Hacker News Reader

Comment by drakonka | Hacker News Reader

It feels weird for me to read comments in this thread debating about and assuming a simple note about unionization or organization by an employee whose job it was to do exactly this kind of thing is "not in good faith" or a "violation". In my mind this kind of thing has the same sentiment as _any_ policy notice. The world in which notifying people that they have the right to organize is a "violation" is a really messed up one. It's simply distributing a fact, as the company is legally required to do, published by an employee who was responsible for distributing exactly these kinds of facts. It's sad when this type of information sparks this kind of a) termination by the company of an otherwise apparently very well performing employee and b) controversy in a forum.

View on HN

You can read her own words to see it wasn't in good faith:

https://medium.com/@ksspiers/google-fires-another-worker-for...

> Recently Google was forced to post a list of rights that we have in the workplace. So when I heard that Google had hired a union busting firm and started illegally retaliating against my coworkers, I decided to make sure that my coworkers knew about the posting.

She was mad at her employer and used her role to retaliate.

> I created a little notification, only a few lines of code, that pops up in the corner of the browser whenever my coworkers visited the union busters’ website or the community guidelines policy.

It only mentions the union busters' website in the OP but she also says it popped up a notification when people visited the community guidelines policy. That's pretty invasive, this is a notification everyone will see.

I agree with Drakonka that it's dystopian when being moderately assertive talking about labor rights is viewed as a reason to fire someone. Especially when these kinds of notifications have a history of being used to tamely spread information before ("Happy Birthday Sundar!" popping up when any employee visited google.com). Reminds me more of the rules for posting on a bulletin board.

Edit: "Happy Birthday Sundar!" didn't actually happen, my bad.

The issue isn't about discussing labor rights it's about abusing security tools for political purposes. A bulletin board is not a good analogy. A bulletin board is non-invasive. This tool creates pop-ups on people's browsers. Normally, these notifications are security or privacy warnings so displaying personal messages here gives it a false sense of authority. Furthermore, it looks like she used an e-push to do this:

> "She misused a security and privacy tool to create a pop-up that was neither about security nor privacy," Hansen wrote. "She did that without authorization from her team or the Security and Privacy Policy Notifier team, and without a business justification. And she used an emergency rapid push to do it."

https://arstechnica.com/tech-policy/2019/12/engineer-says-go...

I agree with you that the issue doesn't have to be labor rights. I agree that the emergency rapid push seems like a slight misuse.

I'm questioning the double standard of being able to use the tool to display company wide messages ("Happy Birthday Sundar!"). Why was the "Happy Birthday Sundar!" poster not held equally accountable? Seems like any topic management doesn't like is political speech.

Edit: The "Happy Birthday Sundar!" message didn't happen.

Was "Happy birthday Sundar!" made without consulting leadership and using emergency push to deploy it?

My mistake - the Happy Birthday Sundar thing didn't happen. I was looking for a source and realized I read a different comment in this thread wrong. I'll end my original post to reflect this.

>by an employee whose job it was to do exactly this kind of thing..

I think this is the crux of the issue and people are making up the facts they don't have to fit a narrative.

There is a reasonable difference between security notifications and other corporate policies.

Were any non-security notifications in scope for their job or the tool used?

Is there precedent for google flagging specific external websites with HR policy notices?

The thing that gets me is that this isn't a "message board" or email, or forum... or anything like that. They needed 2 approvals to put this message out there.

It doesn't sound like just anyone could do this, but only people with specific privilege and approvals.

A company being "legally required" to do something doesn't mean that individual employees can decide for themselves to implement that policy... Otherwise you could ask random employees to Right-To-Be-Forgotten and delete you from Google...

I think the real questions are: 1) Was it part of their job? [no] 2) Was it a message board? [no] 3) Was it protected speech anyway? [unsure]

There's a difference between leaving a "simple note" and abusing a security tool to spam employees. Google is tired of employees using their job as a political soapbox. Furthermore, it sets a precedent. Next week someone uses the same tool to argue against unionization. And now Google had to let them do it or they'll be seen as being impartial.

Using access granted to you as a developer to alter work tools to spam controversial messages to your coworkers is wildly inappropriate and unprofessional. There's no rationalization that makes this acceptable behavior.

This is exactly what I'm talking about - that we consider a message about organising/unionising to be so controversial at all. To me that is some dystopian level weird.

It's controversial merely because it doesn't belong in a security tool that's intended to warn users about malware.

I say this as a non-management, rank-and-file employee: I don't like the idea of activists (whether I agree with their cause or not) hijacking the company's internal tools to broadcast their message. There are plenty of ways to communicate with your colleagues, there's just need to resort to that.

The worst part is that when the activists abuse the company's open tools, the likely response will be to put more restrictions down the tools. In the end, everyone loses because of one individual's thoughtless, narcissistic actions.

you forgot that some of us are debating the sign-off process as well. the most surprising aspect if you ask me...

>“You’re allowed to put posters up on the wall to help organize your workers, and this can be seen as kind of a digital extension of that,” said Veena Dubal, a professor at the University of California’s Hastings College of the Law in San Francisco.

This professor completely ignores the sign-off, and I wonder if actually it's really important... Can we really call it a digital-extension of a wall, if it's impossible to put something without 2 approvals?

I would start protesting Google if they did not fire a security engineer for abusing systems like this. A security engineer subverting internal security systems is what is messed up. Turning it all in a horrible PR story about a retaliatory union-busting firing should disqualify your career for many years to come. Maybe she can exchange this loss of career prospect for some activism credit against the Big Bad Google.

Performance does not matter: fire both the genius and the slacker for abuse. The factual content of the message does not matter: fire both those who lie, spam, or those who distribute relevant activist messages. Legally required company does not matter: if it is not your role, it is not your role (distributing these "facts" was never part of her job description, it has nothing to do with security. It is also naive to assume Googlers visiting that very website would be interested or unaware of this policy notice).

The controversy is because people have different opinions: those who feel activism trumps profession, and those who feel it don't. Like said, any company that employs security engineers who hold their activism as more important than their profession is a dangerous company worth avoiding. I am glad this firing happened.

Subverting internal security systems by going through the usual approvals process for a code review? When it was her job to add notices to the tool she was working on? And arguing that she deserves to have her career sunk because of it entirely?

What absolute extreme bullshit. By your own arguments if a security engineer was advocating for increased security against management, they would be considered an activist and someone that deserves to be fired, tarred and feathered and tried as a witch.

She was doing activism, not work. She knew damn well that she could not push without a code review, so she basically threw two colleagues under the bus (they were reprimanded).

She will get work somewhere else, but, to me, it does not look good to be fired for abusing internal security tooling, with the huge responsibility that security engineers have. Burning bridges and making a stink about it was her own choice, and this should have consequences, like crying about any other unrelated protected status (I did this very bad thing, but my employer fired me for racism, unionizing, being a (trans) woman, being old, etc.). You poison the well for everyone with that crap. Your group identity becomes so important to you, that you start to label individuals as "old white men" and anything negative happening to you must be related to your group identity. I don't play that game, so don't handicap me with your stereotypical groupthink.

The only one being tarred and feathered here is Google, for union-busting and retaliatory firing (as if... some even argue these firings target transgenders). Your example misrepresents my argument: advocating increased security against management is harmless and part of your job. Trying to be cute and score brownie points with activist pals is a risk she thought worth taking. Good on her.

She did not abuse any sort of security tooling. She was working on a application designed to serve notices both security and legal to Google users. She added this notice because as part of being legally compliant with the law people have to be informed of their right to unionize.

The rest of your argument is massive projection because she did nothing of the sort. She added a notice which linked to internal Google documentation which was reviewed by her peers and by any account incredible benign. Acting like this was some severe security violation is out of line.

> She was working on a application designed to serve notices both security and legal to Google users. She added this notice because as part of being legally compliant with the law people have to be informed of their right to unionize.

That's a valid point, though it takes me a lot of energy to hold this view even for seconds. But I see where you are coming from now.

It does assume / hinges on: adding such legal and security notices without approval of higher-ups is the way security and legal compliance at Google is done. That would look bad on Google, because it is bad security practice (using a rapid code push meant for solving critical bugs, for something that could go live next week), bad culture practice (why not ask input from more experienced Googlers?), and bad legal practice (a legal notice is worth at least one meeting with someone hired to do / deal with law issues).

> She added this notice because as part of being legally compliant with the law people have to be informed of their right to unionize.

I do not believe this for a single moment. This was her "temporarily change the Linux background"-moment, not a "oh, let's be proactive and do legal requirements for Googlers who can't Google 'right to unionize'.". That is the one you use to cover your ass and turn this into a political hot potato. But then still, if true, you go to your supervisor and you can bring this up. You don't emergency push a legal notice.

> Acting like this was some severe security violation is out of line.

I think that what she did would be grounds for insta-firing a security engineer, even in very employee-friendly countries in the EU. It betrays trust of all colleagues (the message would be no different from a carefully vetted company policy, so she basically spoofed her colleagues). She played an activist prank using internal security tooling: I laugh when I think of the confused angry emails upper management must have been sending the Privacy Policy Notifier team lead, they got trolled hard. I also think all this backlash from the diversity crowd is something that Google has deserved: They are either hypocritical (they never meant it, and are now stuck babysitting 20+ genders), or supporting Damore's argument that the ideological echo chamber within Google does not really work, and in business terms is a very ugly beast (if this was an action movie, they fired the scientist for pointing out that the volcano is about to explode).

So for severity I would not go as far as a good wry laugh about this. The mask is coming off. I can understand not wanting to build government murder machines and stick to ads, or not wanting to be part of the deeply ingrained rapey culture and this being the reason to protest and organize. But an internal security tool that your colleagues trust you to run on their machines is just a very bad "murder baby hitler" way to go about it. Murders your trust, processes, and protocols. Some big nasty lawyers are going to push the "disrupt the workplace"-argument hard, Google is going to be even more careful to fire blue-haired employees, and the argument that Google is intentionally targeting on anything protected by law will make even less sense.

She used an emergency push to deploy this change. Her job was to add notices for security purposes, not political activism:

https://arstechnica.com/tech-policy/2019/12/engineer-says-go...

Choosing which facts to be highlighted is an editorial decision. Google probably already complied with the letter of the law by publishing this fact internally at least once.

Whether it is published once or 1000 times is editorial. It is not within scope of their job to notify >1 time if Google’s management wants employees to be nominally reminded of their rights against their employer exactly once.

Note that I am not arguing for or against; I personally think it’s wrong she was fired and I hope the wage-thieves at Google get held to the flames over it. But let’s not pretend that she wasn’t editorializing because it can be described as “simply distributing a fact”.

She was further distributing a fact which is in her former employer’s best interest to publicize the minimum amount required by law.

That’s why retaliation like this is illegal. I’m surprised they’re surprised; Google has already conspired (and gotten caught) to illegally cheat employees out of billions of dollars of wages.

Reply on news.ycombinator.com