the principal technologist at the American Civil Liberties Union, it only said that messages were encrypted “in transit.”
Interestingly, in its support documentation, Google only says the following:
“When you message or talk with someone on Hangouts, your information will be encrypted so that it’s secure.” There’s no mention about end-to-end encryption.
So that’s when Soghoian decided to start asking questions, and took advantage of the AMA session on Reddit to do so, Motherboard reports.
In the exchange he noted that “Google has repeatedly refused to acknowledge whether or not it is capable of wiretapping Hangouts for government agencies.” Then he referenced Apple’s FaceTime product
His first question, according to WebProNews?
“Why has Google refused to be transparent about its ability to provide wiretaps for Hangouts? Given Google’s rather impressive track record regarding surveillance transparency, the total secrecy regarding the company’s surveillance capabilities for this product is quite unusual.”
He put the question to Richard Salgado, Google’s director for law enforcement and information security, along with David Lieber, senior privacy policy counsel.
Salgado responded by citing Google’s record of disclosing wiretap requests, CultofMac reports, noting “there were a total of seven wiretap orders in the first half of 2014, covering nine accounts.” What he said after that is what stirred up the Reddit hornet’s nest.
“Hangouts are encrypted in transit,” Salgado said, providing a link to Google’s help document.
Then readers pointed out that “in transit” isn’t the same as the end-to-end encryption that Apple uses for its aforementioned programs.
Reddit user reddit_poly put it quite well:
“This means that Hangouts are only encrypted on their way between your computer and Google’s servers. Once they arrive at Google’s end, Google has full access.”
To which geekpondering, another Reddit user, replied:
“Of course they do. How else would they transcribe your conversations in order to determine your social behaviors in order to sell ads to you?
More data! nom nom.”
Motherboard asked Google to clarify its answer, and a spokesperson confirmed that end-to-end encryption isn’t used in Hangouts. Technically, this means that if law enforcement agencies ask, Google can wiretap conversations, even if you turn on the “off the record” feature. That feature only prevents chat conversations from appearing in your history, anyway. It doesn’t provide extra encryption or security.
It’s not really clear how many times this has occurred, Motherboard says, adding that it’s likely a rare occurrence. In 2013, Google only received 19 requests from the U.S. government to conduct a wiretap, according to the company’s Transparency report. In the first half of 2014, which is the latest data publicly available, Google received seven wiretap requests, as mentioned earlier, but it doesn’t specify which Google products the wiretap orders were for.
The spokesperson for Google didn’t comment when Motherboard asked how many of the wiretaps were for Hangouts.
So perhaps the takeaway from this is that if you don’t want to share something with the world, by all means, don’t mention it on Google Hangouts.
