[desert soundscape]
[♪ dramatic music ♪]
[Narrator] Lookout.
Guardian.
Sentry.
In every mob of meerkats, there's always one watcher.
While others are burrowing for food,
one stands at the highest point possible
and scans the horizon,
a machine built to watch.
Their long tail creates a tripod to rest on.
Dark patches around their eyes reduce the sun's glare.
A clear membrane keeps the dust out.
And Inside? A panoramic view of the surrounding desert.
They're looking for anomalies
in a landscape they know better than anyone.
A shadow that moves faster than it should.
A rock.
A zebra.
Or something more dangerous.
And as soon as they spot a potential threat,
they raise the alarm.
[predator shrieks, meerkat barks]
A signal for the rest to run for cover.
[♪ dramatic music ♪]
Crisis averted, thanks to the lookout.
When we’re faced with threats,
we rely on watchers too.
In the dark.
In the ocean.
In the mountains.
There have always been those who watch out
to protect the rest.
But who's looking out for the threats lurking online,
when you can't hear, feel or smell them?
Thankfully, there are watchers there too.
Those who stare out at the horizon
waiting for something to move.
[♪ anthemic music ♪]
When it's your job to keep billions of people safe online,
you have to live and breathe and see the internet
just like the attackers do.
Because the only way to stop a hacker
is to think like one.
This is Shane Huntley.
Before working at Google,
Shane worked in a much different professional setting.
[Director] What exactly did you do
in Australian intelligence?
[Shane] I really can't get into that.
[Narrator] So how did an intelligence expert
end up at Google?
Well, unlike most professional origin stories,
this one starts on vacation.
[♪ rousing music ♪, traffic buzzing]
[Shane] It was early 2010.
I was backpacking around India at the time,
and I was at this internet cafe and pulled up the news,
and there's all these articles
about something called Operation Aurora.
I was like, "Wow!"
I was in the government,
and we knew all this stuff was going on,
but none of the victims were ever willing
to talk about it before this time.
[Narrator] Meanwhile, 7,500 miles away
in reaction to Operation Aurora,
seismic shifts were taking place
in how Google handled security.
New technologies,
new network architectures,
new industry standards,
new t-shirts,
new mouse pads,
but most importantly,
new hires.
[Heather] As a security engineer, at the time,
if you were not working for a government
or a contractor for a government,
you might have never been exposed to
these kinds of sophisticated attacks.
We realized that we needed to create specialty teams
to do specialty parts of the job,
including a group who studies these hackers full-time,
nation state adversaries in particular,
to prevent attackers like that from being successful.
[Narrator] Which explains why a certain specialist
on vacation in India got a message like this.
[Shane] "Hey, Shane,
I'm starting this new team at Google.
Do you wanna move to California and do that?"
And soon after, I was coming over
to start this Threat Analysis Group and haven't looked back.
The primary job of threat analysis
is to understand the attackers so we can counter them
and we can protect our users from them.
[Toni] We're dark wizard catchers.
There's a lot of people on the internet
that are trying to do bad things
It's our job to stop them.
By understanding who those attackers are
and how they operate,
we're able to apply that information to stop attacks.
[Shane] So today, we track over 270 different threat actors
around the globe.
These are government backed threats,
but also financially motivated threats,
which is cybercrime,
ransomware,
and we also track disinformation threats—
coordinated groups trying to run disinformation campaigns
for malicious ends.
[Narrator] The Threat Analysis Group
is commonly referred to by its acronym,
T.A.G.
The nickname is appropriate,
considering how T.A.G. hunts down
and, well, tags malicious actors and their techniques.
So security teams across all of Google and beyond
can forge defenses and responses
even before an attack takes place.
Their smarts have helped prevent dangerous junk
from popping up in your personal email
and have helped keep trade secrets locked down
at Fortune 500 companies.
They've helped trace a mystery supervirus to its perpetrators
and have helped protect organizations
from local canasta groups to national campaigns.
[Shane speaking indistinctly]
T.A.G. hasn't always had the impact that it has today,
but everybody has to start somewhere.
[Shane] I managed to join Google
the week after the very last thing of Aurora.
It was like hundreds of people there weeks before
to work through the Aurora attack.
But when I started,
there were only like 10 of us in the building,
and I'm turning up all like, bright-eyed,
having gone through my Google training,
like, "Okay, what are we gonna do?
How many pieces of malware do we have?"
[bell dings] "Five."
Okay, "How many threat groups do we know about?"
[bell dings] "One."
Okay, so green fields.
We were somewhat starting from scratch.
[Narrator] The team worked with what they had.
They analyzed,
they hunted,
they staffed up with new experts
like Toni here.
[Toni] Yep.
[Narrator] They built out dossiers on threat actors
and reports on attack strategies
but the team's greatest strength
didn't come from new technology,
but something that Google had been working on
since its inception.
[Shane] We have, surprise, surprise,
a really great search engine software.
[♪ dramatic music ♪]
[Narrator] To make that search engine run,
Google downloads the entirety of the public-facing internet
to its data centers.
The good
and the bad.
From there, the dangerous sites
and content are generally flagged
before they ever reach your results page.
But that doesn't mean they're useless.
These bits of bad content are exactly
what the T.A.G. team is looking for.
[Shane] The things that need to be blocked.
[Toni] Exploits.
[Shane] Software that needs to be fixed.
[Toni] Phishing messages.
[Shane] Almost every piece of malicious software
that exists anywhere on the internet.
We can see what they do when they run.
We can, like, look at what's inside them.
This is something which would, for anyone else,
I don't know how they'd build it, or it would take decades.
But for us, it's sort of just lying around
in the Search team, and we're able to use that sort of scale
and technology for our mission as well.
[Shane speaking indistinctly]
So one of the things that we do in T.A.G.
is we actually take a copy of the search engine software,
and we feed in every piece of malicious software
that we've run across on the internet, and then we index it.
So we have our own version of Google Search
just for searching through malicious software.
And this is valuable
because even when attackers try very hard to evade,
there's always some signatures of what they're doing
and some ability to link things together.
And a great example is
what we did with a piece of ransomware called WannaCry.
[Reporter] It's being called the WannaCry attack.
[Reporter 2 speaking in Spanish] Malware WannaCry.
[Reporter 3] WannaCry.
[Reporter 4] Ransomware has been around for a long time,
but WannaCry is different.
[Narrator] WannaCry was the biggest
ransomware attack in history.
It's a pervasive type of attack
where hackers hold victims' computers hostage.
In a single day, WannaCry infected over 200,000 computers
in 150 countries,
crippling major institutions
like banks, universities and even bringing
Britain's National Health Service to a standstill.
[Shane] It was being sent out everywhere.
It was causing all of this damage,
but nobody knew who was behind it.
[Narrator] In the same way, you might reverse image search
to see where a picture came from
the team took the malware
and plugged it into their search engine.
[Shane] 'Cause we'd run these billions of pieces of software
and looked at them all,
we can really drill down
and find what's related depending on how it behaves,
what accounts they're using to set up to upload.
There's all these details down to like the lowest level
of specifically how this one snippet of code is being used.
By looking at those details, we're able to find
that one link that was able to determine
that it wasn't somebody just trying to steal money.
It was the North Korean government.
[White House Staffer] After careful investigation,
the United States is publicly attributing
the massive WannaCry cyber attack to North Korea.
We do not make this allegation lightly.
We do so with evidence, and we do so with partners.
[Shane] We used to think about intelligence services
or country versus country.
But now, often we actually see country versus individual
or country versus company.
We certainly want to defend
against Google, itself, getting hacked.
What we really see that's much more common
is attackers coming after our users.
Day to day, we are trying to be the people that stand
between the attackers and you, to keep you safe.
[Narrator] Identifying and tracking adversaries
is an important part of T.A.G.'s mission.
But the most critical is learning from these bad actors
to build better defenses.
Something Camille Stewart Gloster
knows a thing or two about.
For three years she worked to ensure that Google Products
evolved to stay ahead of the threat landscape.
[Camille] All of the work happening
across the various Google Security teams
directly supports safer Google products.
The intelligence that T.A.G. sends to different products
allows them to be more resilient.
[Toni] So it's not just about the whack-a-mole
of stopping an individual campaign.
It's being able to turn around to Gmail.
[Shane] Chrome or YouTube.
[Toni] Or Google Drive and say, "Hey, if we address this,
we can eliminate an entire class of attacks
and protect all these users."
[Narrator] So what exactly are they addressing?
All the techniques attackers use
to go after Google's products and their users.
[Toni] Yeah, so there's so many different ways
to try and get around our defenses.
One of the most common that we see is phishing.
[♪ 'Fishing Pole' by Andy Griffith ♪]
♪ Well now take down your fishing pole ♪
♪ and meet me at the fishing hole. ♪
♪ We may not get a bite all day ♪
♪ but don't you rush away. ♪
[Narrator] Phishing, it's the kind of attack
where bad actors email, call or text
to try and trick you into clicking on malicious links
or handing over identifying information,
passwords or credit card numbers.
It's a type of attack
that many of us are all too familiar with.
[Toni] Attackers are gonna prey
on whatever they think people will click on.
So whether that's...
[Camille] Threats.
[Shane] Money.
[Toni] A salacious bit of gossip.
[Shane] Fear is a big one.
[Toni] So when the pandemic started,
we saw a huge uptick in targeting around COVID-19.
[Camille] As citizens,
we were all looking for information
and likely ready to consume anything
that might provide some clarity.
[Narrator] This became
the ideal strike zone for attackers:
preying on people's fear and confusion
around the pandemic to capture their clicks,
leveraging phony details to private personal information
and to pedal sham vaccines and treatments.
[Toni] There's a lot of money to be made.
So you have this explosion
driven by criminal motivations.
How do we protect users from the scope
And the scale of these types of attacks?
And a huge part of it is making sure
it never makes it to your inbox.
[Narrator] Inside Gmail's code are filters
built in to block over 100 malicious messages every second.
[Camille] If Google wasn't catching
all of that malicious activity—
the spam, phishing and malware—
your inbox would essentially be a field of landmines.
[Narrator] This mine sweeping is accomplished
through a web of smart filters
that evolve and reorient based on the threats of the day.
[Camille] They not only block things,
but they learn from everything they block.
They are leveraging the intelligence
from the T.A.G. team
to pull from your inbox
99.9% of the threats.
[Shane] I think what keeps me up at night
is just what's at stake for some people.
[Toni] Gmail has over a billion users.
We have to secure everyone.
And certainly there are people
who have a bigger risk profile than most.
That's politicians,
that's other government employees,
that's journalists, civil society—
All these people are targets that we have to protect.
[Narrator] In most cases,
the first step in being protected
is knowing you might be a potential target.
[Shane] We actually tell every single user
that's targeted by a government-backed threat.
We put a big warning at the top of their Gmail
or other service to let them know that.
[Toni] We've stopped this type of attempt.
We blocked it.
But we want you to know that this is happening.
[Shane] Some people think this would be really rare,
but actually like, over the course of a year,
we actually warn around 36,000 different users
that they're targeted by some government or another.
[Narrator] There's perhaps no greater concentration
of foreign nation state targets in the US
than in the government.
Just ask Michael Kaiser. [clapperboard claps]
He's the head of Defending Digital Campaigns,
a group dedicated to providing cybersecurity resources
to campaign officials on the national stage.
[Michael] There are folks in this world
who would not like to see democracy succeed.
Bad actors who are trying to influence an outcome
or make the process look less legitimate.
And campaigns would be a target of those people.
[Shane] We don't run any election infrastructure.
We don't build software for voting machines,
but we do have candidates and political figures
that use our services, such as Gmail.
They use our phones.
And we do see that there are hostile actors
that are trying to interfere with the political system
of not just US elections, but elections worldwide.
[Toni] One of the things that's so difficult about this
is that political campaigns
in a lot of ways are a pickup game.
[Michael] So who is part of a campaign?
Well, you have staffers.
You probably have volunteers.
You have the candidate,
and then you have people like the candidate's family.
Close friends, confidants,
all these people are connected to the campaign.
We believe that anyone associated
with a campaign is at higher risk.
[Toni] Even if I'm an intern,
if they can compromise my account,
that gives the attacker a foothold
into the campaign's network.
It's not enough to sort of draw a fence around the people
that you see on the front page of the newspaper.
The reality is you have to secure everyone.
[Narrator] After all its years in business,
Google has learned a thing or two
about protecting large groups of people
and has used those learnings
to create something called The Advanced Protection Program.
[Toni] Advanced Protection Program is open to any user.
It's very similar to what Google does
with its own employees, and it works.
And basically what it requires is two-factor authentication.
That makes your account a lot more secure
because it means that an attacker,
even if they've managed to figure out your password,
they can't get into your account.
[Michael] If you have two-factor authentication,
your account pretty much becomes un-phishable.
[Toni] It tremendously cuts down on the amount of risk
from all of these corners of the internet.
[Shane] Protecting the democratic system
is a fundamental thing
that keeps me enthused about my job
and makes me proud of what we do in our team.
This is some of our most high priority work
and something that we really take very seriously.
[girl shouts joyously]
[subway humming]
[Narrator] The problems
that the Threat Analysis Group monitors
may seem larger than life.
Most of us have enough to manage
without having to worry about nation states
and cyber criminals
encroaching on our accounts.
[Shane] Over the last decade,
the actors have got a lot better about what they do,
and they've had to because of teams like T.A.G..
We haven't made their life easy.
And this is valuable
because the more effort they have to expand,
the safer the users are.
[Narrator] Each innovation created from T.A.G.'s insights
makes it a little more expensive to target users.
So although there are new attackers
entering the game all the time,
the table stakes to get to Google users
are often entirely out of their reach.
[Shane] I'm in this battle not because I believe we'll lose.
I'm in this battle because I believe we can win.
We may not win 100% of the time,
but we can make a lot more people a lot more secure
and prevent a lot of attacks.
[Toni] That's what we're here for
is to take that weight off of our users' shoulders.
We want you to use two-factor authentication
and not click on suspicious links.
Leave the rest to us. [laughs]
[♪ anthemic music ♪]
[Matt] We’re a lot like the 911 system.
A 24-hour, 7 day a week force
against whatever it is that we’re facing.
[Fatima] Right now,
there are thousands of attacks being launched against Google.
[Shane] We started seeing
North Korea targeting security researchers,
fake social media profiles.
[Toni] One of the last people you want having
their hands on this kind of information
is the North Korean government.
[Fatima] We might have to burn it all down
and start from scratch.
[Matt] I love it.
[laughs]