Google’s top security teams unilaterally shut down a counterterrorism operation

By the same token should we we also consider it reasonable for companies Huawei to avoid fixing security vulnerabilities being exploited by governments like China and not consider them to be deserving of having importation of their products blocked on this basis?

I don't think other countries would necessarily want to use google products if they are intentionally leaving security vulnerabilities open, so maybe it is better that all companies fix all security vulnerabilities they find?

And the users of the exploits were a state actor that was friendly to the USA.

Which is effectively saying that wanting vulnerable software is a patriotic thing.

Especially calling it a "counter terrorism" operation. Where did the author of the article get that information from?

It seems like a hit piece.

Allowing vulnerabilities to remain open/undisclosed because your government approves of them... for one thing, they aren't only useable by your government/allies, you don't know who else knows about them.

Our government's approach of finding security vulnerabilities and keeping them for their own use (instead of responsibly reporting them to get fixed) puts all our security in danger. There isn't much we can do about that (except, well, try to use our "democracy" to get the government to behave differently).

But in USA at least, private citizens can't generally be compelled to cooperate.

If engineers at a private company find a vulnerability, it should be responsibly dealt with to fix it. No matter who else knows about it or may be taking advantage of it.

I think it is unethical for a software engineer to do or go along with anything else.

(Disclosure: I work for Google, speaking only for myself)

One of the times I perceived that I was being given the option to be read-in to some spooky stuff on a client site my view at the time was the IC should do their job, and civilian security folks should do ours. I said that they don't need us to compromise our work if they are good enough at theirs, it's an equilibrium. When I work for them, I'll work for them, but when I work for customers, I work for customers. The world doesn't need more compromised people.

I also didn't buy the "if you only knew/ticking bomb" arguments, because they know they have jobs to do and they aren't going to let some civvy contractor geek stand in their way. I'm sure I lost a lot of professional opportunity as a result, but you have to ask what it is you're protecting.

If companies who provide products that citizens trust are being subordinated to the IC to spy on them, just what does the IC think it's protecting? When the IC "misses" open secrets like Epstein's blackmail ring, human trafficking coyotes, compromised politicians, the total infiltration and compromise of universities and public institutions by foreign influenced operators, election integrity issues, and economy altering money laundering operations in plain sight, just what job is it they are doing again?

We need an IC and general guardian class certainly, but the point is to protect the integrity of the nation. Civilians and companies aren't game pieces, and if they are, I don't think the IC wants the accountability that comes with that.

Imo, Google made the right call in this situation.

From a systems security standpoint, no. This is the same kind of idealistic naivety that causes the FBI to advocate for weak encryption, or senators to call for "security only breakable by us, because we're the good guys".

At least for Germany this is patently untrue. Our parliament is stonewalled regularly and they get away with it. And even in the US, the congress is being lied to with no repercussions.

Maybe they shouldn't base life or death consequences on something as capricious as the existence of an undetected 0-day. It's not just Google, what about other security companies, independent white-hats, etc?

The alternative is basically saying, "you shouldn't/can't improve software security, coz terrorism", which not only feels super unethical, but also likely a 1st amendment violation.

> In some cases, security companies will clean up so-called “friendly” malware but avoid going public with it.

Ah, this explains why if you follow security-related news, it feels like U.S. or “Western” countries never conduct offensive operations ever.

If the western government in question wants to hack vulnerable software - they can create their own vulnerable software, ship it and distribute it. No one - utterly no government - democratic or not has any privileged right to hack market software and services.

Try passing a law through both houses stating the US government has the right to exploit US companies - and watch the US economy collapse.

Apart from the fact that the article seems to obscure the fact of if companies actually know about the counter-terrorism operations (they somehow say people suspect it).

It also creates this myth of "democratic oversight" and we all know how much that's worth since Snowden. Also it constructs as if Google is in such a special position here. I mean the vulnerability could be caught by anyone theoretically. Also what is a counter-terrorism operation, monitoring some environmental protestors, what about political activists (of any colour), or does it only count if it's Islamic terrorists?

And then there's the whole "putting soldiers lives at risk" which gets repeated every time this comes up. As if we should accept every violation of privacy/human rights, because it saves soldiers lives. They are soldiers, it's their job. Arguably their lives have been put at risk by sending them on the mission.

The obvious question is: if some malware is on a public website, who guarantees that only the "bad guys" will be targeted?

If you don't disclose the 0-days, who guarantees that your own citizens won't be targeted by the same kind of exploits on the very same vulnerable devices?

If you purposely keep a backdoor open in a device, who guarantees that the "bad guys" won't find that backdoor and use it themselves?

Although I usually disagree with Google's decisions a lot, this time I can't see much wrongdoing in their action.

Counter-cyber-terrorism is a double-edged sword, because it's about placing landmines and waiting for a bad guy to step on them. But nobody guarantees that only the bad guys will step on them. So it's probably time to end this "but we can do it because we're the good guys" rhetoric: it's very easy to get burned when you play with fire.

So what the NSA has been doing (even after exposure by Snowden) has had "oversight baked in"? Who are we kidding?

This posturing, pretending that " the west is better than everybody else", is downright naive and idiotic. No organisation is pure of heart, moral, or ethics, and none have crystalline motives.

Can someone help me understand why this is a good thing? By the arguments presented by other commenters, it seems to me that a) these hallmarks can be duplicated by someone else and b) by only running operations with said hallmarks, the intelligence agencies might miss other vulnerabilities.

Secondly, I think it's fair to say governments absolutely abuse any vulnerability they can at any point in time.

The article seems to be suggesting that they should have left the holes unpatched, but that wouldn't work. Rival state-backed hacker teams do the same work that the Project Zero people do and would discover the attacks, reverse engineer them, and exploit them.

It came out (either from Snowden or from other reporting) that the NSA had a term, NOBUS, short for "nobody but us". The idea was that if they had a hack that was so tricky that they thought that no one else could exploit it, they would exploit it, and if the hole they found was "easy" they would share it so it could be fixed. But that's just arrogant: nothing is NOBUS for long.

The writer assumes that western / US-affiliated elections are universally, lawfully elected, and never the product of illegalities... while writing about likely-illegal operations by some of the very same people within those very same governments.

Google is a multinational company with most shareholders (weighted by investment amount, not control) and most employees being from outside US.

That reads like a opsec vulnerability in the approach

That's the kind of self-delusion you only get from a power-hungry government official.

I hate to be that guy, but the holocaust was literally this. Nothing has happened since the 1930s that would make me feel safer around a government just because it was lawfully elected.

The Snowden files tend to show there's not a lot of oversight.

Doubt it. They frequently abuse their surveillance powers and spy on each other's citizens. Imagine what they do to a foreign national.

They should report it the same they report any other vulnerability.

Sounds like un-nuanced, black&white nerd myopia (sorry fellow nerds). Ethics dictate that the greater good should be conserved rather than mechanically-plugging holes with blinders on, no matter the fallout. (This is the kind of flawed, idealistic, un-empathetic logic Rand Paul often wades into.) If the failure of this operation leads to mass casualty events or other deaths, then you know who enabled it.

The most sensible move would've been a cooperative agreement that these holes would be plugged in a fixed amount of time, say 2 months, so the operation could have other sploits ready while not exposing the average international user to risks for too long.

Secure systems that do what they say they'll do help everyone. The idea that there's some sort of obligation to keep security vulnerabilities around so that the bad guys can get pwned feels as vile as saying that there's an obligation to keep medical knowledge secret lest enemy soldiers learn how to take care of their health.

I hope this doesn't discourage Google's threat analysis team, and others, from doing the same in the future.

The justification for not intervening is weak too - after all, we only have this article's word for it that the targets were 'terrorists'. They may well just have been freedom fighters, like Nelson Mandela was.

Won't terrorists go after you now? Close the exploit, or be mortared. You go to the feds. They say: Oh! I can't get to that now!!! My phone says I need to update!

Even if Google is legally obligated to ignore cyber attacks by allied nations, who's to say that they are even capable of accurately attribution?

1: https://www.zdnet.com/article/fortnite-epic-games-ceo-rails-...

That’s a bit too conspiracy-minded; it’s almost certainly just an accident of history. It’s certainly convenient for black-hat and national security types though.

How long until some congressperson finds out about Rust, though, and decides it’s a threat to national security since software written in Rust has many fewer security vulnerabilities.