Top Google Security Staff Warn Search Data Could Be Hacked if EU Rules Change

Google’s top privacy and security staff have warned that plans in Europe, designed to get it to open up its search data and Android operating system to competitors, could lead to people’s search queries being hacked and an increase in cybercrime across the content, according to multiple interviews and documents shared with WIRED.

Mountain View’s alarm comes as European Commission officials are set to make final decisions next month in two cases, around Google Search and Android interoperability, under the European Union’s landmark Digital Markets Act competition rules. The rules, which were first adopted at the end of 2022, are designed to force open Big Tech companies that dominate markets, make it easier for others to compete, and reduce reliance on a handful of firms.

Heather Adkins, Google’s vice president of security engineering and a founding member of its security team, says the company has concerns around the proposed changes for both Search and Android. In April, the European Commission published initial details, plus now-closed public consultations, on how Google should open up its search data—sharing anonymized search data with rivals—and allowing other AI services to have more access to the Android operating system.

“If implemented as described today, I think within a short period of time on Android, we’d see a significant increase in fraud in the EU,” Adkins tells WIRED. “The fraudsters are creative and informed. Past implementation [date], I would give it maybe weeks before we began to see an increase in fraud in Europe.”

Meanwhile, Adkins also claims the proposed changes to Google Search could result in people’s search queries being de-anonymized by bad actors and search data shared with small companies being a target for criminal hackers.

The European Commission’s proposals are complex, impact technical systems with billions of users, and are steeped in the continent’s competition laws. As European officials’ deadline of July 27 for announcing its final decisions approaches, Google has been increasingly vocal in its opposition to the parts of the plans it does not believe will work. Some Google competitors, who could benefit from accessing the data, say the plans have less privacy and security impacts than has been suggested.

These competitors, independent researchers, and academics who have responded to the consultations have pointed out how Europe’s plans could work and also potential flaws with them. Rebuttals and counter rebuttals have been issued as competition law collides with privacy impacts. Spokespeople for the European Commission acknowledged WIRED’s request for comment but did not respond to questions about Google’s concerns.

Since the end of 2022, the Digital Markets Act has allowed European officials to designate tech companies that have large market shares as “gatekeepers” and use the rules to get them to open up their systems and data to competitors. Google parent company Alphabet, Amazon, Apple, Booking, ByteDance, Meta, and Microsoft are all considered gatekeepers, with their products—from LinkedIn and TikTok to Instagram and YouTube—being subject to the rules.

Google’s search business, which is estimated to make up 90 percent of the worldwide search market, is, unsurprisingly, the only search engine that includes the rules. Under the DMA, Google already shares some data with search engine competitors; however, the planned changes alter how this would work.

The plans broadly say Google should provide online search engines with access to search data “on par” with the data that Google itself collects, including “any query input” people enter into Google Search plus some other metadata. Put simply: what people type into Google. It will also have to share click data and the ranking results of search queries. “This is a unique data set which only Google has had access to for many, many years, and there’s not a straightforward way for any other competitor to build or obtain access to something similar,” says Alissa Cooper, the executive director of the tech policy research hub the Knight-Georgetown Institute.