Hacker News Reader

Comment by Cogito | Hacker News Reader

The bigger issue here is that they reacted to this event, rather than proactively managing it.

From the article, “Access to sensitive data is logged, and the company has automated systems designed to detect and prevent abuse”,but if that were the case surely they would have acted on this before it became public.

In reality they have no incentive to police this kind of behaviour until they are called out on it.

In truth, I would never spend time and effort looking into potential malfeasance myself, as I would be too focused on building out new features and ideas.

I don’t know if a natural incentive exists that would drive the behaviour it seems society expects.

View on HN

You are wrong.

> In reality they have no incentive to police this kind of behaviour until they are called out on it.

Access to personal information of users is "policed" internally, proactively, and you can get fired over it. It's one of the things they hammer into your head the first month of bootcamp after you join. The internal tooling and frameworks have all sorts of built-on heuristics to catch this [1], and there's internal teams who're continuously improving these security measures.

[1] this = accessing information not related to your job duties

Happy to be wrong.

Are you saying this person was fired before it became public that they had misused data? Or was it reactionary?

I don't know about this case.

But I know for a fact you can get fired for this without any public/PR issue, by internal triggers/investigation only.

For what it’s worth, I believe you. I sincerely believe that people would have been fired for inappropriate use/access of data.

My comment is a deeper one. The incentive in general is to improve value produced, and identifying bad actors is not a short term way to increase value produced. Long term it probably is positive, but because those outcomes are somewhat removed from the immediate here and now I expect them to be disincentivised. I would love to see evidence or reason for why they aren’t, but that’s the thrust of my thinking.

The guy's job was apparently to check out profiles of people that may present a security threat. So if his job was to look at profile data all day, in this specific case his firing would almost have to be reactionary, because his nefarious activities would have looked like normal job activity to any auditing program. We only know his activities were nefarious because he said so. A developer or people in almost any other position for that matter would likely have been caught proactively.

This is the very scenario that gives rise to the question "Who watches the watchers?"

I am absolutely convinced that whatever loophole he found, it is already patched with addition controls over that team.

What gives you such a high degree of confidence to make that statement?

I worked at Facebook. I am directly familiar with how the company treats those cases.

I mean, even if he never accessed any user data, bragging that he can is still problematic for the company - it looks bad on the outside.

As much as I love dunking on Zuck, it might be difficult to detect all unnessecary data viewing, especially if someone is part of an internal security team whose job description includes looking for hackers on FB's systems.

So basically, if the abuse is not egregious (ex: looking up a celebrity's details), they have to rely on someone making a complaint and then reviewing the employee's logs.

I knew someone who worked for the IRS and they had similar issues - it's harder than you'd think to automatically detect this kind of thing, the best you can do is log so you can punish if it's discovered someone abused credentials.

"The bigger issue here is that they reacted to this event, rather than proactively managing it."

They may well be proactively managing it, but you don't hear about it when those actions are taken?

The automated systems are designed to detect and prevent abuse.

Do they detect and prevent abuse? Who knows but that's what they were designed to do.

It's great (if weasel wordy) copy.

>The bigger issue here is that they reacted to this event, rather than proactively managing it.

If he was bragging about having access, but didn't actually access it in a way that was inappropriate for his role, then there's nothing for the company to have proactively done.

Reply on news.ycombinator.com