Hacker News Reader

Comment by Maro | Hacker News Reader

You are wrong.

> In reality they have no incentive to police this kind of behaviour until they are called out on it.

Access to personal information of users is "policed" internally, proactively, and you can get fired over it. It's one of the things they hammer into your head the first month of bootcamp after you join. The internal tooling and frameworks have all sorts of built-on heuristics to catch this [1], and there's internal teams who're continuously improving these security measures.

[1] this = accessing information not related to your job duties

View on HN

Happy to be wrong.

Are you saying this person was fired before it became public that they had misused data? Or was it reactionary?

I don't know about this case.

But I know for a fact you can get fired for this without any public/PR issue, by internal triggers/investigation only.

For what it’s worth, I believe you. I sincerely believe that people would have been fired for inappropriate use/access of data.

My comment is a deeper one. The incentive in general is to improve value produced, and identifying bad actors is not a short term way to increase value produced. Long term it probably is positive, but because those outcomes are somewhat removed from the immediate here and now I expect them to be disincentivised. I would love to see evidence or reason for why they aren’t, but that’s the thrust of my thinking.

The guy's job was apparently to check out profiles of people that may present a security threat. So if his job was to look at profile data all day, in this specific case his firing would almost have to be reactionary, because his nefarious activities would have looked like normal job activity to any auditing program. We only know his activities were nefarious because he said so. A developer or people in almost any other position for that matter would likely have been caught proactively.

This is the very scenario that gives rise to the question "Who watches the watchers?"

I am absolutely convinced that whatever loophole he found, it is already patched with addition controls over that team.

What gives you such a high degree of confidence to make that statement?

I worked at Facebook. I am directly familiar with how the company treats those cases.

I mean, even if he never accessed any user data, bragging that he can is still problematic for the company - it looks bad on the outside.

Reply on news.ycombinator.com