Control government-backed attack alerts in G Suite

gsuiteupdates.googleblog.com

33 points·danso··8 comments

This may help people who are under attack by governments of unimportant countries. But attacks by the governments of the world's great powers come in the form of national security letters, sealed court orders, secret warrants, and those are usually illegal to disclose to the target of the attack.

I’m interested in background as to why, specifically, government-backed attacks are reported differently. In my experience who funds the attack is anecdotal to the triage, midigation, and reporting of an attack; be it from government, corporate espionage, or an independent group.

Governments tend to have powers that corporate/individual entities don't have. They have the power the imprison, freeze assets, and other things that organizations may be worried about.

If you ran an NGO that was engaging in activities that governments may not like (such as a group trying to spread democracy in China), you would very much like to know if your accounts were being targeted by government actors, as it may put you on alert that you have peek someones attention that could be bad for your organization.

I wonder how Google determines that an attack is government-backed? They must have some incredible intel.

They run all the attachments and downloadable files in an email in a virtual machine and see where the malware connects to.

Turns out many governments do attacks on a lot of people semi-automatically, and use a handful of command and control servers, so their attacks are fairly easy to identify.

What about attacks from China once it launches its censored version? I believe censoring alone is not enough to do business in China.

Except for the ones that Google sponsors and installs on their systems for the US and China to spy on civilians.

Source?

Reply on news.ycombinator.com