Google and Operation Aurora
“Business Ethics”

Group
Angela Fisriza
Anita Christiani Sigiro
Suryadi
Williem

Faculty of Economics and Business
Master of Management
Universitas Gadjah Mada
2014
Google and Operation Aurora I. Introduction
In a competitive business world, there are two practices to win the competition which so-called competitive intelligence and industrial espionage. In competitive intelligence, a business entity legally gathers information by examining corporate publications, websites, patent filings and the like, to determine its activities. For the same reason, in industrial espionage, it steals trade secrets by removing, copying, or recording of confidential or valuable information in a competing company.
Industrial espionage describes hidden activities, such as the theft of trade secrets, bribery, blackmail and technological surveillance. Industrial espionage is most commonly associated with technology-heavy industries, particularly the computer and auto sectors, in which a significant amount of money is spent on research and development (R&D).
One of the most notable industrial espionage is “Operation Aurora” which took place in 2009 when some parties hacked Google China operation, stealing intellectual property and, in particular, accessing the email accounts of human rights activists. II. Brief Explanation
Operation Aurora was a cyber attack conducted by advanced persistent threats, such as Elderwood Group that based in Beijing China. Elderwood Group was the digital arms dealer that was used against Google, operating since 2009, when Titan was hit. The Elderwood supplier has frequently been linked to the 2009 attacks. Elderwood used against a large number of industries, including defense, technology and human rights organizations, throughout 2014 and before. Some researchers believe that attack code has been sold to cyber espionage hackers since 2009.
The name Operation Aurora itself was given by Dmitri Alperovitch, Vice President of threat research at cyber Security Company in McAfee. Based on McAfee’s research on cyber attack, it found that aurora was part of the file path on the attacker’s machine. This was included in two of the malware binaries. George Kurtz, the chief technology officer of McAfee once mentions in his blog that McAfee believe the name was the internal name the attacker/s gave to this operation.
On the 12nd of January 2010, Google revealed on its blog that they had been attack. The attack occurred in mid December and originated from China. Google said that the attack was reviewing its business in China. The next day, January 13rd, the news agency reported that U.S congress plans to investigate Google’s allegations that the Chinese government used to spy on human right activists.
McAfee as an American global computer security software said that the main goal of the attack was not money, but to gain access to and potentially modify source code repositories at high tech, security and defense contractor companies. By the high used of technology such as banks, shopping, and even communication, it might be possible for the cyber attack. Google stated that over 20 other companies had been attacked and other sources said more than 34 organizations were targeted. The hacker successes in stilling intellectual property from companies with the used of the security gap in Internet Explorer. The target for this operation not only companies, but also Chinese opposition figures.
The other evidence including IP addresses, domain names, malware signatures and other factors, showed that Elderwood was behind the Operation Aurora. One of numerous attacks conducted by the Elderwood gang and others such as PLA Unit 61398, a Shanghai-based advanced persistent threat group also called "Comment Crew", named after the technique often used by the group involving internal software "comment" features on web pages, which are used to infiltrate target computers that access the sites. III. Consideration of Ethical Matter It is unethical because in this case, there is a violation in the privacy, intellectual property rights, and human rights. The attackers took certain data in illegal ways and used it for their own personal interests in unethical ways. By the help of an insider in Google and the government of China, the criminal stole the data and violated the system to gain important information. According to John Locke, intellectual property should be treated like private property. Meaning that, when an organization or individual create a software program, then it should be treated as a private property. When stealing or using data without permission, they are violating property rights. IV. Stakeholders
There were three classifications of stakeholders in this case, suspects, victims, and others. For suspects, parties such as Elderwood, Beijing Group, and People’s Liberation Army came into mind. Elderwood and People’s Liberation Army were on the same side which attacked Google in 2009. The attackers used various server addresses in which located in China, Taiwan, Texas, and Illinois. Elderwood was revealed after technical evidences such as IP addresses, malware signature, and others show that this group was behind Operation Aurora.

Figure 1. Stakeholders in Operation Aurora Symantec and McAfee were two security companies which tried to identify the problem. According to Symantec, the primary targets were companies in the defense industry supply chain. The Elderwood attacked target towards intellectual property systematically. Meanwhile, McAfee stated that the primary goal of the attack was to gain access to source code repositories at high tech, security, and defense contractor companies. Google, after the attack, planned to operate a completely uncensored version of its search engine in China. Later on, it closed its offices in Mainland and departed to Hong Kong. V. Business Ethics Theories
In Operation Aurora case, we try to evaluate the morality of the violation by using theory of Kantianism, utilitarianism, and social contract. We choose these theories because in these theories the moral principles of individuals can be defined by using logical reasoning. The rational perspective of this case can be approached to consider the moral judgment by modern society standards with these theories.
Kant’s theory is based on moral principle called categorical imperative. It emphasizes that everyone should be treated equally to everyone else. It means that everyone has the same moral right to such treatment and to treat others in the same way. Kant attempted to show that there are certain moral rights and duties that all human beings possess regardless of any utilitarian benefits that the exercise of those rights and duties may provide for others. Kant’s version of the categorical imperative is following the principle:
“An action is morally right for a person in a certain situation if, and only if, the person’s reason for carrying out the action is a reason that he or she would be willing to have every person to act on the person in any similar situation.”
In Kant’s analysis, human beings have a clear interest in being free from injury or fraud and in being free to think, have privacy, and associate with whomever they choose. Kant’s moral principles imply that everyone should be free of the interference of others in these areas. That is, human beings have these negative rights: the right to freedom from injury or fraud, freedom of thought, freedom of association, freedom of speech, and the right to privacy. From the perspective of Kantianism we can conclude that spying the privacy of individuals in terms of communication (email privacy in this case) and private property information is immoral and unethical in society and business as well.
Utilitarian have proposed an important and influential alternative version of utilitarianism to deal with critics of traditional utilitarianism called rule-utilitarianism. The basic strategy of the rule-utilitarian is to limit utilitarian analysis to the evaluations of moral rules. According to the rule-utilitarian, when trying to determine whether the a particular action is ethical, one is never supposed to ask whether that particular action will produce the greatest amount of utility. Instead, one is supposed to ask whether the action is required by the correct moral rules that everyone should follow. According to the rule-utilitarian, the correct moral rule is the one that would produce the greatest amount of utility for everyone affected. In Operation Aurora, there were larger losses in the companies targeted compared to the amount of benefit gained by the attacker. Therefore, we can conclude that according to the rule-utilitarian perspective, this kind of action is unethical.
Social contract theory offered the concept that morality is based on rules describing how individuals are supposed to treat one to another. Rational individuals will accept certain rules if everyone else also follows those rules for mutual benefit. There are also some principles in the social contract stated that people have the right to freedom of speech, freedom of association, the right to be safe from harm, and the right to own property. In Operation Aurora case, the attacker violated one of the principles of the social contract theory which is the right to own property. Because the attacker did not respect the property ownership of the original authors, this action can be considered as an unethical conduct under the social contract theory. VI. Alternative Actions by Google Following the Operation Aurora attack, Google demanded an explanation from Chinese government which denied its involvement in the action. Due to this unsatisfactory follow up, Google then cancelled its censored search results policy, shut down its office in Mainland, China, and moved its operation to Hong Kong. However, there were several alternatives Google could take to solve the problems, either it was legally or illegally.
It was possible for Google to strike back the suspects, such as Elderwood and Beijing Group. Another possible action was to negotiate with China government about the agreement on censorship and security in its services. Google could reserve the right to strike back any parties who potentially attack Google in the future. VII. Recommendation Google can make preventive action in human resource and security. In human resource, Google should improve the quality of screening and recruiting the employees. It has to make sure that the selected employees loyal and have integrity as the complementary for the technical and managerial expertise. It is important since this procedure will minimize the likelihood the employees harm Google by selling sensitive information to other parties. In security, empowering antimalware software is a necessity. If needed, Google could cooperate with security provider to strengthen its security system. Governments of the countries potential to be the victims can make a whitelist (a list of software which are safe to use). The list functions as a guide for computer users to check the security level of software. The list should be updated regularly to cope with the rapid development of software. For internet users, they should be wiser in using the Internet. Safety in internet usage becomes critical nowadays. Safety internet actions can take form such as increasing the level of password security, changing the passwords periodically, and update the browser and antivirus software regularly, particularly for office application and others which commonly connected to the Internet.
References:
Investopedia, Industrial Espionage definition, URL: http://www.investopedia.com/terms/ i/industrial-espionage.asp, accessed May 28, 2014.
Brewster, Tom (2014), Is Elderwood the digital arms dealer that fuelled attacks on Google?. URL: http://www.theguardian.com/technology/2014/may/15/ elderwood-digital-arms-dealer-google, accessed May 27, 2014.
Harvey, Mike (January 16, 2010), China accused of cyber attack on Google and ‘global industrial targets’, URL: http://www.thetimes.co.uk/tto/technology/ article1859862.ece, accessed May 28, 2014.
Velasques, Manuel G. (2012), Business Ethics: Concepts and Cases, Seventh Edition, Pearson Education Limited, London.
VivaNews (2010), Serangan Cyber Terbesar Sepanjang Sejarah, URL: http://teknologi.news.viva.co.id/news/read/193494-serangan-cyber-terbesar-sepanjang-sejarah, accessed May 28, 2014.
Zampaglione, Aaron (2011), Intellectual Property and Cyber Threat. URL: http://www.azampagl.com/docs/intellectual-property-and-the-cyber-threat_aaron-zampaglione.pdf, accessed May 27, 2014.