Why I’m Forced to Say Farewell: Google Management Has Lost Its Moral Compass | René Mayrhofer

Search

Why I’m Forced to Say Farewell: Google Management Has Lost Its Moral Compass

Last updated on

2026-06-07

6 min read

When Google offered me the job of Director of Android Platform Security in 2017, it was impossible to refuse. Yes, Trump was already president—my family and I had qualms—but he seemed contained, even ineffective. More importantly, Google was a different company 9 years ago. Android was open source first and had just surpassed 2 billion users. I’d been studying its security from the outside since 2009, and it was (and still is!) the most exciting end-user facing operating system to work on. However, while the source code was always public, getting direct contact to the internal Android team had been incredibly difficult; trying to discuss new ideas for security mitigations or architectures supporting upcoming fields like mobile digital ID was a frustrating exercise for academics and industry researchers outside Google.

Getting the chance to lead on the inside, on the most widely used Linux based, (mostly) open source operating system in the world, was an incredible chance. I am still thankful for the initial offer, especially to Dave Kleidermacher and Nick Kralevich for their trust in me, and the welcoming atmosphere from day one. Google was the place to be to getting things done on a global scale, The culture was transparent and open to diverse discourse, and from the start it was made clear that, as Googlers, we were not only welcome but expected to bring our own identity and values into the job. As an academic and tenured professor of computer security, working on Android inside Google was literally the most appealing place in the whole of the Silicon Valley – the one that best matched the spirit of academia and my own ethical principles to work for the public good.

While I was never really involved with the cloud side of things, on the company level, the goal was still to become completely carbon-neutral, and contracts with the Pentagon were canceled after employees spoke up against them (I signed the 2018 open letter). The AI principles published by Sundar Pichai in 2018 stated very clearly that “AI applications we will not pursue: … 2. Weapons or other technologies whose principal purpose or implementation is to cause or directly facilitate injury to people. 3. Technologies that gather or use information for surveillance violating internationally accepted norms. 4. Technologies whose purpose contravenes widely accepted principles of international law and human rights.” Many computer scientists and software engineers wanted to work at Google, and I heard both hearty congrats and fierce jealousy when I mentioned the job offer to colleagues before relocating to Mountain View.

Then there were the people. Larry and Sergey were still answering some tough leadership questions every week, and “Don’t Be Evil” wasn’t just a slogan of often-referenced Googliness—it was a north star for teams making hard calls. My immediate team—Android Security, the defenders of Billions of users—has the motto to “make things so secure that we ourselves can’t break them, whether the device costs $1000 or $100, or the user is a celebrity or a refugee“. It was always about doing right for our users, and protecting their interests first (occasionally even against business interests of other Google apps and services). I met the most amazing experts within my first months of joining, including Android legends like Dianne Hackborn. Everybody was friendly, happy to give time to newcomers, to share their knowledge about the technology as well as about the internal processes. And everybody was dedicated to do right by the global population—thanks a lot to all of you for that hard work! I am still incredibly proud of many of our achievements, most of which required moving other ecosystem stakeholders over long periods of time. Making full device encryption the Android 10 default even for the cheapest of devices moved the world forward. Enabling end-to-end encrypted Android backup quietly while the discussions focused on Apple defined a de facto state of the art that still holds strong in current law enforcement vs. user privacy discussions. Insider Attack Resistance, ARM MTE, privacy-first digital credentials, and many other things were only possible because we pulled together to make our users more secure—including against a potentially malicious sub-part of Google itself.

Unfortunately, times have changed. Google management has quietly abandoned its goals to become carbon-neutral because of the AI model energy usage. Worse, Google management is now signing deals with the US Ministry of War—where “any lawful purpose” by the current US government has already been repeatedly demonstrated to be in violation of international laws. None of this is being debated or communicated within the company. It is just decided by...