Design Education

Like many other well-known organizations, we face cyber attacks of varying degrees on a regular basis. In mid-December, we detected a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google. However, it soon became clear that what at first appeared to be solely a security incident–albeit a significant one–was something quite different.
First, this attack was not just on Google. As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses–including the Internet, finance, technology, media and chemical sectors–have been similarly targeted. We are currently in the process of notifying those companies, and we are also working with the relevant U.S. authorities.
Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists. Based on our investigation to date we believe their attack did not achieve that objective. Only two Gmail accounts appear to have been accessed, and that activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves.
Third, as part of this investigation but independent of the attack on Google, we have discovered that the accounts of dozens of U.S.-, China- and Europe-based Gmail users who are advocates of human rights in China appear to have been routinely accessed by third parties. These accounts have not been accessed through any security breach at Google, but most likely via phishing scams or malware placed on the users’ computers.
We have already used information gained from this attack to make infrastructure and architectural improvements that enhance security for Google and for our users. In terms of individual users, we would advise people to deploy reputable anti-virus and anti-spyware programs on their computers, to install patches for their operating systems and to update their web browsers. Always be cautious when clicking on links appearing in instant messages and emails, or when asked to share personal information like passwords online. You can read more here about our cyber-security recommendations. People wanting to learn more about these kinds of attacks can read this U.S. government report (PDF), Nart Villeneuve’s blog and this presentation on the GhostNet spying incident.
We have taken the unusual step of sharing information about these attacks with a broad audience not just because of the security and human rights implications of what we have unearthed, but also because this information goes to the heart of a much bigger global debate about freedom of speech. In the last two decades, China’s economic reform programs and its citizens’ entrepreneurial flair have lifted hundreds of millions of Chinese people out of poverty. Indeed, this great nation is at the heart of much economic progress and development in the world today.
We launched Google.cn in January 2006 in the belief that the benefits of increased access to information for people in China and a more open Internet outweighed our discomfort in agreeing to censor some results. At the time we made clear that “we will carefully monitor conditions in China, including new laws and other restrictions on our services. If we determine that we are unable to achieve the objectives outlined we will not hesitate to reconsider our approach to China.”
These attacks and the surveillance they have uncovered–combined with the attempts over the past year to further limit free speech on the web–have led us to conclude that we should review the feasibility of our business operations in China. We have decided we are no longer willing to continue censoring our results on Google.cn, and so over the next few weeks we will be discussing with the Chinese government the basis on which we could operate an unfiltered search engine within the law, if at all. We recognize that this may well mean having to shut down Google.cn, and potentially our offices in China.
The decision to review our business operations in China has been incredibly hard, and we know that it will have potentially far-reaching consequences. We want to make clear that this move was driven by our executives in the United States, without the knowledge or involvement of our employees in China who have worked incredibly hard to make Google.cn the success it is today. We are committed to working responsibly to resolve the very difficult issues raised.

———————————————————————————————

（翻译者Vincent Leung ）
在中国的一个新做法
就像很多其他著名的组织，我们经常面对着各种程度的网络攻击。在去年的十二月中，我们侦测到了一次来源于中国，高度复杂和有目标指向并且针对我们公司基础设施的攻击。这次攻击导致了我们知识财产的失窃。但是，我们很快明白了虽然表面上这只是一次严重的安全事故，其实这是某样非常不同的东西。

首先，这次攻击并不只针对Google。在调查中我们发现至少另外20间不同类型的公司，包括网络，金融，科技，媒体和化学，都受到了类似的攻击。我们正通知这些公司，也正在和相关的美国政府机构一起工作。

第二，我们有证据表明这些攻击者的主要目标是侵入一些中国人权活跃分子的Gmail帐户。根据我们目前的调查，他们的攻击并没有达到这个目标。只有两个Gmail帐户显示被侵入，而且这个侵入只限于帐户信息（例如帐户创建的日期）和邮件主题，而不是邮件的内容。

第三，作为这次调查的一部分但是独立于对于Google的攻击，我们发现了一些向中国宣扬人权的美国、中国和欧洲的Gmail用户被第三方经常性侵入。这些帐户的侵入并不是通过Google的安全漏洞，而是很可能通过安装在这些用户电脑的钓鱼软件或者是恶意软件。

我们已经利用了从这次攻击而得到的信息去作出对于基础设施和结构上的改进，用以增强对于Google和我们用户的安全。对于个人用户，我们会建议他们在电脑上安装可靠的防病毒和防间谍软件的程序，安装他们操作系统的 补丁和更新他们的网络浏览器。他们应该一直都要在点击即时信息和邮件里面的链接，或者在被要求披露像密码那样的个人信息的时候保持谨慎。你可以在这里阅读 我们更多的网络安全的建议。想要了解更多关于这些攻击的人可以阅读这份美国政府的报告（PDF），Nart Villeneuve的博客这这份关于GhostNet间谍事件的报告。

不仅因为我们在这次事件中挖掘出来的安全和人权暗示，还因为这些 信息深入到一场关于言论自由的国际性辩论，所以我们采取了这些不同寻常的措施来披露这些信息。在过去的二十年里面，中国的经济改革方案和它国民的创业精神 使到数以亿计的中国人民脱离贫困。的确，这个伟大的国家今天正站立在世界上大部分的经济进步和发展的中心里面。

在2006年1月，尽管我们对于需要过滤某些搜索结果感到非常不安，但是为了令中国人民能够更加便利地获得信息和一个更加开放的互联网超过了这些顾虑，我们发布了Google.cn。在那个时候我们说明了“我们会谨慎监察中国的状况，包括新的法律和其他关于我们服务的规定。如果我们觉得我们不能够达到我们提出的目标，我们就会立即重新考虑我们在中国的做法。”

这些攻击以及它们揭开的监控，加上近年来进一步限制网络言论自由的尝试，使我们得出我们应该重新审视我们在中国进行商业活动可能性的结论。我们已经决定我们不再愿意继续在Google.cn里面对于搜索结果的过滤、审查，所以在接下来的几周我们会与中国政府讨论我们能否在现有法律框架之内运行一个不经过滤的搜索引擎的可能性。我们知道这有可能意味着我们需要关闭Google.cn，甚至我们在中国的办事处。

作 出这个重新审视我们在中国的商业活动的决定是异常困难的，而且我们知道这会导致潜在的十分深远的影响。我们希望澄清这是由我们在美国的高管们决定的，并没有我们在中国的员工的任何知悉和参与。Google在中国的员工为今天Google.cn的成功作出了巨大的努力。我们承诺我们将会负责任地去解决这个问题。