Google's Elite Hacker Swat Team Vs. Everyone

Brash. Controversial. A guard against rising digital threats around the globe. Google’s project zero is securing the internet on its own terms. Is that a problem? 

- Robert Hackett

ONE FRIDAY AFTERNOON IN FEBRUARY, Tavis Ormandy, a virtuosic security researcher with a brown buzz cut and an uneasy smile, was performing some routine “fuzzing”, a common code-testing technique that blasts software with random data to expose faults, at his desk at Google headquarters in Mountain View, California. The process was going as expected when he spotted something amiss in the data set. Weird, he thought. This isn’t typical corrupted data. Instead of the expected output, he saw bizarrely configured anomalies—strange chunks of memory strewn about. So he dug deeper.

After assembling enough information, Ormandy called his fellow security researchers into a huddle to share what he had found. The Google team, which goes by the name Project Zero, soon realised what it was looking at: a wide-ranging data leak spouting from a San Francisco company called Cloud flare. Most of the time, Cloud flare’s content-delivery network processes roughly a tenth of the world’s Internet traffic without a hitch. But Ormandy had discovered that the company’s servers were splattering people’s private data across the web. The information had been leaking for months.

Ormandy didn’t know anyone at Cloud flare, and he was hesitant to cold-call its generic support line so late in the day ahead of a three-day weekend. So he did the next best thing he could think of. Ormandy took to Twitter to appeal to the tens of thousands of people who follow him there.

Could someone from Cloud flare security urgently contact me

The time stamp was 5:11 p.m. Pacific Time. Ormandy did not bother to alert the company’s