So, why are senior U.S. officials using Gmail?

Google says U.S. government officials were target of phishing attack

When Google announced that hackers had gone after Gmail users, the company noted that they specifically targeted U.S. government officials and military personnel.

In fact, Google said the hackers, who the company alleges were based in China, < target="new" href="">were aiming for "senior" U.S. government officials. And that raises the question of what government leaders are doing using Gmail in the first place.

U.S. government officials, after all, have access to official government email systems that have layer after layer of security. So how does Gmail, Google's cloud-based email service, come into play?

There's a two-layered answer.

First, Brad Shimmin, an analyst with Current Analysis, pointed out that Google, which is fighting Microsoft for enterprise customers, has been pushing hard to get government agencies - all the way from small and local to big, federal organizations - to move to Google Apps. And that effort seems to be working.

Late last year, for instance, the U.S. General Services Administration, which supports and manages federal agencies, announced that it was moving all of its approximately 17,000 workers to the cloud, and to Gmail in particular. The U.S. State Department, NASA and the Army also have moved some of their email services to Gmail.

Add to that list of users the cities of Seattle and Los Angeles and the D.C. government.

"Look at the Google Apps customer list and you'd be surprised at how many top government agencies utilize Gmail and other Google Apps.... It's pretty staggering," said Shimmin. "They don't tell us how many per industry, but you'll see there are quite a few government agencies using Google Apps and Gmail is a key function of Google Apps -- so you'll see it used a lot."

OK, so some key government agencies officially use Gmail. Now comes the second layer of this issue.

Most people have a work email, but they also have a secondary, generally free, email service for their personal use. Actually, Shimmin noted that 90% of Internet users have more than one email address.

That means some government officials might discuss critical, security sensitive topics on their highly secure government email accounts and then get their kid's soccer schedule or make dinner plans on their personal Gmail account. And they also might forward work emails to their personal account simply so they can read them at home.

Either way, there are a whole lot of government officials using Gmail. And that means there's some back-and-forth between personal and work accounts, as well.

And that makes the Gmail attack a bit more serious, says Dan Olds, an analyst with The Gabriel Consulting Group.

"Any Gmail hack is a bad thing for Google, but having it hit government officials is worse, since these are the people who can focus a lot of regulatory attention on them," added Olds. "Although this sounds, so far at least, like the hacking was due to users getting sucked into phishing attempts, this won't necessarily get Google off the hook."

And since the attack came in the form of a phishing scheme that tried to con users into handing over their passwords, Shimmin said Google shouldn't take a big beating over this.

"The onus lies with the individual on this one," said Shimmin. "If you don't conduct safety practices on your own and you act like an idiot and click on a link you shouldn't click on, that's not Google's fault. Google shouldn't take a beating for this, because people should have been smart enough not to fall for a phishing attack."

However, he also noted that just because Google shouldn't take the blame, that doesn't mean it won't. The allegation that it involves China and espionage makes it a high-profile attack, with Google is right in the middle of it.

"It's a black eye for Google as it is with any vendor that's caught with something this high profile," said Shimmin. "It could have been some kid in the new Jersey who launched a phishing attack. What's giving Google the biggest hit with this is that it's a strange story and it's connected with espionage and China."

As for Olds, he says it's not yet clear how this will play out for Google.

"It's hard to say if this specific incident will have a long-term effect on Google or cloud applications in general," he added. "To me, it's a drip effect where these hacks keep coming, one after the other, and could add up to a general perception that [the cloud] is just not a safe and secure way to transmit and store anything important."

Sharon Gaudin covers the Internet and Web 2.0, emerging technologies, and desktop and laptop chips for Computerworld. Follow Sharon on Twitter at @sgaudin or subscribe to Sharon's RSS feed. Her e-mail address is

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags GoogleMicrosoftsecurityWeb 2.0 and Web AppsU.S. General Services Administration

More about ASACurrent AnalysisGeneral Services AdministrationGoogleMicrosoftNASATopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Sharon Gaudin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place