Responsibly disrupting cyber-enabled counterterrorism operations

The ethics of private sector discovery of vulnerabilities exploited ‘in-the-wild’ – outside a laboratory or research environment – are complex. A June 2024 opinion piece re-ignited a debate about a 2021 incident when Google was blamed for compromising a long-running counterterrorism operation of a Western intelligence service.

The Google zero-day incident

In January 2021, Google’s Project Zero and Threat Analysis Group (TAG) teams published an ‘In-the-Wild Series’. The report documented a series of vulnerabilities and exploitation techniques they had discovered at the beginning of 2020.

The report described a threat actor who used two full-chain attacks – a combination of vulnerability exploits chained together by executing them in succession to bypass all of the security measures present on a device, usually intending to compromise it to install malware. Both exploited Google’s Chrome browser for initial access. At the time of the discovery, one of the exploited Chrome vulnerabilities was a ‘zero-day,’ a vulnerability unknown to Google and thus without a patch available. This initial report did not focus on the vulnerabilities discovered but examined the exploit techniques used.

Two months later, in March 2023, Google’s Project Zero released another report detailing additional activity, discovered in October 2020, by the same actor. This time Google chose not to provide significant context on the exploitation techniques discovered. Instead, it briefly described them as ‘novel’ and ‘sophisticated’. This follow-up report also noted that, after Google patched a Chrome vulnerability, it was immediately replaced with an exploit for another Chrome vulnerability, demonstrating that the threat actor had planned for this eventuality.

Ethics of vulnerability hunting

Unlike the field of Advanced Persistent Threat (APT) malware research, ‘in-the-wild’ vulnerability exploitation hunting has largely avoided a discussion of the ethical dilemmas that might arise from this kind of work. APT research has been compared to intelligence brokerage or counterintelligence. This has resulted in a collection of informal guidelines and proposed norms for threat actors and security companies – enabling a delicate balancing act between the companies’ duty to protect their customers and the methods used to meet this duty.

In contrast, most discussions of vulnerability exploitation hunting skip ethical considerations and aim to ‘make zero-day hard’. That is, increase the cost of discovering and exploiting unknown vulnerabilities so it is out of reach for most threat actors. To achieve this goal, vulnerabilities should be discovered, disclosed, mitigated and patched, using whatever means necessary, on the hunter’s terms. Google’s ‘In-the-Wild Series’ and the surrounding controversy offer a rare opportunity to advance the ethics of in-the-wild vulnerability exploitation hunting, similar to the debate around APT research.

Nuanced decisions

A central and often repeated point in the discussion around Google’s conduct in this case is that patching vulnerabilities exploited in the wild is the only right thing to do, even if doing so threatens responsible use of that exploit. However, the reality is more complex, in five ways.

First, it is not clear that Google’s vulnerability patching ‘shut down’ a cyber operation. The threat actor appeared to have a mitigation plan, including ready-to-use exploits for additional vulnerabilities. Patching vulnerabilities does not necessarily stop operations that are using them, both because the availability of a patch does not immediately prevent further exploitation and because resourceful threat actors can find and exploit additional vulnerabilities.

Second, vulnerabilities are often discovered separately by different actors. Even if the threat actor detected by Google acted responsibly, other less responsible actors might be exploiting the same vulnerability. Fixing vulnerabilities as soon as they are discovered limits potential additional harm.

Third, how you report vulnerabilities matters. The ‘In-the-Wild Series’ focuses on the tactics, techniques, and procedures (TTPs) of exploitation used. This serves Project Zero’s goal of ‘making zero-day hard’ by describing attacker techniques defenders should try to mitigate. However, in a departure from common practice, Google chose to withhold all indicators of activity, such as malware hashes, IP addresses, or domain names used. This decision prevents other cyber security vendors from following up or detecting this activity or its targets becoming aware they have been targeted.

Besides omitting what is often seen as necessary information, Google described at length the amount of engineering effort that the threat actor put into preventing unintended consequences from using the exploits. This description provides little value for defenders, but it can be seen as calling out and even promoting responsible behaviour. Google also applauded the threat actor for targeting the appropriate devices with the minimally required exploits – again echoing commonly proposed norms of responsible behaviour.

Fourth, although we don’t know how Google initially discovered the exploitation, we know that Google actively monitored and probed relevant sites and servers to extract additional exploits successfully. This suggests that Google had enough insight to circumvent exactly the threat actor’s targeting mechanisms it previously applauded. 

Google’s control of popular software, such as the Chrome browser and the Android operating system, give it a significant advantage to in-the-wild vulnerability exploitation hunting. No APT or intelligence agency has capabilities similar to Google; indeed, some such actors went to great lengths to get access to those capabilities.

Finally, the March follow-up reporting should be viewed in a different light than the initial ‘In-the-Wild Series’. Although the initial discovery was largely due to Google’s Project Zero and TAG teams’ technical pedigree, the follow-up appears to have been the result of an operational security failure by the threat actor. Despite earlier indications of the threat actor’s responsible behaviour, Google’s use of this incident to discover additional exploits and thus further disrupt this campaign might be viewed as a debatable ethical decision.

The bigger picture

Google made non-trivial ethical decisions in this matter. The firm is a major stakeholder in internet governance and, as such, in the security of cyberspace. If one subscribes to the notion of multistakeholder internet governance, then Google, along with other Big Tech companies and a wide variety of private sector entities,  should make decisions responsibly – in an accountable, calibrated, transparent and inclusive manner.

Google’s initial response, given its duty to protect its customers, seems to have been a well-calibrated decision in response to the responsible behaviour they discovered. On the contrary, the follow-up report seems to have been less well-calibrated. It arguably does not demonstrate accountable and transparent decision-making, ultimately undermining the overall goal of reducing harm.