Biden transition team using Google Workspace, Titan Keys given lack of official security support

A report in the Wall Street Journal today revealed that the Biden-Harris presidential transition team has turned to Google Workspace in light of the current administration and US government not yet officially recognizing this month’s election results.

In recent years, the General Services Administration, which has yet to ascertain President-elect Biden as the winner, “would own and manage the setup of government email accounts for a presidential transition team, which are typically assigned the “ptt.gov” domain.” Meanwhile, Department of Homeland Security cybersecurity staff would help “protect those newly created government email accounts.”

“We are preparing to govern during a global pandemic and an economic recession, all while working remotely. From the outset of the transition, we have invested in best-in-class IT systems and processes,” a transition official said.

As an alternative to that system, the Biden transition team is relying on what the WSJ calls a “standard, paid Google Workspace network.” Today’s report cites sources and domain registration records associated with in-use email accounts.

Previously known as G Suite before last month’s rebrand, the Biden team is most definitely using Gmail and presumably Docs, Sheets, and Slides for collaboration. Meanwhile, the “shared drives” feature is cited in today’s report as being used to keep “internal information on a need-to-know basis.”

It’s not clear if transition staffers are using Google Chat and Meet. There is one picture of Biden video calling Senator Harris over Zoom after selecting her as his running mate in August. It’s not clear if they have since switched tools.

Meanwhile, staffers are required to use Titan Security Keys. These two-factor authentication keys have to be plugged in to the computer signing in after a username and password has been entered. It provides another layer of security and works to confirm their identity. Google sources these keys from partners, like Yubico for USB-C, but adds its own firmware to verify the key’s integrity. It’s not clear if the Biden team is also using Google’s Advanced Protection Program, which further boosts security by limiting account access.