Hacker News Reader

Comment by skissane | Hacker News Reader

> The documents concerned a mandatory tool that was recently installed on the Google Chrome browser on workers’ computers, the employees said. In October, some Google employees raised concerns that the Chrome extension was an internal surveillance tool designed to monitor their attempts to organize protests. It would automatically report staffers who create a calendar event with more than 10 rooms or 100 participants, according to an employee memo that outlined concerns about the tool

From a technical viewpoint, I don't get this. Why create a Chrome extension to monitor usage of Google Calendar? Doesn't Google Calendar have an API they could use to do this on the server-side instead? (And if it doesn't, maybe they should add the necessary features to their API to enable this, and doing that might then benefit their customers and their partner ecosystem.)

View on HN

Installing an extension to monitor employee use of a company computer is legal and generally accepted behavior.

If the Google calendar is for a personal gmail account, then accessing the calendar details server side is a huge privacy breach.

> Installing an extension to monitor employee use of a company computer is legal and generally accepted behavior.

Legal and generally accepted in US jurisdiction. In Germany that would require approval by employee representatives, unlikely to happen in any bigger company. In Finland a somewhat related and highly controversive law was introduced many years ago that it would be legal if registered with data protection authorities. Something like 3 companies registered in a decade. Maybe some did it without registering, but generally this is not deemed clearly acceptable practice.

Can you expand on this point? I wasn't sure if your point was that this might hinder Google expanding in other countries or if you were just taking issue with the phrasing.

My point was just to show that legal systems differ and the balance between employer and employee rights can vary.

Google has a big data center in Finland. IIRC they stopped their plans for a Berlin lab after visible anti-Google protests in the neighborhood, but I'm sure they have employees somewhere in Germany. International companies just follow local legislation and practices and there is no problem (most of the time at least, there are examples of failure like Walmart trying to expand to Germany with too much of an American management style and eventually giving up).

Google already have expanded to plenty of countries, and presumably in some of them this kind of monitoring would be illegal.

> If the Google calendar is for a personal gmail account, then accessing the calendar details server side is a huge privacy breach.

Surely, Googlers have separate work and personal Google accounts, and only the former would be used with the Google corporate calendar? Article says that one of the things which triggers a report is booking more than 10 meeting rooms for a single meeting – surely, a Googler's personal account would lack permission to book meeting rooms in their corporate offices, and only their work account would have permission to do that?

But the account associated with reserving the rooms surely mitigates that privacy issue.

After all, the rooms belong to Google.

It’s not legal if employers specifically use it to disrupt employees’ attempts to organize. The NLRA specifically grants employees the right to organize and it prohibits employers from monitoring these organizing employees.

The fact that Google employees, in this case, may not be considering forming a union at this time is irrelevant. The meetings they are having may prompt them to form one at a later time. Either way, their freedom of association is protected.

Like it was a "safety hazard" to have too many people at once in the smoking area behind the textile mill. It is a slippery slope to try to tease apart what is, and what isn't, interference right?

Google also has a clause in their employment agreement that says you agree to them putting surveillance software on your devices, company supplied and personal, as a condition of your employment. I asked about that one, got the HR response "Well I suppose you could interpret it that way, but that isn't what we mean." and I said, "Okay, lets change it to say what you mean." and got the "Well we really aren't in a position to change these documents, it would be a mess trying to track a zillion individual agreements." etc etc. That rabbit hole of pushing back and forth leads to "perhaps Google isn't the right place for you." :-)

> Google also has a clause in their employment agreement that says you agree to them putting surveillance software on your devices, company supplied and personal, as a condition of your employment.

How would Google even know about your personal devices? That seems to only make sense if you intend to use your personal device for work.

It's not even an unusual condition. At Dropbox, starting some time in either 2018 or 2019 we had to install a remote administration app on our devices if we wanted to connect to corp vpn or to log into corporate google accounts. Mostly so that the device could be wiped if it was lost, IIRC.

Another reason not to have work email, chat, or any other work system on your personal phone/pc/etc.

I think it is a good incentive to disconnect from the workplace.

Yeah, that's pretty normal for campus network access. Otherwise it kind of defies the logic of having a corporate network in the first place.

It's definitely a slippery slope though.

"If we already have a privileged app running on people's devices... {insert management-centric ask}"

When I did some contract work for a big crypto exchange, they required you to provide them the ability to remote wipe any device you used, including your personal phone, for their systems. Since they required you to use Authy I just used an old phone with a throwaway gmail account to set Android up and the beat-to-hell Chromebook they provided that would not hold a charge for more than a few minutes.

The Google policy probably applies to personal devices used in BYOD work settings.

Lots of people at tech companies use personal devices for work. This includes things like having your work calendar, email, or corporate applications on your personal phone. In my company's case there is some kind of enterprise iOS policy that gets installed as part of onboarding a device to access company systems. This has the ability to enforce a password policy, monitor installed software and software versions, to lock out devices that are running known vulnerable apps or iOS versions, as well as the technical ability to remotely wipe the entire device (never heard of that being exercised). Company data resides on the device (via email, documents, and other means) so it's reasonable for them to want to have some oversight. An attacker could attempt to get into company systems via the device, after all, since it has (some limited) access to my corporate account.

I use my personal phone for work because it's extremely handy to have work email and calendar on my phone, and I don't want to carry two phones.

Google gives you a phone I think...

> I use my personal phone for work because it's extremely handy to have work email and calendar on my phone, and I don't want to carry two phones.

I invite my personal calendar to any work events that I need to be aware of when I'm not at work.

Otherwise, when I leave the office, I leave work there too. I'm extremely fortunate to be able to do that.

It's tragic that my good fortune isn't an option for many.

This is quite normal BYOD security policy. If you don't intend to use your personal devices for anything work-related (connecting to the same network, using related accounts) this policy shouldn't apply at all.

I don't think the reply is about BYOD... There is speculation about IMSI catchers being used to target personal cell phones without any BYOD app installed.

Didn't a whistleblower at a car company suggest this...

https://www.theverge.com/2019/3/13/18263757/tesla-elon-musk-...

And if such a a company had that technology then we can only speculate its use is more widespread than imagined.

Maybe this is the only reason remote jobs are not available at these companies... Nothing to do with being onsite just more of a precaution to vet employees before even allowing them to be remote.

So if a company could capture your personal text messages and personal cell phone calls while within an office campus (and no BYOD app installed)... would they use that knowledge to prevent poaching as well?

Be careful.

Not BYOD devices, any device you use to connect to the corporate servers. So if you read your corp email on your home computer, or access employee only services from your phone or laptop etc. One of the interesting things about working there was that much of what you needed to do could be done over the existing Google services.

As for how? It was left unspecified but we speculated they could drop a keylogger or other bit of surveillance kit if you logged into your corporate gmail account from a device where it wasn't already installed. Clearly crooks can do this, it has to be easier when you can sign your downloads and are a 'trusted' vendor.

This is some nonsense.

> So if you read your corp email on your home computer, or access employee only services from your phone or laptop etc

I know literally no Google employees that use Google corp resources from personal computers. Phones are common, but as you're hopefully aware, the security considerations are different.

> As for how? It was left unspecified but we speculated they could drop a keylogger or other bit of surveillance kit if you logged into your corporate gmail account from a device where it wasn't already installed.

Who theorized this? Because it's certainly not a thing that's ever happened. It would be trivial to detect, either as a client, or by looking at the source of Gmail.

>Like it was a "safety hazard" to have too many people at once in the smoking area behind the textile mill. It is a slippery slope to try to tease apart what is, and what isn't, interference right?

No. It is a necessary thing to do and what a legal system ostensibly exists to do.

A slippery slope in what direction? In the direction of too many rules being illegal or too many things that could impede organizing being allowed?

> Google also has a clause in their employment agreement that says you agree to them putting surveillance software on your devices, company supplied and personal, as a condition of your employment.

That doesn't mean it's enforceable or that it wouldn't run into statutory limits. Many workplace relations laws are written on a strict liability basis, intent isn't necessary for infringement. So if it has a chilling effect on organising, it's potentially infringing.

Mind you, there's something very rich in Google employees complaining about Chrome being used as a monitoring tool. Look around you, folks. What do you think pays for the fancy cafeteria? It's not hugs and smiles.

There were a number of things in the Google employment agreement that my attorney suggested were either unenforceable for legal reasons or overly broad, he also pointed out that companies generally don't retain people who sue them (the contract is employment 'at will'). His advice was that if you didn't like it, just quit. That is the low cost way of getting out from under the contract that left little ill will behind. Suing was messy and follows one around to future job interviews.

"The reasonable man adapts himself to the world: the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man."

An acquaintance loves that quote, but modifies it slightly, " ... Therefore all progress depends on the unreasonable man to get someone else to change it."

Quite.

I'm generally of the view that knowingly adding unenforceable provisions to a contract should be a crime and/or professional malpractice worthy of being disbarred. It's obtaining advantage through unconscionable deception. Or, less fancily: fraud.

Entirely too much of this kind of thing is allowed to slide by legislatures.

The disruption of those meetings is illegal, not the monitoring of their organization.

Not in all countries.

Just to add EU view on "legal". This is highly illegal and it is criminal offense in same manner as wiretapping. You (as employer, even if you own employee computer) can get jailtime for this although hefty fine is more plausable.

Before employee leaves the company, its manager is responsible to get all the company data stored (by leaving employee) on another computer, then IT takes the computer and wipes all the drives, with at least two persons present.

It is funny how cultures and legal systems differ. In US corporate culture, it's very ingrained that things done with company property belong solely to the company, and that the company has a right to look at company property and data at any time, for any reason.

A big portion of one of my information security jobs involved looking at employees' browsing history and emails daily. Sometimes to investigate potential misconduct (something dumb like a manager wanting to see if someone's slacking off, or something serious like suspicion of stealing information), but usually to investigate potential security issues (like if we believed a computer visited a malware-associated web page, we wanted to see how the computer ended up there).

In the US, pretty much no one bats an eye that this is considered necessary and normal. Employees who don't want to be snooped on are free to use their personal devices at work, like their phones, which of course we have no access to. But it's considered very normal that if an employer gives you a computer to use for work, that they can inspect that computer and data to and from it. No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property.

For infosec operations people in European countries, how are these things handled? How do you investigate potential breaches which originate from endpoints? Do you have to ask the employee if you can look at their browsing history? What if it's a potential misconduct investigation, where tipping someone off may result in destruction of evidence?

> No one has a feeling of their privacy being violated, because there's no expectation of privacy when using someone else's (the company's) property.

Excellent. Now you only have to remove the expectation of privacy in any situation from the social norms, and another big problem will be solved. You will be able to live under total surveillance without anyone feeling that their privacy is being violated, because there was no expectation of privacy to begin with.

An alternative hypothesis (crazy, I know...), is that the power imbalance in favor of the rich went very far in the US, which means that the poor have no safety net or ability to organize, so they are completely at the mercy of the whims of corporations for survival. And so, they will accept many indignities without bating an eye.

Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me.

Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?

Of course. It's completely normal to use company stuff for your own things, within reason. I print tickets or whatever at work, from my work laptop. Everyone does that, and no one cares so long as it's not abusive.

It's a weird idea that you have to be a complete robot at work and only ever do work things.

No one cares if you print tickets at work. But the nature of communications, malware, and legal risks to an organization via computers makes it so monitoring computer activities makes sense to me.

But the official position of the company can’t be “everyone use the company’s resources as they see it for personal use”. So it’s best to just say company resources are for company. What if someone gets hurt using company machinery for personal use? In the US, that would be cause for the company’s workman’s compensation insurance premiums to increase. Why would an employer want that kind of headache?

I agree, but I think if you do that, you should accept the employer having the right to potentially be able to see that information.

In practice, from doing many of these investigations, no one bats an eye or gives a single shit about what kind of non-work activities you're doing. The visit to the ticket website would just be a few entries in a long list of other web visit entries, which we'd quickly scroll past while trying to find the thing we're actually looking for (usually malware-related traffic).

> Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me.

Every single second that you are working, you know that your employer might be looking over your shoulder. It's like living under a microscope. For me, this is an indignity. Having to work in such circumstances would probably drive me to deep depression.

> Do people in EU countries expect to use any other of their employer’s equipment for personal reasons?

Within reason, sure. I would say that the main value that underlies all EU countries (not that we realize it perfectly, or even get close to it, of course!) is that human beings are the most important thing.

I find mainstream American values increasingly inhumane.

US law holds the employer responsible for what happens on their computers. No one cares to if you check your email every now and then or read the news. But how can an organization protect itself from the myriad ways someone can damage the computer or others on the network without monitoring it?

In addition, everyone has a personal computer in their pocket they can use if they want privacy.

Yes, yes. There is always some legal reason with you guys. Somehow we manage here in Europe. Go figure...

But how do you manage? That's why I wanted to hear from infosec operations people who work in Europe. Security breaches can be a massive risk for an organization, and there are undoubtedly a lot of serious security issues, which could've turned into something much worse, that my team at my old job would've missed if we had absolutely no right to look at network and web traffic from a company computer.

I do agree that there should be more requirements to look at data, though. Managers requesting bullshit fishing expeditions to see if an employee is slacking off should be required to submit some sort of evidence before making the request. That never sat right with me, or anyone on my team. But for security issues, there was no question that there was an absolute necessity and justified reason to look at that information.

I'm asking because my concern is maybe European corporate infosec people really aren't managing, here, and are blind to some ongoing major security issues.

    Within reason, sure. I would say that the main value that
    underlies all EU countries (not that we realize it
    perfectly, or even get close to it, of course!) is that
    human beings are the most important thing.

American here: I strongly agree. And I don't like giving more power to corporations. They have too much already, and I believe that strong labor movements are one way to fight this.

Still, I just... would never feel "entitled" to use my employer's property for personal uses. And I wouldn't have an expectation of privacy. When I care about privacy, I simply use my own device.

Now, let me be clear. The reality of working in America is that people use their work computers for personal uses all day long. Generally nobody cares, as long as you're getting your work done.

And if somebody really needs to do something personal, they can always just whip our their phones. If I was printing out some concert tickets at work, I'd use my employer's printer. Everybody does this. But if I was going to send some sexy messages I wouldn't do it with work equipment.

So, I don't know. I just don't see the problem. There are many many problems with America, and many ways in which Europe does things better IMO. I just don't see this as one of them.

There's a difference between using the computer and expecting privacy on it. It's entirely possible that you're not supposed to use certain equipment for personal use, but if you do it anyway, that doesn't erode your right to privacy.

I'm not saying this is always the case in the EU, though. Obviously there is equipment where for many reasons it's absolutely vital that you don't use it for anything personal. I'm not supposed to run a torrent client on the company server, for example. You can't just "borrow" a company car for a personal trip. But when I happen to use the laptop that the company has assigned to me to work on, to do a bank payment, my boss has absolutely no business knowing the details of that transaction.

I would have to agree. A company decrypting my encrypted traffic would not be okay.

I would be okay with them knowing I visited the banking site on company time (if I used their equipment, their DNS, etc) but not with decrypting the SSL encrypted data I'm exchanging with the bank or obtaining it in some other way such as a keylogger.

Though again, I'd probably avoid the issue entirely by using my own device and data connection if I didn't trust my employer. (I'm a bit spoiled, working in IT: I'd probably know if my employer was doing shady things with the data)

How would the company know you’re just using it for a bank payment as opposed to running a torrent client without having the ability to monitor activity?

That's interesting. I did work for a company, that had itself registered as a certificate authority on the computer's browser, and for most sites, e.g. Wikipedia, it would use its own certificates and presumably monitor what you were looking at, but for internet banking, it didn't intefere.

> but for internet banking, it didn't intefere

How did this work? I presume they had a whitelist of Internet banking sites. But, do you really think their whitelist would include every Internet banking site in the world? I doubt it.

>Expecting to have the same rights as if using your own devices when using someone else’s device that they are paying you to perform work on qualifies as an indignity to me.

Ah, but it's not someone else's device now is it? It's a corporation's device and corporation's have lobbied for laws that specifically prevent individuals for being liable for the colorations actions. If they aren't liable for the actions of said corporation, why should this be treated as two people's opposing rights of property vs privacy rather than a non human entity's property rights vs a humans privacy rights?

> Just to add EU view on "legal". This is highly illegal and it is criminal offense in same manner as wiretapping. You (as employer, even if you own employee computer) can get jailtime for this although hefty fine is more plausable.

This is not an EU-wide regulation. The UK is currently a member of the EU, and this practice is legal in the UK. Employees do not have the expectation of privacy on employer owned equipment.

(Please, lets not devolve into a conversation about Brexit, it's an unrelated tangent)

An extension is the kind of random IT junk companies push all the time. Pushing surveillance into the server side of a core product is rather more heavy an operation.

But Google's core business is surveillance. Implementing it server-side could make it available as a GSuite feature. Bonus points for passing it through an opaque ML step for plausible deniability. "The 'culture fit' 'algorithm' determined that you hurt team cohesion".

Making it a prod ready feature would take weeks, a pile of money, and dozens of staff who may object and are in a position to do something about it.

Making a single use extension takes an hour or three by a contractor who won't object. Its trivial enough that the whole thing could be built using a bottom of the barrel freelancer site with a high success rate.

Yeah, and Eric Schmidt could have simply taken a digital camera into a public restroom, snapped some pictures over the stall walls, and been satiated. Yet here we are.

The monitors probably (correctly) aren’t authorized to use the API.

The API is made to make automation around calendaring tasks easy. You can pull up appointments, see who booked them, and manage their state. (https://developers.google.com/calendar/overview)

Tracking activity in activity planning software isn't quite as nefarious as looking at peoples emails. Pulling up the meeting bookers boss and sending an email to them & legal is pretty bog standard integration work.

As stated, I can't see any requirement for a client-side footprint...

Ten rooms or a hundred attendees seems like the kind of event that shouldn't be any kind of problem if it were flagged; presumably that's some kind of company sanctioned event.

If it's not, what in the flipping hell are you doing using company property and resources to organize it? I understand that people mix their personal and corporate identities together shamelessly, but that just seems like shockingly poor opsec.

Kinda hard when you work in a huge center owned by the same corporation.

I don’t think people are considering enough that the people who raised the concerns could simply be wrong.

Note that Google didn’t need an extension to know which employees were tracking other employee’s calendars.

Why create a Chrome extension to monitor usage of Google Calendar?

Obviously for the “chilling effect”. Really rubbing it in the employee’s faces that they’re being surveilled.

Remember that those who decided calendar monitoring was the right approach are idiots. They don't think beyond what they intend to happen.

can't understand why you're being downvoted. the chilling effect is indeed the obvious reason.

Perhaps by doing the monitoring client-side they can get reports both on successful attempts to create a calendar event as well as unsuccessful attempts to create a calendar event. For example, even if the browser for some reason cannot connect to the server and no event is actually created, perhaps the extension still reports on the "attempt" to create an event.

ah yes, So it can report back to its server when the network is down.

oh wait...

Ah, no.

What if the network is up, but the server is down.

If the network were the issue, Chrome could log the attempts to a local store then send the report when the network is up again.

I sign into chrome at work and home and my extensions are synced, so was this extension installed on personal devices?

Maybe it's to prevent calendar spam, either inadvertently or through abuse?

Reply on news.ycombinator.com