88. China vs Google: When Beijing Took on Silicon Valley (Ep 1)

0:03For exclusive interviews, bonus episodes, ad-free listening, early access to series, first look at live show tickets, a weekly newsletter, and discounted books. Join the Declassified Club at therestisclassified.com.

0:43Tremphaya is a prescription medicine used to treat adults with moderately to severely active Crohn's disease and adults with moderately to severely active ulcerative colitis. Serious allergic reactions, increased risk of infections or lower ability to fight them and liver problems may occur. Before treatment, get checked for infections and tuberculosis. Tell your doctor if you have an infection, flu-like symptoms or need a vaccine. Explore what's possible. Ask your doctor about Tremphaya today. Call 1-800-526-7736 to learn more or visit TremfierRadio.com. Queen Carvania stood haloed by the morning sun.

1:23An army hung on her every word. My champions, I have sold my chariot on Carvana. It was a lovely SUV, an inexplicably queenly offer. They're even coming to the castle to collect it. Tonight, we feast! An offer you can feast on. Sell your car today on Carvana. Pick up fees, mail, buy. Let's talk about Peyronie's disease, or PD. It's not widely talked about, and some men may feel reluctant to bring it up, but it's more common than you'd think. PD can happen when scar tissue builds up under the skin of the penis, causing a curve or the bump during an erection that, for some men, may lead to pain during intimacy and impact mental health.

2:07A trusted urology specialist can help diagnose PD and walk you through your options, including non-surgical treatment. Visit TalkAboutPD.com.

2:24Like many other well-known organizations, we face cyber attacks of varying degrees on a regular basis. In mid-December, we detected a highly sophisticated and targeted attack on our corporate infrastructure, originating from China, that resulted in the theft of intellectual property from Google. However, it soon became clear that what at first appeared to be solely a security incident, albeit a significant one, was something quite different. We have taken the unusual step of sharing information about these attacks with a broad audience, not just because of the security and human rights implications of what we have unearthed, but also because this information goes to the heart of a much bigger global debate about freedom of speech.

3:04Well, welcome to The Rest is Classified. I am David McCloskey. And I'm Gordon Carrera. And that was a statement not by a spy, Gordon, or an intelligence officer, but by Google's chief legal officer issued on the 12th of January 2010. And that statement is about a hack, a cyber attack conducted by China against Google. It's come to be known as Aurora. It's a story about cyber espionage that sort of plays into a bigger battle about the world's biggest country and one of America's biggest corporations. Yeah, that's right. I mean, the idea of states like China, North Korea, Russia, hacking companies isn't such a big surprise these days.

3:51But in many ways, this is the origin story. This is where it all began, the idea of states versus companies. it's also the first big cyber security story about a hack that I remember making the evening news because it was a big deal because it escalated into the world of politics it was the first time you know a big company admitted it had been hacked and not just any company but one everyone's heard of Google and crucially Google are going to point the finger at who they say was responsible for this hack. So it's going to be the canary in the coal mine, really, for the world of Chinese cyber attacks and cyber espionage that we hear so much about today.

4:35Well, and it's also, I mean, because you have a corporation pointing a finger, as it were, at the state responsible for the attack, it also, I think, is a story that gets pretty political pretty quickly. I mean, this is a story that will feature characters like Secretary of State Hillary Clinton, Paula Brough members in Beijing and the founders of Google itself in kind of this swirl of politics and cyber attacks and espionage that all jam together. It's also really hard, Corden, for me to remember a time when it wasn't common to have state sponsored cyber attacks. And yet this is not actually that long ago.

5:14We're talking about a 15 year span. It's remarkable how far we've come since this kind of origin story of state sponsored cyber espionage. Yeah, I think that's absolutely right. In a way, it's familiar, but also from a slightly different era. I think it's because it is the dawn of that era. And it's about cyber espionage against companies, but also, as we'll see, against dissidents. So there is an element of this which really is about, if you like, traditional spying. But it also gets into issues of freedom of speech. How far do companies have values about freedom of speech? How far are they going to fight for those?

5:51What are the kind of complex equations between money and freedom of speech which come up? And yeah, it gets to the big geopolitical questions about technology in China and the West and who runs, who owns the technology which we all depend on. All big issues today. Maybe that's a good place to start, Gordon, which is setting the scene with China and the Internet, because those are going to be two massive threads in this story. By 2010, the surveillance state that we now see in China was certainly on its way to being constructed, but was nowhere near what it has become today. Yeah, I think that's another thing we have to get into our heads, a slightly different China in 2010 and different way people thought about China.

6:36It wasn't yet the China of Xi Jinping and the confrontation of today. And so the relationship between China and the West and China and the internet is a bit different. I mean, when it comes to the internet first email, from China, went over an academic network back in 1987. Across the Great Wall, we can reach every corner of the world, it announced. Sounds like something a spy service would send. But I think it was meant as a kind of, in the days of the internet being an academic thing. The internet was less evil back in the 80s, right? I mean, it was a more innocent time. Definitely. But then, so that was 87, the first Chinese email.

7:10But two years later, you get Tiananmen Square. And that is, of course, a moment when there are pro-democracy students in the centre of Beijing calling for greater freedom in China, and they are going to get crushed, literally crushed, by Chinese People's Liberation Army, PLA tanks, and killed by troops. And it is the pivotal moment in China in recent decades, because the regime becomes obsessed with threats to internal stability and that dissenters, critics could be trying to overthrow the regime. And so then you get this idea, the fear growing in China that the internet is a Western Trojan horse, something that's going to be brought into their country, the internet, and it's going to subvert the country by promoting free speech, political change, Western ideas.

8:04And so they're going to do their best to stop that happening. And that's probably true, right? That seems like a reasonable fear, you know, for an authoritarian political system, the internet, open communication that will undermine your political power. Yeah. And you can actually hear it from Western leaders at the time. If you go back to the kind of Bill Clinton, Al Gore days in the 1990s, they talked about how the internet, as part of the forces of globalization, was going to bring reform and democratisation to lots of countries. Of course, if you're the communist regime in Beijing, you're like, I'm not sure how we feel about that.

8:40So they're going to build what becomes called the Great Firewall of China to deal with this threat from the internet. Interestingly enough, some Western companies help give them the technology, but it's basically border control for the internet. Rather than someone checking your passport, it's checking what internet traffic is coming into the country. means if you went into China in this period and searched for Tiananmen Square, you'd get nothing. If you looked for certain websites, they'd be blocked. I mean, I remember being in China, I mean, as late as 2013, and suddenly the TV news would just suddenly stop because it was something that was considered sensitive in China.

9:17So they're going to these efforts to block what they see as subversive material getting in. And they're very conscious that America and the West dominates the internet. I mean, you know, another story that I remember people in China telling me was that there's this moment in 2004 where they got a fright about their dependence on Western technology. And that was because Microsoft was trying to clamp down on pirated versions of the Windows operating system. And lots of people had pirated copies, sold them illegally, and were using them. So Microsoft came up with this idea, which was anyone who's operating an unlicensed version, their screen would kind of go black, and a message would appear saying, you're running a pirated copy.

9:57The problem in China was that literally everyone, including every government department, was using a pirated copy of Windows. And so suddenly there is this moment where all the screens in government departments everywhere in China go black with this message going, you're running a pirated copy of Windows. So you can see why if you're in China, you suddenly go, hang on a sec, a Western company just effectively showed that they have the ability to turn us off. You can see why that's pretty scary. This is going to be a story about cyber espionage, but it's really a story about how the Chinese can sort of use the internet, use the tools of this digital domain to control their own population.

10:42So even as that spreads sort of beyond its borders, thinking about China's relationship with Microsoft or as we'll talk about with Google, it's really an inward-looking set of interests, isn't it, that is driving a lot of these concerns and driving a lot of the external behavior. Is this kind of like, how does this affect us in China? I think that's absolutely right. If you look at China's intelligence posture and everything it does, its primary concern is about domestic stability. So, you know, they're going to start to kind of worry about Western technology. They're going to say to Microsoft, well, if you're going to operate in this country, then you have to share some of your source code, which Microsoft will do at special centers.

11:17Other countries that want to go into business and sell in China, like Apple, you know, have to comply with Chinese laws. So, but of course, Western companies at the same time are desperate to get into the Chinese market. I mean, it doesn't take a genius to work out why. Western companies are interested in getting into the Chinese market. It's big. It's a giant market. That's right. Right. And most Western companies, I have the sense, whether they did it quickly or whether they sort of hemmed and hawed, were ultimately willing to concede to the kind of concerns or stipulations that the Chinese government had about what they'd have to do to get access to the market, right?

11:56I mean, most US companies, international companies were more than willing to do that because they have an obligation to the shareholders to earn money and to make profits. And that's why they exist. Yeah. And certain companies are excluded. So social media companies are never kind of allowed in your Twitters, your exes, things like that, effectively. But Google is a really, really interesting case. And it's at the heart of our story. So Google founded in a garage famously in 1998 by Larry Page and Sergey Brin. Just like our podcast founding story, right, Gordon? Yeah, founded in a garage. I don't think we've yet to become billionaires, though.

12:31Not yet, but we got the garage bit down. Yep. So it's founded as a search engine in the late 90s. It's been growing. 2004, crucially, again, for this story, they're going to launch Gmail, the kind of mail service. And these are hard to remember. More optimistic days of the internet, as you said earlier. Google's mission statement is to organize the world's information and make it universally accessible and useful. And the company also has a more informal motto, which is, don't be evil, which I thought was the CIA's motto, actually. But Google maybe got it from there. That's the unofficial motto of the CIA as well.

13:07Yeah. And sometimes we struggle with it, Gordon. Sometimes we struggle. It goes back to the Snowden world, doesn't it? And it's that era of internet idealism, of which Snowden was a kind of extreme proponent. But it is that idea that the internet is going to provide a free flow of information. It's going to liberate people, including those under more repressive regimes. It's going to be a force for good and for freedom. So Google starts looking at entering the Chinese market around 2005. And so you get a very complicated debate in the company itself about how far it should or shouldn't operate in China, because China, as we heard with the Great Firewall, censors information.

13:46And so there are tensions. Now, Sergey Brin, one of the founders, is an interesting figure here, because he had actually been born in the Soviet Union. His father, who'd been an academic, had tried to emigrate at one point, had been denied a visa. They'd had the police come to their house. They'd had surveillance on them, the KGB, all those things. He's grown up with this kind of awareness of what a repressive society looks like. Eventually, the family emigrate, I think, when Sergey Brin is six, and he ends up eventually in California and starting Google. But it does leave him with that legacy of kind of a different perception of it.

14:23So when you get that debate within the company, I think he is on the more cautious end about going into China. But others are saying, well, hang on a sec, this is our mission is to make information accessible, including to people in China, even if you have to make compromises. And I guess it does seem particularly hard for like a search company as opposed to, I mean, if you're providing widgets into the Chinese market, or if you're Apple and you want to sell phones, like, I guess in theory, it's easier to make some compromises in China to get access to the market than if literally your company's sort of whole purpose is to provide open information, right?

15:01I mean, social media sites, search companies like Google, it seems like that tension would be far greater. I think that's right. It is a different China. It's a China before Xi Jinping. It's a China where you can believe it is opening up. And we're looking at it now in hindsight, we know it's going to become a responsible stakeholder. Wasn't that the term used in sort of the late 90s, early 2000s, that we will sort of ensnare the Chinese in a thicket of commercial relationships and international organizations and political ties. And eventually the nature of the regime will change a bit. Oops. How did that work out?

15:39Anyway, at the time, let's go back to kind of the mid 2000s, there's a compromise. So Google gets a license to create Google.cn. So that's the Chinese version, but it's going to abide by the requirement to censor certain search results. It says it will do that according to Chinese law, but it will put up a disclosure notice saying when it's done that, and it's going to host an uncensored US hosted site. It seems like the Chinese government would not appreciate that very much to have the disclaimer and then literally the link to go to the other site. And so this tension from 2007, you start to get the censorship requests coming in.

16:13Now, some are the kind of stuff you see everywhere, including, you know in the uk and elsewhere pornography illegal activities but there's also kind of requests for political information to be removed things like tibet things like tiananmen square in all about one percent search results are blocked 2008 though olympics in beijing and things get more tense because the chinese government is pushing for more censorship because they're worried about protests u.s executives are unhappy about this in google but they think maybe it's temporary for the olympics but it doesn't end after the games more and more search terms, more and more content requests, often embarrassing stories about officials are the things that are getting asked to get taken down.

16:55It's like a big row in 2009, apparently after one Politburo Standing Committee member in charge of propaganda discovered that if he entered his own name into Google, a raft of critical results turned up. And he was like, something must be done about this. You should get used to it. Anyone these days who Googles themselves. You're just asking for trouble. You are. You are. But this is, again, this is early days, you know, and this is probably, I would imagine most Chinese officials were not used to putting their names into open sort of databases and getting back a whole bunch of nasty, nasty reviews of their political activities.

17:27I mean, I guess you see kind of a push and pull and maybe more and more tension building then in the relationship between China and Google. So, So I guess this brings us, Gordon, to mid-December of 2009. And it brings us to the Googleplex, as it were, Google's headquarters in Mountain View, California. It's December 14th, 2009. Let's see. Young McCloskey Gordon is feverishly working inside the bowels of Langley somewhere. Just for context, Gordon Carrera. What's young Gordon Carrera doing in mid-2009? Very young Gordon Carrera. Very young. It's working in the BBC then at that time, I think probably in West London, but not in an office like the Googleplex.

18:13I'll read this lovely and colourful description of the Googleplex and you can tell me how similar it was to BBC headquarters. So the Googleplex was known for its playful and unconventional design elements, including a T-Rex skeleton named Stan, a giant rubber duck and a variety of colourful, quirky decorations. Employees enjoyed a range of amenities, such as free laundry facilities, two swimming pools, volleyball courts, and numerous cafeterias offering a variety of food options. Maybe you only had one swimming pool at the BBC, Gorda. It was volleyball, then a swim, then some free food in the cafeteria, and then to my desk for a little bit of light work.

18:50A little bit of light work. Sitting on one of those giant balls. Yeah, so you got the core workout while you were working. While wearing sandals. That was the Gordon career of 2009. But that is, I think, a fair reflection of life in the Googleplex. I'm sure Langley was like that as well. So December 14th, 2009, among the Googlers, because that's what they're called, is a woman called Heather Adkins, who's part of our story. So she's managing a security team. She's been at Google already for seven years since 2002. So very early on in the company. And one of those people who got into cybersecurity, because she's kind of innately curious about how hackers work.

19:31I've met her as well as being a cyber ninja. The key thing you need to know about Heather is she's a serious medieval historian who knows a lot about English churches. And I once tried to kind of ask her about churches in part of England, and I realised she knew like infinitely more than I did from my tiny bit of undergraduate medieval history. And I was like, oh, OK. But actually, what's interesting is she will say there is a link between medieval history and cybersecurity. I'm excited to hear it. Which is, and it's a good, I think I buy this, which is studying medieval history is about taking fragments of information because only fragments have survived the past.

20:12And then you have to kind of extrapolate out from those tiny details to build a picture of what was happening. It's a kind of detective work, which is similar in a way to cybersecurity. So I think there is a link there. But anyway, 2009, most of the work for the security team is dealing with criminals, stealing credit cards and just kind of nuisance hackers who want to show they can take Google offline. Four o 'clock on this day, December the 14th, 2009, she comes out of our last meeting, goes back to her desk. There's lots of people from the security team huddled around a screen talking. It's a hive of energy.

20:45Hey, what's up? She says, you'll never believe what we found. And they found something on the Google network. So inside the systems. Now, who do they think it is at first? They say, we've caught the interns doing naughty stuff. That's the first reaction. That should be everyone's first reaction. That's like, that's 99 % of the problems. Weren't you an intern at CIA once? I mean, like, I'm guessing you didn't do... I was. Yes, I was. I mean, just a few years before this, I had been an intern at CIA. Did you hack the CIA system? No, no, that was frowned upon. And I was excited about the prospects of full-time employment.

21:21And I felt like, in addition to not having the capabilities that if I had attempted to hack anything at the agency, I might not have gotten a job. So I was kind of, I was very well behaved. That's their first response is like, it's interns showing what they can do. Because I guess that's the hacker culture. Hackers famously are people who want to just show that they can mess with things and what they can do. But they pretty quickly realise as they pull at some of the threads that it's much more serious. It's not the interns. It's not the interns. Someone is inside their system doing things they certainly shouldn't be.

21:52I mean, initially, someone from the security team, Tim Dwen, thinks only one machine's compromise and it gets worse. The bad guys have got everywhere. It's a massive breach of the corporate systems. Basically, the hackers are in, they're moving fast, they're changing tactics. They basically have never seen anything like this in Google, and they've got no playbook for how to deal with it. All right. So there with the interns off the hook, let's take a break. And when we come back, we will see how they point the finger at China. See you after the break. Hey, this is Michael and Hannah from Goal Hangers, The Rest is Science.

22:27This episode is brought to you by Cancer Research UK. What if your immune system could learn to recognize cancer cells? That's immunotherapy. One type is CAR T-cell therapy. T-cells are your body's watchman and doctors can now extract these and reprogram them to spot cancer. CAR T-cells, they've started showing this real promise in treating cancers of the blood like leukemia because unlike most cancers, blood cancer cells, they float around separately, and that makes it easier for CAR T cells to seek them out and destroy them. And now, Cancer Research UK-funded scientists are designing CAR T cells that can tackle solid tumors too, making them tougher so they can survive a more crowded and hostile cancer environment.

23:10Now, these approaches are experimental, but they do start to show where treatment might go next. And over the past 50 years, Cancer Research UK's pioneering work has helped to double cancer survival in the UK. I mean, this shows you how far research can take us. For more information about Cancer Research UK, their research, breakthroughs, and how you can support them, visit cancerresearchuk.org forward slash rest is science. Hey parents, how do you make smarter choices for your kids' college today? That's where Sally can help. With Sally, you can find scholarships, funding options, tools, and guidance all in one place.

23:47And if you need a loan, Sally has options for different families and different situations. College is only worth it if you do it right. So don't just help your kid go. Help them go smarter. sally.com slash go parents. Let's talk about a condition many people haven't heard of. And it turns out it's more common than you'd think. Peyronie's disease, or PD for short. PD can happen when scar tissue builds up under the skin of the penis. This can cause a curve or the bump during an erection and, for some men, lead to pain during intimacy and may impact mental health. It may also lead to anger and frustration, depression, lower self-esteem, and even withdrawal from sexual activity and physical intimacy.

24:31Because of this, some men could feel embarrassed or reluctant to talk about PD. The actual cause of PD isn't always known. In some cases, it may be linked to a minor injury or repeated injuries during sex or other physical activity. The good news is PD is treatable. If you notice a curve with a bump, a trusted urology specialist can help diagnose it and walk you through your options, including non-surgical treatment. To learn more about Peyronie's disease, visit TalkAboutPD.com.

25:06Welcome back. the team at Google HQ, the Googleplex in Mountain View, California, has just realized they have a serious breach on their hands. They now need to dig into this, Gordon, and find out who actually is responsible and maybe even most importantly, just how sort of deep this breach is into their systems. Yeah, because they're realizing it's bad. So Heather Adkins, who's running the security team, hands a list of machines that they think might have been compromised to other members of the team and they have to go physically pull the hard drives from across the google campus and this is in the middle of the night in the dark in a rental car and they're running around with flashlights grabbing machines which they can then pull to do for forensics at first they try to unscrew the hard drives and then they realize that's going to take too long so they just pull out the whole machine and just put it in the trunk of the car and drive off i mean it sounds more like a heist than a security investigation.