Tag Archives: Public Policy

A pilot program to build a diverse pool of policy experts

During the 15 years I have been at Google, I have seen important improvements in the diversity of our workforce. For example, I used to be the only woman in the room, but now I am often surrounded by talented women leaders.

I work in the world of government affairs and public policy, which means engaging with governments and influencers to find constructive solutions to challenges that our industry and society face today. Having diverse representation and voices is important to us, as so much of our work requires building relationships across different groups, geographies, issues, and perspectives. But we must still do more to ensure that we are fostering a tech policy ecosystem that reflects the diversity of the world we build for.

That’s why our team started the Policy Summer Institute (PSI) with our academic partners at CIVICA, an alliance of eight leading European higher education institutions in the social sciences. The goal: to promote professional opportunities of first-generation university students in the digital policy ecosystem.

For our first year, nine scholars from Sudan to Switzerland had the opportunity to learn about how we work on tech policy by spending a week with our government affairs and public policy team in Europe. They then completed a summer internship funded by Google with one of our partner consultancies.

I am delighted that several of our scholars were offered further employment opportunities at their agencies following their internships. Others will continue to explore tech policy issues through their studies.

Shivona Fernandes-Köhler, an Msc. Politics and Policy Analysis student at Bocconi University in Milan, shared her key takeaways from the experience:

What was your motivation to apply for the program?

I have always been interested in the interrelations between the private and public sector, especially regarding innovation, and wanted to understand the impact that policy firms and big tech have on the world around us. However, without an existing network, internships in the field are often limited and challenging to gain access to. When I first saw the program, I didn’t think I had a chance, but when I saw that it focused on first-generation university students, I felt motivated to apply and showcase that diversity is in fact my strength.

Seven photographs of ten people in various locations at Google offices.

Our amazing first cohort of PSI scholars. Shivona is on the top right in a white shirt standing next to Mahreen Zaidi San Miguel, who was a coordinator of the program.

How has this experience prepared you for the next stage of your career?

In the immediate term, I'll be staying on with the policy agency I interned with as a working student while I finish my studies. Being part of the PSI showed me that it's important to get a range of experience in different sectors, and that in order to really progress my career, I'll need to build a strong network of professional contacts. Being part of this program and working with fascinating and diverse individuals has given me a new sense of confidence, one that highlights that taking a unique path is key to a successful future.

What was something you learned that was unexpected or surprising?

My summer in Berlin was filled with surprises. I was unaware of the many facets of this sector and the incredible team effort involved in making it function. From the outside, it can appear as if policy-making is not something that businesses should be involved in, but rather something that should be left to the politicians. Instead, I have realized that both the public and the private are essential to one another and that they can only function with a well-coordinated network. I was also surprised on a personal and cultural level. Despite living in Italy, and being raised in Germany, I never realized that working cultures can be so different even within a country!

Can you share an example over this summer where you brought a different perspective to the work you were doing?

People in the tech and policy world can often get stuck in their own bubbles: Everyone has their own habits, organizational methods and ways of communicating. Being at a small policy firm that had just begun working with Google, I had the opportunity to develop methods and strategies to make collaboration and communication easier and more effective. I was especially involved in delivering new event formats and monitoring media updates. As a newcomer to the sector, I was able to highlight areas of ambiguity and improve existing organizational matters, facilitating workflow and workload.


While the tech policy industry needs to do a lot more when it comes to diversity, I am proud of the results of this pilot program and look forward to continuing to work with our partners to build a robust, diverse talent pool that supports our industry’s growth.

Google at the 2022 United Nations General Assembly

This week world leaders gathered in New York City for the United Nations General Assembly (UNGA). Google participated in a range of UNGA-related engagements as part of our commitment to collaborate with international organizations to achieve collective solutions to the world’s most pressing challenges. Here are just a few of the many topics we covered:

Global governance in a digital era

The global internet was built to be a shared resource that everyone could access wherever they lived — but over the last few years this ideal has been increasingly challenged. Regulatory barriers to the free flow of information across borders are threatening to fragment the internet. New and revitalized global governance frameworks are needed for an increasingly digitized world, and international organizations will be critical to achieving them, which is why we support the UN Global Digital Compact.

Over the course of this week, we had various conversations about what needs to be done to ensure that the internet remains open, secure and reliable for everyone. Preserving the cross-border availability of secure technologies and digital services – coupled with forward-looking decisions by governments to invest in digital infrastructure and digital skilling – can protect access to information everywhere and ensure that the benefits resulting from the global internet are preserved.

Kent Walker is seated on a stage with moderator Ravi Agrawal talking

Kent Walker on stage with Foreign Policy Editor in Chief Ravi Agrawal at FP Tech Forum

Supporting the UN Sustainable Development Goals

Progress on the UN Sustainable Development Goals (SDGs) was a key topic during this week’s UNGA. The 17 UN SDGs were created “to make a better world for everyone, now and into the future.” They include goals like achieving gender equality, ensuring quality education and tackling economic inequality. At Google, we see countless ways in which technology can help accelerate progress on these goals.

While the global community has made some important progress in meeting the SDGs since they were launched in 2015, headwinds persist due to Covid-19 and global conflict and, unfortunately, not a single country is on track to meet all 17 goals by 2030. To that end, Google's philanthropic arm, Google.org recently announced that we are expanding these efforts through a $25 million commitment to support NGOs and social enterprises using artificial intelligence (AI) to accelerate progress in achieving the SDGs.

group of people seated at a conference table

James Manyika, Jacquelline Fuller and UN Deputy Secretary-General Amina Mohammed hosted a roundtable on using AI to accelerate the UN’s Sustainable Development Goals. (L to R: Jacquelline Fuller - President of Google.Org, Elizabeth Cousens - President of UN Foundation, Paula Ingabire - Minister of Information Communications Technology and Innovation of Rwanda, UN Deputy Secretary-General Amina J. Mohammed, James Manyika - SVP of Technology & Society and UN Tech Envoy Amandeep Singh Gill).

A number of the SDGs – ensuring sustainable cities, and access to affordable and clean energy, for example – were established with sustainability top of mind. And as our CEO has said before, solving climate change is humanity’s next big moonshot. Working together, governments, companies, and citizens can create technology-enabled, scalable solutions that deliver a prosperous, carbon-free future for all of humanity.

As a company we've been carbon neutral since 2007, and by 2030 we aim to achieve net zero emissions across our operations and value chain, and to run our data centers and offices entirely on carbon-free energy. As we work towards these goals, we’re collaborating with partners to share tools and resources to make clean energy achievable for all, such as the 24/7 Carbon-Free Energy Hub and Academy launched earlier this week. And we continue to partner with UN Energy, Sustainable Energy for All, and dozens of companies and cities around the world to grow the 24/7 Carbon-Free Energy Compact.

Ukraine

The war in Ukraine continues to be both a tragedy and a humanitarian disaster. Since the war broke out, our team has worked around the clock to combat disinformation, elevate authoritative content across our services, protect cybersecurity in Ukraine and globally, while also providing humanitarian assistance and supporting the region more broadly. This week, we were honored that Sundar was selected as a recipient of one of this year’s Atlantic Council Global Citizen Awards, in recognition of Google’s efforts in response to Russia’s continuing war in Ukraine, our commitment to digital resilience, and our ongoing support for refugees and displaced people throughout the world.

Sundar Pichai speaking at a podium

Sundar Pichai delivers an acceptance speech at the Atlantic Council’s 2022 Global Citizen Awards, highlighting the role the private sector can play in helping refugees around the world.

International organizations like the United Nations are unique in their ability to convene countries from all over the world, and we are pleased to collaborate closely with member governments to play our part.

Sprinting towards a more equitable and sustainable future

Editor's Note: Today, Google is launching the Portulans Institute’s first global Future Readiness Economic Index at the 2022 United Nations General Assembly. This report covers 124 economies, is designed to help countries accelerate digital transformation, and a new online toolwill allow anyone to assess how stronger, sustainable and inclusive growth can be achieved.

The world continues to face a great deal of uncertainty. The pandemic touched every corner of the globe; conflicts have wreaked havoc on food security and energy prices; and climate-related disasters are becoming all too frequent. Being prepared for uncertainty and ready to adapt to current and future challenges is more essential than ever.

Central to this idea of readiness is digital transformation — no longer seen as a luxury, but a necessity. We have witnessed unprecedented technological advancements in the last few decades that have brought us closer together and made our societies and economies more interconnected. New possibilities have emerged from the digital revolution, including new ways to address long-standing challenges and the promise of a more equitable and sustainable future. Despite the acceleration of digital transformation that we’ve seen, there are still numerous issues to address before technology’s potential can be fully realized.

“The Digital Sprinters”

With this context in mind, we launched our Digital Sprinters initiative in November 2020, aiming to provide a blueprint for emerging countries to accelerate their digital transformation.

As we shared in our Digital Sprinters 2020 report and framework, digital transformation will require investment by governments and the private sector in infrastructure, people, technological innovation and public policies:

  • Infrastructure: Investing in digital connectivity and secure and environmentally sustainable infrastructure. It’s not just about investment but also how the infrastructure is managed.
  • People: Preparing people across all communities for the jobs of the future.
  • Technological innovation: Deploying technological innovation that can unlock new opportunities. Increasing the use of data, artificial intelligence and cloud computing, which empower the growth of next-generation technologies. This means new opportunities alongside new questions about how best to harness these technologies.
  • Public policies: Supporting a regulatory ecosystem that promotes competitiveness. Advancing policies that encourage competitive and open markets, interoperable regulatory standards, and tax regimes that are predictable and based on international standards.

The Future Readiness Economic Index

Building on the Digital Sprinters framework, in 2021 Google commissioned the Portulans Institute’s first edition of the Future Readiness Economic Index (FREI). The index gives governments, businesses and analysts comprehensive metrics and milestones to assess their digital transformation.

That original index focused on 27 countries — but future readiness matters globally. That’s why today we’re launching Portulans Institute’s first global Future Readiness Economic Index at the 2022 United Nations General Assembly. The report covers 124 economies and helps countries in assessing how ready they are for the future, and how they can accelerate their digital transformation for stronger, sustainable and inclusive growth.

Assessing trends is an inexact science. But by breaking down the data in critical areas like infrastructure, talent development, skills matching, and technology adoption, the Future Readiness Economic Index can help countries focus their efforts to get the biggest returns on investment. For example, the Index suggests that the United Arab Emirates, which ranks 27th globally on the Index, could sprint ahead by encouraging greater research and innovation in emerging digital technologies like cloud, AI and machine learning; while Mexico, which ranks 62nd on the index, would benefit from expanding Internet access and bandwidth, as well as improve energy consumption efficiency.

This year’s report is accompanied by an online tool that will allow anyone interested in digital transformation to simulate, compare and assess how it can be achieved.

Seizing the opportunity to sprint ahead

Generally speaking, the most future ready economies are mostly high-income countries, with Singapore leading the world in this regard. Those that score highly all have in common solid institutions and infrastructure, and good all-around performances across all FREI pillars.

Many emerging countries are lagging in future readiness — held back by weaknesses across all four pillars. Accelerating digital transformation would be a game changer for such countries. In fact, according to a Digital Sprinters studyby the strategic economics consultancy AlphaBeta, accelerating digital transformation could add half a trillion dollars to the annual GDP of three African countries (Nigeria, Kenya and South Africa), and over a trillion dollars to the annual GDP of the six largest economies in Latin America, by 2030. In this journey emerging countries have a key advantage. Unlike more developed economies, they can leapfrog ahead, building advanced tools from scratch rather than upgrading or replacing outdated legacy infrastructure.

There is no ‘one size fits all’ approach to becoming future-ready. Countries should pick and choose the tools best suited to their needs and objectives. The Index provides some objective comparisons to help determine which policies, technologies, and balance of human capital, infrastructure and other critical elements might work best.

By highlighting the gaps in policy, technology, human capital and physical capital, the Future Readiness Economic Index is aimed at providing governments around the world with insights on both challenges and opportunities. We hope it can equip them with some helpful tools to spur future progress.

The Court’s decision to dismiss much of the Texas AG’s antitrust case

Today, a United States District Court struck down large parts of Texas Attorney General Paxton’s case as being "not plausible."

Importantly, the Court dismissed the allegations about our Open Bidding agreement with Meta — the centerpiece of AG Paxton’s case. Despite his allegations, this has always been a well-publicized, pro-competitive agreement.

The Court also agreed that many of AG Paxton’s claims relating to our technology innovations and practices — like Open Bidding and Accelerated Mobile Pages — are not plausible violations of antitrust law. The Court dismissed his claims about Privacy Sandbox too.

Today's decision underscores how AG Paxton's case is deeply flawed. As we’ve long said, advertising technology is a fiercely competitive industry — and our products increase choice for publishers, advertisers and consumers while enabling small businesses to affordably find new customers. We look forward to setting the record straight about the remaining claims.

Google and U.S. developers find agreement over Google Play store

The Android app economy has helped create nearly two million American jobs; developers around the world have earned more than $120 billion using the Google Play Store. We’re proud that Google Play helps developers build great apps and rewards them for doing so. And we know that a successful ecosystem must benefit both developers and consumers, which is why we have rules of the road to keep the store secure, protect privacy and prevent fraud. While we strive to make Google Play the best platform for everyone, Android also provides consumers and developers the opportunity to use other app store options.

Today, we’re pleased to share a proposed agreement that will help ensure that both developers and consumers can continue to benefit from Google Play. Google and a group of U.S. developers have reached a proposed settlement that allows both parties to move forward and avoids years of uncertain and distracting litigation.

As part of the settlement, we’re establishing a $90 million fund to support U.S. developers who earned two million dollars or less in annual revenue through Google Play during each year from 2016-2021. A vast majority of U.S. developers who earned revenue through Google Play will be eligible to receive money from this fund, if they choose. If the Court approves the settlement, developers that qualify will be notified and allowed to receive a distribution from the fund.

In addition to the fund, we’re committing to maintain a number of existing practices and implement new benefits that help developers innovate and communicate with their users:

  • To continue to provide developers with a tiered pricing model, we’ll maintain Google’s 15% commission rate for the first $1 million in annual revenue earned from the Google Play Store for U.S. developers, which we implemented in 2021.
  • We’re revising our Developer Distribution Agreement to make it clear that developers can continue to use contact information obtained in-app to communicate with users out-of-app, including about subscription offers or lower-cost offerings on a rival app store or the developer’s website.
  • In new versions of Android, Google will maintain certain changes implemented in Android 12 that make it even easier for people to use other app stores on their devices, while being careful not to compromise the safety measures Android has in place.
  • To showcase independent and small startup developers building unique high-quality apps, we’re creating an “Indie Apps Corner” that will appear on the apps tab on the U.S. Google Play homepage and shine a spotlight on these developers.

These commitments, including the $90 million fund, build on a number of ways we already support developers, such as providing tools that help developers build great apps, lower their costs, and grow their businesses. In fact, compared to other prominent digital content stores, we provide developers more ways to interact with their customers.

Finally, we’ve heard developers want to understand more about how Google Play operates, which is why we’ve agreed to publish annual transparency reports. The reports will share information about the Google Play Store, including statistics such as apps removed from Google Play, account terminations, and other data regarding how users interact with Google Play.

We’re pleased that we worked with the developers to propose this agreement for the Court’s approval. As the agreement notes, we remain confident in our arguments and case, but this settlement will avoid protracted and unnecessary litigation with developers, whom we see as vital partners in the Android ecosystem. We remain steadfast in our commitment to building thriving, open platforms that empower consumers and help developers succeed.

Our support for the Economic Opportunity Coalition

A healthy economy exists only when opportunities to participate are open to everyone. Google has long worked to make that possible through efforts such as our Google Career Certificates, the Grow with Google Small Business Fund and our commitment tosupplier diversity. Core to this work is our belief that progress is best achieved when we partner with others to scale these efforts.

Consistent with that approach, today Google is proud to help launch the Economic Opportunity Coalition, a group dedicated to building an equitable economy. Google intends to work alongside others in the public, private and nonprofit sectors to find ways to help close the racial wealth gap in the United States. The Coalition has identified four focus areas: investing in strengthening community finance organizations, supporting entrepreneurship, improving financial health and addressing infrastructure needs, such as affordable housing.

At Google, we have pioneered solutions to these issues and continue to do so. For example, our $100 million Google Career Certificates Fund focuses on Google’s digital skills training program and introduces a new financing model to provide loans and grants to students through Social Finance, a leading national nonprofit in the field of workforce development. Another example is our funding to Opportunity Finance Network to help Community Development Financial Institutions, which provide capital to underserved small businesses.

Our work in this regard contributes to sustainable economic growth, and the efforts of others in the Coalition will amplify our impact. Building a world in which everyone has access to opportunities will help foster more vibrant economic communities, and we look forward to others joining us in the Economic Opportunity Coalition and contributing to this important work.

Our new office is a love letter to Atlanta

Google has been a part of Atlanta for more than 20 years. There are more than 1,000 full-time Google employees in Georgia — in two offices in Atlanta and a data center in Douglas County — helping to build and support our products, and help our partners and customers across the South and nationally.

We recently opened our doors to the newest office space in Midtown Atlanta at the 1105 West Peachtree building. This new Google office encompasses 19 floors spanning 500,000 square feet, and is a part of our broader investment in local communities across the U.S.

Atlanta has a rich civil rights history and is home to top Historically Black Colleges and Universities (HBCUs) and tech talent. Continuing our long-term investment here will help support our Black Googler community in Atlanta, in line with our racial equity commitments.

Inspired by the city’s legacy for social change, our office was designed as an homage to the people of Atlanta, with each floor an ode to Atlanta’s cultural, musical and artistic history. We worked with more than 50 local and diverse companies to design and build the new space, including artwork from more than 20 local artists.

A giant heart outlining the Google Atlanta sign greets you in the lobby. One of the staircases features a rainbow design — in support and celebration of the LGBTQ+ community — inspired by the city’s nearby rainbow crosswalks. The WERD Cafe, our Googler cafeteria, is named for the first Black-owned and programmed U.S. radio station.

Our commitment to Atlanta extends far beyond the walls of our new office. In 2021, Google products helped provide $13.21 billion of economic activity for tens of thousands of Georgia businesses, nonprofits, publishers, creators and developers.

Today, we’re announcing a $1 million commitment to the Urban League of Atlanta to support their work in training underserved communities throughout Georgia. This grant will help jobseekers get digital skills training and place them in high-growth jobs.

On top of this, to bring equitable opportunities to more Georgians, we’re partnering with local community organizations and universities. We’re working with HBCUs like Clark Atlanta University and Spelman College to attract top talent, and partnering with the Technical College System of Georgia to offer Google Career Certificates to 22 colleges across the state at no cost.

Lastly, we are partnering with Mayor Andre Dickens and the Atlanta BeltLine to launch the Atlanta BeltLine Marketplace, an effort to help local Black, Latino and women-owned small businesses reach new customers by retrofitting rail cars into office spaces. We’re providing Wi-Fi for the rail containers, a complete suite of Google Nest products, Chromebooks and free digital skills training.

We look forward to continuing to support and partner with our customers, employees and local communities in Atlanta for years to come.

Our new office is a love letter to Atlanta

Google has been a part of Atlanta for more than 20 years. There are more than 1,000 full-time Google employees in Georgia — in two offices in Atlanta and a data center in Douglas County — helping to build and support our products, and help our partners and customers across the South and nationally.

We recently opened our doors to the newest office space in Midtown Atlanta at the 1105 West Peachtree building. This new Google office encompasses 19 floors spanning 500,000 square feet, and is a part of our broader investment in local communities across the U.S.

Atlanta has a rich civil rights history and is home to top Historically Black Colleges and Universities (HBCUs) and tech talent. Continuing our long-term investment here will help support our Black Googler community in Atlanta, in line with our racial equity commitments.

Inspired by the city’s legacy for social change, our office was designed as an homage to the people of Atlanta, with each floor an ode to Atlanta’s cultural, musical and artistic history. We worked with more than 50 local and diverse companies to design and build the new space, including artwork from more than 20 local artists.

A giant heart outlining the Google Atlanta sign greets you in the lobby. One of the staircases features a rainbow design — in support and celebration of the LGBTQ+ community — inspired by the city’s nearby rainbow crosswalks. The WERD Cafe, our Googler cafeteria, is named for the first Black-owned and programmed U.S. radio station.

Our commitment to Atlanta extends far beyond the walls of our new office. In 2021, Google products helped provide $13.21 billion of economic activity for tens of thousands of Georgia businesses, nonprofits, publishers, creators and developers.

Today, we’re announcing a $1 million commitment to the Urban League of Atlanta to support their work in training underserved communities throughout Georgia. This grant will help jobseekers get digital skills training and place them in high-growth jobs.

On top of this, to bring equitable opportunities to more Georgians, we’re partnering with local community organizations and universities. We’re working with HBCUs like Clark Atlanta University and Spelman College to attract top talent, and partnering with the Technical College System of Georgia to offer Google Career Certificates to 22 colleges across the state at no cost.

Lastly, we are partnering with Mayor Andre Dickens and the Atlanta BeltLine to launch the Atlanta BeltLine Marketplace, an effort to help local Black, Latino and women-owned small businesses reach new customers by retrofitting rail cars into office spaces. We’re providing Wi-Fi for the rail containers, a complete suite of Google Nest products, Chromebooks and free digital skills training.

We look forward to continuing to support and partner with our customers, employees and local communities in Atlanta for years to come.

Transparency in the Shadowy World of Cyberattacks

The following is adapted from remarks delivered by Kent Walker, President of Global Affairs, at the International Conference on Cyber Security 2022on July 19, 2022.

Thank you for the chance to be a part of this important conversation about cybersecurity.

At Google we’re proud to say that we keep more people safe online than anyone else in the world. But that wasn’t always the case.

So let me start by telling you a story about how we got it wrong, and two things we all can learn from that experience. My dad always told me that it was cheapest to learn from the other guy’s mistake. So let me tell you about one of ours.

As some of you may recall, in late 2009, Google was the victim of a major cybersecurity attack, code named Operation Aurora.

We’ve long had some of the most attacked websites in the world. But Aurora was something special.

Aurora was an attack attributed to the Chinese government, a significant security incident that resulted in the theft of intellectual property from Google.

But Aurora wasn’t just any security incident. And it wasn’t just against Google.

As part of our investigation we discovered that several other high-profile companies were similarly targeted. Other companies either hadn’t discovered the attacks, or hadn’t wanted to disclose them. When I was a federal prosecutor specializing in technology crimes, one of the biggest challenges we encountered was getting companies to go public or even come to the authorities.

So we felt it was important to talk about the attack–to tell the world about its impact, the methods of the hackers, and the sectors at risk.

We worked with the US Government to share threat vectors and vulnerabilities.

And we didn’t stop there: After Aurora, we launched an entire team called Project Zero to find and promptly disclose previously undiscovered, zero-day vulnerabilities in our own and other companies’ software, raising the security bar for everyone.

And today, Google’s Threat Analysis Group, or TAG, works to counter a range of persistent threats from government-backed attackers to commercial surveillance vendors to criminal operators. TAG does regular public disclosures of foreign state actor attacks, including doing the difficult work of attribution.

Without giving too much away, I can also tell you that, working with our team at VirusTotal (now called Chronicle), we have some projects in the works that will help us raise awareness of vulnerabilities from around the world. And we’re very excited about our upcoming partnership with Mandiant, one of the world’s premier security teams, to broaden and deepen this work.

So I’d say that the first lasting lesson from the Aurora attack is the need to weave openness and transparency into the fabric of a cybersecurity response. It’s not always comfortable work–we’ve had to have some tough conversations with partners and with our own teams along the way–but it’s necessary to move the industry forward and ensure bugs are getting fixed fast, before they can be exploited in the wild.

In the ensuing years, we’ve developed principles to ensure we can share learnings about vulnerabilities, cyber attacks (such as attacks on elections), and disinformation campaigns responsibly, transparently, and helpfully with the public, with our partners, and with law enforcement.

And the US government has in turn stood up its own process to facilitate more information sharing with industry partners in order to expedite patches that safeguard us all.

But the value of transparency isn’t the only reason I bring up the Aurora story.

Aurora not only taught us the need to embrace transparency, it also taught us a second, and even more important lesson: What works and what doesn’t when it comes to security architecture.

It’s possible to over-index on info sharing alone.

Focusing on the fundamentals of software security is in some ways more important to raise all of us above the level of insecurity we see today.

We curate and use threat intelligence to protect billions of users–and have been doing so for some time. But you need more than intelligence, and you need more than security products–you need secure products.

Security has to be built in, not just bolted on.

Aurora showed us that we (and many in the industry) were doing cybersecurity wrong.

Security back then was often “crunchy on the outside, chewy in the middle.” Great for candy bars, not so great for preventing attacks. We were building high walls to keep bad actors out, but if they got past those walls, they had wide internal access.

The attack helped us recognize that our approach needed to change–that we needed to double down on security by design.

We needed a future-oriented network, one that reflected the openness, flexibility, and interoperability of the internet, and the way people and organizations were already increasingly working.

In short, we knew that we had to redesign security for the Cloud.

So we launched an internal initiative called BeyondCorp, which pioneered the concept of zero trust and defense in depth and allowed every employee to work from untrusted networks without the use of a VPN. Today, organizations around the world are taking this same approach, shifting access controls from the network perimeter to the individual and the data.

If you fast forward to today’s hybrid-cloud environment, zero trust is a must.

At the core of zero trust is the idea that security doesn’t have a defined border. It travels with the user and the data. For example, as the Administration pushes for multi-factor authentication for government systems, we’re automatically enrolling users in two-step verification to confirm it’s really them with a tap on their phone when they sign into our products.

Practically, this means that employees can work from anywhere in the world, accessing the most sensitive internal services and data over the internet, without sacrificing security. It also means that if an attacker does happen to break through defenses, they don’t get carte-blanche to access internal data and services.

The most impactful thing a company, organization, or government can do to defend against cyber-attacks is to upgrade their legacy architecture.

Is it always easy? No, but when you consider that legacy architecture with its millions upon millions of lines of proprietary code, has thousands of bugs, each one a potential vulnerability, it’s worth it.

And beyond replacing existing plumbing, we need to be thinking about the next challenges, and deploying the latest tools.

In the same way the world is racing to upgrade encryption to deal with the threat of quantum decryption, we need to be investing in cutting-edge technologies that will help us keep ahead of increasingly sophisticated threats.

The good news is that cyber-security tools are evolving quickly, from artificial intelligence capabilities, to advanced cryptography, to quantum computing.

If today we talk about security by design, what comes next is security through innovation–security designed with AI and machine learning in mind–designed to counter bad actors using new tools to evade filters, break into encrypted communications, and generate customized phishing emails.

We’ve got some of the best AI work in the business, and we’re testing new approaches and using some of our leading-edge AI tools to detect malware and phishing at scale. AI allows us to see more threats faster, while reducing human error. AI, graph mining, and predictive analytics can dramatically improve our ability to identify and block phishing, malware, abusive apps, and code from malicious websites.

We look forward to sharing more of our findings so that organizations and governments can prepare. After all, this is no time for locking down learnings or successful techniques. Bad actors are not just on the lookout for ways to exploit your unknown vulnerabilities. As with Hafnium and SolarWinds, they are looking for the weak link in the security chain, letting them springboard from one attack to another. A vulnerability at one organization can do damage to entire industries and infrastructures.

Cybersecurity is a team sport, and we all need to get better together, building bridges not just within the security communities, but also between the national security community and academia and Silicon Valley.

Kent Walker speaking on stage

Having started with one story, let me leave you with another—cybersecurity and Russia’s war in Ukraine.

A lot has changed in our approach since Aurora. And perhaps no example illustrates that shift more clearly than our response to the war in Ukraine.

Russia’s invasion sparked, not just a military and economic war, but also a cyber war and an information war. In recent months, we have witnessed a growing number of threat actors– state actors and criminal networks–using the war as a lure in phishing and malware campaigns, embarking on espionage, and attempting to sow disinformation.

But this time, we were ready with a modern infrastructure and a process for monitoring and responding to threats as they happened.

We’ve sent thousands of warnings to users targeted by foreign-state actors–a practice we pioneered after Aurora. And in the vast majority of cases, we’ve blocked the attacks.

We launched Project Shield, bringing not just journalists, but vulnerable websites in Ukraine under Google’s security umbrella against DDOS attacks. While you can DDOS small sites, it turns out that it’s pretty tough to DDOS Google. We disrupted phishing campaigns from Ghostwriter, an actor attributed to Belarus. And we helped the Ukrainian government modernize its cyber infrastructure, helping fortify it against attack.

We are proud that we were the first company to receive the Ukrainian government’s special peace prize in recognition of these efforts.

But the work is far from done.

Even now, we’re seeing reports that the Kremlin could be planning to ratchet up attacks and coordinated disinformation campaigns across Eastern Europe and beyond in an attempt to divide and destabilize Western support for Ukraine. In fact, just today, our TAG team published a new report on activity from a threat group linked to Russia’s Federal Security Service, the FSB, and threat actors using phishing emails to target government and defense officials, politicians, NGOs, think tanks, and journalists.

And, looking beyond Russia and Ukraine, we see rising threats from Iran, China, and North Korea.

Google is a proud American company, committed to the defense of democracy and the safety and security of people around the world.

And we believe cybersecurity is one of the most important issues we face.

It’s why we invested $10 billion over the next five years to strengthen cybersecurity, including expanding zero-trust programs, helping secure the software supply chain, and enhancing open-source security.

It’s why we’ve just created a new division–Google Public Sector–focused on supporting work with the US government. And it’s why we are always open to new partnerships and projects with the public sector.

In recent years, we’ve worked with the FBI’s Foreign Influence Taskforce to identify and counter align foreign influence operations targeting the U.S. We’ve worked with the NSA’s Cybersecurity Collaboration Center. And we’ve joined the Joint Cyber Defense Collaborative to help protect critical infrastructure and improve collective responses to incidents on a national scale.

Getting our whole digital economy on the front foot is essential. And there’s some encouraging progress. For example, we were glad to see last week’s Cyber Safety Review Board report deeply investigating the log4j vulnerability and making important recommendations about how to improve the ecosystem.

We need more of that.

Looking ahead, our collective ability to prevent cyber attacks will come, not only from transparency, but from a commitment to shoring up our defenses — moving away from legacy technology, modernizing infrastructure, and investing in cutting-edge tools to spot and stop tomorrow’s challenges.

We can’t beat tomorrow’s threats with yesterday’s tools. We need collective action to shore up our digital defenses. But by drawing on America’s collective abilities and advantages, we can achieve a higher level of collective security for all of us.

Thank you.

Source: The Keyword


Google and the Global Cross Border Privacy Rules

The value and convenience of the global internet relies upon the free flow of information across borders: collaborating with global colleagues, speaking with a loved one via Google Meet, finding directions to the closest pharmacy on Google Maps, or finding and buying everyday items online. Global data flows make these daily activities work seamlessly, and support the health and growth of the modern digital economy and the opportunity it promises for users around the world.

As governments explore new rules governing data transferred abroad, there is an unprecedented need for global, interoperable solutions. Companies, governments, and policymakers must work together to create new legal and technical tools, set out interoperability standards, and most importantly, align on new frameworks to maintain both privacy and essential data flows.

One of these global solutions is the recently announced Global Cross Border Privacy Rules (CBPR), a privacy certification that will allow companies to demonstrate their compliance with government-approved requirements for data protection, backed by a review of those protections by a third-party. The Global CBPR system is an important step toward enabling continued, trusted data flows between participating jurisdictions, and Google is committing to certifying under the future Global CBPR system.

How collaboration will help ensure the future of data flows

When governments announced the formation of the Global CBPR Forum earlier this year, designed to oversee the Global CBPR system, Google was honored to participate in the first meeting along with representatives from 20 jurisdictions. What we shared and heard from the governments at the Forum was a desire to solve the problem of trusted data flows together.

At the Global CBPR Forum, industry players and government representatives sounded a clear call for the certification program to find the right balance between holding companies accountable for their data use, protecting individuals from harm and misuse, and helping maintain the trust within the ecosystem that enables innovation and change, all while being globally scalable.

The Global CBPR system advances efforts to protect the digital ecosystem from fragmentation, which would come at a cost to access to information as well as opportunities and livelihoods for people around the world. This is a critical moment for governments to work with industry and other stakeholders to stabilize the regulatory landscape so that companies can confidently offer products and services that rely on international data flows without compromising privacy protections. The Global CBPR system is one step towards that clarity and security.

Next steps for Google and the Global CBPR system

Our investment in privacy and security is at the core of every product we build. We will bring this experience to the conversation to help build a robust Global CBPR system. We will work with our partners to provide input through the Global CBPR Forum on the practical realities of services facing fragmented privacy regulations. This global fragmentation is a challenge for any business, especially for small and medium-sized enterprises (SMEs) who often don’t have the resources to navigate a patchwork of laws. We also encourage the governments of the Global CBPR Forum to work with academics and civil society to understand how to make CBPR requirements scalable and able to bridge divergent legal requirements and cultural expectations of privacy.

We are also committed to finding ways to help and support Google customers to certify to this global standard, especially among small and medium enterprises. This kind of support will help scale these key privacy protections to more users, strengthening the businesses of our customers. We will continue to look for ways in the future to support participation in the US and globally in the CBPRs to raise privacy protections for users around the world.

The creation of the Global CBPR Forum is part of a global conversation on bringing strong, interoperable privacy protections to our users and the users of countless other companies around the world. We look forward to the Global CBPR Forum establishing new requirements and will certify to the system at the first opportunity.

Source: The Keyword