Questions on legal processes/reporting , frameworks, reporting and auditing.

[Kuldran]

Legal process(es) and reporting

I would like to have better understanding on how the legal process has been thought of. For instance I currently report matter to various organisation based on the issue at hand the the geo location. (ic3, hosting provider, isp, etc.).

In the event of a report how would one complete these types of reports to the appropriate groups? In most cast these are time sensitive as I/we maybe monitoring bad actors involved in activities that may cause harm or loss to businesses or individuals. What process will be changed, what are the delays? 8 hr+ is not acceptable in these delays.

What can I expect to see in my logs or what will I be able to use in a server log to track this these individuals. The answer is not acceptable to be nothing or report it to us we will handle it, authorities want logs, we need to be able to describe it. you have to understand that some situation may mean that by the time you get around to providing long a 3rd party may not have these logs anymore.

Legal Framework(s)

Which and how will Google enforce the legal frameworks to insure no abuse, and other requirements will be met. This question seems to not have been asked and is a bigger question mark on the top of my head now. The issue stems from Google being a US based company will have to comply with US laws, my worry is that US laws have many legal framework which will gag a company from saying this matter (which Google may or may not spend time in court defending) cannot be announced in anyway to the user or community.

What measures will be in place to prevent Google from becoming a one stop shop of this type of over reach? because again you say this will be a double blind proxy that is till it goes live. Then the court via case no one knows about Google becomes the 2 ends for users that meet the requirements.

This is a big concern and saying this cannot happen is tantamount to digging your head in the sand. The issue exist it should be addressed.

Reporting and audits

Because this is an issues of trust and Google expects us to have a blind trust in a system which is basically a MiTM for net traffic. what reporting and audit look like.

Will audits be done to insure Google and the other side are not playing with he infrastructure will there be a way for end users to validate the code not simply chrome? If not possible who will be allowed to audit the full stack top down, will these auditors be chosen to represent a region or everything. What will be the criteria for a pass or fail, and who will determine the criteria?

If a third party auditor is chosen how will we be sure they are not biased to give a passing grade? Or misinform the general public on what was observed (example gag order by the courts)?

Will users be able to trace the chain they use to connect back to the outside world?

Final question for today.

I will end this with this simple question? If Google/GoogleChrome/Alphabet/(enter what entity/project name you want) is forced by a government to instate a "one stop shop" for monitoring at any point will this project be terminated immediately regardless of the region or government this comes from for everyone? As you said this project is for privacy and if you become a government monitoring hub then it's no longer a privacy tool.