Cyberspies and Cyberspace: What the ‘Google China’ Affair Reveals About Media and Intelligence Networks in New Media Environments Tim Stevens, King’s College London (unpublished essay, 2010) In January 2010, the world’s largest and most visible media company, Google, declared that it was the victim of a concerted campaign of ‘cyber attacks’ on its computer and information networks, which became known as ‘Operation Aurora’. Without openly blaming Beijing for these events, Google made it clear they believed Chinese security organisations or their proxies to be responsible for what they perceived as acts of ‘cyberespionage’, which also targeted pro- democracy human rights activists using their online services. Google threatened to withdraw from the Chinese market, or at least to end the self-censorship of its web search results, unless Beijing addressed these issues of surveillance and intelligence-gathering. The ‘showdown’ between Google and China was an important news story in its own right, and brought to the fore possible Chinese intervention in other states’ computer networks. It also exemplified deeper concerns about the vulnerability of the US in particular to cyberespionage and other forms of computer network operations. This paper contends that the ‘Google China’ affair is an interesting case study of how intelligence relates to the ‘new media’ environment of cyberspace. The news story itself was utilised to further political and security agendas in the West, a process which involved both media actors and intelligence services. The first section provides a brief outline of Google’s announcement and media responses to it. There follows a description of how institutional discourse in the preceding year helped foster a media environment receptive to a story involving a global media company and foreign intelligence agencies acting against the West and its commercial and security interests. Consideration is given to the sources used by Western media, many of whom 1 were close to intelligence agencies, and to the known or suspected activities of Chinese intelligence and allied actors. The final section suggests how the events and activities described relate to theories of global networks, and concludes that the relationships between media and intelligence are both overt and obscure. * On 12 January 2010, David Drummond, Google’s Senior Vice President for Corporate Development and the US company’s Chief Legal Officer, issued a 765-word statement on The Official Google Blog, which provides ‘insights from Googlers into our products, technology, and the Google culture.’1 In ‘A New Approach to China’, Drummond articulated Google’s decision to ‘review our business operations in China’ as a result of alleged breaches of Google’s computer systems, and of Gmail accounts used by human rights activists and advocates in China, the US and Europe.2 Taking the unusual step―for a large information technology company―of publicly admitting a serious cybersecurity problem, Drummond announced that Google were no longer willing to censor the results returned by its Chinese internet search service, Google.cn,3 as required by the terms of the operating agreement allowing it to launch its Chinese product in January 2006.4 Although Drummond did not explicitly place responsibility for the ‘attacks’ on Beijing, the tenor of the statement left few people under any allusions that the Chinese authorities were the focus of Google’s comments, and the cause of the reversal of their self- censorship policy.5 Despite the occurrence of a large earthquake in Haiti the same day, Google’s announcement also became major global news. The proximate reasons for this are not hard to fathom. By traditional 1 http://googleblog.blogspot.com/, accessed 25 February 2010. 2 Drummond (2010) 3 http://www.google.cn/, accessed 5 February 2010. 4 See: Schrage (2006) 5 Subsequent forensic analysis suggested that the Aurora attacks could be traced to two Chinese educational establishments, one associated with the People’s Liberation Army (Markoff & Barboza 2010) 2 criteria, ‘Google China’―as the slug lines would have it―was certainly newsworthy, possessing as it did elements of recency, superlativeness, relevance, and other ‘news values’.6 Negativity and consonance were also two major factors. Although Google is not a news organisation in the traditional sense, in the contemporary global media environment it is the biggest portal to, and disseminator of, news to the internet-using population.7 In part, this status was reflected in the censorship conditions agreed for its operations in China, such was the influence Beijing evidently felt such a media company could exert. News that China might be engaged in espionage against the US could not fail to be headline news either. Initial coverage of Google’s announcement focused on the two main protagonists in the story, Google and the Chinese government. The rhetorical hook for many of these stories was Google’s corporate motto, ‘Don’t Be Evil’. Coined by Google engineer Paul Buchheit in 2001, the phrase was adopted by Google as a ‘core value’, expressing a corporate ethic of honest decision-making, respect for the rule of law, and, as its ‘Code of Conduct’ explains, ‘providing our users unbiased access to information’.8 The decision to enter the Chinese market in 2006 had tested the limits of this concept at the time,9 and an apparent reversal of the policy on which Google’s Chinese operations depended gave cause for wide reconsiderations of Google’s corporate ethos. Even within one particular media outlet, The Guardian (UK), commentary tentatively supported Google’s courage in standing up to China,10 or expressed scepticism at the decision based on Google’s lack of previous ethical consistency with respect to Chinese 6 Galtung & Ruge (1965), Bell (1991), pp.156-160. 7 In 2005, Google surpassed Time Warner as the world’s largest media company by market value (BBC 2005) 8 http://investor.google.com/conduct.html, accessed 5 February 2010. On the origin of the slogan, see Battelle (2005), p.138. 9 e.g. Thompson (2006). As early as 2003, the ‘Don’t Be Evil’ ethos had been challenged by commercial imperatives (see McHugh 2003). This debate continues (e.g. Warman 2010). 10 Goldkorn (2010) 3 censorship.11 Concerns were also expressed as to what situation Google’s potential withdrawal/expulsion would bequeath Chinese internet users, including human rights activists.12 Evgeny Morozov of Georgetown University, and contributing editor of Foreign Policy magazine, opined that Google.cn was ‘sacrificed’ in a bid for positive media coverage, particularly in Europe where Google’s activities have been the subject of privacy worries.13 Morozov reasoned that Google’s appeals to security concerns masked this aspect of their corporate tactics, adding: All the talk about cybersecurity breaches seems epiphenomenal to this plan ... Besides, there is no better candy for US media and politicians than the threat of an all-out cyber- Armageddon initiated by Chinese hackers. I can assure everyone that at least half of all discussions that Google’s move would spur would be about the need to make America secure from cyberattacks.14 Written less than a day after Google’s announcement, Morozov’s words were prescient, and the media discourse that followed focused more on America’s vulnerability to Chinese state activities than on Google. Although, as previously noted, there were worries that the withdrawal of Google would leave Chinese ‘netizens’ bereft of unfiltered information sources, thereby bolstering China’s internal surveillance activities and social engineering policies, Western media attention fastened on the threat China posed externally. Chinese cyberespionage was central to media reportage and commentary, and this narrative became explicitly political in the weeks that followed. It was also consistent with existing discourse about cyberwar, the vulnerability of 11 Stevens (2010a) 12 Qiang (2010) 13 Morozov (2010) 14 Ibid. 4 Western nations to cyber attacks, and the relative inaction of policymakers to combat these threats. * The ‘Google China’ affair must be contextualised within discursive developments throughout 2009, in which broadcast media played a critical role in the US and elsewhere, principally in the UK.15 In January, the assistant director of the Federal Bureau of Investigation’s Cyber Division claimed that cyber attacks were second only to a weapon of mass destruction or a bomb in a major American city in terms of active national security threats.16 In the middle of the year, both the US and UK published national cyber security strategies which officially elevated cybersecurity to the top of national security strategies, after only terrorism and the wars already underway in Iraq and Afghanistan.17 Launching the US Cyberspace Policy Review in May, President Barack Obama stated that ‘this cyber threat is one of the most serious economic and national security challenges that we face as a nation’.18 By means of affirming this through organisational means, the Review called for the appointment of an Executive Branch Cybersecurity Coordinator reporting to the deputy national security advisor within the White House. This proved a difficult post to fill, and six months of Beltway wrangling and media speculation over who would become the new ‘cyber czar’ ended just before Christmas with the appointment of Howard Schmidt, an advisor to the George W. Bush administration and an information technology industry executive.19 15 Of course, ‘information warfare’ discourse has much deeper roots and a long history prior to 2009, e.g. Virilio (2000), Bendrath (2003), Curtis (2006), ch.7. 16 AFP (2009) 17 Cyberspace Policy Review (2009), Cyber Security Strategy of the United Kingdom (2009) 18 Obama (2009) 19 Phillips (2009) 5 In a CBS Sixty Minutes special in November 2009, Congressman James Langevin described the US cybersecurity situation as the nation’s ‘pre-9/11 moment’,20 a comment he later explained: ‘Much like in the months leading up to September 11, 2001, we know the threat exists and have an opportunity to address it before real damage occurs.