Hm it's hard to believe these incidents were so long ago. They were very big news at the time, but I can understand that many people have never heard of them,

Hm it's hard to believe these incidents were so long ago. They were very big news at the time, but I can understand that many people have never heard of them, or forgot. I'm reading the recent book This Is How They Tell Me the World Ends, which reviews all these incidents. I recommend it for anyone working in software! Google isn't the main focus of the book, and it comes off looking significantly better than our government ... ---- (1) China hacked Google in 2009, probably through sending phishing e-mails to employees, and was inside for months: https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora Apparently they were looking for the gmail accounts of political enemies, and one way to do that is just to hack the whole company ... This led to two-factor authentication, and many more security measures. (2) Snowden's leaks showed that the NSA hacked Google by tapping underwater cables, which at the time were full of unencrypted traffic: https://www.theverge.com/2013/10/30/5046958/nsa-secretly-taps-into-google-yahoo-networks-to-collect-information https://www.theverge.com/2013/10/30/5046958/nsa-secretly-tap... The motive was basically to collect all data in the world so we could hypothetically find out about the next 9/11. (3) Here's a 2010 era account of a Google employee who was fired for stalking with his work credentials: https://www.gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://www.gawker.com/5637234/gcreep-google-engineer-stalke... ---- So even if you're a big successful company, you're not likely to defend against the two most powerful governments in the world hacking you. (And this is OUTSIDE all the information you're compelled to reveal by law!) Google did change many things in response to these incidents (like hiring hundreds of security engineers, Project Zero, etc.), but this is evidence of the point. If you collect a lot of valuable data, then you will need to spend a lot of money securing it, and you'll probably get hacked to some degree anyway. Also it might be worthwhile to look at past Hacker News discussions on these topics: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=aurora%20google&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://news.ycombinator.com/item?id=1054791 https://news.ycombinator.com/item?id=1054791 https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=google%20nsa&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... https://news.ycombinator.com/item?id=6641378 https://news.ycombinator.com/item?id=6641378