Google Shut Out Privacy and Security Teams From Secret China Project

The secrecy surrounding the work was unheard of at Google. It was not unusual for planned new products to be closely guarded ahead of launch. But this time was different. The objective, code-named Dragonfly, was to build a search engine for China that would censor broad categories of information about human rights, democracy, and peaceful protest.

In February 2017, during one of the first group meetings about Dragonfly at Google’s Mountain View headquarters in California, some of those present were left stunned by what they heard. Senior executives disclosed that the search system’s infrastructure would be reliant upon a Chinese partner company with data centers likely in Beijing or Shanghai.

Locating core parts of the search system on the Chinese mainland meant that people’s search records would be easily accessible to China’s authoritarian government, which has broad surveillance powers that it routinely deploys to target activists, journalists, and political opponents.

Yonatan Zunger, then a 14-year veteran of Google and one of the leading engineers at the company, was among a small group who had been asked to work on Dragonfly. He was present at some of the early meetings and said he pointed out to executives managing the project that Chinese people could be at risk of interrogation or detention if they were found to have used Google to seek out information banned by the government.

Scott Beaumont, Google’s head of operations in China and one of the key architects of Dragonfly, did not view Zunger’s concerns as significant enough to merit a change of course, according to four people who worked on the project. Beaumont and other executives then shut out members of the company’s security and privacy team from key meetings about the search engine, the four people said, and tried to sideline a privacy review of the plan that sought to address potential human rights abuses.

Zunger — who left his position at Google last year — is one of the four people who spoke to The Intercept for this story. He is the first person with direct involvement in Dragonfly to go on the record about the project. The other three who spoke to The Intercept are still employed by Google and agreed to share information on the condition of anonymity because they were not authorized to talk to the media. Their accounts provide extraordinary insight into how Google bosses worked to suppress employee criticism of the censored search engine and reveal deep fractures inside the company over the China plan dating back almost two years.

Google’s leadership considered Dragonfly so sensitive that they would often communicate only verbally about it and would not take written notes during high-level meetings to reduce the paper trail, two sources said. Only a few hundred of Google’s 88,000 workforce were briefed about the censorship plan. Some engineers and other staff who were informed about the project were told that they risked losing their jobs if they dared to discuss it with colleagues who were themselves not working on Dragonfly.

“They [leadership] were determined to prevent leaks about Dragonfly from spreading through the company,” said a current Google employee with knowledge of the project. “Their biggest fear was that internal opposition would slow our operations.”

Google’s Senior Vice President of Engineering John Giannandrea speaks onstage during TechCrunch Disrupt SF 2017 at Pier 48 on Sept. 19, 2017 in San Francisco, Calif.

In 2016, a handful of Google executives — including CEO Sundar Pichai and former search chief John Giannandrea — began discussing a blueprint for the censored search engine. But it was not until early 2017 that engineers were brought on board to begin developing a prototype of the platform. The search engine was designed to comply with the strict censorship regime imposed by China’s ruling Communist Party, blacklisting thousands of words and phrases, including terms such as “human rights,” “student protest,” and “Nobel Prize.” It was developed as an app for Android and iOS devices, and would link people’s search records to their personal cellphone number and track their location. (Giannandrea could not be reached for comment.)

The company managed to keep the plan secret for more than 18 months — until The Intercept disclosed it in August. Subsequently, a coalition of 14 leading human rights groups, including Amnesty International and Human Rights Watch, condemned the censored search engine, which they said could result in Google “directly contributing to, or [becoming] complicit in, human rights violations.” Employees who opposed the censorship staged protests inside the company. Meanwhile, a bipartisan group of U.S. senators called Dragonfly “deeply troubling,” and Vice President Mike Pence demanded that Google “immediately end” its development.

Google employees who had worked on Dragonfly watched the furor unfold and were not surprised by the backlash. Many of the concerns raised by the human rights groups, they noted, had already been voiced inside the company prior to the public exposure of the plans, though they had been brushed aside by management.

Every new product or service that Google develops must be reviewed by legal, privacy, and security teams, who try to identify any potential issues or problems ahead of the launch. But with Dragonfly, the normal procedure was not followed: Company executives appeared intent on watering down the privacy review, according to the four people who worked on the project.

In January 2017, Zunger, the 14-year veteran engineer at the company, had been tasked with producing the privacy review. However, it quickly became apparent to him that his job was not going to be easy. His work was opposed from the outset by Beaumont, Google’s top executive for China and Korea.

Many of the concerns raised by human rights groups had already been voiced inside the company and been brushed aside by management.

Beaumont, a British citizen, began his career in 1994 as an analyst for an investment bank in England and later founded his own company called Refresh Mobile, which developed apps for smartphones. He joined Google in 2009, working from London as director of the company’s partnerships in Europe, Asia and the Middle East. In 2013, Beaumont relocated to China to head Google’s operations there. He described himself in his LinkedIn biography as a “technology optimist” who cares about “the value and responsible use of technology in a range of fields.”

According to Zunger, Beaumont “wanted the privacy review [of Dragonfly] to be pro forma and thought it should defer entirely to his views of what the product ought to be. He did not feel that the security, privacy, and legal teams should be able to question his product decisions, and maintained an openly adversarial relationship with them — quite outside the Google norm.”

Three sources independently corroborated Zunger’s account. Beaumont did not respond to multiple requests for comment, and Google declined to answer questions for this story.

During one meeting, Zunger recalled, Beaumont was briefed on aspects of Dragonfly that Google’s privacy and security teams planned to assess. He was told that the teams wanted to check whether the Chinese search system would be secure against state and non-state hackers, whether users in China would have control over their own data, and whether there may have been any aspects of the system that might cause users to unintentionally disclose information about themselves.

“I don’t know if I want you asking those questions,” Beaumont retorted, according to Zunger, who said the comment was “quite surprising to those in the room.”

Beaumont micromanaged the project and ensured that discussions about Dragonfly and access to documents about it were tightly controlled. “Different teams on the Dragonfly project were actively segmented off from one another and discouraged from communicating, except via Scott’s own team, even about technical issues,” said Zunger.

This was “highly unusual,” according to Zunger. Normally, even for extremely confidential work inside the company, he said, there would be “open and regular communication within a project, all the way up to senior leadership.”

“The project, as it was then specified, was not something I could sign off on in good conscience.”

With Dragonfly, the opposite was true. The restrictions around the project limited the ability for discussion and seemed intended “to prevent internal objections,” Zunger said. Some members of the Dragonfly team were told that if they broke the strict confidentiality rules, then their contracts at Google would be terminated, according to three sources.

Despite facing resistance, the privacy and security teams — which together included a total of between six and eight people — proceeded with their work.

Zunger and his colleagues produced a privacy report that highlighted problematic scenarios that could arise once the censored search engine launched in China. The report, which contained more than a dozen pages, concluded that Google would be expected to function in China as part of the ruling Communist Party’s authoritarian system of policing and surveillance. It added that, unlike in Europe or North America, in China it would be difficult, if not impossible, for Google to legally push back against government requests, refuse to build systems specifically for surveillance, or even notify people of how their data may be used.

Zunger had planned to share the privacy report and discuss its findings during a meeting with the company’s senior leadership, including CEO Sundar Pichai. But the meeting was repeatedly postponed. When the meeting did finally take place, in late June 2017, Zunger and members of Google’s security team were not notified, so they missed it and did not attend. Zunger felt that this was a deliberate attempt to exclude them.

Sundar Pichai speaks at the New York Times DealBook conference on Nov. 1, 2018 in New York City.

By this point, Zunger had already decided to leave Google, due to a job offer he had received from Humu, a startup company co-founded by Laszlo Bock, Google’s former head of human resources, and Wayne Crosby, Google’s former director of engineering. Had Zunger not received the offer to join Humu when he did, he said, he would likely have ended up resigning in protest from Google over Dragonfly.

“The project, as it was then specified, was not something I could sign off on in good conscience,” he told The Intercept.

Zunger does not know what happened to the privacy report after he left Google. He said Google still has time to address the problems he and his colleagues identified, and he hopes that the company will “end up with a Project Dragonfly that does something genuinely positive and valuable for the ordinary people of China.”

Google launched a censored search engine in China in 2006 but stopped operating the service in the country in 2010, saying it could no longer tolerate Chinese government efforts to limit free speech, block websites, and hack activists’ Gmail accounts. At that time, Google co-founder Sergey Brin had advocated inside the company to pull out of China because he was uncomfortable with the level of government censorship and surveillance. The “key issue,” Brin said, was to show that Google was “opposing censorship and speaking out for the freedom of political dissent.”

The Dragonfly revelations prompted questions about whether Brin had dramatically reversed his views on censorship in China. But in a meeting with Google employees in August, Brin claimed that he knew nothing about Dragonfly until The Intercept exposed it.

According to three sources, employees working on Dragonfly were told by Beaumont, the company’s China chief, that Brin had met with senior Chinese government officials and had told them of his desire to re-enter the Chinese market, obeying local laws as necessary.

Scott Beaumont, president of Google Greater China, delivers a speech during the opening ceremony of the Future of Go Summit in Jiaxing, China, on May 23, 2017.

However, the Dragonfly teams were instructed that they were not permitted to discuss the issue directly with Brin or other members of Google’s senior leadership team, including Pichai, co-founder Larry Page, and legal chief Kent Walker.

Two sources working on Dragonfly believed that Beaumont may have misrepresented Brin’s position in an attempt to reassure the employees working on Dragonfly that the effort was fully supported at the highest levels of the company, when that may not have been the truth.

“How much did Sergey know? I am guessing very little,” said one source, “because I think Scott [Beaumont] went to great lengths to ensure that was the case.”

Inside Google, a deep ideological divide has developed over Dragonfly. On one side are those who view themselves as aligned with Google’s founding values, advocating internet freedom, openness, and democracy. On the other side are those who believe that the company should prioritize growth of the business and expansion into new markets, even if doing so means making compromises on issues like internet censorship and surveillance.

Pichai, who became Google’s CEO in 2015, has made it clear where he stands. He has strongly backed Dragonfly and spoken of his desire for the company to return to China and serve the country’s people.

In October, Pichai publicly defended the plan for the censored search engine for the first time, though he tried to play down the significance of the project, portraying it as an “experiment” and adding that it remained unclear whether the company “would or could” eventually launch it in China.

Staff working on Dragonfly were confused by Pichai’s comments. They had been told to prepare the search engine for launch between January and April 2019, or sooner. The main barrier to launch, the employees were told, was the ongoing U.S. trade war with China, which had slowed down negotiations with government officials in Beijing, whose approval Google required to roll out the platform in the country.

“What Pichai said [about Dragonfly being an experiment] was ultimately horse shit,” said one Google source with knowledge of the project. “This was run with 100 percent intention of launch from day one. He was just trying to walk back a delicate political situation.”

“What Pichai said was ultimately horse shit.”

The launch plan was outlined during a July meeting for employees who were working on Dragonfly. The company’s search chief, Ben Gomes, instructed engineers to get the search engine ready to be “brought off the shelf and quickly deployed.”

Beaumont told employees in the same meeting that he was pleased with how things were developing for the company in the country, according to a previously undisclosed transcript of his comments obtained by The Intercept.

“There has been a really positive change in tone towards Google during [Pichai’s] recent visits” to China, Beaumont said. “Part of our task over the past few years has been to re-establish that Google can be a trusted operator in China. And we’ve really seen a pleasing turnaround, relatively recently in the last couple of years. We are fairly confident that, outside of the trade discussions, there is a positive consensus across government entities to allow Google to re-engage in China.”

A few weeks later, details about Dragonfly were emblazoned across international newspapers and the internet, and the company was scrambling to contain the outpouring of internal and external protest. Beaumont was furious that information about the project had leaked, said two sources familiar with his thinking, and he told colleagues that he feared the disclosures may have scuppered the prospect of Google launching the platform in the short term.

“[Beaumont’s] endgame was very simple — his ideal circumstance was that most people would find out about this project the day it launched,” said one Google source. “He wanted to make sure there would be no opportunity for any internal or external resistance to Dragonfly, but he failed.”