Hacker News Reader

Comment by arkadiyt | Hacker News Reader

This is all too common. I teach "Security 101" onboarding to new hires at my company and this is one of my slides:

- Google Engineer Stalked Teens, Spied on Chats: http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...

- Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-al...

- Uber Employees Allegedly Use Data to Stalk Exes, Celebs: http://www.newser.com/story/235409/lawsuit-uber-employees-us...

- Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employ...

- Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees...

I suspect the vast majority of these abuse cases never make it to the public.

View on HN

Maybe you should add the Case in the UK where some one bribed some BT call centre employee to look up address of the parents of some one in witness protection.

Parents where then killed by a hitman - bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that.

> During the investigation of the Stirland murders, police found that corrupt BT workers had given out details of where the couple had moved. As a direct result, Gunn was able to track them down.

Of note, not witness protection:

> The couple declined to join a witness protection programme and instead decided to leave their Nottingham council estate.

> The pair, originally from Nottingham, were forced into hiding when Mrs Stirland's son, Michael O'Brien, murdered a man connected to a criminal gang in 2003. [the son was in jail: https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickba...]

https://www.theguardian.com/uk/2008/feb/22/ukcrime1

> bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that.

At least two of the employees got a suspended sentence:

> Kelly and Pickering later admitted computer misuse and were given suspended jail sentences. Both were sacked by BT.

http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.s...

I can't find what happened to the first - the one who had direct contact with the gang.

Ah it might have been the main one - the reason I think the UK has such weak is is a large number of NUJ members would be in jail

these are all social media companies, but what about similar abuses or security holes as such for those of us who are thinking about putting our small business data online to cloud drives/storage lockers. I.e. the google suite drive, dropbox business, backblaze backups of the world?

The problem tends to be user interfaces built for one purpose and used for another, whether it's originally by law enforcement (due to search warrants) or by support.

With something like Google Drive or Dropbox, that's where I'd look.

You can say these things shouldn't exist, but then you have no support. How do you help grandpa when he has trouble with his account if you can't do anything?

The end-to-end encrypted, no-support you're-on-your-own future isn't well distributed yet, and as long as there are people who can barely use a computer without a lot of hand-holding, it probably never will be. Someone has to be helping the users. They must trust someone. Such trust can be abused.

This privacy issue is no fun, but it pales in comparison to the horrors perpetrated by the pharma industry and oil companies like this... https://www.washingtonpost.com/climate-environment/2019/06/2...

I use Cryptomator to protect my documents within my Dropbox.

https://support.google.com/a/answer/9230979?hl=en may be relevant (I work in cloud, but am not familiar with that tooling, other than knowing of it's existence). AWS might provide something similar, but I don't know what it is.

Not really. The problem is unauthorised access by users with sufficient privileges to do what ever they want. That would include turning off audit logs.

Do you think that when Google serves your data up to the secret police that shows up in audit logs?

It depends on your threat profile. Are the secret police more likely to target you than a vengeful ex who happens to work at Google?

Obviously Google doesn't provide any real defense against court ordered snooping, but everyone (should) know that at this point. No sufficiently large company will provide any real defense, and going with no name companies doesn't help either.

Do you imagine that engineers at Google just wander around with unaudited ability to disable audit logs?

Do you imagine this to be an impossibility? It would only take one.

I imagine that nobody has ever been deliberately given this power (why would it need to exist?), and that the auditing implementation is robust against most combinations of credentials that most engineers could put together. The number of people that could pull it off in theory is probably very small, the number that could do it in practice without leaving any trace is probably 0.

If they have legitimate access to the underlying infrastructure, they can just run cat on the physical files.

Even if you manage to end up as root in a shell on the host OS, the data you're interested in is going to be encrypted at rest, probably with keys that aren't on the same machine, and your access to the machine is going to have been logged somewhere. Access to the underlying infrastructure for the data persistence layer is also presumably granted to a tiny fraction of engineers. Only the relevant teams would need it, and even then not all of them.

I think the problem has more to do with human nature. I've read statistics that 1 in 25 people have strong sociopathic tendencies; the percentage could arguably be higher for high-ranking jobs in media companies.

There will always be people who want to make use of the power they hold for personal gain. I'd imagine this is especially true if they're unable to empathise / audit their own behavior due to their personality type.

No amount of process improvement can stop this type of exploitation as far as I can imagine. If the platform is built, we should probably accept that it either has—or will—be exploited .. or put measures in place to stop that kind of power existing in the first place.

Only 2/5 of these seem to fit the "social media" category. What they all seem to have in common relevant to this thread is excessive data harvesting from their consumers.

I would say use a service you trust, and encrypt all sensitive data anyway.

I know a student programmer at the university data center that got caught sniffing through the network logs of other students.

Student: bad, corporation/government: business as usual.

Reply on news.ycombinator.com