89. China vs Google: The War That Shaped the Internet (Ep 2)

0:03Gordon:For exclusive interviews, bonus episodes, ad-free listening, early access to series, first look at live show tickets, a weekly newsletter, and discounted books, join the Declassified Club at therestisclassified.com. When you join Sam's Club, you get way more than you'd expect. You don't just get value. You get insider tips from fellow members. You don't just pick up a pizza. You actually vote on its toppings. Mmm, bacon crumbles. You don't just visit the club, because with the Sam's Club app, everywhere can be the club. You don't just shop the latest finds. You find your people. And at the end of the day, isn't that what it's all about?

0:44Gordon:Come join us. Sam's Club.

0:54Gordon:You know, we have security investigations from time to time. it's not such an unusual thing. But we quickly discovered that this was a very sophisticated adversary. And furthermore, the more troubling thing to me is that we discovered the motivation, which we believed to be to gain access to Gmail accounts, in particular for Chinese human rights activists. We've made a statement of intent that we intend to stop censoring. And if we can do that within the confines of Chinese law and policy, we'd love to continue Google.cn and all of our operations there. And if we cannot, then we'll do as much as we can, but we don't want to run a service that's politically censored.

1:33Gordon:Well, welcome to The Rest is Classified. I'm David McCloskey. And I'm Gordon Carrera. And that was Sergey Brin, one of the founders of Google. And he's speaking there just a few weeks after the discovery of a massive hack of Google that has been linked to China. And we are on the second part of our investigation into this cyber attack that has come to be known as Aurora. And that really marks, I think, Gordon, the beginning of a kind of new era of cyber attacks, state-sponsored cyber attacks and cyber espionage. And we had just left in our last episode, the security team in the Googleplex in Mountain View, California, sitting out in this outbuilding, investigating what they now know to be an absolutely massive breach of Google systems.

2:26Gordon:And they've just discovered this. It is Christmas time of 2009. It's clear it's very high-end cyber espionage. And the cliffhanger, Gordon, that we left them with last time was, what in the world are they going to do about it? And the first thing they're going to try and do

2:42David:about it is kick the hackers out of the system. And of course, you have to plan this carefully. Because these are very sophisticated hackers. We talked last time about how they have a different kind of resource, sophistication and motivation from your typical criminal hackers. It is a different type of behavior where if you're dealing with a criminal, they basically are just looking around for any company where they can make money off and who they can get into. And if they can't get into one company, they'll go to another. But if they've gone for you as an espionage target, because they want something you've got.

3:17David:And then you've got a much bigger challenge to both find them and get rid of them and to do it without them realizing what you're planning. Because the crucial thing is you've got them in your system and you've got to try and eject them from the system and not leave them anywhere where they can hide. And that is going to be the challenge for Google running this out of the war room. They're keeping that investigation very secret. They've got it locked down. They've got a list of who can come in and come out of the room with a security guard on the floor, kind of speakeasy style. You've got to kind of know the right password to get in through the security guard.

3:57David:The cleaners are not allowed into the war room. So the pizza boxes, the coffee cups are mounting up.

4:03Gordon:It's getting smelly in there. This is a terrible holiday season for the security team, isn't it? I mean, this is about as bad as it could possibly get.

4:10David:It is bad, isn't it? And it is approaching holiday time when you're trying to work out what to do about it, which does make you wonder whether the hackers had deliberately picked that moment. The defenders are looking at the systems. They want to keep the element of surprise as much as possible. So they're working off their own separate network, which they built in parallel to the Google corporate network, with this plan to cut them off instantly at one moment. And the idea is that they are going to, at one moment, purge the attackers off the Google network by effectively switching every person who works for Google off the network and booting them out of the network and initiating a password reset for the whole company.

4:54Gordon:It's like Jurassic Park when they have to reset, do a hard reset on all of the electrical fences, right? It is just like Jurassic Park.

5:02David:It's just like Jurassic Park. But the idea is if you throw everyone off the network, then you ensure that the attackers kind of haven't kept a toehold, which is we saw last time. You just need one way in and then you can kind of reestablish yourself. So January 4th, they're going to initiate a company wide password change. They haven't told anyone why. I mean, that is going to leave a lot of people grumpy, isn't it? I mean, if you basically come into work one day and you're locked out of your machine by the security team and they're still not at this point telling you why. I think you're going to be an unpopular person, aren't you?

5:35David:If you're the security team, if you're the IT workers.

5:38Gordon:Yeah. And you've already spent so much time memorizing that like 15 digit password that's got all the lowercase and uppercase and special symbols. And now you've got to come up with another one. Well, yeah. What do you use as your password, David? What's your preferred? That's only available for club members, Gordon. That's right. Along with my home address. Yeah, exactly. Along with your home address. If you're not a member of the club, you don't know what you're missing. It's really good stuff. But this is the crazy part, Gordon, is that essentially Google on the 12th of January goes public with this eventually.

6:07After all of this secrecy, the company decides to just

6:11Gordon:say what happened and to point a finger at who they think did it.

6:16David:I mean, that's the remarkable thing about this, because the truth is defense companies, others were getting hacked in this period, but no one talked about it. And I remember being a journalist around this time, and people were saying this cybersecurity stuff is really bad. You'd go, well, who's been hacked? Tell me. And of course, the answer was, can't tell you. No company would ever admit it got hacked. No government would admit it got hacked. No one wanted to admit it. No one wanted to admit they'd had their intellectual property and business secrets stolen because it might crater their share price.

6:46David:There was no incentive to be honest about these things. There were no regulations requiring anyone to do so. So even though there'd been a fair bit of hacking in the previous years, particularly, as I said, defence companies and governments. No one admitted it. No one talked about it. And yet here, I think for the first time, a major company is going to decide it's going to go public and it's going to issue a statement saying it's got hacked. What's also amazing about it is they're not just going to say we got hacked, but they're going to say who they think did it. They're going to point the finger at China and they're going to say the primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists.

7:26David:And they're going to say they only believe they got into two accounts through the Google internal hack, although, as we know, they'd got into some other activist accounts through other methods. But, you know, this is also a big deal to actually point the finger at someone for having attacked you. That was unusual as well.

7:43Gordon:It also suggests that Google had technical evidence that the attack had come from China, because I think you're going to be really cautious about publicly pointing the finger at anybody solely based on circumstantial evidence around the Gmail accounts that they're looking at, right? Because in theory, it could be anybody. They would have had to have some reason to say, no, it was China.

8:08David:Yeah. And I think there was technical evidence. As you remember last time, Dmitry Aperovitch from McAfee, some other cybersecurity researchers have all been kind of poring over the code. They've been tracing it back. I mean, they can see it coming from two colleges in China, which is interesting. And it's not entirely clear whether those colleges servers were being used by someone else or whether, which is possible, the hackers were based out of those colleges. Now, not that they were students, but that the colleges were a place where you've got technical expertise and whether there were a team of hackers there.

8:39David:And I think there are other signs that not only was this Chinese intelligence, but it could have been hackers who Chinese intelligence had kind of coerced or persuaded or brought in to do it. And that was something Russia and China, I think particularly in the 2000s, used to do a lot. They used to go to universities or to criminal groups and say, you're a really good hacker. Now you're going to work for us, for the state, for the intelligence agency, whether it's the Chinese or whether it's the Russian FSB. Recruit, coerce, persuade, pay some of those young hackers to do it. And that seems to have been one possibility.

9:10David:Those responsible, the group called Elderwood, Sneaky Panda, that's my favorite title for them.

9:16Gordon:I hate how these names get attributed in these cyber stories, because essentially, I guess what happens is it's done by cybersecurity researchers who are looking at essentially the mechanics of the attack, the code used, things like that to kind of understand that, okay, this is a particular group that's doing this based on kind of the weaponry that they're deploying essentially, right? It's a cybersecurity researcher who's coming up with the name Sneaky Panda or in Russia, what was it? Fancy Bear. We covered in the North Korean billion dollar heist of the Central Bank of Bangladesh. I think one of the North Korean groups was like the Beagle Boys or something ridiculous like that.

10:00Gordon:So these names, they make all this sound ridiculous. And I honestly think the way this seeps into the popular consciousness this is you actually think there's a group in China who named themselves Sneaky Panda and then start attacking Google.

10:15David:Elderwood is better or APT-17s. I don't know. I agree. I couldn't agree more. But whatever the case, Google are going public. And it's so interesting because this is a direct challenge to Beijing. This is a company accusing a government. And Google is going to, you know, in the same statement, say it's not just being hacked. It's not just pointing the finger at China, but it's going to do something about it. And it's no longer going to censor its search results in China. So this is a kind of big moment, because as we looked at last time, there has been this battle within Google about, do you go into China?

10:51David:Do you not? What accommodations do you make with the Chinese? And now in the wake of being hacked, Google is saying, we are going to take it to you, and there's going to be consequences for this hack.

11:02Gordon:So maybe there, Gordon, with the fallout from this attack getting intensely political, Let's take a break. And when we come back, we will see how this turns into a massive confrontation between Google and the Chinese state. We'll see you after the break.

11:36Gordon:with adjustable shelving customized to your business's needs. Shop and save on pro-grade storage at The Home Depot. How pros get more done. Chronic migraine is 15 or more headache days a month, each lasting four hours or more. Botox, onabotulinum toxin A, prevents headaches in adults with chronic migraine before they start. It's not for those with 14 or fewer headache days a month. It prevents on average 8 to 9 headache days a month versus 6 to 7 for placebo.

12:03David:Prescription Botox is injected by your doctor. Effects of Botox may spread hours to weeks after injection, causing serious symptoms. Allerge your doctor right away as difficulty swallowing, speaking, breathing, eye problems, or muscle weakness can be signs of a life-threatening condition. Patients with these conditions before injection are at highest risk. Side effects may include allergic reactions, neck and injection site pain, fatigue, and headache. Allergic reactions can include rash, welts, asthma symptoms, and dizziness. Don't receive Botox if there's a skin infection. Tell your doctor your medical history, muscle or nerve conditions, including ALS Lou Gehrig's disease, myasthenia gravis or Lambert-Eaton syndrome, and medications, including botulinum toxins, as these may increase the risk of serious side effects.

12:39Gordon:Why wait? Ask your doctor, visit BotoxChronicMigraine.com, or call 1-800-44-BOTOX to learn more. When it's time to scale your

12:47David:business, it's time for Shopify. Get everything you need to grow the way you want. Like, all the way. Stack more sales with the best converting checkout on the planet.

13:00Gordon:Track your cha-chings from every channel right in one spot. And turn real-time reporting into big-time opportunities. Take your business to a whole new level. Switch to Shopify. Start your free trial today.

13:20Gordon:Welcome back. Google is about to take off the gloves, as it were, against the Chinese government. and, Gordon, I think it's fair to say that many inside Google would be, in particular in the wake of this attack, be sort of deeply uncomfortable with the accommodation that the company had reached about doing business in China just a few years before. Yeah, that's right.

13:43David:Last time we looked at how, in 2006, Google had started operating its website in China but agreed to be censored and agreed to these censorship requests. There'd been tension over it. Now, some of the staff inside the company had been unhappy about that, even at the time, and about the willingness to not just have pornography getting censored, but also politics, stuff about Tiananmen Square, what happened in 1989. So there'd already been this kind of internal debate in the company. And now the company as a whole, after the statement, are learning that they've been hacked. There are people going around saying, we did a deal with them, China, and they still hacked us.

14:20David:That's how one person at the company puts it at the time. Sergey Brin, one of the founders of Google, we talked about last time, born in the Soviet Union. So, you know, he'd seen surveillance is particularly upset. He'd never been very comfortable with the deal. Now he's really angry at China, having tried to access human rights accounts through Gmail, as well as the kind of problems over censorship. He reminds other executives the motto, don't be evil. Also, as we said, the CIA's motto.

14:47Gordon:It's unofficial motto.

14:49David:So Bryn is going to describe Aurora as the straw that broke the camel's back. And he's going to say China has made great strides against poverty and whatnot but nevertheless in some aspects of their policy particularly with respect to censorship with respect to surveillance of dissidents I see the same earmarks of totalitarianism and I find that personally quite troubling so I think that's an interesting statement because I think where he's talking about the earmarks of totalitarianism and personally finding it quite troubling it's just this fact that you've got someone at the top of Google who's got personal experience of totalitarianism and is bothered by it and and there are differences in google because eric schmidt who has been brought in by the two founders as a kind of ceo business figure to help them grow and build a company he is more of the view which was a common view in the us which is you have to comply with local law wherever you do business that's the view as well from bill gates at microsoft and others at the time which is you know if you want to do business in china you have to obey chinese law but squaring that with the kind of values of the company has clearly become an issue at this moment for the first time and eventually the other kind of co-founder larry page is going to agree with sergey brin and they're going to shut down and announce they're going to stop censoring the google.cn site and then eventually that's going to lead to the offices in beijing closing and i love this so a new yorker reporter goes to the google hq in beijing so they used to have a beijing office on the day it's going to be shut down.

16:17David:And well-wishers show up to lay flowers and candles in mock morning. And then they discovered that the flowers were promptly removed. A security guard from the neighborhood informed them that they would need to apply for permits at the relevant department. Otherwise, they were conducting an illegal flower tribute.

16:35Gordon:I can't believe why Google's business didn't work in China, Gordon, in a place where you need permits for flower tributes. This is the point where it gets really injected into the bigger geopolitics between the US and China. I mean, it's a spat between Google and China, first and foremost, but it's almost impossible for it to not end up laddering into the broader relationship between Washington and Beijing.