Sound far-fetched? Google's internal networks were breached in December 2009 in a widespread attack known as "Operation Aurora" that resulted in the theft of some Google source code and some (but not all) personal details of at least one Chinese human-rights activist, including his account creation data and e-mail subject lines.
Google may have some of the best minds in the world working to secure its systems, but it's also a big target -- and a potentially big prize -- for hackers. "Companies like Google are under attack because they have so much data about you," says Bill Morrow, CEO of CSIdentity, an Austin-based provider of identity theft protection services. "Instead of getting a little snippet of your life's digital footprint, [attackers] could get your entire profile."
Defcon 2
Use common sense. "If it's absolutely critical intellectual property, don't use [online] services," says Mark Kadrich, CEO of The Security Consortium, a San Jose-based security services provider and research firm.
The same goes for personal information. No system is 100% perfect. If you simply could not recover from a piece of information getting out into the world, then no online service can offer you the level of security you need.
While Google's mechanisms are strong enough to protect against common threats, a determined attacker such as a corporate competitor or a government agent who gains access to your account on Google could conceivably access everything you've entrusted to the company -- including data you didn't even know you were leaving behind.
"You have both very sensitive and less sensitive data under the same log-in credential," says Vatsal Sonecha, vice president of business development and product management at security vendor TriCipher Inc. "An attacker who gets into your account has the keys to the kingdom."
It's up to you to make the distinction between what information can be trusted to Google and what can't.
Defcon 1
Encrypt your e-mail. If you use an e-mail client like Outlook or Thunderbird to access your Gmail account, you can use a product like PGP Corp.'s PGP Desktop Home or its open-source cousin GnuPG to encrypt all of your outgoing e-mail. Or you can use the FireGPG Firefox extension to add encryption to Gmail's Web interface.
Businesses can use tools such as PGP Desktop Corporate on the desktop or one of PGP's server-based products to encrypt all outgoing e-mail at the network level.
