My reading of the post on the AdWords blog is that Google has identified 10% of all clicks to be invalid (by their definition) and thus, they do not charge for them. 0.02% of all clicks are the result of complaints by advertisers of click fraud; manual investigations by the click quality team reveal that they should be included in the invalid category and refunded.
This, of course, does not answer the question of the clicks that Google did not identify as fraudulent, but were fraudulent, either because no one complained, or their filtration/click quality did not identify them as invalid. Such clicks can be manufactured quite easily by botnets operated over a large distribution of IP addresses, user agents, language types, etc. They can also be generated by humans operating under similar instructions as the botnets.