Leaked Document Says Google Fired Dozens of Employees for Data Misuse

https://www.vice.com/en/article/g5gk73/google-fired-dozens-for-data-misuse

by jbegley • 5 years ago

107 55 5 years ago

Spokesperson quoted in the article as saying that this mostly relates to corporate IP and things like that. No confirmation that any of the cases were related to stalking users or other misuse of user data. Cases like the dismissal of Margaret Mitchell would probably be counted among this number. Other probable examples would be if someone gets dismissed for leaking data about upcoming products.

nomdep• 5 years ago

Or maybe internal forum posts to magazines like Vice

gowld3• 5 years ago

10% (4) of last year's cases were in the "misuse of systems" not "confidential info" bucket.

But "misuse of systems" could be mining Bitcoin or whatever, I guess.

newbamboo• 5 years ago

“Insider abuse is a problem across the tech industry”

Rarely do I think we need more laws and regulations, but that these are not disclosed to the public and impacted users as data breaches strikes me as terrifyingly unjust. When cops misuse power to do this they are criminally prosecuted. Seems appropriate.

jedimastert• 5 years ago

When cops misuse power to do this they are criminally prosecuted.

I don't disagree that this is completely unjust, but cops are also completely under-prosecuted for basically anything (in the US, at least).

eli• 5 years ago

And in most cases are in fact legally immune from any personal liability.

trasz2• 5 years ago

US isn’t really representative for a proper law enforcement regulation, just like it isn’t a good example of working health insurance. Or the judicial system.

jeffbee2• 5 years ago

There’s literally nothing in this article about user data, except innuendo. Every time they say user data it is at the end of “company secrets or user data”. They can construct the same misleading sentence out of “company secrets or the location of the holy grail” and it would be just as true.

hn_go_brrrrr• 5 years ago

My read is the leaked doc itself used this construction. If so, it's Google doing the obfuscating, not TFA.

ronnier• 5 years ago

This is why end-to-end encryption is so important. Only a matter of time before some employee dumps a database of highly sensitive chats, emails, etc on the internet. With e2ee that just wouldn’t matter as much.

tester34• 5 years ago

why would anyone want to basically not only throw himself into the jail, but also lose $300k career? I guess juniors do not have access to prod dbs

gowld3• 5 years ago

To make a new career in the QAnon industry.

https://www.amazon.com/Google-Leaks-Whistleblowers-Expos%C3%...

maccard• 5 years ago

Not all of these people would have been engineers, some may have been support people or account managers.

zionic• 5 years ago

Why would someone shoot up a movie theater?

Humans do not always act in their rational self interest.

jcims• 5 years ago

I've worked in infosec at a FAANG and large corporate environment, and the amount of eye watering stupidity I've seen from brand new employees is difficult to reconcile with the prevailing theories about the level of intelligence they hire. It's like they spawned into a whole new universe and don't have any understanding of what is expected of them.

raxxorrax• 5 years ago

I guess people would spy on those they know and the answer is curiosity.

Most people would think they won't get caught and there is probably a large number of unreported cases.

gowld3• 5 years ago

A matter of negative time.

https://www.amazon.com/Google-Leaks-Whistleblowers-Expos%C3%...

jasonvorhe2• 5 years ago

Uh, yeah, one of those project veritas stunts:

Using Google's own internal search engine, Zach discovered their six-part plan for complete information dominance and released 950 pages of these documents to the world in June 2019 with an appearance with James O'Keefe on Project Veritas, which quickly became one of their most popular stories.

Of course he's into QAnon and thinks that Covid-19 was planned: https://www.vice.com/en/article/k7qqyn/an-ex-google-employee...

What a great source.

jnwatson• 5 years ago

End-to-end encryption doesn't really matter when the insider has access to the keys.

Encryption doesn't really change the problem. It moves the problem from access control over the data to access control over the keys.

dtech• 5 years ago

If the insider can have access to the keys it's not end-to-end encryption.

bhawks4• 5 years ago

I think we have to be honest that the state of the art for end to end encryption doesn't work well yet for many types of usescases beyond 2 way communications.

How could you make an e2ee calendaring service? E2ee google sites like page with groups based access control? Realtime group collaborative editors?

Any one of these features is distinctive and novel enough that if you had something that worked even in a moderate scale you could turn it into a company.

Traubenfuchs• 5 years ago

Imagine working on your countries tax return backend and having access to a staging database that's just the prod database 1 year behind. That would be wild.

Wherever normal people have the access to gain an information advantage, they will.

pcbro141• 5 years ago

In Sweden, Norway, Finland, the government leaks this info for like 30 Euro. You can know anyone's taxable income.

12ian34• 5 years ago

Just to be clear, "leak" isn't the correct verb to use here given that it's not "private" information. It's an official state-sponsored database and searches are non-anonymous (you find out the names of who has been searching you).

lordnacho• 5 years ago

Surely you would expect a firm like that to have access logs, and scan them periodically? You'd be caught if you tried to look at stuff you weren't supposed to, without a doubt? Why would someone even try?

jasonvorhe2• 5 years ago

Even "super smart" people like Anthony Levandowski think they can outsmart fully managed company laptops and audit systems while bulk downloading/copying code and other IP to hand it over to another company.

eplanit• 5 years ago

I love that the evidence of data misuse is from "leaked" documents. Perfect.

stingraycharles• 5 years ago

I think leaking documents is very different than data misuse. Data misuse is harming to the individual, while leaking documents is harming to the company. As a matter of fact, leaking this document may even have positive effects in the long run on the behavior of the company.

koheripbal• 5 years ago

The article specifically says that some portion of those terminated employees were caught sharing internal documents externally (leaking).

bhawks4• 5 years ago

They both rely on the same mechanism though, just different impact and intent.

mistrial9• 5 years ago

Vice figured out Larry Bri11iant now ?!?

fay59• 5 years ago

Has anyone ever publicly talked about controls on user data access at Google? There’s several folks defending Google here, but employees’ goodwill above sont number of people who have access will almost necessarily fail at some point.

EricBurnett• 5 years ago

A good starting point for reading is https://cloud.google.com/security/binary-authorization-for-b... . It also links out to other whitepapers covering different dimensions of the problem.

jeffbee2• 5 years ago

Another good one, which is not linked from there, describes how RPCs are authenticated and authorized. https://cloud.google.com/security/encryption-in-transit/appl...

azinman23• 5 years ago

Why is this news? I’d expect in large organizations there to be occasional abuses, and it’s great that they’re caught and fired. To me it’d be newsworthy if they were not fired.

stefan_• 5 years ago

If your org handles user data and never fires anyone for abusing access to that data, it's probably only because you have no effective process to detect it.

azinman23• 5 years ago

Or you have a really toxic culture. I believe that was the case early on at Facebook with “god mode.” [1]

[1] https://therumpus.net/2010/01/conversations-about-the-intern...

bryan_w• 5 years ago

Wait a second, I never hear about police officers being fired for abusing license plate/id lookups....

mabbo• 5 years ago

I would be more concerned if this wasn't the case.

Google is enormous with thousands of employees and a lot of data. There will always be an edge case where an idiot employee decides to do unethical things, looking at data they shouldn't.

If no one had been fired for this, I would presume that means Google either isn't paying attention to who looks at what, or that they aren't firing people when they find out they've done this.

Krasnol• 5 years ago

I'm still concerned because once you have data, humans will be humans and chances are that those which really thought that through were not caught.

That's why I practice data avoidance and data economy.

ARandomerDude• 5 years ago

Agree with your point.

It reminds me though, that are some industries that frankly know more about you than they should (e.g., mortgage loans). I don't think the politicians have found the right balance of not creating another housing crisis, and requiring your neighbor to know virtually everything about you just to get the keys.

deadalus• 5 years ago

From June 2021 : Facebook reportedly fired 52 employees who were caught spying on users

https://nypost.com/2021/07/13/facebook-reportedly-fired-52-w...

handrous• 5 years ago

It's yet another indication that what they're doing is fundamentally a terrible idea and should be outlawed.

Another is that private companies holding massive databases of info about everyone is barely better than the government doing the same, if you're more worried about government abuse than private abuse of data. Many companies can and do sell access to governments, and of course warrants & other orders exist.

(yes, this also applies to the "credit bureaus", banks, and all sorts of other companies that hoard and sell all kinds of creepy stalker data about people)

fxtentacle• 5 years ago

Maybe Google's data trove is blackmail-profitable?

If someone evil working for Google looks at a millionaire's private data, will they be able to blackmail them for more money than what they lose if Google fires and potentially sues them?

I'd be really interested in the answer, because if it is yes, then Google is surely collecting way too much information and it is actually somewhat reasonable for people to "game the system" and take advantage of it. Of course, I fully agree that it is illegal and unethical, but so are shoplifting and robbing people at gunpoint, and both of it sadly still happens quite regularly.

Also, I remember a while ago reading about some sort of professional insurance and broker that celebrities use to pay off what is effectively journalists attempting to blackmail them.

"Schmidt has a reputation for contacting celebrities in advance of trying to publicly sell private photos or videos to see if they want to purchase them back."

https://www.dailymail.co.uk/tvshowbiz/article-471218/Sultan-...

https://www.businessinsider.com/10-victims-of-celebrity-blac...

bhawks4• 5 years ago

I'd be really interested in the answer, because if it is yes, then Google is surely collecting way too much information

An example from the article has an employee listening to children's voicemail. Google operates a voicemail service. It is not clear to me how you would operate a voicemail service without storing that data somewhere. (Yes e2e encryption, however let's acknowledge that is very uncommon).

Google operates a number of services (docs, Gmail, photos, etc) that require the storage of sensitive data and I am actually happy they have programs that seem to be catching internal abuses.

specialist• 5 years ago

All PII must be encrypted at all times. At the field level.

Translucent Databases explains how.

https://www.amazon.com/Translucent-Databases-Peter-Wayner/dp...

http://wayner.org/node/46

Source: Was once an insider. Created and ran electronic medical record exchanges.

giardini• 5 years ago

Governments and corporations that have access to private and/or protected information have dealt with this problem for decades. I would be surprised had Google not years ago established policies to deal with misuse or improper/illegal access to information.

Information systems are very open to snooping by programmers and tech staff, however. Ultimately some (usually small) group of employees must be trusted more (but never completely) b/c they have access to the network, programming or databases. Audit trails, logs, encryption and yes, "internal affairs departments" all play a role in maintaining a secure system so that even the god-like programmers must be careful not to overreach.

I've never heard of a reference to "Google IAD" but I certainly hope one exists.

bhawks4• 5 years ago

This is a problem for any product that stores and retrieves user data. It is not just a Google problem. It is not just a 'devs shouldn't have db access' problem.

If you're working on a system that doesn't have data usage policy, one where there is no auditing or monitoring mechanism and no visible enforcement being done against abusers you don't deserve your customers trust because you're not protecting their privacy.

skered• 5 years ago

There are dozens of us... DOZENS

eterevsky• 5 years ago

As a Google employee I would expect very few cases of unauthorized user data access. There are lot of security checks around access to user data. I would guess that almost nobody has raw untracked access to sensitive data. Some engineers may have direct access to storage layer, but wouldn't be able to read the data because it is encrypted. Some others could read the data, but can't do it without all of their operations being logged and potentially audited.

Leaked Document Says Google Fired Dozens of Employees for Data Misuse

Related Stories