Google announced on Tuesday that it will now warn you if your personal Gmail account appears to be the target of “state-sponsored attackers.” The announcement coincided with the first deployment with the alert. Shown on a red background at the top the Gmail page, it reads: “Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer. Protect yourself now.”
A link provides some information about the threat and some tips to secure a compromised account (at least, for users who don’t immediately duck and cover). The solutions offered aren’t too dramatic: change your password, enable two-step login verification, and update your browser. Google isn’t saying much beyond an item on its security blog, and it’s unclear how it detects threats or how many people have so far received the warning. Eric Grosse, VP of security engineering, says in the blog post that the alert doesn’t mean there has been an attack—just “that we believe you may be a target.”
Better safe than sorry, right? But cybersecurity expert Jeffrey Carr, who received the warning on his own Gmail account, calls it “Google’s worst security idea ever.” The problem, Carr says, is that it induces panic among people who may not be targets at all—and it doesn’t do anything to protect the people that foreign intelligence services really want access to, who shouldn’t be using Gmail in the first place. “If the Mossad, the FSB [Russia’s Federal Security Service], the MSS [China’s Ministry of State Security], or the NSA is interested in you, they’ll find a way to legally and covertly intercept your data without sending a spear phishing email to your Gmail account.”
To Google’s credit, the alert could be particularly valuable in countries that routinely spy on their own people. By letting people in (oh, let’s say) China know that they may be the victims of an attack, Google is engaging in a sort of quiet activism in line with last week’s announcement that users in China will be notified when a search term could trigger Internet censors. It doesn’t change anything directly, but it sheds light on an ongoing problem.
Google isn’t saying which country’s actions inspired the new alert, but journalists and activists across China reported seeing the warning, and the Internet giant’s relations with the Chinese government have long been contentious. It’s also unclear whether Google intends to alert users any time any government tries to access an account without permission, or if the alert is more tailored, presumably for China.
If the alert takes on real meaning anywhere, it might be in Washington. Foreign Policy blogger Daniel Drezner, who received the alert, jokes on his blog that it could set a new standard for measuring influence in the Beltway. After all, what wonk wants to find out he’s the only one the office who isn’t being spied on by a foreign government?
