Hacker News Reader

Perhaps there was something specific about that specific instance that made it fraud, but reselling a phone isn't fraud by default.

Not interested in needing to beg a horrible algorithm or become internet famous just to get ahold of a human that might turn my digital life back on.

I'm only speaking in general terms here, not specifics.

However, reselling phones is usually against the ToS of pretty much every retailer. This isn't unique to Google. Here are our ToS - https://store.google.com/intl/en-US_us/about/device-terms.ht....

> You may only purchase Devices for your personal use. You may not commercially resell any Device, but you may give the Device as a gift. Recipients of gifts may need to open and maintain a Google Payments account in order to receive any support offered by Google. These Terms apply to any gift recipient.

I'd like to see you walk into an Apple store, and buy 10 iPhones. Or say, 100?

In fact - Apple even introduced controls to stop scalping of Genius Bar appointments:

http://www.idownloadblog.com/2013/09/12/apple-store-genius-b....

Or say you create 100 email accounts - john001@gmail.com, john002@gmail.com, john003@gmail.com etc. - and have them each buy a phone, and ship them to a single physical address.

It's certainly possible to see how this would come across as hijacking or botnet fraud.

You're saying that like it's a reasonable condition. Other sellers of things don't have such conditions like, having it be against ToS to resell your car or your forks.

Agreed - I am arguing with them as if it's reasonable but it's entirely not.

> In fact - Apple even introduced controls to stop scalping of Genius Bar appointments

Yeah, they prevent the purchase. That sounds reasonable. They decidedly DO NOT brick the buyer's phone, or their entire digital life, if they suspect someone bought more than the limit.

Also, even if they did, which would be just as horrible and outrageous as when Google does it, at least they have reasonable phone support and retail stores. It's not just about Google's indefensible behavior in terminating Google accounts, it's about how the company wants to be relied on for everything digital without providing even a bare minimum level of support.

The issue isn't buying over the limit.

The issue is making it seem like your account is hijacked, or part of a bot-net, or committing payment fraud (e.g. stolen credit cards).

Say you create 100 email accounts - john001@gmail.com, john002@gmail.com, john003@gmail.com etc. - and have them each buy a phone, and ship them to a single physical address. Most people would see that as a major red flag for something fishing going on.

Or say suddenly all of these otherwise unrelated accounts suddenly started ordering goods online, and shipping to a PO Box in the Ukraine.

As a consumer, I most definitely want all of this stopped.

In fact, my bank will regularly call me up and ask me to confirm transactions that seem suspicious (or send me an SMS) - if I don't respond in time (e.g. I'm travelling), they will lock out my credit card.

That is exactly what you want as a customer.

So in this case - it seems these people knew they were engaging in something shady - but perhaps they didn't put two and two together and think, gee, if I let somebody order something on my credit card, yet addressed to him, I wonder if it will look like my account was hijacked?

A bank freezing your account to protect you, because they think someone hijacked your account, is different than a bank that thinks you're a bad person and the bank wants to find out every single account you have and punish you.

Many people have experienced financial protections, but few have experienced an adversarial bank, and I imagine that would scare a lot of people.

It sounds like to me Google does both things. Google does things which are comparable to customer fraud protection, and Google also does things which maximally asserts its positions in a punitive manner, at which point, is it time for lawyers and media PR battles?

"In the first case, (and based on their own statements) those people were buying up phones by the hundreds, shipping them to a single physical address and then scalping over the internet.

It's basically fraud. So yes, they probably got picked up by an automated algorithm that looks for hijacking/CC fraud or bot-nets."

No, it's not "basically fraud". Yes, it violates Google's terms, and banning the customers from using Fi would have been a reasonable response, but Google's TOS is not enshrined in criminal law. Unless your position at Google is on the legal team, you might want to be careful about throwing around phrases like that with nothing to back it up. By admitting you work there, you are officially speaking for the company with such statements.

Thanks for bringing that up.

I suspect you and I are talking about two different things however.

I'm using fraud as an ordinary layman would use it - that is - deliberate deception to secure unfair or unlawful gain.

In this case, I think most people would agree that spawning up multiple dummy accounts (e.g. john001@gmail.com, john002@gmail.com, john003@gmail.com) and then using them to get around ordering restrictions is definitely deceptive. (These account names are obviously illustrative).

And in terms of what's a "reasonable" response, that's above my paygrade. All I can comment on is the public statements that those people made around the time, and around their interactions with Google and their interpretation of them.

However, are you a legal practitioner? If so, then perhaps you are using the term in the other sense? Also, if you're willing to comment IAAL, that would be very interesting.

"I'm using fraud as an ordinary layman would use it"

Fair enough, my point was more that I was so surprised you were willing to stick your neck out by officially speaking for Google here, especially regarding legal matters.

No, I'm not a lawyer, but I do have nearly 20 years in law enforcement and LE-related work, enough to have a bit of an informed take on things like this.

I do feel that Google was wrong to permanently and irrevocably delete their entire Google account rather than simply banning their account from using Fi. It's Google's prerogative, but it told me everything I needed to know about them as a company. Suddenly I was acutely aware that if I were to violate, say, YouTube's TOS by uploading something that I thought was fair use when it wasn't, I could permanently lose my entire online life. That's quite simply unacceptable.

AFAIK, nothing was permanently or irrevocably deleted. From all the public statements at the time, all that happened were the accounts were suspended.They would then need to reach out via the recovery link to prove they were really a person (and not say, a bot). (I'm just going off public statements here).

In terms of handling and deleting user data, I do know we have some pretty clear guidelines around this - user data is sacrosanct. You can read up in the ToS, or if you need specific guidance around your personal circumstances, I would always encourage you to consult a legal professional.

> by officially speaking for Google here,

The very disclaimer he added saying he was a Googler also said he wasn't speaking for the company.

His comment was edited, it originally said (Disclaimer: I work for Google) and was changed after my comment was posted. I think that action speaks for itself.

Those don't sound very convincing. Firstly, any time these things get enough press to become well known cases, it's natural that the "appeal to PR" vector gets them sorted out.

Secondly, the per case details don't look good for Google - in the first case, buying and reselling phones for a profit sounds perfectly above the board. Even something a "don't be evil" company might do... In the third case, the statement reads exactly like legalese that would be grudgingly put out by someone who's had a tussle with lawyers.

To your first point - The natural counterpoint is - there are billions of Google account there. Yet, the number of cases you hear about this is in the handful.

To your second point - scalping phones is most definitely against ToS. This is true for Google, Apple, Smsung anybody.

Here are our ToS - https://store.google.com/intl/en-US_us/about/device-terms.ht...

> You may only purchase Devices for your personal use. You may not commercially resell any Device, but you may give the Device as a gift. Recipients of gifts may need to open and maintain a Google Payments account in order to receive any support offered by Google. These Terms apply to any gift recipient.

This isn't unique to Google. I'd like to see you walk into an Apple store, and buy 10 iPhones. Or say, 100?

In fact - Apple even introduced controls to stop scalping of Genius Bar appointments:

http://www.idownloadblog.com/2013/09/12/apple-store-genius-b...

Or say you create 100 email accounts - john001@gmail.com, john002@gmail.com, john003@gmail.com etc. - and have them each buy a phone, and ship them to a single physical address.

You can see why this would come across as hijacking/botnet fraud, right? (That's separate to the ToS violations).

But from public statements - the scalping itself wasn't what got them, it was probably the bot-net like account creation, and indications of payment fraud.

Thirdly point - it doesn't sound remotely like legalese, and there's no indication lawyers were even involved. In fact, why would they be? I would have preferred him to post some more technical details, as that would have cleared things up, but he posted a nice message of his own volition, which I suppose is fine.

It reads more like the message of somebody who's relieved, and glad he got an explanation of what actually happened behind the scenes.

Exactly the type of Google apologist FUD I would expect from a Google employee.

Google is not at all transparent about how or why accounts get closed, and their support when it happens is utterly terrible. The fact that the links in the parent posts had to resort to PR shaming is proof of that. Most people don't have the online following to pull that off.

In reality, an average person who loses access to their Google account is screwed, and that should be an important consideration when looking at Google products.

To speak about that third case the very real concern I would have there is that it appears he got access to his account back by being able to attract enough attention from Google management, as he was well connected and had a relatively high profile twitter account (> 100k followers)

That kind of solution is unlikely to be of use to customers who don't have the ability to bypass the common process...

That may or may not be true, but it's by definition hard to tell because the cases that don't get attention, you don't hear about. So it's hard for us to tell for sure. But in general, considering that billions of people have Google accounts, the fact that you can count these cases on your fingers and that you don't see articles about it every week means that it's probably safer than flying by plane.

Let's be honest, nothing is 100% safe. If you decide to keep everything off of the cloud also has its own risks.

that's an interesting assumption, an alternative interpretation would be that as they're so common they're no longer news-worthy.

Either could be true...

It wasn't necessarily the publicity. He reached out through normal channels, but these things normally take some time to process, since they normally have to be reviewed by humans.

It's one of those things where you want to tread carefully.

I mean, say my account got hijacked.

I want to get back in. So does the hijacker. I would much rather prefer waiting an extra day or so, than risk having the hijacker purporting to be me getting back in.

I've actually had to deal with the exact above scenario for a friend before - they had a Gmail email account, and another (unnamed) email provider. The hijacker did try to get back in, and it's a pretty scary proposition. So having a bit of peace of mind that the bar is suitably high is good.

(Disclaimer: I work for Google, but any statements above are my own, and do not reflect those of my employer).

erm from https://pbs.twimg.com/media/DHz1WNEXcAEVEHr.jpg "I spoke to the leadership there and they restored accounts"

doesn't sound a lot like the standard support process to me.

AFAIK, the two things are orthogonal.

My understanding was he'd already kickstarted a normal recovery process https://accounts.google.com/signin/recovery

And he wanted more details, so I assume he spoke to somebody up the escalation chain in our support org, who gave him more details.

that's not what https://www.inc.com/sonya-mann/salil-mehta-free-speech.html says about it.

"Mehta was lucky. The public outcry and press attention prompted Google to manually review his case."

"It could have turned out differently. Without his impressive credentials and far-reaching network, Mehta never would have found out why his Google account was shut down. He wouldn't have been able to access his correspondence or restore his blog, which he says has been read by the likes of Elon Musk and Warren Buffett."

That website (Inc.) doesn't cite any sources for your quotation at all. It simply appears to be their personal speculation. To me that's rather disingenuous.

I actually work in a support org at Google (on the Enterprise side, admittedly).

That account recovery link I provided (https://accounts.google.com/signin/recovery) is available to anybody (This is for consumer - i.e. GMail. If you have an enterprise - i.e. GSuite account, it's slightly different in that your domain administrator can also restore you as well).

You don't need to be anybody special - you just go to that URL, fill in your details, and somebody will review it for you.

Yes, it will take time. If you make noise, it's possibly it will get escalated and you will get assurances from somebody that it's being looked into. But in general, it will take some time to process it, simply to ensure that we're giving you (and not somebody else) access to your account.

I know it sucks, but account security is tough, and I have nothing but respect for the hardworking people that handle that. In my second week at Google, I accidentally typed my password into a non-secure (but still legitimate) web-form. Within minutes, I got an alert asking me to change my password immediately. They take security very seriously.

Disclaimer: I work for Google, but any opinions above are my own.

They have direct quotes from Google's press office, so perhaps not just personal speculation...?

" A Google spokesperson told Inc. that Mehta mistakenly marked some of his own email as spam, which confused the algorithm and triggered the shutdown. By August 21, the account had been fully restored."

Given that you think that a person without that reach would have had a similar experience....

that's your perogative of course, but you should forgive a little doubt from outsiders that things would've been so smooth for those without recourse to similar avenues.

> I want to get back in. So does the hijacker. I would much rather prefer waiting an extra day or so, than risk having the hijacker purporting to be me getting back in.

Except, that’s not what happens.

Google lets the hijacker in, and locks you out. I live in Germany, and yet, as detailed in https://news.ycombinator.com/item?id=15404541, Google let a hijacker from Russia with knowledge over nothing except my password in, and I had no way to reset it despite access to all reset questions and reset email (but no access to the reset phone number).

Not even a Google employee friend was able to help me, as their internal escalation team for this... contacted my hijacked account via Gmail.

Google’s system is useless, and if you honestly rely on it, you should stop right now.

Go into Gmail, IMAP settings, and write down the "POP3 activated since" date, that’s the only place you find your account creation date, it’s required for account recovery. Update your phone number, and choose an ISP that NEVER deactivates unused phone numbers.

> I mean, say my account got hijacked.

That's a straw man argument because, as far as anybody can tell, the account in question wasn't hijacked.

In reality, this person had a big, multi-day inconvenience foisted onto them out of nowhere, for reasons they apparently can't even talk about. And that's assuming Google even told them what the violation was.

If Google wants people to buy in to their platform then they need something better than an across the board zero tolerance policy.