Google Admits Hangouts Conversations Can Be Wiretapped

In the post-Snowden world, end-to-end encryption (E2EE) has been a topic of concern with respect to various services that involve communication. While WhatsApp late last year added end-to-end encryption to its messaging service, there are still a few services that have still do not feature the same, which makes them susceptible to interception.

Google at a recent Reddit AUA (Ask Us Anything) session when detailing the current status of its role in assisting the US government in surveillance, disclosed it does encrypt Hangouts conversations but remained unclear on the use of end-to-end encryption. It later, separately clarified that Hangouts does not use end-to-end encryption.

Google's Richard Salgado, Director for Law Enforcement and Information Security, and David Lieber, Senior Privacy Policy Counsel, were representing the firm at the Reddit AUA. During the AUA session, Christopher Soghoian, Principal Technologist at the American Civil Liberties Union, asked, "Why has Google refused to be transparent about its ability to provide wiretaps for Hangouts? Given Google's rather impressive track record regarding surveillance transparency, the total secrecy regarding the company's surveillance capabilities for this product is quite unusual."

Salgado replied saying Hangouts conversations are encrypted. He said, "Hangouts are encrypted in transit, and we're continuing to extend and strengthen encryption across more services."

Google later confirmed to Motherboard that Hangouts doesn't use end-to-end encryption. Without E2EE, it is possible for Google to intercept conversations when requested by law enforcement agencies and governments. With its current implementation however, of encryption in transit, ISPs and telecom operators will not be able to intercept conversations. Google specified to Motherboard that the 'Off the Record' feature only keeps messages out of chat history, but the messages are otherwise indistinguishable from regular, on the record ones.

E2EE is employed to protect communication between two parties (originating party and intended recipient) without being intercepted or read by third parties, including the company offering the service.The data is encrypted by the originating party, and can only be decrypted by the recipient.

The Mountain View giant in the recent past revealed that worldwide government requests for user data rose 150 percent over five years. The company however is unclear how many of these requests were for Hangouts.

It's worth noting that Apple's iOS 8 features built-in encryption that prevents the company itself from accessing data on the devices without the owner's consent or passcode. Apple's iMessage and FaceTime video chat service also feature end-to-end encryption.