My impression is that this incident is a fuckup at the customer end of things

No, according to this article, "The problem was on Google's end. They acknowledged a bug," and according to this comment, Google had upgraded their IMAP migration tool right before this happened.

Sounds like a case of insufficient testing on Google's part before rolling out the new version of their tool.

SSL is not supposed to be preventing MITM nor is it supposed to be for identifying purposes.

I disagree. Why else does SSL have certificate signing capabilities? SSL even has client-side certificates for client identification, though it isn't widely used in HTTPS. In order for any asymmetric cryptosystem to work you need to exchange public keys, and you always have to establish some kind of trust system for those keys.

We have other technologies for that like PGP but the internet relies on anonymity so you're never 100% sure that you're going to talk to the correct persons.

Hence the need for SSL.

Even with PGP, your initial communications will have to be trusted (eg. you personally hand over or get a key) or any subsequent communications will be compromised. SSL doesn't even go that far because every communication is viewed as an initial communication. If the certificate is re-signed or changed to another CA the next day, your browser will not complain as long as that CA is in it's trusted root certificates.

This is a fault of how the key management in SSL has been implemented in web browsers, but says nothing about the technology itself. Two examples of systems using SSL with better (but less convenient) key management systems are OpenSSH and OpenVPN.

It's the browsers fault and the CA's as well (with VeriSign the biggest) by asserting that SSL certificates can be used to authenticate an entity rather than a communications.

There's a middle ground between "entity" and "communications." Yes, it is very difficult to verify that a certificate is being issued to the entity "Bank of America," but it should not be hard to verify that you're issuing a certificate to the domain name www.bankofamerica.com. And the latter is all you need to protect against MITM.

I'm as libertarian free-rights paranoid as the next slashdotter (while not quite), but a healthy dose of history here. Customs, border crossings, etc. have never had anything to do with democratic values

Completely incorrect. Many of the British actions to diminish liberty in the 1700s were directly related to enforcing customs and duties: writs of assistance, vice-admiralty courts, etc. The Founding Fathers were reacting in part against British regulation of customs and duties so many of the "democratic values" like the 4th Amendment, the requirement that trials be held in the locality where the crime was committed, etc, were in fact developed in response to customs enforcement.

The most poignant example is writs of assistance. These were open-ended search warrants that authorized the holder to conduct any search whatsoever and were issued to British customs officers in the colonies to catch smugglers. They outraged the colonists, who saw them as an affront to their liberty, and directly led to the requirement for specific search warrants in the early state constitutions and later in the 4th Amendment.

I find it most ironic that the restrictions on search warrants came in response to arbitrary customs enforcement by British customs officers, but today no restrictions at all apply to searches by American customs officers. Whatever court ruled that the 4th Amendment doesn't apply to border crossings ignored significant precedence to the contrary.

See Writ of Assistance in Wikipedia for a pretty decent overview.