Hacker News Reader

Comment by TheAdamist | Hacker News Reader

"The man, who wants to remain anonymous, works for an international company hired by Google. "

So not a Google employee at all, a probably low paid contractor who is in possession of thousands of audio files. Your privacy matters, except when the bottom line is involved.

View on HN

What is doubly concerning here is that the contractor was in a position to demonstrate how the system worked to the reporters. That would seem to indicate they have access to that data in a non-secured environment.

I'm not familiar with EU law around these things, but I would imagine there is some kind of whistleblower mechanism available, and a right for authorities to audit/inspect such activities?

I would expect that a telecoms employee who was doing similar work on quality etc to be quite securely vetted.

If I was doing now what I did back in the day For BT / Dialcom (I had root on the UK's main ADMD) I would probably have to pass DV vetting (TS in USA terms)

What about all the telecom APIs like Twilio? They have raw access to millions of phone calls every day. I doubt they have ‘secure rooms’ for debugging.

Isn't he in breach of GDPR requirements?

I can guarantee you that 99% of every company that has a copy of your PII has employees that can connect to work resources via VPN.

Sounds like he was a Turker: "For each fragment that he listens, he will receive a few cents."

Probably a company like https://scale.ai/, although I don't think they do audio.

The person is probably a temp/vendor from a consulting company (think accenture or cognizant), who should've signed the same NDA agreements as anyone working on that stuff.

But whose machine monitoring, security, and use habits almost definitely do not match the requirements Googmazon would require for its own employees. These vendors, time and time again, end up being the weak spots in companies' and governments' handling of sensitive information.

and how are they going to enforce the NDA? contractors are being paid peanuts in bad working conditions - firing them might land them a better job elsewhere, and they don't have any assets to sue for any kind of monetary damages.

That can still bankrupt the person on the receiving end of the lawsuit. Just because damages don’t necessarily fully compensate for the loss, doesn’t mean it’s not a massive deterrent to the behaviour.

Does it matter how much they're payed? They're probably payed the right amount relative to the work they are doing.

Also how is having access to small samples of audio a privacy issue? Are they also receiving enough information to attach an identity to the audio clips? How long are the clips? Are they randomly assigned to humans? Do those humans get to listen to multiple clips from the same Home device and can they tell that's the case?

You can say password, credit card number, bitcoin/ethereum mnemonic in 1 minute without problem, can't you?

Reply on news.ycombinator.com