UW Computer Security Research and Course Blog

Google has been scanning whole books and archiving them since at least 2004.  More recently, it settled a lawsuit that will allow it to legally copy copyrighted books and making them available online.  Google allows users to search their book archive at Google Book Search, and view samples or in some cases entire books.  While the ability to look at fragments of the more restricted books is only useful as advertising for luring in potential readers , the fact that some books are posted whole online is significant for the flow of information throughout the world.  As this online library expands, it could aid education and help distribute ideas worldwide.

Assets:

• The digital copies of the books are information resources that individuals might want to spread or suppress.  In general, it is important that users have access to them to supplement their education, and, in the case of partially available books, the publishers want to restrict how much can be seen while still providing enough information to act as an incentive to buy the books.  Google’s security goal with the digital books should be to ensure that access to books is not unduly restricted, while also not giving away too much about restricted works.
• The search results for books are another asset.  The goal should be to keep these as balanced and open as possible.

Adversaries, Threats:

• More oppressive governments try to censor all information, and censoring Google Books would be a natural extension of that.  In addition to filtering traffic to Google, they might try denial of service attacks to take Google Books down altogether.
• In the future, Google itself or a successor company might want to practice censorship by not making certain works available.
• Users might want to gain access to restricted (copyrighted) books.  If the entire books are being stored in a database connected to the Internet, it is conceivable that someone could break into the database and steal the books.
• Publishing companies would want to skew the search results on Google Book Search in favor of their own partially available books, in the hopes that users would buy them.  While it may be doubtful that an attack could affect the search engine directly, it might be possible for a publisher to plant popular search terms in sections of a book and then release the relevant sections to Google.  This could result in a higher number of views on the “advertised” sections, and possibly higher sales of the book.

Weaknesses:

• While Google undoubtedly has defenses against DoS attacks, it cannot prevent censoring nations from filtering traffic and denying some potential users access to its library.
• Google has a lead in publishing online versions of print books.  This might eventually turn into something approaching a monopoly, which would make the library vulnerable to the possibility of someone with bad motives gaining control of it.
• If it’s connected to the Internet, it can probably be accessed somehow; if the complete versions of copyrighted texts are stored on databases connected to the Internet, they could be vulnerable to being stolen.
• Google seems interested in scanning as many books as it can, and may not be paying too much attention to the contents.  This would make their system vulnerable to the search-terms-planted-in-books strategy.

Defenses:

• To defend against DoS attacks, having a distributed system of servers would help (and they certainly do have defenses).
• Encryption of data transmitted could help avoid censorship.
• Google no doubt has excellent access control mechanisms for their databases
• Google can avoid becoming a censor itself by promoting competition: encouraging rival libraries by giving them its own scanned copies when possible.

Risks
Censorship of content on the Internet is basically inevitable; while some users in oppressive areas will be able to circumvent it, there is not much Google can realistically do to help spread information past censors.  Google turning evil seems improbable at the moment, though it could turn into an evil monopoly in the future; hopefully by then there will be more competition.  The possibility of copyrighted books being stolen by users is probably negligible, though there might be some risk of employees taking copies of copyrighted books for their own use or distributing them.  The likelihood of publishers sneaking search terms into samples is fairly likely, and difficult to defend against.  The last one is the most likely exploit to succeed in the short run, but it only affects balance instead of access to information, so it is not as important.

Conclusions
Having access to information is important for a society in general.  Two of the factors contributing to the growth of GDP are the amount of technological knowledge a society possesses and the level of education of the populace.  This is why it is important to encourage the spread of information; making books freely available will help societies grow and prosper, and help lead to a more prosperous world.  That it is important for books be able to spread information as much as possible, free of censorship.