Why you should be skeptical of Google's motives for pulling out of China

If you are part of any community for long enough you become immersed in a great deal of unspoken, but well understood realities. The computer security industry is such a creature. It’s perhaps more true in this industry than in others because it’s a relatively young industry and many people who have been it in for a long time tend to know each other, and often know each other well. People talk in this industry and while discretion to the outside customer might be a virtue, internal to the community that virtue is, let’s say, somewhat porous.

One of the general truths that you learn when you spend enough time in this industry is that state sponsored hacking is commonplace. It’s been commonplace for well north of a decade (or two) and while it’s not generally tough to recognize it for what it is it can be career ending or financially ruinous to discuss it. Governments buy a lot of product and spend a huge outlay on services each year from the security industry. I think we all know it’s bad practice to bite the hand that feeds you.  This state sponsored activity is hardly limited to China of course. Any country with a GDP worth mentioning likely participates in it to some degree.  China just happens to be more aggressive about it than most and it tends to get caught more often.

So what about Google? This is a company, which can hardly be a stranger to this reality. Their security staff is plumb full of sharp edged veterans who know the score. The attack types seen recently are not even remotely new or novel and it’s not likely the first time Google has been targeted (even successfully). If you have been following this story you know (or have read) that doctored Office attachments in email and Instant Message traffic were targeted at selected individuals. These individuals were exploited which resulted in their machines being compromised. Once their machines were compromised they became gateways into their corporations. This is not new either. In fact I would wager it’s nearly a daily occurrence.

So what then is Google’s sudden cause for umbrage? I don’t know but I can say for certain we do not have the full story here. I expect more will follow over time. For years they’ve been willing to abide by China’s onerous net censorship rules in order to happily take advantage of cheap labor, a market presence in china, and revenue from Chinese adwords. Now, they are speaking of leaving because they’ve been personally attacked. The message as I see it from Google is this “We’re happy to curtail the freedoms of others, so long as you don’t do wrong by us personally”.