Google has found itself in hot water after open source developers noticed that the Debian version of Chromium, the open-source version of Google Chrome, is downloading black-box code from Google, designed to listen to the user via any connected microphone and stream the audio back for analysis.
Obviously, this sounds pretty bad, but the situation is a little more complicated than this would suggest, so let's take a step back and see what's really going on.
What is Open Source?
For those unfamiliar, in open source software development, developers work together to create software with source code freely available for review and modification. This is an alternative to commercial software development, where software is developed in secret, and the compiled files (but not the source code) are sold to customers as a black box.
Open source development, because it doesn't sell its product, relies on donations of time and money from developers and corporations - as a result, development tends to go more slowly, and it can be difficult to get the tedious parts of software development done.
That said, in terms of security, open source has major advantages. In particular, when the code is publicly available, it's easy to verify that the software is doing what it's supposed to be doing, and doesn't contain backdoors or fatal bugs. Open source code is trustworthy in a way that commercial software is not.
In the real world, it's nearly impossible to get by using exclusively open source software. As a result, many open source programs use closed-source components for various purposes. For example, the standard flash player used by your browser is closed source, so most browsers on Linux load this (closed-source) module in order to watch that content.
A Digital Wiretap?
The module that Chrome installed is the module that allows the browser to respond to voice searches starting with "Okay Google" from any screen, a convenient feature of the Google Now platform.
The module is similar to other closed-source components like the Flash player, but it attracted the ire of the open-source community for two key reasons.
- Its function is potentially invasive - it's designed to allow the browser to recognize sentences that begin with "OK Google," and automatically search for them. For technological reasons, this speech recognition can't be performed client-side. When the module is activated, it streams all audio it picks up to a Google server for analysis.
- The module is downloaded automatically, and without directly alerting the user. Most open-source software, by convention, asks the user before installing closed-source components. While the module is disabled by default, it's still installed without the user's direct permission.
As Rick Falvinge, the founder of the Swedish Pirate Party puts it,
"Chromium, the open-source version of Google Chrome, had abused its position as trusted upstream to insert lines of source code [...] which downloaded and installed a black box [...] We don’t know and can’t know what this black box does. But we see reports that the microphone has been activated, and that Chromium considers audio capture permitted.
This was supposedly to enable the “OK, Google” behavior – that when you say certain words, a search function is activated. Certainly a useful feature. Certainly something that enables eavesdropping of every conversation in the entire room, too."
The Rebuttal
Technically, Falvinge is completely correct. However, I can't help but feel that the response to this issue has been a little bit hysterical.
One day, I have no doubt, Google will unroll a feature that listens to you all the time and data-mines your conversations. I'm also sure that when Google unrolls that functionality, it will advertise the hell out of it, probably with cheerful pastel-colored graphics. There's no reason to do is secretly, because hardly anyone is actually going to care.
The module that Google installed is already present in every Chrome browser on Earth - Chromium users are at no special risk. Google's sin here isn't spying on the world, so much as violating some implicit taboos in the open-source community. Most of the fuss here comes down to a culture conflict between the open source crowd, which has extremely high standards for security and privacy, and Google, which develops commercial software for a customer base that has, so far, not made their privacy a priority.
Google's official statement on the subject runs along similar lines.
"Chromium is entirely open source and yet it downloads a proprietary module. The key here is that Chromium is not a Google product (we do not directly distribute it, or make any guarantees with respect to compliance with various open source policies). Our primary focus is getting code ready for Google Chrome. If a third party (such as Debian) destributes it, it is their responsibility to enforce their own policy."
In other words: Chromium isn't a Google product, and it isn't Google's job to preserve the sanctity of open source.
A Sign of Things to Come
All of this isn't to say that Google isn't spying on you: if you opt-in to use the module, they totally are. But they're spying on you in a way that we've all pretty much come to accept: consensually, and without human intervention. The contents of your Google searches becoming public would be humiliating to pretty much anybody, but we have a degree of trust that these searches are seen only by abstract machine learning infrastructure deep in the belly of a server farm somewhere. Presumably, the same will go for the contents of conversations that take place near an "OK Google" enabled computer.
If you object to this, you are welcome to use a different open-source browser that does not use closed source components. You may also want to move to an EM-shielded bunker in the Rockies, because you are not going to like the rest of the future. The trend in technology so far has been giving up privacy for convenience, and there's no sign that the process is slowing.
Take this idea to its logical limit. In a decade or two, I'd wager, most people are going to be wearing some kind of head-mounted smart device: portable augmented reality hardware, streamlined down to the size of a pair of sunglasses. Obviously, these will be more useful if you give Google or Apple or Microsoft an always-on stream of everything you see and hear for analysis. Will people go for it? Based on recent history, I think there's a very good chance that they will.
So to bring it back to the issue at hand: relax, Chromium users. Google's not spying on you. But they will be, soon, and you are going to love it.
Or are you? Tell us how you feel about this in the comments.
Image credits: Google Glass, Open Source Keyhole, by Wikimedia