Google announces new efforts to protect journalists and high-risk users from cyberattacks, including providing over 10,000 free security keys through 2021
Context & Ripple Effects
Google has been telling prominent journalists and professors their accounts are targeted by government-backed attackers since its 2016 warning program, but until now the response was notification only — users were told they were targets and left to buy their own defenses.
This announcement closes that gap by funding the fix directly, handing out over 10,000 free security keys through 2021. It follows the template of Google's partnership with Defending Digital Campaigns, which put Advanced Protection tools and Titan keys into US political campaigns for free, and extends the same subsidized-hardware model from campaigns to journalists and other high-risk users. The 2024 follow-on, where Advanced Protection could be set up with a single biometric passkey instead of two physical keys, shows where Google wanted this friction to end up.
First-order effects
- Journalists and high-risk users who previously had to purchase hardware keys themselves can now enroll in Advanced Protection at zero cost, removing the price barrier that kept the strongest Google account defenses out of reach for exactly the people most targeted.
Second-order effects
- Security-key vendors gain a subsidized distribution channel as Google effectively buys inventory at scale, while news organizations and NGOs can standardize on physical keys as default kit rather than case-by-case purchases.
- Rivals running government-attacker warning programs face pressure to match Google's move from alerts to funded remediation, since a warning without a free mitigation looks incomplete next to one that ships hardware.
Third-order effects
- The pattern — detect state-sponsored targeting, then fund the countermeasure — points toward high-risk account security becoming platform-provided infrastructure rather than an individual purchase, with authentication hardware eventually dissolving into passkeys and biometrics as the 2024 change suggests.
The trend: Protection against state-backed attacks is shifting from user-bought security tools to platform-funded defaults for high-risk populations, with Google moving from warnings (2016), to subsidized campaign keys (2020), to journalist keys (2021), to frictionless passkeys (2024).