EMBARGOED FOR PUBLICATION UNTIL 10AM EDT, 09/26/2018

September 24, 2018

Senator John Thune, Chairman

Senator Bill Nelson, Ranking Member
Committee on Commerce, Science, and Transportation
512 Dirksen Senate Building
Washington, D.C. 20510
Via email

Dear Members of the Senate Commerce Committee:

Senator Thune set the tone for the upcoming hearing by stating that “Consumers deserve
clear answers and standards on data privacy protection.” Given the scale and social
impact of the technical systems being deployed by Google and other corporations, I
would add that greater oversight and accountability of not only data, but also the systems
that are designed and deployed based on such data, is urgently needed.
Until the beginning of this month, I worked in Google’s Research and Machine Intelli-
gence division as a Senior Research Scientist, where one of my primary responsibilities
was improving Google’s search accuracy across a wide variety of languages.
I was compelled to resign my position on August 31, 2018, in the wake of a pattern
of unethical and unaccountable decision making from company leadership. This cul-
minated in their refusal to disclose information about Project Dragonfly, a version of
Google Search tailored to the censorship and surveillance demands of the Chinese
government. Like most of the world, including most Google employees, I learned about
this effort on August 1, 2018, from public reporting.
It is notable that Project Dragonfly was well underway at the time the company released
its AI Principles. As has been widely understood, by human rights organizations,
investigative reporters, Google employees, and the public, Project Dragonfly directly
contradicts the AI Principles’ commitment to not “design or deploy” any technology
whose purpose “contravenes widely accepted principles of [...] human rights”.
Some of the most disturbing components of Project Dragonfly, which I here directly
verify, include:

• A prototype interface designed to allow a Chinese joint venture company to

search for a given user’s search queries based on their phone number.
• An extensive censorship blacklist developed in accordance with Chinese govern-
ment demands. Among others, it contained the English term ‘human rights’, the
Mandarin terms for ‘student protest’ and ‘Nobel prize’, and very large numbers
of phrases involving ‘Xi Jinping’ and other members of the CCP.
• Explicit code to ensure only Chinese government-approved air quality data would
be returned in response to Chinese users’ search.
• A catastrophic failure of the internal privacy review process, which one of the
reviewers characterized as actively subverted.1

Each of these details was internally escalated by other employees to no avail, and many
of them were discussed extensively on internal mailing lists; I understand that such
discussion has since been increasingly stifled. I cannot speak for those who escalated
these concerns, but I share their fear of the possible consequences.

1 Thisprivacy review process developed inside Google following years of privacy failures, including the
collection of payload Wi-Fi data and registering users for the Google Buzz product without their consent.
With this in mind, I would like to point The Committee’s attention to the 2011 settlement Google made with
the FTC to: (1) submit to an independent review of its privacy practices every two years, (2) receive consent
from users anytime its services change in a manner that results in sharing more information, and (3) establish
and maintain a “comprehensive privacy program” for the next 20 years. Cf. https://arstechnica.com/tech-
policy/2011/03/google-agrees-to-new-privacy-rules-as-part-of-buzz-settlement/

1
 EMBARGOED FOR PUBLICATION UNTIL 10AM EDT, 09/26/2018

I am part of a growing movement in the tech industry advocating for more transparency,
oversight, and accountability for the systems we build. The primary goals are laid
out in the Google Ethics Code Yellow Petition, which not only continues to circulate
throughout Google but has also been endorsed by 14 human rights organizations and
several technology experts.
I humbly ask that The Committee on Commerce, Science, and Transportation call on
Google’s representative for the hearing, Mr. Keith Enright, to respond to the sincere
and credible concerns of the coalition of 14 human rights organizations who drafted an
August 28th Open Letter To Google. I also ask the committee to inquire about how
Google is meeting its commitments to privacy under its own AI Principles and the
Global Network Initiative, of which Google is a member.
Dragonfly is part of a broad pattern of unaccountable decision making across the tech
industry. It has been made clear, both by word and by action, that the leadership at
Google will be clamping down on the types of internal investigation that were necessary
to bring Project Dragonfly to light. I would hope that The Committee would help protect
the environment needed for future whistleblowers by taking steps to guarantee ethical
transparency and oversight across Silicon Valley.

Sincerely,

/S/ Dr. Jack Poulson