It is the wrong headline because it frames the issue in a certain way — one that leads to misunderstanding what is really going on. However, I won’t deny that “Google vs China” is a great headline for capturing reader’s attention (which is why I embed the phrase in the headline above, even as I disavow its validity)
I’ll explain what I mean in a moment, but, first, a quick recap for the casual observer.
Over the past week, people in the worlds of technology and business have been struggling to parse the information that came out regarding alleged cyber-attacks by the Chinese government on Google and other technology companies.
The situation is one where the people who do know aren’t talking much, and the ones who don’t know are freely projecting their personal biases and agendas onto a murky and opaque reality. Spewed reactions range from “China is Evil. Go Google!” to “It’s all a cynical ploy by Google to mask their failure in the China market.”
For example, an article that appeared just yesterday in Forbes magazine by Rebecca Fannin, entitled Why Google is Quitting China, the author gave an unequivocal answer in the subhead: “The search giant just couldn’t compete with Baidu.”
Also published yesterday, The New York Times published a roundup of experts answering the question “Can Google Beat China?”. The answers varied, but fell mostly on the side that, no, when it comes to Google vs. China, Google will lose.
So there is a story line that took shape in the media, running something like this:
- Somebody hacked Google Gmail accounts of Chinese dissidents
- Separately, Google claims that its own systems were penetrated by attackers seeking to steal intellectual property
- In response, Google is going to stop censoring its search results in China and likely pull out of the Chinese market
- Some commentators think this is because Google was losing the search engine battle in China
- Others think that Google was embarrassed about its systems being hacked and wanted to distract attention from security vulnerabilities in its cloud computing service
- Yet others think that Google is embarked on a quixotic mission to enable free speech on the Internet, a noble but misguided mission that is doomed to fail
- Lastly, some think this talk of openness is all a cynical negotiating ploy to get a better deal with the Chinese government, and that this will all blow over once a new deal gets struck
I think the most of the elements in the above storyline are offbase, and some wrong. To be fair, although the articles referenced were published yesterday, likely the authoring process began a day or two earlier, and this is a very fast-moving situation with significant new information coming to light every day. It is possible that some of the early commenters have revised their views. (Similarly, I expect I’ll have to revise my own analysis in the coming week.)
Myth: Google was losing the China market anyway and this is just a convenient way to cover up an embarrassing failure. Also, revenue-wise the China market is a small percent of Google's revenues and can be dispensed with.
Reality: According to Google and to other reports, the company had its best quarter ever in the China market. Although the dominant player in the search engine sector is Baidu, with 60% or more of the market, Google’s share (36% in fourth quarter of 2009, according to one report) is four times the share that Microsoft Bing has in the US (and no one is saying that Bing is a failure, and that Microsoft should find some excuse to withdraw from the US search market). Google appeared to have a valuable and growing business on its own right. Over the coming decade, China is destined to play a huge role in both the global economy and the Internet sector. It has or will soon have more Internet users than ony other country, its economy has strong growth at 7% per year, and has $2 trillion in cash reserves. Due to its vast population, China has more Internet users that can read English than any other country (although that oft-cited statistic glosses over the question of fluency). Not only is China a market of great importance to Google and other Western companies, it is also a key supplier. Chinese manufacturing companies were shaping up to play a key role in the future of Google’s Android platform, as they have with the Apple iPhone. Any company that walks away from that kind of market and supply chain is potentially throwing away its future. For Google, this is truly a “bet the company” maneuver, one that was not taken lightly.
Myth: This is all brinksmanship and posturing, as some kind of negotiating ploy for better business terms
Reality: If reports are to be believed, the people at Google driving this decision were neither the newly minted MBAs that have been arriving lately to Googleplex, nor the old hard-ball-playing veterans of platform wars recruited from Microsoft and Yahoo. These business-minded individuals continued to favor pragmatic deal-making and ongoing compromise with China. According to some news reports, Google’s decision to go public with this information was driven by Sergey Brin, whose family were penniless refugees from Russia when he was a child, and who can be expected to hold opinions on human rights.
Granted that Google is no slouch at gamesmanship and negotiation, as demonstrated in the FCC auction of 700MHz spectrum last year. That was well-played, because Google bid enough to trigger the open access requirements, but not enough that it was saddled with a $4.7B bill. So there is a validity to that observation. But I also think that Google was mostly an unexpected and unwilling participant in this face-off. The company was a “canary in the coal mine” in an emerging high-stakes cyberwar between China and the industrialized West. Google’s hand was forced by extreme events, in my opinion.
Myth: This was a hack of people’s Gmail accounts, similar to when Sarah Palin’s Yahoo account was hacked in 2008, or when the management team of Twitter ahd their accounts hacked. Therefore people should beef up their passwords and freshen up their anti-malware software. And Google should bone up on encryption and clean up its act in the security area.
Reality: Again, facts are hard to come buy, but it appears that these attacks were military-grade sophistication — what some would consider true acts of cyberwar. These sophisticated attacks used multiple vectors ranging from a zero-day flaw in Internet Explorer to reportedly a flaw in Adobe Reader to social engineering of consumer email accounts, and perhaps even social networking sites.
Regarding Google’s security, it is possible, even likely, that other companies were compromised to a greater degree than Google, but only Google had the cojones (an Olde English word for gumption) to stand up and bear witness.
Myth: This is just a two-way face-off between Google and China
Reality:The news is still coming in, and the full scope will likely never be known. Nevertheless, it is possible that what is going on is a systematic effort by certain forces in China to penetrate the leading technology and industrial companies in the US with the intent of capturing source code and other intellectual property.
This is an area where companies are tight-lipped, perhaps to due various fears (such as potential business in China, or embarrassment that they were penetrated). Granted, only small fragments of information available, and so one can only speculate. But some reports say that Yahoo was penetrated first and chose to keep silent. A few companies, such as Juniper and Adobe, have acknowledged being attacked, but apparently there are 20 or more whose names have not yet surfaced in the media. In China, Facebook, Twitter and YouTube have been shutdown for months.
Myth: China is Evil, dissidents are saints, and Google is fighting a noble and holy war.
Reality: I should acknowledge that this position is more of a straw-man, or even a straw-hippopotamus. The position is not something that is explicitly stated by any credible commentator in major media. But it is part of the broad conversation, an implicit storyline, I have seen the echoes of this in plenty of tweets by individuals. I should also add that I am not an expert in China and have little knowledge of dissident political movements there. Nevertheless, it appears to me that the general populace in China does support their government, and its national security agenda. I point this out not because I agree with their policies, but rather as part of describing the reality of the situation, in order to forecast how all this will play out.
The competitive dynamics of the Web industry are intricate and complex, but seem like tiddlywinks in comparison to the geopolitical, economic and, yes world-historical, context in which all of this plays out. The Chinese government’s alleged action, followed by Google’s response, appears to me to be a landmark event without precedent in the history of business and technology, an event intertwined with larger forces that will play out over the next few years and shape the decade of 2010. It’s a watershed event in the way that the Enron case was a landmark indicator of a set of patterns, practices and business culture that played out over subsequent years.
The Chinese government appears to be an immovable object. And Google, although a giant on the Web, by comparison to the Chinese economy (present and future), is far from an irresistible force. The straightforward equation therefore favors China. However, the outcome will be determined by the extent to which Google can marshall an aggregation of other forces (both governmental and private sector), and the extent to which the immovable monolith begins to show fissures and cracks due to internal changes and evolving perspectives in the population.
The bottom line is that, if it’s “Google vs China”, then there’s no question in my mind that China will win. To the extent that this becomes “China vs The Internet”, or, “Certain factions in Chinese Government vs The Internet plus other governments”, then the contest is more evenly matched. Unfortunately, at that scale, a long-running evenly matched contest can inflict significant collateral damage all around.
Postscript: It goes without saying, but bears repeating here that the opinions in this post (along with my other blog posts), are my opinions alone, and should not be construed as official Gartner positions
Category: Uncategorized Tags:

Ray Valdes





































































































8 responses so far ↓
1 “Google vs. China” Is the Wrong Headline | China Today January 17, 2010 at 8:50 am
[...] View original here: “Google vs. China” Is the Wrong Headline [...]
2 ChinaClip - “Google vs. China” Is the Wrong Headline January 17, 2010 at 11:06 am
[...] See a rest here: “Google vs. China” Is a Wrong Headline [...]
3 "Google vs. China", el titular erróneo [ENG] January 17, 2010 at 4:20 pm
[...] "Google vs. China", el titular erróneo [ENG] blogs.gartner.com/ray_valdes/2010/01/17/google-vs-china/ por esparta hace 2 segundos [...]
4 Why Is Google The Focus Of The Cyber-Attack Kerfuffle? January 17, 2010 at 10:29 pm
[...] colleague Ray Valdes has just written an excellent blog debunking some of the myths around the apparent cyber attacks originating in China. There’s a lot [...]
5 John Pescatore January 18, 2010 at 8:11 am
Myth1: this attack was “military grade” – this same type of attack, exploiting unpatchable vulnerabilities using multiple vectors, has been seen regularly for years in bot net attacks and compromises.
Myth2: Google “had the cojones to stand up” – there are also many other companies, especially service providers, that were *not* compromised by this kind of thing, largely because they enforced better security on their sensitive employees’ PCs. They had the actual “gumption” – they protected their company’s data and customers’ data better than Google did. That takes real cojones.
John P.
6 Ray Valdes January 18, 2010 at 9:48 am
John, thanks for your comment.
Regarding your first point, depends on what you are referring to when you say attack. I chose the term “military grade” deliberately, even though I am well aware this term has fallen into disfavor within the security community — even though the term descends to the same level of vagueness as “enterprise” (in another context). The reason for the word choice is that there is no alternative shorthand that conveys to the layman an attack that targets military facilities (i.e., reportedly Northrop-Grumman was one of the firms targeted along with Google), and one which is at a high level of sophistication.
Yes, the attacks relied on an assemblage of well-known (i.e., effective) hacker botnet techniques, but these were woven together into a potent mix — in the same way that the recent bombing attack in Afghanistan that took the lives of senior in-country CIA staff used a skillful mix of pedestrian techniques.
Regarding your second point, it is so far not disclosed which companies have been penetrated. One report lists the number as 34. Hence at this point it is impossible to say that service providers were not attacked and/or not compromised. This has nothing to do with what security measures are on employees PCs, anymore than the recent hack of actor Stephen Fry’s Twitter account had to with what PCs are used by Twitter employees. In that hack, a vulnerability in a third-party system was used to discover the Twitter password.
That is to say, if a burglar breaks into a Gmail user’s house and finds a yellow-sticky note with the password to the Gmail account, this has nothing to do with security of Gmail per se (the same technique could be used for any email system) or what desktop machines are used by Google employees.
7 Ray Valdes January 18, 2010 at 10:20 am
Parenthetically, friends at Adobe point out a report by McAfee that states: “contrary to some reports our findings to date have not shown a vulnerability in Adobe Reader being a factor in these attacks”
http://siblog.mcafee.com/cto/operation-%E2%80%9Caurora%E2%80%9D-hit-google-others/
8 Jim Lundy January 19, 2010 at 1:48 am
I’m with Ray that this attack was more coordinated and also government sponsored. Sadly, now these types of attacks will be the norm.
This also marks end of days for a certain brand of Browser. These were clearly attempts to steal source code and this puts Enterprises and IT people at risk (if they don’t act). If your career were on the line, what would you do? Trust a vendor to make a patch for something that isn’t patchable?
Cheers
Jim