Engineer says Google fired her for notifying co-workers of right to organize

https://www.nbcnews.com/news/all/security-engineer-says-google-fired-her-trying-notify-co-workers-n1103031

by danso • 7 years ago

743 621 7 years ago

todd3834• 7 years ago

Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension
“We dismissed an employee who abused privileged access to modify an internal security tool,” a Google spokeswoman said in a statement, adding that it was “a serious violation.”

The only times I’ve ever seen people fired quickly in Tech without a performance improvement plan or something similar is a security violation. Be sure you always take security seriously if you like your job.

vntok• 7 years ago

What a title.

dominotw3• 7 years ago

one time i was fired for leaving my computer unlocked to go get some coffee. true story.

swebs• 7 years ago

Military contractor?

javajosh6• 7 years ago

Which is pretty dumb. The most important threat to a typical office dev computer is not console access, it's wayward processes and network traffic. What's more secure, a locked console (that protects you from ~1 local people that you know) or something like Little Snitch, which protects you from ~10e6 people you don't know?

downdown4eva• 7 years ago

More like fired for pulling a stupid stunt that she's now trying to turn into a press release.

cj• 7 years ago

Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.”

So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website.

And Google fires her with the reasoning:

“We dismissed an employee who abused privileged access to modify an internal security tool,” a Google spokeswoman said in a statement, adding that it was “a serious violation.”

I'm not at all opposed to Google employees organizing. But injecting javascript into an employer's internal chrome extension does seem like something that warrants some type of action by Google in response...

Maxion4• 7 years ago

If you further read the article, she went through the standard approval process for changes. She did it by the book. That's hardly "injecting code".

mytailorisrich4• 7 years ago

Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension

That sounds like code review approvals, not actual project/management approval of the 'feature'.

We have the same: Cannot commit any code change unless 2 other team members have reviewed it. That has nothing to do with having actual project/management approval for the change.

eitland• 7 years ago

Social engineering isn't better than other forms of hacking.

thrower123• 7 years ago

Seems like they need to rethink the book. I'm not sure a Googley culture of permissiveness can exist at the kind of scale that they have now, and with the competing activist factions that they have cultivated.

macspoofing7• 7 years ago

Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension.

Yeah. I don't think so. The tool in question is an internal security tool, not a communication tool to get her message out. The two engineers who signed off on this should also be reprimanded. This is a clear abuse of a process meant to take in security-related contributions without too much red-tape.

And you want a separation of concerns here. You don't want a tool created for security to push the political agenda of some activists.

And she literally says the only reason for her change was because she wanted to get the word out because posters aren't effective enough: "Spiers told NBC News that she was inspired to create a digital notification because “a poster in the cafeteria is not the best way of reaching the majority of Googlers.”" ... yeah. Sorry posters aren't effective enough for you, you can't do that.

Touche6• 7 years ago

It's still worth discussing if their reaction warranted the offense. Would they have fired her had she added a pop-up on Earth Day encouraging employees to recycle? Or would she have received a slap on the wrist for that. In other words, how much of what she was advocating was part of the decision to fire?

ninly3• 7 years ago

Or would she have received a slap on the wrist for that.

Or would she have received a pat on the back, given that she went through the Standard Procedure for adding a feature to the browser plug-in?

TravHatesMe2• 7 years ago

That is a good question. Is this a fireable offense regardless of the content? If not, what kind of content is fireable, subject matter that is political, religious, vulgar, or offensive?

Putting this into an internal tool does seem unprofessional in my opinion. Why bite the hand that feeds you?

extropy3• 7 years ago

The particular popup looks pretty official and scary as security popups should.

And portrays that Google management is endorsing this instead of a grassroots poster.

IMHO this is at minimum a misrepresentation case. And I would be pretty pissed if it was used for Earth day. Don't mess around with crying wolf.

Working for Google.

pfortuny• 7 years ago

Exactly. What if the pop-up just said “not using disposable cups helps the environment”, or “the Holocaust happened”. Or even something like “Trump is a bigot”. Would she have got the sack? This is the true question. She was just stating a fact...

lr4444lr2• 7 years ago

Does it matter? If she used Google resources in a manner not company-approved, and if labor law doesn't recognize using a resource like that as a protected communications channel, like they would a company break room announcement board, why should Google be subject to a neutrality test? I support unionization, but I don't see what legal ground she has to stand on here.

jillesvangurp• 7 years ago

Based on what I'm reading here, firing somebody that early in their career is cold and Google deserves all the criticism it is getting lately for basically being a combination of tone deaf, insensitive, overreacting (or shall we call it panicking?), and biased to doing things most of their own people would simply characterize as "the wrong thing". In jurisdictions outside the US, this kind of random act of corporatism could end up being very expensive. Firing people without good reason is a not a thing that holds up in court and this looks like it doesn't stand much scrutiny.

Also, this seems like it is policy rather than an isolated incident. I'd suggest fixing it by maybe correcting people up the food chain. Google is a long way away from their don't be evil motto when they were young, naive, and producing lots of cool new products and services because they weren't held back by corporate idiotism and political correctness.

ocdtrekkie• 7 years ago

This is a mischaracterization, if you read what the extension is used for: Showing popups when people visit certain sites. For example, popping up a notice to remind users not to upload Google data to Dropbox when they visit Dropbox.

So no, she wouldn't have "added arbitrary JavaScript". She would've added an additional message and triggering website to an existing script.

skywhopper• 7 years ago

Sure, but the question is, would they react this way if the injected content was something else?

mc32• 7 years ago

So.... this is interesting. The answer is if they are strict authoritarians and go by the book, yes. There is no leeway. If they are flexible and are open to interpretation and intent then no... but then that leaves them open to risk.

Because of that most companies over time become very strict and unforgiving.

orangecat• 7 years ago

That's the most important question, and there's a pretty good case to be made for "yes". It's a severe error in judgment for a security engineer to co-opt an security notification system in order to spread personal messages. Not only is it spam, it desensitizes users to real warnings. (Imagine an email from Google where the subject is "SECURITY ISSUE WITH YOUR ACCOUNT" and the content is an ad for a Pixel). I probably would have given a strong warning rather than firing, but it's not unreasonable to be especially strict when dealing with security matters.

ninly3• 7 years ago

Certainly bold and perhaps ill-advised, but I would hardly characterize this as "injection"

Spiers told NBC News that she was inspired to create a digital notification because “a poster in the cafeteria is not the best way of reaching the majority of Googlers.”
The message included a link to a statement that the NLRB required the company to post for employees following the settlement of a complaint that was filed against Google in 2016.
Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension. Another source at Google familiar with the update approval process confirmed to NBC news that those two approvals are standard practice for a browser extension update.

Touche6• 7 years ago

Prefixing this by saying I am not siding with Google (since people make assumptions). The standard approval process sounds like most merge review processes on any engineering team. There's a sort of assumed good-faith for this process. The fact that 2 coworkers were fine with your change doesn't mean it was made in good-faith and was within the bounds of normal types of changes.

Any engineer with the freedom to make changes without manager approval knows that adding features or making major changes isn't not the sort of thing you just do on your own. You'd go through another process for that.

So I don't buy this argument at all. This was a knowing violation. That does not, however, mean that they punishment was warranted, I don't think that it was.

lr4444lr2• 7 years ago

That just means the code was made to quality standards, not that the she had authority to make that kind of feature modification without approval. In a less technical analogy, just because you have a right to put up flyers doesn't mean you have the right to use the company paper and printers to make them.

lnanek2• 7 years ago

Let me preface this by saying I think what she posted is true, employees have a right to unionize.

That said, it seems kind of strange, if this was a better way to post something than the cafeteria, that she added it to the union buster's site, though. Wouldn't only execs and management hiring the union busters go there? Seems like it was a way to argue back with the execs who hired the union busters by essentially defacing the union busters site?

She probably pissed off a high level exec who hired the union busters in the first place and was fired by their order. She was making all the management who visited their site see her notice, and some management obviously support the union busters since they hired them in the first place...

SkyBelow2• 7 years ago

When a cop pulls speeders but strongly focuses on one demographic group, even though each pull is justified in that the one pulled was violating the law, the pattern that emerges shows a greater level of injustice and the actual reasoning used is quite different than the stated reasoning because the stated reasoning is not consistently being applied.

In this particular case, does Google consistently apply the stated reasoning? Google says it does, the engineer says they don't. Do we just trust Google despite a very long history of corporations taking illegal or unacceptable actions against employees engaging in similar actions, or do we let it go before a court to be decided?

bad_user• 7 years ago

That justice isn't equally applied doesn't excuse the perpetrator.

If you're speeding over the limit and the cops pull you over, you still deserve the fine, simply because that's the law. This doesn't mean that the cops themselves are innocent of any wrongdoing, but the two issues are separate.

And of course civil disobedience can be justified if the law or its application are unjust, but using it as an excuse after the fact is lame.

sidcool• 7 years ago

Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension.

raiyu• 7 years ago

Spiers wasn't fired for adding code, Spiers was fired for using a pop-up and that simply isn't the Google way.

JumpCrisscross3• 7 years ago

injecting javascript into an employer's internal chrome extension

The purpose of the extension is to serve site-specific pop-ups. Spiers added a pop-up to an existing pop-up tool using existing, precedented processes.

The analogy to a poster in a cafeteria, which is explicitly protected by federal law, passes a first-order smell test.

c0achmcguirk• 7 years ago

Is this a precedent that Google or any company wants to have, though? Engineers with access to company-wide tools or extensions can put political or divisive content into them?

This is more than just a "poster in the cafe" because of the reach and invasiveness of the approach.

Disclaimer: I work for Google, speaking for myself only.

extropy3• 7 years ago

These popups are security popups, the ones you would get from your antivirus/firewall and carry a certain Management endorsement weight.

It's not a free for all space to put random messages into.

dunkelheit2• 7 years ago

The analogy to a poster in a cafeteria, which is explicitly protected by federal law, passes a first-order smell test.

This doesn't feel like the right analogy. She (ab)used her access after all. A better one IMO would be a cafeteria worker sneaking in a leaflet among the napkins. Definitely feels less innocent.

gbronner2• 7 years ago

Almost irrespective of the website that it was triggered on, it represents a huge waste of her time, as well as that of the hapless employees forced to click through her automatically-created popups.

It also weaponizes the internal browser to advocate for political causes.

It shows such stunningly bad judgement that they are entirely justified in firing her.

givinguflac4• 7 years ago

IMHO its absurd to think stating a law/fact is advocating a political cause, unless you consider the law a political cause? In which case, wow.

iandanforth• 7 years ago

This isn't how extension development works? The APIs for calling the notify methods already exist. Depending on how their tools work the diff could have been

1. A list of one website on which to notify

2. The static content to display on that website in a predefined (provided by the browser) popup context.

While I grant what you're saying is possible given the dev's access rights, it's not required for the functionality described in the article.

debt4• 7 years ago

The concerning thing is she seems to call out that employees have the right to “concerted activities” which means Google sung only opposed to unionization efforts but to any “concerted action” by their employees.

Even so much as organizing could be viewed as a threat by Google’s management.

crazygringo• 7 years ago

Indeed. And there are a ton of comments here saying it's OK because "she went through the standard approval process, which requires two co-workers to greenlight changes."

But that doesn't mean it was OK. It just means the co-workers might have greenlit it without taking a close look, or were misled as to what they were approving, or that they were approving it because the code was correct technically, and approval isn't about judging the code's product purpose.

If this tool was NOT meant to be used as the equivalent of "posters on the wall" and she modified it, regardless of co-worker code approval, it DOES seem to be an abuse of privileges.

If her manager had given her the OK, then she's in the right. Otherwise, I have a hard time seeing how this isn't abuse of one's position.

_y5hn5• 7 years ago

Unless managers are authorizing all changes, employees must assume their own judgement. Thus not firing offence.

helen___keller12• 7 years ago

I agreed with this at first, but according to her medium post ( https://medium.com/@ksspiers/google-fires-another-worker-for... )

"Part of my job was to write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web"

If this is true and her job is literally to create javascript notifications of company policy, then I think it's entirely reasonable what she did considering it IS company policy (well, law really) that you have a right to organize.

Link to the popup: https://miro.medium.com/max/2000/0*1BTVYLTvuHiJVvp_.jpg

dqv2• 7 years ago

You're right. It literally links to (what appears to be) an internal company document. go/nlrbnotice

ramblerman2• 7 years ago

Really?

So if I hire you to email out my monthly company statement it’s reasonable that you add some of your own thoughts to said email.

workthrowaway3• 7 years ago

from her blog:

This kind of code change happens all the time.

we have all been there.

i think she knew she wasn't following proper procedure. even if it's done "all the time".

TallGuyShort• 7 years ago

This is very reminiscent of laws regarding jury nullification, and how the practice may be legal, but in some jurisdictions / cases it can be illegal to inform a jury of that fact.

dhdhebsb2• 7 years ago

IMO the problem was putting the pop up on the IRI consultants website. She wasn’t protecting anyone or informing anyone of policy, she was being inflammatory and I don’t see it as a stretch for G to say she abused her position to inject that message.

Vysero• 7 years ago

In my mind this is the hinge or the crux of the issue. If it was her job to create and inject JavaScript notifications of company policy and they fired her for doing that then shame on Google. Actually, it would be more than just shame on Google. If this is true, then I would say Google is not a safe place to work for anybody. Which is why I find it hard to believe that this was actually in her job description and or that there is more context that we are missing; that the premise of the argument is misleading.

"Part of my job was to write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web."

-With regard to what exactly? Context matters, if the browser notifications she was creating were only supposed to pertain to surfing the web then I think we can safely say she overstepped her bounds.

"So when I heard that Google had hired a union busting firm and started illegally retaliating against my coworkers, I decided to make sure that my coworkers knew about the posting."

-Again, it depends on what exactly her job was, but this seems to suggest she had motivation outside the bounds of her job description for doing what she did.

I don’t disagree with what she did. In fact, I think it’s kind of great. However, that doesn’t mean Google didn’t have a right to fire her for it.

s1artibartfast2• 7 years ago

her job is literally to create javascript notifications of company policy,

I think there is a reasonable difference between security notifications and other corporate policies.

Were non-security notifications in scope for their job or the tool used?

tanilama3• 7 years ago

Part of my job was to write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web

She needs to understand this power isn't her own to wield.

And the risk of people abusing power to advance their personal agenda is NOT something that would get passed easily once discovered.

scarmig6• 7 years ago

The extension is intended to inform Googlers of applications that are not approved for corp data, not just generic "employee guidelines and company policies." This is so you don't e.g. upload PII into a random unsecured S3 bucket.

Yes, it's company policy, but this is more like running into a meeting and then interrupting it so you can start reciting NLRB policy than it is posting a flyer. Worse, it misappropriates a security tool in order to do that. And when it comes to intentional actions that violate or undermine security, Google, like most companies, takes a pretty hard line.

Disclosing that I'm a Googler, and speaking only on my own behalf, with no connection to anyone involved except the fact that the extension is running on my browser.

wolco4• 7 years ago

I guess the question is did she add a company policy or guideline by adding what she added? I wouldn't classify a union drive as a company policy.

Some may think a union drive is a company function. From what I remember about my experience with unions is you are allowed to put up notices in the employee breakroom that is done by the union rep who is voted in within each shop.

I would say what she did was more along the lines of blasting the union notice over speakers to everyone who entered the cafe.

sigzero• 7 years ago

No. Just no. She absolutely violated what her job was.

codegeek• 7 years ago

She said "So when I heard that Google had hired a union busting firm and started illegally retaliating against my coworkers, I decided to make sure that my coworkers knew about the posting."

This was purely a Moral decision on her part and not reasonable in my opinion to tag it as part of her job. She was not happy with how google was retaliating against her co-workers (right or wrong) and she took action using her own judgement. She did this not because this was part of her job but because she wanted to get back at google for their behavior (again right or wrong, thats not the point here).

augbog• 7 years ago

After reading both of these statements, idk I feel the grey area is large enough that it didn't necessarily justify firing but also I don't blame Google for doing so. Ugh.

tikiman163• 7 years ago

Her job was to notify people of company policy. Injecting messages based on her personal politics raises red flags. This time she sent a benign message, but what might she do when googlers ultimately don't unionize? What might she do the next time there's a policy she disagrees with?

Google has provided places for people to discuss things. When she didn't think that was good enough she chose to make unapproved code changes that went against corporate direction.

Personally, I'm against unionizing any software company, especially google. Unions were created to prevent systemic abuse of people that were seen as easily replaceable. If you think a recent college graduate making 120k+ that has been provided almost ridiculous perks and freedom unheard of in most of the industry is being abused when they could easily leave Google and expect to receive a similarly paid position virtually anywhere purely because they used to work at Google, then there's no helping you.

Google employees have more rights than at most companies, they can even spend up to 20% of their day working on personal projects and Google won't claim ownership. If they think they need a union when dealing with such a reasonable employer,then those fresh out of college lottery winners need a serious reality check. Let's talk about unionizing Amazon fulfillment centers where they frequently let people go because taking a bathroom break means missing your quota. Let's talk about unionizing virtually any company before we demand labor unions for the most highly privileged group of people in the world.

justinmchase• 7 years ago

Wouldn't she have had to make a pull request? Since when can't a developer make a controlled change to code?

ummonk7• 7 years ago

Yes, and needed the approval of two reviewers, which she got.

paggle• 7 years ago

Yikes. That is straight up black hat shit. What ever happened to posters and bullhorns?

sequoia• 7 years ago

But injecting javascript

Come now. It's a browser extension, it's written in JavaScript, and knowingly installed by employees. No "injecting" went on here, let's not try to make this sound more nefarious than it was (not very). Fireable? Perhaps. But not because of a security concern.

(edit: reading more, it's clear that the only thing that makes this "fireable" in google's view is that it promotes union organizing that they oppose. Any other such message would probably not cause firing unless it caused a PR problem, and perhaps not even then.)

quotemstr3• 7 years ago

This isn't the first time either. Just before the walkout, a group of employees force-changed everyone's desktop background to an advertisement for the walkout. That particular change, while obnoxious, was harmless --- but that change could have been anything, including very difficult to detect spyware. It's essential that company-wide code and configuration changes occur only with official approval and process. Emotional and activism do not constute reasons to bypass this process.

neonate• 7 years ago

Is that true? Amazing if so. I had not heard this before.

kllrnohj• 7 years ago

So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website.

No, the "so basically" is the employee added another URL & a string to a map of URLs & strings in an existing extension.

The extension already existed. It already showed notifications on various URLs. She didn't create that part.

ColonelSanders• 7 years ago

The management is giving each other high fives now. As they no doubt strategize their plan from the comfort of their boardroom, they know this activist's personality will become the face of effort to collectively bargain.

Despite news articles mentioning walkouts themed on identity politics and out of court sexual assault allegations - those are narrow and not representative of the collective: a small, but vocal clique demanding VIP treatment at the expense of everything else. As for the feelings of those not fitting those characteristics? Do they not have their own personal and professional struggles, ambitions to cooperate and rise in the organization and live a happy life with a family?

It's a perfect distraction from the worker's struggle for union representation.

In order to form a union, you need votes. Google's management knows enduring the most radical and loud is a small price compared to having a union to ensure everyone is treated fair.

Cater to the whims of radicals rather than focusing on common ground == no plurality. Union busted, mission accomplished. https://www.nlrb.gov/rights-we-protect/whats-law/employees/i...

nooglersanon• 7 years ago

So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website.

This is actually false (it's not listed in the article, so I wouldn't expect you to know). It was a config file containing URL patterns and plain text messages. Most messages were things like: "please don't upload random company files to dropbox.com/upload".

So my take is that this employee's job responsibilities probably involved notifying sending these types of notifications. However I'd actually agree that there was some "abuse" because letting someone know they are about to upload a file to dropbox is pretty different than using it as a forum to remind people that organizing is a protected activity. I wouldn't fire someone over that because despite them being in the wrong, it doesn't seem malicious.

geofft6• 7 years ago

So basically, the Google employee added arbitrary javascript

This is a little disingenuous. She's a software engineer who works on this extension. "Injecting arbitrary JavaScript" is her job.

If she bypassed code review, introduced a vulnerability, abused a known weakness to violate policy (e.g. logged into an account with signing keys to deploy manually when it's usually automated), etc. then you'd have a case. If she did her job and followed all policies about review and the only question is the content of the notification, then the way she sent it is an unfair criticism. It reeks of CFAA-style stretching of the truth about authorized access, and we as hackers shouldn't stand for it.

I wrote a command-line tool at work to automatically add a bunch of party parrots to a Slack message. This tool runs with your personal credentials, and web-scrapes your Slack access token in order to run. As a normal UNIX tool it also has access to your homedir etc. The credentials it uses can also read your private Slack DMs, access data that you can get to but I am legally forbidden from seeing, etc. - but it does none of those things. I installed it to a bin directory in everyone's path, without code review, because we have a system that explicitly allows this and it is often useful. Our security team raised a general ticket to the effect of, hm, maybe code review should be required before you stick code in everyone's PATH. Nobody is thinking of firing me for "injecting arbitrary Python" or "stealing credentials" or anything because nothing I did was against either policy or convention, even though you can make it sound horrid if you choose.

manicdee• 7 years ago

What would be the cheapest-approved mechanism of presenting this legally mandated notice to employees? Remembering this isn’t just a generic legal requirement but a specific demand imposed on Google at this point in time.

sundayedition• 7 years ago

I think there's a piece that some people are overlooking. There are very specific statutory protections about when, where, and how you have a right to organize.

Things that would likely require legal review and Google has the budget to test the waters of at this point.

The last clause in the link below pertains to this scenario, I think, which may bite Google. Or it may not because it all depends on case law and what union leadership is willing to push back on (which could take years to sort out via legal proceedings)

Really, at the end of the day all Google has to risk via this kind of behavior is some lawyer time, setting precedent, and potentially being required to post a notice if they end up losing.

Source: https://www.nlrb.gov/rights-we-protect/whats-law/employees/i...

Working time is for work, so your employer may maintain and enforce non-discriminatory rules limiting solicitation and distribution, except that your employer cannot prohibit you from talking about or soliciting for a union during non-work time, such as before or after work or during break times; or from distributing union literature during non-work time, in non-work areas, such as parking lots or break rooms. Also, restrictions on your efforts to communicate with co-workers cannot be discriminatory. For example, your employer cannot prohibit you from talking about the union during working time if it permits you to talk about other non-work-related matters during working time.

kache_2• 7 years ago

Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.”

You should get fired five times over for abusing your privileged access to modify software that runs on every employee's computer. How stupid can you be? Start a healthy discussion, don't violate trust. This just puts up a bad reputation for workers who do want to organize

iwantagrinder2• 7 years ago

Did you not read the part where she did, where she followed the process by the book and it was approved? Or did you just have your mind made up to decide to side with Google instead?

Maxion4• 7 years ago

I'm honestly a little surprised (and worried) about all the commenters who argue Google is in the right here.

scarface7425• 7 years ago

From the article, it doesn’t appear to be the case. She said she was allowed to inject JS code as a “digital extension” to putting a poster up.

kop3163• 7 years ago

This was the process: "the standard approval process, which requires two co-workers to greenlight changes"

In my company, I could put in travel orders to let me go to and from Hawaii on the company dime, have a vacation, and have my supervisor approve (which is following the standard process), but doing that should get me in a lot of trouble and/or fired.

PunchTornado4• 7 years ago

Even if she followed the rules that doesn't mean she should be absolved of guilt. You can follow the rules and submit a PR, have 2 code reviews and plenty of tests, if you brake production then you can still be fired for incompentency.

The fact that 2 reviewers approved her change doesn't mean that she has the right to send notifications like this through a browser extension.

some346• 7 years ago

Do you only know copy and paste the same comment?

tjansen• 7 years ago

If it was a code review, it would judge code quality and similar things. Not whether that change is in Google's interest. I guess if she was a product owner and added this feature, she would have been fired as well, despite following the process. She just acted against the company's interest.

kache_2• 7 years ago

In this case, the people who approved it should be fired as co-conspirators. The sanctity of the software that runs on employee's hardware should never be violated.

freyr4• 7 years ago

They got a code review. That doesn't mean the message they inserted was approved, it just means they got two engineers to sign off on the code.

Obviously, inserting pro-unionization messaging into a security tool isn't "by the book", or we wouldn't be having this discussion.

save_ferris• 7 years ago

The article says that she went through the standard approval process.

jpmontez• 7 years ago

"Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension. Another source at Google familiar with the update approval process confirmed to NBC news that those two approvals are standard practice for a browser extension update."

She alleges it was done by the book.

discordance• 7 years ago

That sounds suspiciously like a continuous delivery approval process (like needing two approvers for a PR).

scarface7425• 7 years ago

Does what she did even pass the sniff test? What if she got permission from her supervisor to inject $political_message_you_dont_agree_with in your browser. Would you be okay with that?

maccard• 7 years ago

I'm pretty sure that if I stood up in my office, I could find one or two people who would rubber stamp a change for me, assuming it was in good faith/approved, and would discuss implementation details/issues with the code, rather than question the reason for the changes. Particularly if the changes were tagged with a Jira. If your only defence is "well, what I did wasn _technically_ allowed", you lose the benefit of the doubt.

Incidents like this are the reason why red tape ends up introduced on small teams, and are what turn projects into a nightmare to work on.

0x445442• 7 years ago

As noted later in the article, she got two thumbs up; doesn't this justify her actions </s>.

danso8• 7 years ago

Agreed, but the engineer's claim is that she followed the standard approval process "which requires two co-workers to greenlight changes". The article says another Googler confirmed that this is the process. But the article doesn't say that Spiers' assertion (that she went through the process, and had two colleagues sign off) has been specifically confirmed.

Presumably, audit logs would make this an easy thing to set straight.

PunchTornado4• 7 years ago

You can follow the rules and submit a PR, have 2 code reviews and plenty of tests, if you brake production then you can still be fired for incompentency.

The fact that 2 reviewers approved her change doesn't mean that she has the right to send notifications like this through a browser extension.

felideon2• 7 years ago

According to Spiers[1], modifying software that runs on every employee's computer was her -job-.

[1] https://medium.com/@ksspiers/google-fires-another-worker-for...

thinkingemote2• 7 years ago

The spyware was designed to pop up notifications on visiting URLs to users, she just added another message for a url.

"Part of my job was to write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web. "

I'd be curious to know what URLs employees get alerts about? Perhaps services which do not take kindly to seeing IPs from Google offices?

scarlac• 7 years ago

The notice was added to a relevant page (a work organisation consultant webpage), from what it looks: https://medium.com/@ksspiers/google-fires-another-worker-for...

IshKebab• 7 years ago

I was doing nothing more than notifying my co-workers about Google's obligations under labor law
Kathryn Spiers updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.”

Yeah ok.

throwaway20484• 7 years ago

This extension popping up messages on various sites was a completely normal thing for it to do, she simply added another message.

w0m3• 7 years ago

unrelated to actual purpose of the tool; she co-opted internal security tool for a personal soap box and pushed it to the entire company. That's a clear violation of trust in her job role.

kop3163• 7 years ago

I think the relevant test is here:

"Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.”"

It sounds like the person updated an internal extension on everyone's computer to do this. I am tending to side with Google on this, that is not the right way to go about notifying co-workers of right to organize.

bag531• 7 years ago

I don't know why anyone would choose to work at Google anymore.

shantly4• 7 years ago

Giant piles of money.

Probably still gets you an easy CTO title at a startup after 2-4 years at Google.

decebalus12• 7 years ago

Giant piles of money.

Not anymore, really. It was the case a couple of years ago but right now, for rank-and-file employees, Google downlevels heavily and targets around 80% of the market rate. For some reason, people are still flocking at their doors and because of high supply of candidates, they can afford to be both very selective and very cheap.

ct02• 7 years ago

According to their linkedin, they graduated highschool in 2015.

dominotw3• 7 years ago

college is overrated.

krisroadruck• 7 years ago

I just don't get the internet anymore. You're avoiding using gendered pronouns but needlessly displaying ageism?

the_narrator• 7 years ago

Based on the Google engineer's LinkedIn profile, it is obvious that using any gendered pronoun will be a touchy subject.

ct02• 7 years ago

You must be missing the point of the internet. I don't see a problem here; Only you made graduation year and age the proxy.

Why would the engineer reveal their HS graduation year if they didn't want the world to know it? I considered that they must have had little experience considering their graduation year and the average or even above average experience of those graduating the same year.

SamuelAdams2• 7 years ago

The article mentions that the security engineer in this story is 21 years old.

Touche6• 7 years ago

The article is confusing. She says she was fired for doing one thing. Google says she did something else (modified Chromium without permission). Does she deny their claims, or is her statement just spin? Given just her quotes you would think that she was fired for literally telling coworkers that they have a right to organize.

iwantagrinder2• 7 years ago

Did you not read the part where she did, where she followed the process by the book and it was approved? Or did you just have your mind made up to decide to side with Google instead?

Touche6• 7 years ago

Nope, I am not siding with Google, if you'll see my other comments in this thread. It's just not super clear to me that there's agreement on what actually happened here.

PunchTornado4• 7 years ago

Do you understand that you can follow the process by the book and still do something wrong and be rightfully fired? "The book" doesn't contain everything that an employee shouldn't or should do.

Sending political messages thorugh a browser extension to other employees seems like a reason for being fired no matter how many reviews you've got.

kawfey5• 7 years ago

that's the problem with seeing one side of the story, and the other side being a megacorporation which will never explain the firing more than "abusing privileges."

buboard• 7 years ago

Google getting a taste of ad injection. Nice!

kawfey5• 7 years ago

Bad headline. It should read "Engineer fired her for abusing privileged access to modify an internal security tool."

That's a pretty dumb way to notify co-workers of their right to organize, but I guess it's a really good way to get fired and draw up a big media stink about it.

relluic• 7 years ago

She didn't abuse anything. She followed the standard process and she created the alert on the appropriate page (labor relations) to inform people of company policy: https://miro.medium.com/max/1000/0*1BTVYLTvuHiJVvp_.jpg

Maxion4• 7 years ago

Did no one read the article?

Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension. Another source at Google familiar with the update approval process confirmed to NBC news that those two approvals are standard practice for a browser extension update.

She did it exactly according to internal policy. The extension she updated warns site visitors on many websites. I do not see what she did wrong.

mytailorisrich4• 7 years ago

That sounds like a code review, which is not the same as project/management approval for the 'feature' at all.

Cyph0n2• 7 years ago

The internal extension displays pop-ups when you visit particular sites. All she did was add a new pop-up and associated site to the list.

gautamdivgi• 7 years ago

Not sure why you're downvoted. This does sound like a code review. News sites most often either willfully or through ignorance prefer not to investigate the entire story to truly get to what broke or what didn't break. It's typically just for shock value. I remember a story where cell tower signals were blamed for decline in the North American honey bee population.

Cyph0n2• 7 years ago

But it was not a "feature". It was a change to an extension that did exactly the same thing on other sites, so a code review makes absolute sense.

scarface7425• 7 years ago

I doubt thats the spirit of the rule. I would no more want that injected into my browser than any other political message.

Maxion4• 7 years ago

It's quite a stretch to call this a political issue.

krageon2• 7 years ago

This isn't political. It's about unionising.

ninly3• 7 years ago

And the popup message is one Google is required by law to make available to its employees.

BoorishBears5• 7 years ago

Wait a second, are you saying the browser popup when you visit that specific page is required by law...

... or are you saying the content of the message in the popup is one Google has to make available in some form.

Because I'm fairly certain it's the latter, but this feels like an attempt to obfuscate the real issue with tricky language.

dmix8• 7 years ago

The purpose of the extension within Google is to notify you of privacy and security risks for potentially dangerous websites.

The comment she injected into a benign law website has nothing to do with that and whether there was some weak approval process that missed this glaring fact doesn’t make it okay.

macspoofing7• 7 years ago

Legal compliance is handled by legal, HR, and OPs, not by random security engineers. Come on.

claudeganon• 7 years ago

If you think Google’s anti-union tactics are limited to onsite propaganda, I’ve got some bad news for you...

jefftk3• 7 years ago

She did it exactly according to internal policy.

I don't think this person or the other organizers should have been fired, but code review is not the same as organizational approval.

(Disclosure: I work at Google, speaking only for myself)

javajosh6• 7 years ago

What is the purview of a code review? Is it only about making sure the code meets technical standards, or are reviewers expected to comment holistically?

debt4• 7 years ago

“organizational approval”

Is the literal problem, which necessitated the pop-up.

The Organization Does Not Approve™

It’s like asking someone if you can kick them in the knee before doing so. What do you think they’ll say?

Y’all seem confused: the organization, Google in this case, is antognizing it’s organizing employees. Google absolutely do not, will not, can not approve of unionization efforts. Ever.

gnopgnip• 7 years ago

It doesn't really matter if google would approve. There are a lot of activities that would not be organizationally approved, but are protected concerted activities and it would be unlawful to fire someone for.

sbochins• 7 years ago

Sounds like a code review—which you should all be familiar with. Adding something like that to a security tool requires more approvals than two engineers sitting next to you giving a green light.

mkolodny2• 7 years ago

Not necessarily. If it's your job to add notices to internal tools, and you've added notices to tools before without approval outside the engineers on your team, then I wouldn't expect someone to get more approval than that in this situation.

If I were Google, I'd give the employee a warning (one of three strikes). I'd tell them that they need approval from someone in a certain role (that's not an engineer) to post internal notices. Otherwise, it's up to the employee and their fellow engineers to make a judgement call about which notices are right to post.

mtlynch• 7 years ago

She did it exactly according to internal policy. The extension she updated warns site visitors on many websites. I do not see what she did wrong.

Getting code review approval is not the same as following internal policy.

Adding a conspicuous feature to a security tool installed on every employee's computer requires approval from higher-ups before writing the code. The approvers should have recognized that and rejected the change, but that doesn't absolve Spiers of responsibility for the change.

As an analogy, suppose that I'm a crew member on a submarine. I have authority to fire torpedoes when a higher-up orders it, but I require a peer crew member to push their own "fire" button at the same time. Obviously, if I go rogue and start firing torpedoes myself, that's a serious violation, even if I convince one crewmate to go along with it.

Miner49er• 7 years ago

I'm not a lawyer, but on the surface this seems clearly illegal on Google's part based on the National Labor Relations Act of 1935. Does anyone know of any similar cases to this?

EDIT: Found one in Purple Communications. It was ruled workers can use work email to organize. https://www.littler.com/nlrb-creates-right-use-corporate-e-m...

idlewords2• 7 years ago

It's significant that she did this on her own. You need multiple people for protected concerted activity.

CharlesColeman17• 7 years ago

It sounds like she went through a code review process for the change, would that count?

dmix8• 7 years ago

People are acting like higher ups essentially approved this because of a code review process.

The logical leaps people are willing to take because they think the ends justify the means is interesting.

ummonk7• 7 years ago

Unfortunately, Purple Communications seems to have just got overturned at Google's urging: https://gizmodo.com/disastrous-nlrb-ruling-adds-another-hurd...

amachefe• 7 years ago

The can has been opened, i doubt it will stop with this. Any opinion that is not the companies position will not be tolerated. I bet the people who encouraged Google to "act" of opposing views did not think it through

whiddershins• 7 years ago

I see contradictory impressions about what this article is even saying.

My contribution is that it’s foolish to react too quickly to a story like this.

If the headline were accurate, it would be such an obvious own-goal on the part of Google HR, it beggars belief.

I think the wise course is to wait until more details are made public before getting worked up about it.

nerdponx• 7 years ago

If the headline were accurate, it would be such an obvious own-goal on the part of Google HR, it beggars belief.

I'm not sure about that. Outrage quickly passes and is forgotten.

dhimes• 7 years ago

What am I supposed to do with all of these torches then?

throw_m239339• 7 years ago

Of course we should wait for more facts to comment or try to think about the situation, but we don't live in a era of reason anymore.

All I have to say is that it will be interesting to see a drastic change in culture in the coming years at Google. Google did foster an "open" culture for more than a decade and now that their own employees are coming after the higher ups, they are trying to squash the rebellion they encouraged? they were fine as long as other employees or other businesses were getting the short hand of the stick...

Waterluvian• 7 years ago

The method in which she tried to notify co-workers is the real headline to me. It tells me that they really struggle to be able to communicate broadly with co-workers.

seriesf• 7 years ago

But that’s so untrue. Google internally has a number of different platforms with universal reach.

ramraj07• 7 years ago

I was initially tempted to side with Google, a code review process is not just rigorous enough for catching features being sneaked in.

However, it looks like the sole purpose of the extension is to warn employees about security issues in websites, and this engineer coopted that to show a union forming message.

The final paragraph suggests that there's legal precedence for doing this:

“You’re allowed to put posters up on the wall to help organize your workers, and this can be seen as kind of a digital extension of that,” said Veena Dubal, a professor at the University of California’s Hastings College of the Law in San Francisco. “Whether or not you’re in a union or there’s a union being formed, the law protects organizing activities by employees in the workplace organizing to improve their working conditions.”

makomk2• 7 years ago

I don't buy this analogy. If there's one thing news reporting has demonstrated over the last few years, it's that Google is not lacking in actual digital equivalents of noticeboards where people can put up the equivalent of posters. This seems like she decided that wasn't aggressive enough and implemented the political equivalent of slipping adware into a browser extension instead.

hannasanarion• 7 years ago

Putting adware into a browser extension that is already just adware (pops up messages on sites the employer doesn't want you to visit) is not a security risk.

foxyv• 7 years ago

Apparently Google was already doing this with other sites. Why is this one different? It wasn't like she put up something that was illegal or could increase Google's liability. It's one thing to say: "Hey we don't like that one, change it." It's another to fire someone when they engage in a protected activity.

If she had put it up and refused to take it down I could understand firing her. But this is suspect for sure.

tanilama3• 7 years ago

But everyone's laptop is NO public place, and this extension is installed under the endorsement and requirement of the company.

For someone who doesn't agree with her message, this is best case to shove a message down your throat, worst case a security breach to their computer.

ummonk7• 7 years ago

What do you mean by "someone who doesn't agree with her message"? You mean someone who believes that Googlers don't "have the right to participate in protected concerted activities"? That would just be ignorant of the law.

joshuamorton• 7 years ago

How is it possible to disagree with the message "You as an employee have a right to engage in protected concerted activity?"

This is just a legal fact.

trenning• 7 years ago

But those laptops are company property right?

ummonk7• 7 years ago

I don't think it was just security issues, but policy issues in general, so co-opting it was perfectly reasonable.

someonehere2• 7 years ago

Does anyone have the code approval process?

The chrome extension was modified but approved by two other people? Were these two other people on her side?

Regardless of policy or no policy, having an internal tool modified to say, “we have the right to organize,” clearly sets off some trust concerns with me.

If this extension was approved by two people who were on her side, then those two need to be removed as well and there should be a rethinking of the approval process.

panpanna4• 7 years ago

I believe this is an internal toy updated very frequently. It's by no means a "product":

This kind of code change happens all the time. We frequently add things to make our jobs easier or even to just share hobbies or interests.

felideon2• 7 years ago

Spiers' account of what happened: https://medium.com/@ksspiers/google-fires-another-worker-for...

panpanna4• 7 years ago

Thanks for the link. This section caught my attention:

I was interrogated about separate other organizing activities, and asked (eight times) if I had an intention to disrupt the workplace. The interrogations were extremely aggressive and illegal. They wouldn’t let me consult with anyone, including a lawyer, and relentlessly pressured me to incriminate myself and any coworkers

Sounds more foxconn than Google to me...

leadingthenet• 7 years ago

Personally, this is exactly what I assumed Google to be like when it comes to unionising.

whamlastxmas• 7 years ago

I don't understand this "wouldn't let me" stuff. Pull out your phone and call someone. Some random person in a meeting room at Google isn't the police. You aren't in custody. If you're uncomfortable then walk out. If anyone at my employer was the least bit aggressive to me I would immediately walk away.

sct202• 7 years ago

Google seems to be using tactics used on factory floors to suppress organization. It doesn't seem like a good idea considering how individual googlers have a lot more resources at their disposable compared to a hourly factory line worker. Whoever these consultants are, they seem to be providing very bad advice for a white collar environment where the workers are pretty wealthy and have friends who are in the media.

Kylekramer• 7 years ago

Lot of people are confusing "following standard procedures" with "immune from consequences". To be honest, looks like the employee got a few sympathetic people to sign off on an inappropriate use of a tool. According to the Verge, there are two other people who are also being disciplined.

kawfey5• 7 years ago

I'm starting to assume the two others are the two peer reviewers that approved the change.

tantalor• 7 years ago

That comment: "the company had fired someone last week for misusing the browser notification, and it had also disciplined two others as part of the incident"

https://www.theverge.com/2019/12/17/21024472/google-employee...

mariopt• 7 years ago

“You’re allowed to put posters up on the wall to help organize your workers, and this can be seen as kind of a digital extension of that,”

Well, that digital extension belongs to Google. If she wanted to rally company developers she could have used email, created her own website, slack account, WhatsApp, telegram, etc. There are plenty of channels that don't belong to Google.

I doubt anyone in upper management asked her to do this, maybe she took too much freedom and abused her privileged access? "Oh but someone else approved that PR", well probably they ganged up.

She is a Security Engineer, not HR/Management.

If this approved by HR/Management, there would be no problem at all but I think she/they did whatever they wanted without thinking about it.

maxk42• 7 years ago

As an employee, you have no right to put up posters anywhere in the workplace unless condoned by your employer. She must be conflating this concept with the requirement for your employer to put up posters informing employees of their rights to unionize when there's a unionization effort.

makomk2• 7 years ago

I don't think she'd even have to do that. Google apparently has internal communication channels for employees where this topic would actually be appropriate, there's probably legal precedent that they couldn't stop people using them, and if I remember correctly from previous news coverage their employees have in fact been using them in their attempts at union organizing.

scarejunba• 7 years ago

I'm glad not to be working with people like this. I think I really don't want to be working with people who want to push their pet topic on me via a security tool I consented to have installed on my work machine that's supposed to be helpful to me.

It would feel like a violation. Not "siding with Google" here. It just definitely would feel like a violation of my trust in the platform engineering team. At that point, I want them to promise not to do it in future, or get their software off my machine. And to be honest, relations are going to be strained between us anyway. I'm not going to be thrilled about any further software.

I don't even want reciprocal "I can push to you" powers. And I have no problem discussing these things where we agreed to discuss them.

But letting you install software on my machine comes with an obligation - you don't get to use that as a backdoor soapbox. Feels so very icky.

Like if a friend told me she would like to stay over and I gave her a key and she decided to plaster my home with posters. It doesn't matter if the posters are against the freaking Holocaust. I'm not pro-Holocaust and I'd want the friend to leave. Pronto.

jijji• 7 years ago

You can do all the things you want that are against the company, but it doesn't mean you have a right to continue to work there...

rolltiide• 7 years ago

So are you guys seeing unionization efforts picking up any steam?

I've seen it reach the collective conscious more in the last two years in San Francisco, but I'm not at a FAANG to see if its really permeating. As in at a bar or courtyard it might not be the most outlandish topic of conversation, compared to an idea immediately scoffed at since all of us made conscious financial decisions to pursue high paying jobs without union dues. People are curious about the benefits.

My only observation is that multiple of the largest publicly listed companies in the world are right here, and that the high compensation has nothing to do with what's possible. If compensation reached ratios with housing that haven't been seen since the 1980s, then the compensation would still be substantially higher on average than it is today. For reference, it means fully owning your house in 5 years. Not the 8-11 year situation that even highly compensated FAANG workers experience. But compensation may or may not improve with unionization, with the reality that higher comp outliers might disappear. The employees may have more say in other perks such as the company towns their employers have created in south bay. Overall at this point I am seeing net benefits, distinct from the public sector blue-collar work that unions have become associated with.

shantly4• 7 years ago

IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company

Anyone know the likely reasons your average Googler might have visited this consulting firm's site? Like, was Google sending employees to it for some reason (why?), or would it have just been by chance or because they read Google hired them in the news and wanted to see what they were up to?

helen___keller12• 7 years ago

From the engineer's medium post:

For example, someone changed the default desktop wallpaper during the walkout last year so that the Linux penguin was holding a protest sign. The company has never reacted aggressively in response to a notification such as this in the past. It’s always been a celebrated part of the culture.

I suppose this was her mistake: ""It's always been a celebrated part of the culture"

Google clearly does not always operate in good faith with it's employees on labor relations issues. The correct approach for her to take would be to get written approval from her manager on the popup

Her job was supposedly to "write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web", and this was supposedly a notification of one such company policy, but it was naive to think she could just approach her job in good faith and be treated in good faith. BigCorp follows the law of the jungle, and workers are not unionized at google so every engineer has to cover his or her ass before treading into contentious waters.

For what it's worth, after reading both points of views I think her actions were highly reasonable. But I would never implement that kind of notification like she had done, not without written approval from my boss and maybe my bosses' boss to cover my ass.

debt4• 7 years ago

It’s sort of ridiculous to think any boss would approve this, which is why she did it the way she did it in the first place.

helen___keller12• 7 years ago

I don't really agree. The notice is required by law to be posted in workplaces. It's also required by law for Google to post it on their intranet. It's not a stretch to provide a link to that intranet info, in an add-on that provides links to company policy - assuming you are operating in good faith.

But again, law of the jungle and all that. If I were her boss and she came to me for approval, I also would get approval from my boss and my bosses' boss.

settsu2• 7 years ago

But I would never implement that kind of notification like she had done, not without written approval from my boss and maybe my bosses' boss to cover my ass.

If this is something that goes through your mind, the organization you are at is broken and probably dangerously hostile.

helen___keller12• 7 years ago

No, this is just the truth of working at BigCorp. Most engineers can pretend office politics doesn't exist because they're working in primarily nonpolitical roles. But office politics exists, for any office. And unionization is political.

Ocerge• 7 years ago

The entire landscape of being a wage slave is "dangerously hostile". I can't think of any place I've ever worked where I would think this was a good idea if I wanted to keep my job. Not saying I agree that I should lose my job for organizing in this manner, just saying the net you're casting is probably too narrow.

scarmig6• 7 years ago

I feel like, for consistency, if she committed a firable offense, so did her coworkers who LGTMed the CL, unless she intentionally deceived them about having gotten organizational approval.

My gut is that if she had spammed a bunch of internal mailing lists, she'd not be being fired or even getting a formal reprimand. But the fact that she hijacked an internal security tool for an unintended purpose is alarming. I am fine granting Google rights to run arbitrary code on my browser, but only because I know it has strict processes (including disciplining of employees who subvert the process) to manage submission and deployment of that code.

My preference here would have been for her to get a rebuke and an explanation of why this was bad behavior (unless these ad hoc non-security related messages are common), especially since she's young. But there is a core assumption and trust that is violated when someone abuses control of trusted client code to do something unapproved by organizational review processes.

Most of my anger is directed at the approving coworkers, since they should know better, assuming they are more senior than her.

kords• 7 years ago

“We dismissed an employee who abused privileged access to modify an internal security tool,” a Google spokeswoman said in a statement, adding that it was “a serious violation.”

This doesn't sounds like privileged access, it sounds more like they have issues with their pipeline. If all what it takes for code to get in Production(even if it's internal), is at least two approvals, I think that's a bigger problem.

w0m3• 7 years ago

Partially true, her code reviewers should have said, 'hey - that popup isn't the point of the . tool' and nixed it there.

She was a member of the group maintaining that toola and abused her authority for a personal crusade; hence terminated.

jmpman• 7 years ago

I’d call this bold.... ideals aside, maybe she calculated how much she’d win in the lawsuit? Possibly a large net win?

itronitron• 7 years ago

It seems to me that Google fired Ms. Spiers specifically to discourage future labor organizing activities within Google. Because it was a process-approved insignificant revision by both functional change and reach means that the inevitable Streisand effect actually plays in Google's favor. They will be perfectly happy with any slap on the wrist as long as it moves the eventual union further down the road.

DSingularity• 7 years ago

These efforts will be broken up. No matter the cost. A google beholden to unionized employees is a threat to the establishment. Where google goes other companies go. A democratized tech space is the last thing power wants.

andai• 7 years ago

Google’s response to this was to suspend me immediately and without warning. This was the week of Thanksgiving, the same day they fired the Thanksgiving Four. They also dragged me into three separate interrogations with very little warning each time. I was interrogated about separate other organizing activities, and asked (eight times) if I had an intention to disrupt the workplace. The interrogations were extremely aggressive and illegal. They wouldn’t let me consult with anyone, including a lawyer, and relentlessly pressured me to incriminate myself and any coworkers I had talked to about exercising my rights at work.

jmull• 7 years ago

It sounds like she coopted a security tool to spam users with a political advocacy message.

Hard to see why she shouldn't be fired for that.

Of course she has the right to express that message, and it seems to be factually correct. But that doesn't mean she can use a security tool to spam people.

overgard2• 7 years ago

I'm not anti-union, but come on, modifying an internal security tool to display a politically motivated message? That would get you in trouble anywhere. Also.. managers are humans. You can't provoke people in such a way and not expect a response.

Speaking of provocation: I suspect she might have done this to intentionally get fired. It wouldn't be the dumbest play, she's super young (21), if she doesn't want to code anymore she could use the exposure to parlay this into a new career, and if she does want to still code, she probably made some new supporters and her detractors will factor in youthful indiscretion. Wild speculation sure, but, you just read a big press article about it... Where do you think the tip came from? This isn't the kind of move you make if you intend to stick around at a place.

TheFrizz2• 7 years ago

Also the people arguing for giving the employee a "talking to" instead of firing I think are not considering the game theory aspect to this.

If the precedent is "a talking to" with future offenses resulting in a firing, then smart Google employees will realize that they can create an internal activist email list, get new hires to join it, and then when an opportunity for activism presents itself get an employee with a clean record to perform the activism, rinse repeat.

Of course the message in this case wasn't terribly harmful, so I'm sympathetic to the argument of "it's not such a big deal". But the problem is, Google doesn't want to wait for the big deal (for example a chrome extension change to search exec's TextAreas for keywords a "whistleblower" might want to report on) to actually happen and then fire them. They want to prevent employees from thinking they should ever try doing that in the first place which means putting the foot down before the inevitable happens.

overgard2• 7 years ago

Yeah, in terms of what she did I would agree it wasn't terribly harmful; and I applaud her for taking a principled stand. I just don't really blame management for saying: that was a step too far, you're out. I mean, unionizing is a super sensitive topic at any company, and by adding the message to the tool it added extra weight to the message by making it look like it was endorsed by the higher ups, rather than being a message from a 21 year old. There's no way management is going to be happy that someone is essentially acting as their voice on a topic that is very sensitive.

40acres• 7 years ago

I interviewed at Google last week and asked 3 of my interviewers if the constant churn of bad news from the outside gets to them.

For the most part, no one seemed concerned and the biggest complaint was regarding leaks which make it harder to deal with issues internally and threaten transparency.

yahyaheee• 7 years ago

Had this been an isolated incident, I would maybe have been on googles side here, but this is happening in the context of many other anti-union efforts by management

debt4• 7 years ago

“a poster in the cafeteria is not the best way of reaching the majority of Googlers.”

I heard the food had gotten bad, but I didn’t know it was this bad.

KirinDave8• 7 years ago

The irony of this is that Google's increasingly abusive behavior towards people talking about organization is that they're actually building a case for engineers to unionize to stop Google from these questionably legal firings.

If Google upper management had just shut up and kept the status quo and recognized that without impetus, comfortable workers almost certainly won't organize in America, then the unionization of Google would not be a national topic.

But here we are, with holdout reactionary bro's who ate the Ellison/Jobs/Schmidt wage-fixing cartel line about how evil unions were (even as they organized to oppress workers) in positions of power opening up the company (and thus the company's stock) to huge liability.

thu21114• 7 years ago

I think a lot of people are missing the bigger picture here and are too zoomed in on the specific issue of unionisation. Google really had no choice here, and it's actually a problem for them that this is coming out now via a blog post by the fired employee and not by their own admission.

Google is in a phenomenally trusted position in the world. Chrome is the most popular browser. It auto updates silently and continuously, as do installed extensions. Vast swathes of information and infrastructure is accessed via web apps. We tend to forget that browser makers have access to all our authentication tokens and can do whatever they like.

Put simply, given the level of web dependence in our lives and infrastructure, those who can modify browsers are practically gods. The same goes for operating system developers of course.

We don't think about this because our level of trust in those developers and the corporations they work for is extremely high and deservedly so: after decades of using operating systems and web browsers they've never violated that trust. In fact they've reinforced it by rolling out encryption to block rogue government departments who were exploiting the lack of it, they've invested heavily in security to lock out hackers and done many other great things.

But trust is hard to build and easy to destroy. What if browser makers stopped being so trustworthy? What if they started to become convinced of their own superior morality, the correctness of their political judgements, the importance of their role in the world? What could they do?

They could use SafeBrowsing to arbitrarily censor the web.

They could edit out individual comments, rewrite news stories, insert their own views into the middle of documents purporting to be neutral. They could distort your view of the web at will.

They could violate our privacy at will by linking our identities together and then publishing what we've written, they could publish browsing logs, they could take over any accounts we have and use them for whatever purposes they like, they could feed sensitive information to political enemies to give themselves plausible deniability, they could even frame us by posting illegal material under those accounts. It'd just look like someone phished the password.

They could do many other things we never even considered.

Google absolutely needed to go nuclear on this employee. The news has been filled over the past years with stories about Googler's increasingly hard-left political activism. As a consequence some users and even politicians have started to wonder if Google Search is trustworthy, but their trust in browser developers is so total, so blind, the world hasn't yet taken the next mental leap and started to wonder if Chrome is. Mozilla is hardly in a better position: it's funded by Google and literally just down the road from them. If the integrity of the Chrome devs start to be doubted, few will consider Mozilla devs to be radically different.

Inserting political JavaScript via browser security mechanisms targeted at Googlers, even if it may seem fairly harmless in this case, is a very problematic situation and a slippery slope Google simply cannot afford to go near. It raises fundamental questions, like are Google's internal procedures robust? What else might have been slipped through code review already? Are Google employees only adjusting their own tools or did some already start to abuse their access to people's private data and systems? How many of them feel the ends justify the means when dealing with political causes they feel passionately about?

How safe is Chrome, really?

thinkingemote2• 7 years ago

She didn't weaponise a neutral extension. The extension was already weaponised. It already pushed notifications to users when they visited flagged URLs. She probably just changed a config file to add a new rule and message, 1 line.

chance_state2• 7 years ago

It already pushed notifications to users when they visited flagged URLs.

Did it push notifications with a particular political message? I don't think it did.

w0m3• 7 years ago

1 line, but completely changing the point of the tool in the first place

gvx• 7 years ago

I'm constantly baffled by how anti-union many Americans are, how willing to give up their rights.

chance_state2• 7 years ago

My impression of these tech unionization efforts are that they're mostly about pushing a social/political agenda, with workers rights being an afterthought.

Every single time I see these posts the involved employees are activist LGBT folks.

Am I wrong here? Why do all these issues seem to stem from the same group of people?

bluntfang3• 7 years ago

That's a great question. Are you familiar with the historic treatment of LGBTQ+ folks?

TechBro86152• 7 years ago

I’m constantly baffled how Europeans, who get paid 50-60% as much as Americans, and have almost no innovative companies of their own, think their system is somehow better.

jdauriemma2• 7 years ago

Can you define "their system" in plain language? Are you referring to unionization in particular, or are you framing a broader narrative?

raxxorrax4• 7 years ago

Perhaps the thought comes from the lack of that many homeless people on the streets.

ainiriand• 7 years ago

I think it is incredible that she is 21 and already fired by Google.

throwaway17_17• 7 years ago

I can not seem to find any energy to be against Google here, a 21 year old individual working at one of the most prominent and successful business in the world, making more money per year than a vast amount of the global (not to mention national population) does something that will certainly subject her to reprimand and I am expected to feel some negativity toward Google. I am stuck outside of SV, as a middle age person with many, many hundreds of commits to open source projects, a descent of non-professional experience in software engineering, but because I do not have a BS or Masters in computer science and am over the age of 35 there is no chance I can ever get hired at Google (or any other FAANG realistically). If some of these ardent unionization workers end up fighting loudly and publicly and Google decides they will not deal with some nascent Software Engineer’s Union, maybe I and people like me stuck outside the valley will be able to gladly make boat loads of money working long hours for these thankless corporate taskmasters, while just sitting down and doing our jobs on whatever the company decides it wants to spend its money on, I will gladly work on Maven or Dragonfly or dark as patterns, whatever, I just want to be relevant to the industry not stuck away doing the same job for peanuts until I can afford to retire.

Rant over - but seriously, I don’t have a problem putting aside any personal feelings or beliefs to achieve my employers goal, that is what employment is. Spiers apparently decided that the security position allowed for this action and did it. Google did not want this type of behavior from an employee in that position. She knew Google management wasn’t going to approve, she assumed that risk.

drakonka2• 7 years ago

It feels weird for me to read comments in this thread debating about and assuming a simple note about unionization or organization by an employee whose job it was to do exactly this kind of thing is "not in good faith" or a "violation". In my mind this kind of thing has the same sentiment as _any_ policy notice. The world in which notifying people that they have the right to organize is a "violation" is a really messed up one. It's simply distributing a fact, as the company is legally required to do, published by an employee who was responsible for distributing exactly these kinds of facts. It's sad when this type of information sparks this kind of a) termination by the company of an otherwise apparently very well performing employee and b) controversy in a forum.

s1artibartfast2• 7 years ago

by an employee whose job it was to do exactly this kind of thing..

I think this is the crux of the issue and people are making up the facts they don't have to fit a narrative.

There is a reasonable difference between security notifications and other corporate policies.

Were any non-security notifications in scope for their job or the tool used?

Is there precedent for google flagging specific external websites with HR policy notices?

sneak• 7 years ago

Choosing which facts to be highlighted is an editorial decision. Google probably already complied with the letter of the law by publishing this fact internally at least once.

Whether it is published once or 1000 times is editorial. It is not within scope of their job to notify >1 time if Google’s management wants employees to be nominally reminded of their rights against their employer exactly once.

Note that I am not arguing for or against; I personally think it’s wrong she was fired and I hope the wage-thieves at Google get held to the flames over it. But let’s not pretend that she wasn’t editorializing because it can be described as “simply distributing a fact”.

She was further distributing a fact which is in her former employer’s best interest to publicize the minimum amount required by law.

That’s why retaliation like this is illegal. I’m surprised they’re surprised; Google has already conspired (and gotten caught) to illegally cheat employees out of billions of dollars of wages.

malvosenior• 7 years ago

You can read her own words to see it wasn't in good faith:

https://medium.com/@ksspiers/google-fires-another-worker-for...

Recently Google was forced to post a list of rights that we have in the workplace. So when I heard that Google had hired a union busting firm and started illegally retaliating against my coworkers, I decided to make sure that my coworkers knew about the posting.

She was mad at her employer and used her role to retaliate.

I created a little notification, only a few lines of code, that pops up in the corner of the browser whenever my coworkers visited the union busters’ website or the community guidelines policy.

It only mentions the union busters' website in the OP but she also says it popped up a notification when people visited the community guidelines policy. That's pretty invasive, this is a notification everyone will see.

abj4• 7 years ago

I agree with Drakonka that it's dystopian when being moderately assertive talking about labor rights is viewed as a reason to fire someone. Especially when these kinds of notifications have a history of being used to tamely spread information before ("Happy Birthday Sundar!" popping up when any employee visited google.com). Reminds me more of the rules for posting on a bulletin board.

Edit: "Happy Birthday Sundar!" didn't actually happen, my bad.

workthrowaway3• 7 years ago

you forgot that some of us are debating the sign-off process as well. the most surprising aspect if you ask me...

ggggtez3• 7 years ago

“You’re allowed to put posters up on the wall to help organize your workers, and this can be seen as kind of a digital extension of that,” said Veena Dubal, a professor at the University of California’s Hastings College of the Law in San Francisco.

This professor completely ignores the sign-off, and I wonder if actually it's really important... Can we really call it a digital-extension of a wall, if it's impossible to put something without 2 approvals?

manfredo4• 7 years ago

There's a difference between leaving a "simple note" and abusing a security tool to spam employees. Google is tired of employees using their job as a political soapbox. Furthermore, it sets a precedent. Next week someone uses the same tool to argue against unionization. And now Google had to let them do it or they'll be seen as being impartial.

ggggtez3• 7 years ago

The thing that gets me is that this isn't a "message board" or email, or forum... or anything like that. They needed 2 approvals to put this message out there.

It doesn't sound like just anyone could do this, but only people with specific privilege and approvals.

A company being "legally required" to do something doesn't mean that individual employees can decide for themselves to implement that policy... Otherwise you could ask random employees to Right-To-Be-Forgotten and delete you from Google...

I think the real questions are: 1) Was it part of their job? [no] 2) Was it a message board? [no] 3) Was it protected speech anyway? [unsure]

BickNowstrom3• 7 years ago

I would start protesting Google if they did not fire a security engineer for abusing systems like this. A security engineer subverting internal security systems is what is messed up. Turning it all in a horrible PR story about a retaliatory union-busting firing should disqualify your career for many years to come. Maybe she can exchange this loss of career prospect for some activism credit against the Big Bad Google.

Performance does not matter: fire both the genius and the slacker for abuse. The factual content of the message does not matter: fire both those who lie, spam, or those who distribute relevant activist messages. Legally required company does not matter: if it is not your role, it is not your role (distributing these "facts" was never part of her job description, it has nothing to do with security. It is also naive to assume Googlers visiting that very website would be interested or unaware of this policy notice).

The controversy is because people have different opinions: those who feel activism trumps profession, and those who feel it don't. Like said, any company that employs security engineers who hold their activism as more important than their profession is a dangerous company worth avoiding. I am glad this firing happened.

fzeroracer2• 7 years ago

Subverting internal security systems by going through the usual approvals process for a code review? When it was her job to add notices to the tool she was working on? And arguing that she deserves to have her career sunk because of it entirely?

What absolute extreme bullshit. By your own arguments if a security engineer was advocating for increased security against management, they would be considered an activist and someone that deserves to be fired, tarred and feathered and tried as a witch.

freyr4• 7 years ago

Using access granted to you as a developer to alter work tools to spam controversial messages to your coworkers is wildly inappropriate and unprofessional. There's no rationalization that makes this acceptable behavior.

drakonka2• 7 years ago

This is exactly what I'm talking about - that we consider a message about organising/unionising to be so controversial at all. To me that is some dystopian level weird.

jpmcglone• 7 years ago

I see no issue here. Business feels threatened and neutralizes threat.

There's nothing wrong with Unions, but there is something wrong with government-backed unions.

Let people collectivize if they'd like. Collective bargaining is fine, and you aren't living in a free country if you can't collectively bargain -- but collective bargaining shouldn't mean you automatically get government as an ally.

The battle between Union and Company should be between Union and Company.

papreclip• 7 years ago

Eventually these political types will convince google it's not worth hiring them

ggggtez3• 7 years ago

When I read this, and the other one, the only idea that I can come up with is that everyone is lying, at least a little bit.

It seems pretty unlikely that it would be within your job description to create notifications like this on specific websites, and from reading the blog post and the content here, it seems like these notifications are not meant for "company policies" whatever that means, or at the very least it doesn't make sense why a "security engineer" would have a job that notified employees about this.

So, the assumption therefore must be that this person knew they were going out of the norm, but assumed it was acceptable or protected speech.

That raises a good question: Is it the same thing as a message board? My gut instinct is... no, it really isn't.

This sounds like a tool that requires a specific level of authority to use (you need 2 approvals). Not just anyone can put notifications like this in the tool! So this isn't like a message board... this sounds like it was a person abusing their privileges.

Now, for me the next question is: does that mean they should be fired? Personally, I'd say... no. It shows bad judgement, but firing seems disproportionate. In that regard, even if it was a misguided attempt at using their organizing rights, there is an argument to be made that they shouldn't be fired for it (maybe warned, but not fired). So I think even though it sounds pretty fishy, I think there is likely still a possible case here for workers rights issues (though I am not a lawyer).

miguelmota• 7 years ago

The message in the popup was:

“Googlers have the right to participate in protected concerted activities.”

which seems pretty reasonable since her job is literally to place notifications of what employees legally can and can’t do when visiting websites.

mtnGoat• 7 years ago

This as a whole just doesn't look good for Google/Alphabet, but then again the optics of a lot of their choices lately have looked very poor from the outside looking in.

Honest question for long term(4+ years) Google Engineers reading... has the change in culture and bad press lately had any effect on your feelings towards your employer? Do you think it is eroding their culture at G? Do you see any of this leading to a loss of talent?

abj4• 7 years ago

They also dragged me into three separate interrogations with very little warning each time. I was interrogated about separate other organizing activities, and asked (eight times) if I had an intention to disrupt the workplace. The interrogations were extremely aggressive and illegal. They wouldn’t let me consult with anyone, including a lawyer, and relentlessly pressured me to incriminate myself and any coworkers I had talked to about exercising my rights at work. [1]

Why was this necessary by management? Regardless of what Kathryn did, this is a bad faith move by management.

[1] https://medium.com/@ksspiers/google-fires-another-worker-for...

WhompingWindows2• 7 years ago

"They wouldn’t let me consult with anyone, including a lawyer"

Yikes, that feels so dystopian to me...

twobat• 7 years ago

How does one get to update a Google extension (internal tool) at 21 without any other oversight?

tomerico• 7 years ago

It looks like Kathryn posted her side here - https://techcrunch.com/2019/12/17/google-has-fired-another-w...

A few interesting tidbits: 1. She received extraordinary performance ratings during her short time at google, and got promoted recently 2. Google has not acted this aggressively in the past, where someone deploy a change in people’s Linux wallpaper while the protest happened. 3. She limited the notification to just people visiting the union busting firm

Given those, it does looks like an unusually aggressive response from Google, which would imply that Google has become very aggressive when it comes to unions.

With that said, it is also mentioned in her post that it took several weeks of investigation from Google until they made the final call, which could imply that there is more of a back story here.

FpUser• 7 years ago

It is a right of a juror to say that the defendant is innocent even though the law says otherwise (jury nullification). But trying to inform jurors about that jury nullification right can get one into a very hot water.

Arete314159• 7 years ago

She should have just put up flyers in the women's bathroom stalls. If Google is anything like my old workplace, there's no chance any management would've seen it...

sjg007• 7 years ago

This will be a great lawsuit and exploration of the right to organize in the digital age.

WhompingWindows2• 7 years ago

In the end, how much would unionizing hurt Google's shareholders/executives? Surely they have enough riches already, why not allow the employees to improve their lot as well?

shaneprrlt• 7 years ago

Moral of the story: don't use internal security tools at your work as a platform for your political activism.

Totally agree with the spirit of what she did and applaud her efforts to organize, but there's no way she didn't know what she did could get her fired. What did you think would happen when you made unauthorized changes to software that promote actions against the company's interests?

Not saying the company is a blameless party (especially after the news today of their expiring cloud business, this is clearly a shady company), honestly, I'm not even commenting on the substance of what she wrote.

This just seems like something that anyone with half a brain would realize could get them fired before they deployed those changes.

I still feel bad when anyone loses their job and source of income, and maybe a reprimand would have been more balanced given her high performance reviews before, I just can't see any context where this is seen as neutral or ok.

Animats• 7 years ago

This is an old labor issue, but it used to revolve around handing out union flyers at work and posting on company physical bulletin boards.[1] That's generally allowed by law for labor activity, even if the employer doesn't like it. How this translates to online activity isn't entirely clear yet. But courts will make that analogy.

An employer who tried to pull this in 1970 would have had a picket like outside the door the next day. Union truckers wouldn't deliver to their loading dock.

[1] https://www.jacksonlewis.com/resources-publication/employers...

Vervious• 7 years ago

How come this is so low on the front page? It was posted 4 hours ago and has accumulated 607 points...

nothal2• 7 years ago

One thing this thread has made me realize is that the work culture (at least of Googlers on HN) seems to kowtow to the company over the employees. Really affects my view of the company.

uwuhn• 7 years ago

Is there a major company, tech or otherwise, that breaks this convention?

Andrew_nenakhov• 7 years ago

Bring your whole* self to work.

* but please leave some tiiiiny little bits home

axython• 7 years ago

Kinda stupid question, but why are people that want to unionize in Google dont? Is there a certain limit, requirements?

someonehere2• 7 years ago

I’ve decided that if I’m at work, please keep me out of your protest. Let me decide how I want to react to a company policy my way. Don’t violate the trust given to your team of managing my work tools to inject your political/social objections. Organize outside of work.

yahwrong• 7 years ago

Let the freemarket decide! If people don't like this then they can stop working for Google or using their products.

nswest23• 7 years ago

arguing about the minutiae of whether google acted in accord with their own policies is exactly what google wants to happen here. She was fired for organizing. Google found a valid excuse to fire her but make no mistake, she was fired for organizing.

Engineer says Google fired her for notifying co-workers of right to organize

Related Stories