Crisis Communication Plan

Inc.

Response to customer security breach and preparedness for exposing customer credentials

Prepared by: Savannah Woodall November 22, 2016

Plan Test Date: Jan 1, 2017

Table of Contents

A Message from our CEO …………………………………………..3

Acknowledgements……………………………………… ……………4

Purpose & Objectives…………………………………………………5 Key Publics- Internal…………………………………………………..6 Key Publics- External………………………………………………….7

Crisis Communications Team………………………………………..8

Me dia Spokesperson…………………………………………………9 Media Spokesperson-Trick Questions…………………………….10 Experts ………………………………………………………………….11

Emergency Personnel………………………………………………..11

Crisis Control Room- Equipment & Supplies…………………….12 Crisis Control Room- Room Layout………………………………..13

Key …………………………………………………………14

Dissemination of Key Messages……………………………………15 Pre- Information………………………………………………………..16 Pre- Information-New Release………………………………………17

Evaluation……………………………………………………………..18

Closing Statement…………………………………………………….19

2

A Message from the CEO

Google Inc. is dedicated to making the user experience the most positive that it can be. Our core values are openness, general ethics and corporate citizenship, and we plan to stand by those values even during times of crisis. We take security issues very seriously and will respond swiftly to fix security issues. When properly notified of legitimate issues, we’ll do our best to acknowledge the problem, assign resources to investigate the issue and fix potential problems as quickly as possible.

As a provider of and services for many users, advertisers, and publishers on the Internet, we recognize how important it is to help protect your privacy and security. We understand that secure products are instrumental in maintaining the trust you place in us. This potential security crisis would be detrimental to our company because we have promised the greatest security in regards to customer credentials. It is critical that we are prepared for an event of this nature. This crisis communication plan provides step-by-step instructions on what to do if a security breach occurs and customer credentials are released.

Please read through the entire document to be more adequately prepared for a similar crisis. We will continue to the stand by our existing measures like the Vulnerability Reward Program. I appreciate your service to the Google Company and look forward to enacting this plan at the upcoming test date.

Sincerely,

Sundar Pichai 3

Acknowledgements

By signing this agreement, I verify that I have read this plan and am prepared to enact this plan.

Chief Executive Officer of Alphabet Inc. ______Larry Page Signature Date

President of Alphabet Inc. . ______Sergey Brin Signature Date

Chief Executive Officer of Google Inc. ______Sundar Pichai Signature Date

People Operations Director ______Lazlo Bock Signature Date

Marketing & Communications Director ______Annie Baxter Signature Date

Finance Director ______Mike Roszak Signature Date

Technical Solutions (Gtech) Director ______Munazah Chowdhury Signature Date

4

Purpose & Objectives

Purpose Statement

In the event of a security breach, we will immediately have an open door policy. One of Google’s core values is openness. To ensure that we honor this value, we will immediately inform customers of the breach and any credentials that may have been released. In addition, it is our hope to maintain this open policy with the media and company stakeholders. Finally, in response to this we will provide clear instructions on how we are improving security measures and will offer restoration of or monies lost.

Objectives

1. Initiate the Crisis Communication Plan within 1 hour. 2. Assemble the team within the first 30 minutes. 3. Move up the chain of command to inform all affected parties internally. 4. Provide a press release on our commitment to offering safe systems and being transparent regarding the details of the breach within 3 hours. 5. Maintain a positive presence with the Media by emphasizing our core values. 6. Refer all media questions to internal media spokesperson 7. Use to send updates regarding the details of the breech. 8. Conduct an evaluation survey on the Crisis Communication Plan within 2 days of the event. 9. Return to normalcy.

5

Key Publics- Internal

The internal key publics include the CEO of Google and the CEO and President of Alphabet Inc. (the company that owns Google). These individuals should be notified of the security breach immediately. It is critical that the directors of the Google teams be notified so that they can inform the rest of the organizations and uphold their responsibilities. They will be contacted via and email. These individuals will also be briefed during an emergency meeting.

Name Title Email Phone CEO- [email protected] 650.214.1722 Alphabet Inc. President- [email protected] 650.253.0000 Alphabet Inc. Sundar CEO- Google [email protected] 650.786.3495 Pichai Inc.

Lazlo Bock People Op. [email protected] 212.375.6587 Director Annie Marketing & [email protected] 212.375.0986 Baxter Comm. Director Mike Finance [email protected] 212.375.4367 Roszak Director Munazah Gtech [email protected] 212.375.1276 Chowdhury Director

6

Key Publics- External

Google’s external key publics should be notified within 3 hours of the crisis. Those who we could consider to be external key publics include but are not limited to: media outlets, affected customers, and shipping/distribution companies. The media outlets that we work closely with include CNN, FOX, the New York Times, and the Wall Street Journal. Annie Baxter will be responsible for contacting the media outlets to share the information through the use of a press release. Customers who have had their information exposed will be contacted via and Google Public Alerts. Finally, shipping companies who are affiliated with the store will be alerted via email.

Media Contacts: Outlet Email Phone CNN [email protected] 212.275.8030 FOX [email protected] 873.396.4762 NYT [email protected] 212.556.1600 WSJ [email protected] 202.334.7320

Google Play store affiliated companies: They will be contacted via email and through social media. Outlet Email Phone PayPal [email protected] 212.275.8794 Verizon [email protected] 212.395.2355

Customers: Customers will be informed through the use of their personal Gmail account in addition to Google Public Alerts. We will also publish news on our website and social media pages.

7

Crisis Communications Team

The members of the crisis communication team are listed below. While we have a specific team in mind, Google will need all hands on deck in a crisis of this nature. Name Title Email Phone Number

Larry Page CEO- Alphabet [email protected] 650.214.1722 Inc. Sergey Brin President- [email protected] 650.253.0000 Alphabet Inc. CEO- Google [email protected] 650.786.3495 Inc.

Lazlo Bock People [email protected] 212.375.6587 Operations Director Annie Baxter Marketing & [email protected] 212.375.0986 Communications Director Mike Roszak Finance Director [email protected] 212.375.4367

Munazah Gtech Director [email protected] 212.375.1276 Chowdhury Nicole Mouton Communications [email protected] 212.375.9654 Manager Robert Half Senior Data [email protected] 212.375.6532 Analyst Marc Schoenen Financial [email protected] 650.875.0098 Analyst Quoc V. Le Research [email protected] 650.846.7659 Engineer

8

Media Spokesperson

In the event of a crisis, the media spokesperson will be the Director of Marketing & Communications. If the Director of Marketing & Communications is not available, the spokesperson will be our People Operations Director. The media spokesperson is equipped to handle the media and has been trained in public communications. The spokesperson will be knowledgeable of the crisis at hand and will work with our experts and crisis communications team prior to any interaction with the media. Choosing an individual with public communication experience will ensure that Google will be able to deliver a message that is both positive and informational.

Contact Information Annie Baxter Director of Marketing & Communications Phone: 212.375.0986 Email: [email protected]

Lazlo Bock Director of People Operations Phone: 212.375.6587 Email: [email protected]

Interview Tips for Media Spokesperson

1. Prepare for the worst-case scenario. 2. Always answer truthfully. 3. It is better to say you don’t know, than to answer incorrectly. 4. Be consistent. 5. Continue to stress our key messages of openness, security and citizenship. 9

Media Spokesperson-Trick Questions

Q. The Google credentials crisis has affected more than ______users, how do plan to fix this? A. First, ensure that they have the correct data without sounding defensive. Then say, “The crisis has affected ____ users to date; however, Google is dedicated to maintaining openness with our customer and is improving security systems. We plan to analyze where the security breach occurred and will be using our Vulnerability Reward Program to reimburse customers. “

Q. What measures is Google taking to ensure that this will not happen again? A. First, note that this question has already been asked. Media enjoys asking the same questions over and over. Remember to be consistent and then answer, “Google plans to analyze the details of the security breach to find the hole. In the meantime, we will be assisting affected customers through the Vulnerability Reward Program. Our greatest goal is to ensure that we continue to have an open line of communication to our users.”

Q. Apple hasn’t had a security breach in the last ___ years, how do you think this will affect the Google company? A. Don’t let it be about your competitor. Instead of commenting on other companies, answer the question with reference to your own strengths and qualities. “Google has made a positive presence in the lives of users since 1998. It is our hope that people will continue to see that our company desire to build a community of inclusion, system of safe security, and class of corporate citizenship.”

Q. We have heard that the security breach happened internally, do you plan on firing whoever leaked the information? A. This question is about something that hasn’t happened. Air on the said of caution and say, “While we don’t comment on rumors or industry speculation, I can tell you that we are looking into the source of the beach and plan to increase security measure both internally and externally”

Q. What does the CEO of Google, specifically, have to say about this? A. This is a question you may not know the answer to, but the worst thing you can do is make up an answer. So say, “Because I don’t want to put words in his mouth, I will find out that answer. I can say that google values its users and is open to any questions the public may have. We are investigating this issue, improving security and continue to operate with a sense of community.

10

Experts

Internal

Chris Evans Google Security Team Director Vulnerability Reward Program Director 212.562.1235

Darren Bilby Google Inc. Senior Security Engineer 212.465.7865

External

Eric Mueller Apple Inc. Director of Security Operations 850.789.6548

Emergency Personnel

-Department of Justice: Federal Privacy Council -Federal Trade Commission - Federal Bureau of Investigation

11

Crisis Control Room Equipment & Supplies

The Crisis Control room will be divided into 4 Google Pods. People Operations, Communications, Google Tech and Security. Each sector will be placed in front of several screens, and will have the ability to project whatever they are working on onto the screen for the rest of the team to see. Each area will be equipped with VGA cables, printers, and wireless internet to communicate more effectively. The seats in this room are couches rather than or desk to bring in a more relaxed environment. The management office is located in the center at a higher level than the couches, so that when important announcements are made, all eyes can be focused on the center. This also enables the CEO to see what is happening in the entire room from a bird’s eye view.

Equipment & Supplies: -Projection Screens -Cameras -Couches -Recorders -Chairs -Snacks -Printers -Coffee maker -Fax Machine -Post-it notes -Electrical Outlets -Cups -Pencils -Trash cans -Dry Erase Board -Trash bags -Internet Router -Dry erase markers -Extension cords -Generator -Power strips -Wireless mice -Speakers -Calculator

12

Crisis Control Room

Room Layout

Layout Key: Screen- Couches-- Wall of Room- Walkway- Management Office

13

Key Messages

In the event of a crisis concerning the privacy and credentials of our users, Google must ensure the public that we are fully committed to placing their needs above our own. We will stress the importance of openness, security, and corporate citizenship. We will do this by being up front about the situation at hand and taking ownership for the problem. It is also important that we not only admit to the issue, but ensure people that we are striving to build even stronger security systems.

In the total numbers of years that Google Inc. has been in service, we have never had a crisis of this nature occur. The Google Company is built on a sense of community. We believe in the motto, “users first”, and will we be emphasizing this in the media. Because openness is one of our core values, will will strive to be completely transparent with the public about what exactly has happened, how many people it has affected, and steps users can take to ensure that their information continues to stay protected.

5 Key Messages: 1. Google believes in putting the user first. Please share with us your needs and concerns regarding the crisis. 2. Google’s core values include: openness, general ethics, and corporate citizenship. 3. Google has never had a security breach of this nature in all the years it has been in business. 4. We assure you we are taking the necessary steps to ensure privacy in the future. This includes build a stronger security network and privacy policy. 5. We will be monitoring which users have been affected closely and will be rewarding customer through our Google Vulnerability Rewards Program

14

Dissemination of Key Messages Kd wkd

It is important to have good key messages, but it is just as important of how they get to the attended audience. We do not want the company’s messages to be received in a negative way and presenting in the right way will help.

Google Crisis Response Public Alerts The Google Public Alerts system was created with the intent to keep an open line of communication between Google and its users. These public alerts will be sent out to anyone with any kind of Google associated account. While this system is typically used for natural disasters, it will be used to contact our users during the crisis.

Website/Social Media/ Gmail For the website we will put a key message on a banner on every page. In addition, in the tab we will put a detailed description on what we are doing to solve the security breach. For social media outlets we will continually update statuses to keep everyone in the loop. We will have writers who are on the communication pod that will be responsible for keeping people updated via social media. Finally, an email will be sent out to all Gmail users. This email will have the key messages woven into the script and we will be sure to explain who this security breach has affected and to what extent. This is in addition to what we are doing to fix the problem. We do not want our users to panic so this email needs to be sent as soon as we know the critical details. It should also be sent to the customers before it hits the media.

News The company will reach out to local and global news companies and papers about running features about how the company is working hard to get the security issue solved. The media outlets that we work closely with can be found on page 7. 15

Pre-Information

These documents should be on hand in the event that a crisis similar to this may occur. Being prepared will allow this plan to flow much more efficiently. Mission & Vision Statement - Google’s mission and vision for the company

Core Values - The core values of the company should address our concern for the user and our dedication to keeping an open line of communication

Google Security Analysis - The Gtech team will create this report to show our outstanding record of security. If possible, the team will also show the security breach data to reiterate openness.

Google User Testimonials - We will need these testimonials to build our credit with the public after many users will feel that their privacy has been violated. We must be prepared for the revolt that may occur form customers.

Outline of Google Vulnerability Rewards Program - Our internal expert, Chris Evans, will prepared this document because he is the founder of the program. This - will include directions for users on how to redeem rewards.

16

Pre-Information News Release

News Release Contact: ______Email: ______Phone: ______

FOR IMMEDIATE RELEASE Google Inc. Speaks Out on Security Breach The Google Company experience a security breach on ______at ______. The security breach came from an ______source. We have all hands on deck in solve this issue.

Google is dedicated to maintain an open line of communication between us and our users. Should you have any questions, please contact us via social media or by email at [email protected]. We have specific procedures in place to be able to specify whose credentials have been released and to what extent. We will be contacting Google users through our public alerts system and through Gmail.

Since 1998, Google has had an outstanding security and privacy record and we are not going to let this situation ruin that. We are working diligently to find exactly how the breach happened. In the mean time, you will be sent an overview of our Vulnerability Reward Program.

We would like to thank our 1.7 billion customers for their continued support through using the services . Because of your support, we are able to begin building stronger security and privacy policies while continuing to offer the services that our customers enjoy. Please review Google news, at Google Inc. for updates on this security issue.

17

Evaluation

After the crisis has been been handled, it is important that we debrief and offer an evaluation of the plan. We will do this in thee ways: surveys, our weekly TGIF meetings, and focus groups with those in the crisis control room pods.

Surveys: These will be sent out within 48 hours of closing the crisis. The survey will be sent out using the Google survey program, all Google employees are expected to provide feedback on both the crisis communication plan and how well that plan was following. There will also be a section for suggestions on how to improve this plan, were an event like this to happen again.

TGIF Meetings: These meeting are already a part of the culture at Google. The Friday following the crisis conclusion, we will come together at this meeting to celebrate our perseverance and discuss components that went well and components hat didn’t.

Focus Groups: 4 focus groups will be held with those who were in the crisis control room. Each pod will meet with the members of their pod to evaluate the plan and the actions following the plan. In the focus group, you should only discuss the component of the plan that pertained to the pod. In the focus group, pods will also come up with places in which the plan needs improvement.

18

Closing Statement

Here at Google, we operate successfully because of the people that we employ. We take pride in the fact that we hire smart and determined people. Our mission statement reflects that we enjoy an inclusive, useful, and organized environment. By taking the time to read this plan and understand the steps that need to be taken if an event like this were to happen, you have reached the expectation of those we hire. Thank you for your dedication to our company. While we hope an event of this nature never occurs, with this plan we will be prepared if such a crisis ever occurs.

- Google People Operations

19