In the aftermath, when everything had been started to recover and people had more or
less tidied up and the stock markets had started to recover from the trillions of dollars wiped
off them,
Google's network engineers said that were only five people in the world who are able
to approve changes to their most critical code.
And each one of those five was entirely trusted.
July 4th. In Western Europe, it is Friday afternoon, and office workers are looking
at their clocks and trying to work out if it's okay to leave work early.
In America, they are gearing up for a three-day Independence Day weekend.
Over at Google's headquarters in Mountain View, most of the building is deserted; on-call
engineers are either at home, their phones ready to buzz if anything goes wrong, or they're
pulling late-night shifts in datacentres located around the world.
There is one well-lit office, though, hidden away in a quiet corner of the building. In
it is Maria Christensen, one of Google's most senior engineers and one of the Trusted Five.
She is, against all corporate procedure, rolling out a change to Google's core infrastructure
code.
She's changed only one section: and it's the very first part of the login code for Google
Apps. This should be an incredibly complicated function that spins off more functions to
deal with checking passwords, two-factor authentication, third-party password checks, suspicious activity,
hackers, phreakers, fraudsters, and all manner of disaster prevention.
She's changed just one line of code, she's put it at the top, and it says...
Return true.
She bypasses all the red flags from the software that say this won't work, this is dangerous,
this is broken, and instead she marks it for immediate rollout and commits it.
So Google's systems promptly roll it out across their datacentres. From coast to coast in
North America; over to Dublin and over to Europe; to the Far East and down to South
America. It takes about three minutes. And what it means is this:
No matter what you enter as a Google password, it will be treated as correct. There are no
password checks any more. If you type in the username, you will get in.
And if this seems implausible, if this seems like something that wouldn't happen, remember
Dropbox, the file hosting service used by 175 million people including, I'm fairly sure,
pretty much everyone in this room.
In 2011, they had exactly that security bug for three hours. Now fortunately, the person
who discovered it -- who wasn't a Dropbox employee -- disclosed it responsibly to them
instead of telling the world, so the damage was limited.
Maria has no intention of responsibly disclosing anything. Most of the engineers that would
get notified of a code change like that aren't on call. And those that are have somewhere
between about one and three minutes before Maria gets around to logging into their now
open Google accounts -- never mind the email notification, they've got about three minutes
to, read it, understand it, and grasp exactly what the change means before Maria logs in
and remotely wipes their Android phone by reporting it as stolen.
None of the engineers work it out in time. The rest of Google's Trusted Five are still
asleep as their phones quietly erase themselves.
So then Maria emails her manifesto to dozens of news sites, posts messages on a few high-traffic
tech forums, then logs out -- which is ironic, given that logging out doesn't actually mean
anything any more -- gets into her car, and goes to catch a flight.
As soon as the first journalist tests it successfully, the news goes ballistic. The first place to
break it of all the web, was oddly the Drudge Report: and they said later that it was because
they didn't use Gmail themselves, and didn't really get it, and just went with the story
rather than immediately going to protect themselves.
'Cos that's what most people did. In the hours that followed, people tended to fall into
one of three groups:
First of all, the defenders. Desperately trying to lock down their accounts, desperately trying
to delete anything that might be incriminating, and to stop all their other accounts getting
compromised.
Because, remember, if you have access to someone's email address, then you have access to every
web service they use -- because they can request a password reset sent straight to your inbox.
How good you were at being a defender generally depended on how good you were at getting all
your other accounts moved away from that compromised address.
Of course, even the folks who were initially smug that they didn't use Gmail realised that
other people they emailed did.
Facebook was the first big web service to react, quickly enough that most commentators
suggested they actually had a plan in place for this years before. Within a few minutes
of the story breaking, Facebook turned off not just password resets but the ability to
log in at all, on the assumption that most people would have their accounts compromised,
so they just turned it off. And since nearly everyone was already logged in on their phone
and their computer, Facebook rapidly became *the* trusted method to contacting anyone
-- and that was a new level of trust that stuck around afterwards as folks looked warily
at email.
Then there were the amateur detectives. Those that suspected that their partner was cheating
on them. Those that were desperate to find out what their colleagues were earning, or
what their boss really thought of them. It wasn't restricted to email, of course; because
if you have access to someone's Google account, in most cases you have access to their full
search history and all the web sites they've clicked on. For years, and years, and years.
Have you turned it off? Most people in this room haven't. It was described by one writer
as "like looking into my wife's soul". And the divorce rate had a notable uptick a few
months later.
Meanwhile, companies using Gmail, or companies working with companies that used Gmail, just
had to assume that all their trade secrets had been stolen: in the years to come, patent
and trademark lawyers would make an enormous amount of money as allegations flew back and
forth between corporations.
Now the European stock markets, the only ones open on July 4th at that time, went into freefall
almost immediately; the Asian and American ones would do the same when they opened the
next Monday.
But the most obvious group, if not the largest, were the burners. Everyone who had any sort
of prominent online presence got their account destroyed, utterly destroyed, within ten minutes.
Any YouTube channel with any sort of audience found all its work deleted and vandalised,
even worse than the new comment system that YouTube had brought in. Some burners attacked
individual people thoroughly, hoping to wipe everything as part of a vendetta; but others...
others just tried to destroy as much data as they could from as many people as they
could as quickly as possible.
Google, of course, had backups. They did roll everything back -- but a lot of third-party
sites, vulnerable through password resets, weren't anywhere near so lucky.
(LAUGHTER)
Every blog with more than a few readers got crude messages added to it, or code that redirected
to shock sites, or just torn apart and destroyed. A huge number had no usable backups. This
was the final death knell for most third-party web message boards, the old ones which had
been falling out of use for years and years. As soon as one administrator account fell,
the whole site was quickly destroyed. And not many of those ever recovered because not
many of them had backups.
Some things did work in favour of the "good guys". First of all, the enormous rush of
traffic -- of people trying to fix and break things meant that even Google couldn't quite
cope with the load: a lot of folks were frustrated by slow loading times and falling servers.
But thirty minutes in, at least some of Google's network engineers had worked out what was
going on and pulled the plug -- in one case physically, literally pulling plug from data
centres and uncontrollably shutting down everything they could. Someone finally managed to get
an actual shutdown command into the systems that Maria had compromised about two hours
afterwards, and three minutes later, Google fell off the internet for the first time in
a very, very long while.
In amongst this two hours of mess, this pandemonium, were the people that Maria Christensen was
actually trying to reach. She was hoping to be the next Chelsea Manning, the next Julian
Assange, the next Edward Snowden. More than that: she was hoping to create a hundred,
a thousand, a million people taking that whistleblower role, using the brief hours of "freedom" she'd
created to change the world for the better. That was her manifesto:
Go out. Find the things that need to be leaked, go through the files of the corporations and
governments that are destroying our world, and show them the light of day.
Her view was woefully optimistic. And yes, some people did. There were thousands of leaks,
some of international importance: a few people remembered the Obama transition team, after
the 2008 election, used Gmail until they could get their official whitehouse.gov email addresses
set up. And there were stories of billionaire fashion CEOs putting stories about sweatshops
and burying them; stories of mining companies exploiting workers and exposing them to incredible
danger; tale after tale after tale of people putting aside human concerns and -- this phrase
got used a lot -- acting in the best interests of shareholders.
But none of those stories made the news.
Because what Maria Christensen hadn't done was manage the story. Wikileaks and its allies
always had: they'd drip-fed the stories over months into a 24-hour news cycle that always
wanted more, more, more, but instead...
In this case, though, the story was about the process, not about the information. The
angle that all the news took was that email was suddenly insecure, that you were at risk,
that you should defend against it and this is how you do it, that web sites are being
damaged, and that this is how you protect yourself, and watch us because we will help
you.
So there were no stunning revelations plastered on the front pages. There should have been,
given an infinite number of front pages, but there were, simply, too many stories, and
all of them were much less interesting to the public than the question of whether your
partner has seen your browser history.
And of course, for most people, there was no long-term damage, at least not to them
personally. Statistically speaking, you'd get away with it. And sure, everyone knew
someone who'd been affected, everyone knew someone who'd got in trouble, but chances
are that you, yourself, had gotten away with it. And while a lot of high-profile companies
suffered slightly, there were no world-changing moments. If dumping untold gallons of oil
into the Gulf couldn't kill BP: what could? So most small businesses survived unscathed
and the economy recovered, slowly, having been damaged no more than by any natural disaster.
And Gmail, a year later, had just as many active users as before. Because, after all,
what were the odds of that ever happening again? And it's not like the government couldn't
read all your messages anyway. And no-one really got hurt in the long run, and maybe
it was for the best that me and her broke up, y'know? It all works out in the end. And
besides, it would be a real pain to try to switch my email account somewhere else. I'd
have to change my email address!
It's amazing how much we trust to single points of failure. And while this is a worst-case
scenario -- very much so -- everyone here will have that one lynchpin on which everything,
at least in your online life, hangs. That backup you haven't taken for a while. The
email account that you forgot had access to everything. Or that password that your ex
still knows.
But my point is this: even in the face of seeming disaster, when the world is falling
around you, you remember that eventually, this too shall pass. Because it takes more
than just one single point of failure to change the world.
Oh, and as for Maria Christensen? She got arrested at the airport, after her flight
was delayed... because the airline ran on Google Apps.
Thank you very much, I've been Tom Scott, enjoy the rest of the show.
[Translating these subtitles? Add your name here!]