Hacker News Reader

Comment by Cogito | Hacker News Reader

Happy to be wrong.

Are you saying this person was fired before it became public that they had misused data? Or was it reactionary?

The guy's job was apparently to check out profiles of people that may present a security threat. So if his job was to look at profile data all day, in this specific case his firing would almost have to be reactionary, because his nefarious activities would have looked like normal job activity to any auditing program. We only know his activities were nefarious because he said so. A developer or people in almost any other position for that matter would likely have been caught proactively.

This is the very scenario that gives rise to the question "Who watches the watchers?"

I am absolutely convinced that whatever loophole he found, it is already patched with addition controls over that team.

What gives you such a high degree of confidence to make that statement?

I worked at Facebook. I am directly familiar with how the company treats those cases.

I don't know about this case.

But I know for a fact you can get fired for this without any public/PR issue, by internal triggers/investigation only.

For what it’s worth, I believe you. I sincerely believe that people would have been fired for inappropriate use/access of data.

My comment is a deeper one. The incentive in general is to improve value produced, and identifying bad actors is not a short term way to increase value produced. Long term it probably is positive, but because those outcomes are somewhat removed from the immediate here and now I expect them to be disincentivised. I would love to see evidence or reason for why they aren’t, but that’s the thrust of my thinking.

I mean, even if he never accessed any user data, bragging that he can is still problematic for the company - it looks bad on the outside.

Reply on news.ycombinator.com