I'm going to temporarily put aside what this guy did (which is really bad, but people with bad intent aren't common), to discuss what this tells us about Google (which is about The System, and cause for larger concern).

If anybody from Google can (anonymously if necessary) step in and answer questions, it'd be great.

* Different gmail accounts. Google knows they're all you.

In the original Gawker story, this caught my eye:

"...pulled up the person's email account...[and] a list of other Gmail addresses that the friend had registered but didn't think were linked to their main account—within seconds"

Keeping separate Gmail accounts is how many protect against "Google knows everything about me." In fact on Google's "What Google knows about you" page, it never crosses accounts (unless you've manually connected them). This story basically tells us the "What we know about your account" page is a bit misleading. Of course most folks in IT know it's a bit naive to think one could never figure out that different gmail accounts are related. But it was interesting that Google pretty formally knows the relationship, but doesn't tell you right where it should.

* SREs, and their level of access.

It's not so much that I care is a specific group has lots of access. I care that not that many groups do in total. This story makes me concerned that actually many groups have lots of access. Despite the "elite navy seal" vibe presented in the Gawker story about SREs, I'm now thinking that many, many teams have this kind of access. (Previous to this story, I was led to believe that SREs were quite low level (not in importance. but in nature of responsibilities. Very performance oriented, having little reason to have access to an individual user's data.).

Please feel free to jump in and correct this, Google peeps. It would make me feel better.

* What this does for SaaS and web apps in general

I love Google Docs and sincerely believe that most web apps that allow across-the-net collaboration are good for us. And are preferable to The Old Way. I want people to TRUST their stuff to Google (and Github and Amazon, etc).

I hate security FUDers who love to derail conversations of great possibility with some far out scenario, "Can my enemy see my Google Docs?!?!"

I'm way less worried about a few creeps who work at Google (they work everywhere...) and more concerned about laissez-faire access processes.