What do you do if your computer gets hacked? Try to browbeat the alleged hacker into not hacking your computer again? Probably not. Positively not, if you are smart and the hacker happens to be a heavyweight boxing champ. So why is Google, arguably the world's smartest company, pursuing such a stupid strategy?
Google seems willing to jeopardize its multi-billion dollar Chinese business over alleged cyber attacks by Chinese government on its infrastructure. In a blog post titled "A New Approach to China" Google enumerates a long list of cyber attacks and insinuates the attacks to be sponsored by China. Amazingly, in the opening line of the same blog post Google admits that cyber attacks are nothing unusual for the company. The opening line of that blog post says, "Like many other well-known organizations, we face cyber attacks of varying degrees on a regular basis."
The post continues:
In mid-December, we detected a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google.
The blog post then talks about cyber attacks on the infrastructure of other well-known corporations, and cyber attacks on the mail accounts of human rights activists. After building a case that in no way implicates the Chinese government in any of the abuses, the blog post drops the bombshell. It states:
We have decided we are no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all. We recognize that this may well mean having to shut down Google.cn, and potentially our offices in China.
Any other company would have ordered some security reviews and continued as usual. Yahoo was a target of cyber attacks from China too, but it did not take to blaming the Chinese government. A report by Reuters states:
Yahoo Inc knew it had been a target to sophisticated Chinese cyber attacks on U.S. Corporations before Google alerted the company to them, a source familiar with the matter said, but chose to remain silent after its bigger rival went public.
The Reuters article continues:
Analysts have said many companies choose not to publicize cyber attacks out of fear of exposing technological vulnerabilities and, in this case, of upsetting business relations with China.
A security breach is understood to be the fault of the company whose security gets breached. Companies typically go about blaming others for security breaches when they are about to go out of business and have nothing better to do. Google though seems uninterested in following rational norms of business.
Google's stance is all the more incomprehensible as Google engineers themselves are unable to prove any Chinese government involvement in the cyber attacks on Google infrastructure. According to a New York Times report:
Google engineers said they doubted that a nongovernmental actor could pull off something this broad and well organized, but they conceded that even their counterintelligence operation, taking over the Taiwan server, could not provide the kind of airtight evidence needed to prove the case.
Google's response seems unreasonable even if Google has positive proof of Chinese government involvement in cyber attacks. Governments all over the world do such things. The United States government does that too. If government hacking is a moral issue for Google then maybe Google should quit business altogether as the National Security Agency infiltrates computer systems and monitors communications all over the world.
Maybe the Chinese are doing more than what governments typically do. A report by The Guardian newspaper states:
Google is investigating whether one or more of its employees in China helped launch the cyber attack against it last month, according to reports.
According to Reuters news agency, citing two unidentified sources, the attack, which targeted people with access to specific parts of Google networks, might have been helped by employees in the company's offices in China. It has several hundred staff on the mainland.
Google seems to have isolated information leaks that allowed attacks to be carried out on its infrastructure to Google China employees. This connection between the cyber attacks and Google China employees leads to an obvious inference: the Chinese are recruiting Google China's employees as agents/spies and using the information yielded by such agents to compromise Google's infrastructure worldwide.
Is this the central issue Google is taking a stand on?
Defending against attacks from the inside is much harder than defending against attacks from the outside. Insider attacks can at times be impossible to defend against. Maybe Google is afraid that Chinese government agents in Google China can potentially expose Google's worldwide infrastructure to crippling attacks.
This is a legitimate concern. In the worst case scenario, information leaks by Chinese agents can lead to the shut down of Google's worldwide operations and cause untold billions in damages.
Google did not cite this reason for confronting the Chinese government in its "A New Approach to China" blog post, but this oversight maybe due to legal issues. Google may have been able to pinpoint information leaks to specific individuals but it has no way of conclusively proving that they were working for the Chinese government.
So is the mystery solved then?
Unfortunately, even though this concern itself is legitimate, the way Google is dealing with it is not.
The correct way to deal with this concern is to compartmentalize Google China's operations from the rest of Google. This is the way Google should be operating everywhere else too and probably is.
The vociferous drum-beating by Google makes no sense. It is not clear exactly what Google is protesting and to what end. By attacking Google's infrastructure, the Chinese are providing invaluable information on vulnerabilities in Google's computing infrastructure and short-comings in security policies. The good thing about government sponsored attacks is that they have limits (at least in peacetime). While a rogue hacker may indiscriminately delete data and disable computer systems just to boast about it, a government sponsored hacker has to be content with adding backdoors and stealing information. Effectively, government sponsored hackers provide the perfect opportunity to test and polish security policies and procedures. Any self-respecting security team would love the challenge of fending-off cyber attacks from a government agency.
Maybe Google is trying to fight censorship by all of this, but then why does it not target all countries that censor the internet? An article titled "Will Google stand up to France and Italy, too?" by the British newspaper The Guardian says:
In the past several years, internet censorship has spread rapidly throughout a range of political systems. According to the Open Net Initiative, a consortium of academics and computer scientists who track censorship trends, the number of countries that censor the internet has gone from a handful a decade ago to almost 40 today -- and the censorship club's fastest growing membership segment consists of democracies.
If Google wants to fight censorship, the best approach for it would be to create software that lets people break free of censorship. Chinese people do want and use such software. In fact, a Chinese company already produces a browser for that purpose. According to a report by CNet:
Maxthon, a browser made by a tiny Beijing company of the same name, has attracted millions of users in China for functionality that can funnel traffic through a Web proxy and circumvent government controls on information in search engines like Google, Yahoo, MSN, Baidu.com and other popular sites or Internet service providers in that country.
Maxthon is made by a company in China and it is probable that the browser is
compromised in some way that lets the Chinese government spy on the activities
of the people using it. If Google wants to fight censorship it should be
building the capabilities of Maxthon into its Google Chrome browser. Google
Chrome is open source so the Chinese government will have a tough time
compromising it. Google is
not doing no such thing; therefore, Google's
censorship stance is not genuine.
Evidently, Google has no defendable case at all. Google is not making a genuine effort to fight censorship. It is not applying its stance against censorship uniformly. It does not have any evidence that implicates the Chinese government in the attacks upon its infrastructure either. Worse, it has no reason to protest the attacks even if the Chinese government is involved. It just wants to fight an unnecessary fight which is rigged against it. Why?
Perhaps Google wants to exit China?
Sarah Lacy at TechCrunch believes Google is doing poorly. She says:
Google’s business was not doing well in China. Does anyone really think Google would be doing this if it had top market share in the country? For one thing, I’d guess that would open them up to shareholder lawsuits. Google is a for-profit, publicly-held company at the end of the day. When I met with Google’s former head of China Kai-fu Lee in Beijing last October, he noted that one reason he left Google was that it was clear the company was never going to substantially increase its market share or beat Baidu. Google has clearly decided doing business in China isn’t worth it, and are turning what would be a negative into a marketing positive for its business in the rest of the world.
Kai-fu Lee is a former Microsoft executive and he headed Google China from its inception till September 2009. He clearly did not leave happy and had significant differences on strategy with Google's management. Interestingly, he wasn't the only senior figure to leave Google China around that time. A China.org.cn report, announcing the resignation of Kai-fu Lee, states:
Though rumors of Lee's resignation were heard from time to time during his four-year term at Google China, many of his employees are still shocked about the news. The Sina.com report added that all the key members of Google China's original launch team formed in 2005 when the company entered China had all resigned.
It is not known what prompted the wholesale resignation of senior employees from Google China, but it can be safely concluded that none of them left happy. (The resignation of all senior employees of Google China has considerable significance for other reasons but we will come to that later.)
Considering this context, Sarah Lacy could not have expected to hear Kai-fu Lee talking positively of Google China. The facts though indicate that Google China has done spectacularly well. A Wall Street Journal blog post states:
Google has made significant progress in China in recent years, raising its share of the Internet search market to roughly 36% in the fourth quarter of 2009 from 13% when it started its Chinese-language google.cn site in early 2006.
Google gained 23 percentage points in four years. By comparison, Google's share of the US search market stood at 65.7 percent in December 2009 and it took Google almost 12 years to reach that marketshare.
Expecting Google China to dominate the Chinese search market the same way Google.com dominates the US search market and do it in a mere four years is not reasonable. Google China's performance has been stellar. A 23 percent gain in marketshare in just four years is spectacular performance in any industry.
Not only has Google made huge gains in China but it has achieved those gains with a very modest workforce as compared to its big rival Baidu. According to China Daily, Google China has 700 employees, while Wikipedia claims Baidu to have 6,252 employees (checked on January 20, 2010). Baidu has a roughly 58 percent of the Chinese search market and it has operations in Japan as well, but even accounting for that, Google China's workforce seems far more productive than Baidu's. Consequently, Google China's gross margins must be enviable.
The day before Google announced its intent to confront the Chinese government, Baidu's market valuation stood at $13.4 billion. (The market valuation estimate is based on Baidu's closing price on January 12, 2010.) This suggests Google's Chinese operations are also worth several billion dollars at the very least.
Given such a large valuation, if Google wanted to exit China, it had better options than picking a confrontation with the Chinese government. Google could have spun off its Chinese operations into an independent business and aimed for a public offering of the new business's stock. Once the new business became public, Google could have sold its stake in the new business to investors and recovered substantial value for its share-holders. Even if an IPO was not an option, Google could have sold its Chinese operations to a Chinese corporation and recovered something on its Chinese investment.
Having exhausted the obvious explanations for Google's actions, let's try to work out the most probable outcome of Google's actions.
Google can't budge on its censorship stance without losing face and the Chinese government is not going to let Google run an uncensored search-engine so Google will have to exit the Chinese search market. This is the outcome Google seems to want. According to a report by The New York Times:
Google has said it is prepared to shut down its local Chinese-language search engine, Google.cn, unless it is allowed to run it uncensored. The company has also indicated that it would like to retain much of its operations there, including its growing ranks of Chinese engineers, its sales force and its toehold in the country’s mobile phone business.
Google can exit the Chinese search market in two ways. The implausible scenario is for Google to simply pull the plug on its Chinese search operations, layoff all employees involved in search, and abandon its Chinese users. Under this scenario Google's 36 percent marketshare gets distributed to the other players. Baidu likely takes the lion's share but the niche players get some bits as well.
The above scenario is implausible because it is inconsistent with Google's "do no evil" credo. It involves laying off hundreds of employees and depriving tens of millions of Chinese of a useful service. This is obviously "evil", and Google "cannot" do that. The Chinese government won't like this scenario either as it will make the Chinese search market uncompetitive and will lead to the loss of hundreds of jobs.
The more likely scenario calls for Google to handover its Chinese operations to some other search player. This way Google preserves the jobs of its Chinese employees and does not completely abandon its Chinese users.
The Chinese search market is dominated by Baidu and Google China. Apart from these two, there are a few niche players like Microsoft and Yahoo. Google needs to pick someone from this small pool of players and handover Google China to it.
Baidu is Google China's primary competitor and is also partially owned by the Chinese government; therefore, it is politically infeasible for Google to hand its Chinese operations to Baidu. Microsoft also operates in China, but Google and Microsoft are fierce competitors, so Google can't handover its Chinese operations to Microsoft either. That leaves Yahoo.
Yahoo actually does not operate directly in the Chinese market. It used to operate in the Chinese market, but some years back it decided to partner with the Ali Baba Group, and it is the Ali Baba group that manages Yahoo's China properties.
For Google, the Ali Baba group is the perfect candidate to cede control of its
Chinese operations to. The deal with the Ali Baba group can
will be structured
around Google agreeing to take an ownership stake in the Ali Baba group in exchange
for Google China. Google can will also agree to divest its stake in the Ali Baba
group in the near future and exit the Chinese search market completely.
The precedent for doing such a deal already exists and the Chinese government would be ecstatic if Google decided to take that route. The deal would not be too unpalatable to the American government either. Yahoo owns forty percent of the Ali Baba Group, and if Google also takes a sizable stake in the Ali Baba Group, the Ali Baba Group will effectively become majority owned by American corporations. Google will eventually have to divest its stake but it will have Yahoo as the natural partner to sell the stake to. Such a deal will allow Google to smoothly exit the Chinese search market and let everyone save face too.
This is the deal Google seems to be seeking. In fact, there is considerable evidence that Google pre-planned its confrontation with China months in advance to get this result. The mass resignation of senior members of the Google China team in September 2009 was certainly not spontaneous. In all probability, it was deliberately provoked by Google's management. By getting all senior members to resign, Google smoothed the way for the Ali Baba deal. It systematically got rid of all Google China employees who could have potentially protested Google's actions and tried to guide settlement negotiations with the Chinese government in directions Google's management did not want.
But why does Google want the Ali Baba group to have Google China?
Actually, Google does not want to benefit the Ali Baba group. By handing Google China to the Ali Baba group Google intends to benefit Yahoo which owns forty percent of the Ali Baba group. The motivation for Google wanting to benefit Yahoo in an underhanded manner has been known for quite some time now.
Back in 2004, Google signed a patent licensing deal with Yahoo that allowed Google to use Yahoo's pay-per-click related contextual advertising patents. Prior to the deal, the two companies had been wrangling in court over Google's right to show contextual paid-search ads on its search pages. Yahoo claimed to have patent rights on Google's AdWords and AdSense business models. Google on the other hand contended that Yahoo's core paid-search patent was invalid.
The licensing deal ended litigation between the two companies and effectively legitimized Google's core business model. The deal was extensively analyzed on Techuser in 2005 and also in 2008. The two previous Techuser analyses concluded the following:
- Some material terms of the 2004 patent licensing deal were never disclosed.
- The undisclosed terms involve substantial obligations on the part of Google.
- Google received several years' "grace period" on the enforcement of the undisclosed terms.
The earlier Techuser analyses also concluded that Google misinformed its investors about the terms of its 2004 settlement and because of that it can no longer comply with the terms of the deal without triggering a fraud investigation.
Seen in this background, Google's Chinese actions make perfect sense. Google has run out of "grace period" on its 2004 deal. In the coming months, Google either needs to start complying with the terms of the deal or it has to face breach of contract litigation from Yahoo.
Both options are completely unpalatable to Google, so Google is offering Yahoo the Chinese search market in lieu of its obligations in the patent licensing deal. It is quite possible that surrendering the Chinese market won't completely settle the debt Google owes Yahoo. In that case, Google is buying additional time from Yahoo in exchange for Google China. Of course, Google will have to come up with something else to trade once it runs out of the time extension it is buying by handing over Google China.
The right choice for Google was to come clean on its obligations to Yahoo. By proceeding the way it is going, Google will seriously compromise the interests of its share-holders and employees in coming years. Sadly, the "do no evil" corporation has chosen a path that will see it doing some serious evil.
by Usman Latif [Jan 22, 2010]