Google has been stealth downloading audio listeners onto every computer that runs Chrome

[tim@diffalt.com (Tim Beelen)]

How do I find out what program is listening to my microphone?

On 6/21/2015 4:55 PM, Shelley wrote:
> ----------
> On June 21, 2015 1:14:32 PM Seth <list@sysfu.com> wrote:
>
>>  from
>> https://www.privateinternetaccess.com/blog/2015/06/google-chrome-listening-in-to-your-room-shows-the-importance-of-privacy-defense-in-depth/ 
>>
>>
>>
>> Posted on June 18, 2015 by Rick Falkvinge
>>
>> Google Chrome Listening In To Your Room Shows The Importance Of Privacy
>> Defense In Depth
>
>
> Wow, this is exactly the kind of bullshit- and bullshit response- I'd 
> expect from this duplicitous NSA asset.
>
> I keep a seldom-used, older version of chromium on one of my debian 
> laptops so I'll check for this.  My webcam and microphone are 
> physically disconnected anyway, but I still want to see if their 
> spyware has infected my system.  Fuckers.
>
> Thanks for posting this; I've been out of the news loop for a couple 
> of days.
>
> -S
>
>
>>
>> Yesterday, news broke that Google has been stealth downloading audio
>> listeners onto every computer that runs Chrome, and transmits audio data
>> back to Google. Effectively, this means that Google had taken itself the
>> right to listen to every conversation in every room that runs Chrome
>> somewhere, without any kind of consent from the people eavesdropped 
>> on. In
>> official statements, Google shrugged off the practice with what 
>> amounts to
>> â??we can do thatâ??.
>>
>> It looked like just another bug report. "When I start Chromium, it
>> downloads something." Followed by strange status information that 
>> notably
>> included the lines "Microphone: Yes" and "Audio Capture Allowed: Yes".
>>
>> chrome-voicesearch
>>
>> Without consent, Googleâ??s code had downloaded a black box of code that â??
>> according to itself â?? had turned on the microphone and was actively
>> listening to your room.
>>
>> A brief explanation of the Open-source / Free-software philosophy is
>> needed here. When youâ??re installing a version of GNU/Linux like 
>> Debian or
>> Ubuntu onto a fresh computer, thousands of really smart people have
>> analyzed every line of human-readable source code before that operating
>> system was built into computer-executable binary code, to make it common
>> and open knowledge what the machine actually does instead of trusting
>> corporate statements on what itâ??s supposed to be doing. Therefore, you
>> donâ??t install black boxes onto a Debian or Ubuntu system; you use 
>> software
>> repositories that have gone through this source-code audit-then-build
>> process. Maintainers of operating systems like Debian and Ubuntu use 
>> many
>> so-called â??upstreamsâ?? of source code to build the final product.
>>
>> Chromium, the open-source version of Google Chrome, had abused its
>> position as trusted upstream to insert lines of source code that 
>> bypassed
>> this audit-then-build process, and which downloaded and installed a 
>> black
>> box of unverifiable executable code directly onto computers, essentially
>> rendering them compromised. We donâ??t know and canâ??t know what this black
>> box does. But we see reports that the microphone has been activated, and
>> that Chromium considers audio capture permitted.
>>
>> This was supposedly to enable the â??Ok, Googleâ?? behavior â?? that when you
>> say certain words, a search function is activated. Certainly a useful
>> feature. Certainly something that enables eavesdropping of every
>> conversation in the entire room, too.
>>
>> Obviously, your own computer isnâ??t the one to analyze the actual search
>> command. Googleâ??s servers do. Which means that your computer had been
>> stealth configured to send what was being said in your room to somebody
>> else, to a private company in another country, without your consent or
>> knowledge, an audio transmission triggered byâ?¦ an unknown and 
>> unverifiable
>> set of conditions.
>>
>> Google had two responses to this. The first was to introduce a
>> practically-undocumented switch to opt out of this behavior, which is 
>> not
>> a fix: the default install will still wiretap your room without your
>> consent, unless you opt out, and more importantly, know that you need to
>> opt out, which is nowhere a reasonable requirement. But the second was
>> more of an official statement following technical discussions on Hacker
>> News and other places. That official statement amounted to three parts
>> (paraphrased, of course):
>>
>> 1) Yes, weâ??re downloading and installing a wiretapping black-box to your
>> computer. But weâ??re not actually activating it. We did take advantage of
>> our position as trusted upstream to stealth-insert code into open-source
>> software that installed this black box onto millions of computers, 
>> but we
>> would never abuse the same trust in the same way to insert code that
>> activates the eavesdropping-blackbox we already downloaded and installed
>> onto your computer without your consent or knowledge. You can look at 
>> the
>> code as it looks right now to see that the code doesnâ??t do this right 
>> now.
>>
>> 2) Yes, Chromium is bypassing the entire source code auditing process by
>> downloading a pre-built black box onto peopleâ??s computers. But thatâ??s 
>> not
>> something we care about, really. Weâ??re concerned with building Google
>> Chrome, the product from Google. As part of that, we provide the source
>> code for others to package if they like. Anybody who uses our code for
>> their own purpose takes responsibility for it. When this happens in a
>> Debian installation, it is not Google Chromeâ??s behavior, this is Debian
>> Chromiumâ??s behavior. Itâ??s Debianâ??s responsibility entirely.
>>
>> 3) Yes, we deliberately hid this listening module from the users, but
>> thatâ??s because we consider this behavior to be part of the basic Google
>> Chrome experience. We donâ??t want to show all modules that we install
>> ourselves.
>>
>> If you think this is an excusable and responsible statement, raise your
>> hand now.
>>
>> Now, it should be noted that this was Chromium, the open-source 
>> version of
>> Chrome. If somebody downloads the Google product Google Chrome, as in 
>> the
>> prepackaged binary, you donâ??t even get a theoretical choice. Youâ??re
>> already downloading a black box from a vendor. In Google Chrome, this is
>> all included from the start.
>>
>> This episode highlights the need for hard, not soft, switches to all
>> devices â?? webcams, microphones â?? that can be used for surveillance. A
>> software on/off switch for a webcam is no longer enough, a hard 
>> shield in
>> front of the lens is required. A software on/off switch for a microphone
>> is no longer enough, a physical switch that breaks its electrical
>> connection is required. Thatâ??s how you defend against this in depth.
>>
>> Of course, people were quick to downplay the alarm. â??It only listens 
>> when
>> you say â??Ok, Googleâ??.â?? (Ok, so how does it know to start listening just
>> before Iâ??m about to say â??Ok, Google?â??) â??Itâ??s no big deal.â?? (A company
>> stealth installs an audio listener that listens to every room in the 
>> world
>> it can, and transmits audio data to the mothership when it encounters an
>> unknown, possibly individually tailored, list of keywords â?? and itâ??s no
>> big deal!?) â??You can opt out. Itâ??s in the Terms of Service.â?? (No. 
>> Just no.
>> This is not something that is the slightest amount of permissible just
>> because itâ??s hidden in legalese.) â??Itâ??s opt-in. It wonâ??t really listen
>> unless you check that box.â?? (Perhaps. We donâ??t know, Google just
>> downloaded a black box onto my computer. And it may not be the same 
>> black
>> box as was downloaded onto yours. )
>>
>> Early last decade, privacy activists practically yelled and screamed 
>> that
>> the NSAâ??s taps of various points of the Internet and telecom networks 
>> had
>> the technical potential for enormous abuse against privacy. Everybody 
>> else
>> dismissed those points as basically tinfoilhattery â?? until the Snowden
>> files came out, and it was revealed that precisely everybody involved 
>> had
>> abused their technical capability for invasion of privacy as far as was
>> possible.
>>
>> Perhaps it would be wise to not repeat that exact mistake. Nobody, and I
>> really mean nobody, is to be trusted with a technical capability to 
>> listen
>> to every room in the world, with listening profiles customizable at the
>> identified-individual level, on the mere basis of â??trust usâ??.
>>
>> Privacy remains your own responsibility.
>>
>> Rick Falkvinge
>> ABOUT RICK FALKVINGE
>> Rick is the founder of the first Pirate Party and is a political
>> evangelist, traveling around Europe and the world to talk and write 
>> about
>> ideas of a sensible information policy. He has a tech entrepreneur
>> background and loves whisky. Read more of his articles on his website.
>>
>> Twitter |More Posts (91)
>>
>
>