Go Google. Thank you for putting your $$$ where your values are and for valuing human freedom over fascism. Pull out of China!

Why can’t China just make up their own Google type company if they want to restrict stuff from the public? Why do they need Google at all, except to hook up with outside information?

Max Hailperin:
There is apparently some evidence to the contrary.

Some interesting quotes from the linked article:

Dan Kaminsky, director of penetration testing at IOActive whose research has helped improve the security of the Internet infrastructure, predicted the attacks would prompt references to a Digital Pearl Harbor.

“I don’t know how accurate or how fair that is but certainly something of note has occurred that has not occurred in previous years,” he said.

“I think everybody is surprised by the utterly unambiguous response,” Kaminsky added. “This definitely is ‘shot heard round the world’ territory, at least in our [security] community.”

I agree with Kaminsky. I host several servers in a data center, and can attest that attacks are commonplace and relentless.

“Something big” has probably happened for Google to react so categorically.

Max Hailperin: If, and this is a big if, this scenario is correct (that the initial entry point for the various security breaches was the black-list upload service)…

There is apparently some evidence to the contrary.

I don’t think it’s as simple as that. Having google in China greatly increased the amount of information available to the public. Pulling out only hurts the chinese public without affecting their overall revenues all that much. It’s unfortunate that they might have to pull out, but I have met some of the Chinese google people, and they have a high regard for balancing the public’s access to information and the government’s desire to restrict it. Overall, they felt it better to be there as a presence for openness, limited though it is.

Progress in restrictive countries like this isn’t made by turning our backs upon them, but by engaging them in world commerce and having them realize that they need to play by the same rules as everyone else if they want to advance in the world.

DaveM: Reading between the lines of the Google blog post (some technical guesses): [1] It sounds like google realized that attacks against the Gmail accounts of Chinese dissidents was being launched from inside google’s own Chinese servers. [2] Hijacking google’s own servers could probably only be done by the Chinese government, or at least with its active assistance. [3] Therefore, to allow operations in China is to expose the internal google network to attack by the Chinese government. … The only safe option may be to pull out.

I too had been wondering whether there was a technical rather than merely tit-for-tat connection between the security breach and the change in Google’s operations in China. Even if there is, I think DaveM’s speculation is a bit off base. Although he presents the chain of reasoning that I numbered [1], [2], [3] as running in the forward (deductive) direction, it really worked backwards (inductively) for him; from the observation [3], he was speculating upon [1] and [2]. So the reasoning only is even inductively correct if item [3], the starting point, is a correct observation. But item [3] is incorrect; Google did not say it was pulling out of China, but rather that it was going to talk with China about whether it could stay on an uncensored basis; it would pull out if not.

As such, if there is any technical connection, it can’t be with the mere presence in China, but rather with the censoring. For example, suppose Google has supported that censoring by giving the Chinese government a private means for uploading the “black list” of items for Google to censor. Suppose that that private means had some vulnerability, in which by sending an appropriately crafted message on that connection, the Chinese government could breach the security of that specific Google server. Once that specific server running the black-list upload service was breached, it could be used as a starting point for a chain of other actions breaching the perhaps weaker security barriers within Google’s networks, and eventually even moving outbound from Google to conduct unrelated industrial espionage at other US companies.

If, and this is a big if, this scenario is correct (that the initial entry point for the various security breaches was the black-list upload service), then presumably Google would immediately have patched that particular vulnerability and conducted a security audit to try and make sure there weren’t other vulnerabilities on that channel — hence their stated willingness to talk with China over a period of weeks about how they are going to move forward. (I am assuming, though it isn’t explicit in the Google blog post, that during this period of weeks, the censorship is continuing as usual.)

But, continuing with the big if, Google wouldn’t have stopped with just tightening the security on that private black-list-uploading back door that they gave the Chinese government. They would be asking themselves, should we continue to give these guys a back door at all, however tightly controlled? Isn’t that just playing cat and mouse with them and asking for continued, more sophisticated, trouble? That line of reasoning (coupled with the non-technical dimensions) could explain the decision to move away from the censoring. They would effectively be saying: if you want to break in, you’re going to need to do it through the same interfaces as we expose to all other attackers.

Also the fact can’t be ignored that google was unable to cope with Baidu. Its better to loose either business or ethics. Google if stayed more, must have definitely lost both of it. Now at least the ETHICS are intact.

Google also runs top100.cn, which is the world’s best source for free and legal MP3s from bigname international artists.

- It sounds like google realized that attacks against the Gmail accounts of Chinese dissidents was being launched from inside google’s own Chinese servers.

- Hijacking google’s own servers could probably only be done by the Chinese government, or at least with its active assistance.

- Therefore, to allow operations in China is to expose the internal google network to attack by the Chinese government. Google guards its “secret sauces” very, very carefully. Their search algorithms are highly proprietary. But there’s no fighting City Hall. The only safe option may be to pull out.

Sounds sad, but DON’T think the same thing can’t happen here; it already has. AT&T reportedly lets the US government scan every byte of data that is transmitted over the Internet backbone. If the US government were as hostile as China’s, google would have to pull out of here, too.

Lior: Until they remove .cn sites from their index (which I think they should), “pulling out of China” is basically an empty gesture.The location of their business units after all is mostly a choice-of-law issue, not related to the actual search experience.

That’s not quite right. Having Chinese servers with Chinese IP addresses and a .cn domain is an improved experience for Chinese users. Google made a forecast on how much uptime they would have if they created a Chinese subsidiary, compared it to the forecast on how much uptime regular google.com would have in China (as perceived from China), and made a decision towards what they believed would be better reliability. It hasn’t turned out to be as good as they’d hoped.

And as for other people saying that “Oh Google wasn’t doing too hot in China anyway; they only controlled 30% of the search market” are missing the point. China is a rapidly growing economy and will probably become the world’s largest economy someday, and being a significant player in that market is worth something. It doesn’t cost Google much on the margins to operate in China – but this move could be potentially costly in revenue loss. This move doesn’t make short term (or even medium term) business sense, but it might be valuable signaling to many different players in the game and help Google long-term. Or it might not.

Steve: China may have a billion people, but if they don’t have a lot of income to spend, it’s hard to make a lot of money. Google can’t achieve the advertising revenue shareholders expect and the Chinese market exposes to company to excess risk.

If Google isn’t getting the advertising revenue it wants, it’s probably because of the dominance of Baidu. I can tell you that if you go to a high-end restaurant or a high-margin business like Starbucks or a name-brand retail store, it isn’t going to be empty and most of the patrons will be Chinese. The kinds of people who use the internet a lot in China are probably the ones with higher-than-average disposable income. There is a lot of money to be made by targeting the people with money in China.

Originally I was optimistic, because I love the idea of a company with the clout of Google possibly nudging the Chinese government towards a more open country. Great PR stunt, as the Steve above notes (no relation).

I’m still hopeful, but not optimistic. China brings thousands of new eyes to the Internet daily, and while many of those new eyes don’t have the purchasing power of Americans, as a collective they’re pretty strong. Google ditched a very large market that’s growing at a rate we envy.

Shang Hai Information Technologies.