‘Chronicle Is Dead and Google Killed It’

In early 2018, Google’s parent conglomerate Alphabet announced the birth of a new “independent” startup that was supposed to revolutionize cybersecurity. Chronicle was meant to be a new type of startup. One of its products was designed to structure, organize, and help companies understand their security related data—a “Google Photos for businesses’ network security,” as Forbes put it when the company announced its first product this year.

The promise was radical: Chronicle would leverage machine learning and Alphabet’s near-endless well of security telemetry data about known malware and internet infrastructure and use it to help security teams at companies detect intrusions that could threaten a company’s network. Crucially, Chronicle would also remain independent from Google, according to Stephen Gillett, the startup’s CEO.

“We want to 10x the speed and impact of security teams’ work by making it much easier, faster and more cost-effective for them to capture and analyze security signals that have previously been too difficult and expensive to find,” Gillett wrote in a blog post announcing Chronicle. “We know this mission is going to take years, but we’re committed to seeing it through.”

At the time it was unclear what Chronicle was going to be. But industry observers were excited for what they thought was going to be a significant disruptor in an industry that is full of relatively old technologies such as antivirus and firewalls, is rife with products that offer solutions in search of a problem and outright snake oil.

Just a year and a half after the announcement, however, Chronicle has been folded back into Google, within its Cloud department—and some employees feel Chronicle management abandoned and betrayed the original vision. Chronicle’s CEO and chief security officer have already left and the chief technology officer is leaving later this month, Motherboard has learned. Others are eyeing the exit.

“Chronicle is dead,” a current employee told Motherboard. “Stephen [Gillett] and Google killed it.”

Do you work or used to work at Google? We’d love to hear from you. Using a non-work phone or computer, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, OTR chat at lorenzofb@jabber.ccc.de, or email lorenzo@motherboard.tv. You can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

Employees have left because of a combination of Chronicle losing its original vision, a distant CEO, a lack of clarity about Chronicle’s future, and disappointment that the startup has been swallowed into Google, according to interviews with five current and former employees who were present across different stages of Chronicle’s growth. Motherboard granted them anonymity to speak candidly about internal company events.

“People keep quitting. Sales doesn’t know what to do since there’s no real product roadmap anymore. Engineering is depressed for the same reason, folks have been finding jobs at startups or transferring to other parts of Google,” the current employee said.

“A lot of people got royally fucked,” one former employee added. Other sources spoke about how stock and employee compensation shook out as the startup was folded in. Chronicle was a “shitshow,” the former employee added.

Gillett has left Chronicle for another role within Google. Co-founder and CSO Mike Wiacek has left the company entirely. Will Robison, the CTO, announced internally that he’s leaving too, according to two current employees and two former employees. Robinson’s planned departure has not been previously reported.

In a blog post announcing his departure, Wiacek said he is leaving the entire Alphabet organization after 13 years there. In the post, he did not get into the reasons why he left, although he may have left a hint of the internal issues facing the former startup.

Reflecting on his time there, Wiacek wrote that “Chronicle had one of the most healthy and vibrant corporate cultures I could imagine. Things were never perfect, but that’s important! Diversity and tension, in a trust-filled environment, are fuel for innovation.” (Wiacek declined to comment for this article.)

“Chronicle is dead.”

The use of the past tense there is important, according to one of the current employees.

“What culture does Chronicle have now?” they said. “It’s a zombie. Bunch of people eyeing the exit.”

Gillett did not respond to a request for comment. When asked for comment, a Google spokesperson provided a link to a June blog post in which it announced it had acquired Chronicle.

In an interview with The Information last month, Gillett seemed to try to have it both ways, admitting that some employees were disappointed about joining Google, while calling the folding “not [a] disappointment.”

“We have zero employee issues,” he said.

But the loss of three of the highest ranking Chronicle employees, as well as the departure of other Chronicle workers, suggest that Google faces challenges in figuring out what to do with one of the industry’s most hotly watched and anticipated cybersecurity companies. Like Google’s digital rights and internet freedom division Jigsaw, Chronicle is yet another Google offshoot that has been launched with great hype but has failed to deliver on its promises.

STARTING FROM X

After being a secret within X, Google’s research and development organization, since 2016, Gillett publicly announced the birth of Chronicle in early 2018, describing its mission to help companies “find and stop cyber attacks before they cause harm.” The idea was to offer a new platform to let companies track and analyze large troves of security-related data, and combine that with VirusTotal, a Google search engine and repository for malware, with the goal of helping them track hackers, prevent breaches, or investigate them.

Industry observers got excited right away. Patrick Gray, the host of the influential Risky Business podcast, said on Twitter at the time that Chronicle could be “a meteor aimed at planet Threat Intel™,” using the insider term for a part of the cybersecurity industry that helps other companies counter hackers. Some of Chronicle’s leads had a long history in digging into cybercriminal and government hacking groups, and the company could take advantage of vast repositories of data from Virus Total and other Alphabet sources, Forbes explained in March.

But Gillett told the publication “we are distinctly not Google,” emphasizing the company’s independence.

There was great enthusiasm inside the startup too. “Things were crazy,” in a good way, one former employee said.

Chronicle was supposed to be different from other cybersecurity firms; the plan was to have a company that really had the space to try new things in the field of cybersecurity, thanks in part to being under X, where founders are encouraged to create “radical new technologies to solve some of the world’s hardest problems.”

“The idea was—very, very early on—we’re going to build a startup that’s going to do great things, so very ambitious goals. And to be able to achieve this, we need to be outside of the usual framework of Google,” another former Chronicle employee said.

And X didn’t only seemingly provide a lot of freedom, but it also came with a lot of money.

“Chronicle was in a very unique position, where we had more or less unlimited funds, in a way,” because of its connection to X, one former employee added.

Those days didn’t last, though. One of the former employees described Chronicle’s position under X as a “double-edged sword,” and another said the initial buzz only lasted a couple of weeks once they joined.

“The honeymoon phase was really only about two weeks long, and then the Google ecosystem and the inability to be legitimately agile, and do rapid prototyping, and [be] actually innovative, became painfully apparent,” the former employee said.

Many of the Chronicle staff were longtime Google employees, bringing their own culture into the startup. Chronicle was only allowed to use Google’s own tools for work even to the hindrance of projects, one former worker said.

For how quickly Chronicle could actually move to experiment on projects, “You’re a giant freighter on the ocean; you’re not a sports car,” they added.

“Any large company begins to approach the level of a government, for better and for worse,” another said.

At the center of some of the sources’ grievances with Chronicle was Gillett. Four sources described Gillett as distant or unavailable throughout the company’s growth.

“He was a figurehead. He didn’t care what the company was doing, outside of money,” one former employee said.

“All of us got this fatigue at looking at ideas, and needed leadership from someone saying ‘this is what we are going to do.’ That leadership did not come. Stephen, again, did not really know what was going on,” another said.

“A lot of people felt betrayed when it occurred.”

Earlier this year, at the business-oriented RSA security conference, Chronicle announced its new security platform, calling it Backstory. As Wired reported at the time, Backstory was supposed to be “a cloud platform on which companies can store their network-intelligence data indefinitely, allowing them to use Google’s search smarts to comb through logs and gain insight into emerging digital security threats.” Chronicle also announced that it had partnered with antivirus companies Avast and Proofpoint to share data, and that it was going to integrate Backstory inside the endpoint security product offered by Carbon Black.

But Chronicle then became the exact opposite of what it was supposed to be. Instead of running as a free-thinking company outside of the normal Google structure, it was merged into Google Cloud in June, becoming part of Google’s security offering. Many of the startup’s employees found out on the same day of the public announcement at an all hands meeting, according to current and former Chronicle employees.

“A lot of people felt betrayed when it occurred,” one of the former employees said.

The merger also affected employees’ compensation, as some Chronicle employees had lower salary and stock packages compared to regular Google employees, given that they were working for a startup, according to one current employee. After the merger with Google Cloud, salaries and stock packages were not adjusted, leaving some Chronicle employees feeling they had lost out on higher equity, according to two current Chronicle staffers.

Stock “has hit people hard,” one of the current employees said. A former employee also mentioned issues with equity.

One former employee believed the acquisition wasn’t a turning point for the company, but rather it crystallized what they had suspected.

“It kind of came across as: we decided to sell, because building a sales team is difficult, and Google already had a sales team,” they added.

LIFE IN THE CLOUD

Life at what remains of Chronicle is still going. One current employee stressed that new products are on the horizon beyond Backstory, and that they are happy working at Chronicle. This month BlackBerry Cylance announced its own product integration with Backstory.

What has happened now is that “the mission is broader,” tackling markets beyond what they started out with, the current employee said. Even if it means leaving some of Chronicle’s original renegade approach behind.

In early August, a month after Chronicle was folded in, workers gathered for a party at a Google building in Palo Alto, California.

It was supposed to be a party to welcome the new workers and celebrate the startup’s new life. For some, it was a happy occasion. But it was also a funeral: the end of Chronicle.

Inside a large conference room, founders gave speeches, employees cried, and some drew messages and memes on a whiteboard, according to two people who attended.

One meme compared Gillett to Thanos, the Marvel supervillain that makes half the universe disappear with a snap. Referring to co-founder Mike Wiacek’s office nickname “Chainsaw,” somebody else wrote: “Mr Chainsaw, I don’t feel so good,” with the letters turning to dust in a clear reference to the Avengers: Infinity War scene where Spider-Man is wiped from existence, according to an attendee of the party.

“I have ideas but can’t do anything while being an Alphabet employee,” a current employee said. “There’s nothing to do, just sit around collecting [stock] basically. Not that I want to keep doing that. I signed up to build something legit. But that’s not gonna happen here.”

Subscribe to our new cybersecurity podcast, CYBER.