Top Google Security Staff Warn Search Data Could Be Hacked if EU Rules Change

Google’s top privacy and security staff have warned that plans in Europe, designed to get it to open up its search data and Android operating system to competitors, could lead to people’s search queries being hacked and an increase in cybercrime across the content, according to multiple interviews and documents shared with WIRED.

Mountain View’s alarm comes as European Commission officials are set to make final decisions next month in two cases, around Google Search and Android interoperability, under the European Union’s landmark Digital Markets Act competition rules. The rules, which were first adopted at the end of 2022, are designed to force open Big Tech companies that dominate markets , make it easier for others to compete, and reduce reliance on a handful of firms .

Heather Adkins, Google’s vice president of security engineering and a founding member of its security team, says the company has concerns around the proposed changes for both Search and Android. In April, the European Commission published initial details, plus now-closed public consultations, on how Google should open up its search data —sharing anonymized search data with rivals—and allowing other AI services to have more access to the Android operating system.

“If implemented as described today, I think within a short period of time on Android, we’d see a significant increase in fraud in the EU,” Adkins tells WIRED. “The fraudsters are creative and informed. Past implementation [date], I would give it maybe weeks before we began to see an increase in fraud in Europe.”

Meanwhile, Adkins also claims the proposed changes to Google Search could result in people’s search queries being de-anonymized by bad actors and search data shared with small companies being a target for criminal hackers.

The European Commission’s proposals are complex, impact technical systems with billions of users, and are steeped in the continent’s competition laws. As European officials’ deadline of July 27 for announcing its final decisions approaches, Google has been increasingly vocal in its opposition to the parts of the plans it does not believe will work. Some Google competitors, who could benefit from accessing the data, say the plans have less privacy and security impacts than has been suggested.

These competitors, independent researchers, and academics who have responded to the consultations have pointed out how Europe’s plans could work and also potential flaws with them. Rebuttals and counter rebuttals have been issued as competition law collides with privacy impacts. Spokespeople for the European Commission acknowledged WIRED’s request for comment but did not respond to questions about Google’s concerns.