Google illegally spied on workers before firing them, US labor board alleges | Hacker News Reader

Google illegally spied on workers before firing them, US labor board alleges

theverge.com

933 pointsbrundolf740 comments

True story, a person I know who was offered a job at Google got the employment agreement (prior to arriving which was pretty standard at the time) and read that bit about "allowing Google to protect it's IP by installing a rootkit" and they red lined it to change it "May only access Google related information and no personal information."

When they showed up HR started with "But that isn't how we use it, we would never access your personal data." To which this person said, "Great then we're agreed, all this does is make that limitation explicit.", To which HR said, "But we don't have a changed agreement", the person responded "Here is the agreement red-lined and clear, this is the only change, feel free to have legal review it."

The day proceeded until the point in the normal on-boarding process where your "mentor" would pick you up. No mentor, no employment agreement back from HR yet. Two hours later HR came back, asked for all the equipment and the badge to be returned and said, "We're sorry Google has decided we do not wish to proceed with your hire. Thanks."

I was pretty amazed by that.

I'm not. Legal doesn't want to deal with everyone having a different employment contract. Google has always leaned towards being ok with a ton of false negatives to avoid false positives. They'd rather give up 10 good hires than make one bad one.

This is just an extension of that. They don't want any exceptions and they aren't willing to make any.

Isn't it great when even something as huge and life-changing as a job is subject to a contract of adhesion with no negotiation allowed? I'm sure glad to live in such a free country with great worker rights. (Sarcasm intended.)

I have no idea how those contracts are enforceable. Quit your job, move across the country and then on your first day here are nine contracts to sign, no you can't take them home we need them now. If you don't sign you are unemployed and we want that relocation money back.

I used to ask potential employers when I got deep into interviews with them. "Is there any way I can see all the contracts I would need to sign on my first day?" and my experience is employers are very taken aback the question. How can you possibly talk remuneration when there also is some hidden contract that is part of it that you can't see until your first day?

I was un are of this system until I hired in the US. It blows my mind.

Here (Germany) offer letters are used to outline the general terms of an offer however the next step will then be that you’re sent a contract (some of mine have been > 10 pages) outlining a lot of relevant things such: - role (ideally even with a job description but that is rare) - place of employment (city/country) - IP assignment - length of probation - length of notice period for both sides - expectation of work travel - vacation - compensation

And a bunch of other things that I’m forgetting.

Similar to the above story, there’s always some resistance from employers to customize terms. It’s operationally much simpler for a company to have unified terms. However at every company I’ve been at I’ve been able to secure changes to the IP assignment clauses.

Of course all of this only works because these contracts are enforceable. There’s no such thing as at will employment here.

If you want to know, the same system happens in Japan too.

When you get the offer letter it's an outline only. Then you either accept the offer letter as it is, or walk away. Asking for the detailed contract (called 就業規則 in Japanese) will always end up losing your job offer, because you have no legal right to see the contract before you join the company.

Some companies are so hostile (and this is the norm in my experience), that even very valid questions along the line of "Do I get severance pay if I am forced to retire?" or "How do stock options work?" will end your job application process right there because you will get labeled as overzealous.

Also, Japanese law doesn't require to state in the contract the exact position that you are hired into. So you will often get hired with the job description: "engineering team member". Of course HR will tell you mealy-mouthed or mellifluously that you are a senior/principal engineer and/or a manager, but none of that will hold any legal water in a lawsuit since your contract doesn't say so.

If you ask me, Japan and the US, some of the largest economies of the world are constant labor right abusers and the UN and other nations simply turn their head when this ever gets brought up.

I still remember the furore it caused when I asked for a copy of the 業務規則. (because the new overtime pay policy was paying ~$3/hr worked after 10pm and I wanted to see the section that covered that calculation)

I just wanted to read the actual language around hours worked and overtime because it was never stated what the policy was.

Turns out you couldn’t read it without a director sitting next to you, and it was in a binder that you weren’t allowed to touch.

My conversation with the CEO:

“Why would you need to read that?”

“Because my contract says ‘in accordance with the 業務規則’ and I’d like to know what my contract is”

“Well you can ask me a question and ill tell you if it’s in there”

Glad I got off that sinking ship.

I feel for you. I also had my fair share of labor rights abuse in Japan. My experience is that only foreigners are 'brave' enough to ever bring this up, which makes the whole situation even more miserable since you cannot expect any help from Japanese colleagues.

Like what?

That's funny. The law in Japan stipulates that a copy of the 業務規則 needs to be in a place easily accessible to employees.

This discussion doesn't revolve around how things should be but how it is in the real world.

Employees, but not future employees :(

Well, Japan also has this thing that a written contract isn't even needed to start employer-employee relationship, oral agreement is technically enough, difficult to prove of course so everyone does written contracts, but still.

Regarding details, well, there is a list of things mandated by law to be included in the offer, they include things like salary, hours, list of additional allowances (手当), though not necessarily all of them, retirement pay and such, so you should be able to receive that information without even asking. In my, albeit not very numerous, experiences in one case I've got something called 雇用契約書兼労働条件通知書 ("Employment Contract And Notice Of Working Conditions") , which included all the details, and in the other case I've got a separate 雇用契約書 (Employment contract), which included generic things like "you work for me, I pay you for that, don't go spreading company secrets around", and 労働契約書 (Labor contract), which included all the details like salary and whatnot. I should probably note, however, that I've only asked for and received these things after we were finished with all the interviews and reached a 内定 (the employer making an internal decision to hire the worker. It's nothing official, just a word to describe the state of the person(s) responsible being okay with the idea). I just politely asked for documents to review before I make my final decision, and while I've never received 授業規則 even after asking, they happily obliged with contracts and documents related to how the company decides on employee's salaries. I think there's a lot more resistance to bother with contracts and whatnot when they don't know if you're willing to work with them in principle or not.

As for "how stock options work", well, while it's probably nice on the side of employer to entertain such a question and while it's probably reasonable to give an answer along the lines of "erm, these are stock options of this and that type, these additional conditions apply, google please?", ending the job application process right there is probably overreacting.

I also feel it's important to note that 就業規則 is not really "a detailed contract", because it's not a contract, it's more of a "Labor rules" for the company, so it does count as an internal document and not for outsiders' eyes. Obviously, the rules must conform to the law and as someone has already noted they must be easily accessible to workers, which was always the case for me. In fact I have always received a hard copy of these on my first day.

It varies by country, even in Europe. In France you also sign beforehand. But in Spain it's quite common to only sign the contract on the first day; before you can request a letter saying that they are contracting you and the salary, but not more.

It sounds legally like coercian. There are some porn producers who are going to jail for a very long time (their whole life) over this. Recruit girls for a photoshoot, tell them a couple days out that it's a porn shoot but it's for private collections, etc. When the girls arrive they're railroaded into signing documents, in a strange city with no money in their pocket, etc.

I'm surprised that the parent post was downvoted, because AFAICT it's a valid comparison. Is there something I'm missing?

In the context of starting a job at Google, I highly doubt you sign your employment contracts the day you show up for work.

Typically employment contracts are signed and settled well before you enter the building as an employee.

I would be surprised if the OP’s anecdote regarding the Googler pulled on the 1st day is in line with reality.

Edit: apparently I’m wrong, the downvotes were deserved! I run hiring at my company and we send people all contracts at the same time that we send the offer letter. No surprise paperwork on Day 1. I’m surprised to hear other companies wait until the start date to sort out legal

I was hired right out of school by Google in 2007. I was absolutely presented with various contract documents on day 1 to sign. In fact, I was not even given paper copies of them; I was supposed to click my agreement in an intranet signing tool.

(I couldn't say what fraction of my employment paperwork was handled in this way, but things like IP assignment were definitely included.)

At one of my first jobs, one of the things I had to agree to was having read "the employee handbook".. but it was not a pdf or other document, it was part of an internal wiki or something, with in-links and out-links all over the place.

I don't recall if I tried to figure out whether the strongly connected component that comprised the handbook was the same as "all pages on the wiki", but I was a little distressed at the time (this being one of my first jobs) that I was being asked to sign my name on something that I couldn't realistically read.

There's always a price to pay for all the innovation that happens in SV. It's just that it ends up being paid by the people rather than by the companies. Companies can afford to pay for the most exclusive of bodyguards, the government.

That’s quite reminiscent of the user experience Google’s customers go through with the TOS

When I was hired by Google in 2010, I was sent physical papers to sign and return. I distinctly remember this because Google mailedthe papers to my old address from my first application rather than my 2010 address so I had to drive to my family member's house to get papers on a Friday and send them back by Monday.

I still have email copies of the contracts which they sent in parallel. This includes General Hiring Contract & Salary and a standard NDA with California Section 2870 modification.

The only paperwork I saw in 2014 before my first day was an offer letter (no contract per se; CA is an at-will state), NDA, relocation offer (always ask for one; it's rarely offered) and a list to fill out of prior inventions. The rest does get signed in noogler orientation.

The benefits (to Google) of being a giant company with at-will employment.

That's pretty normal, at least in tech in CA. Every job I've taken in the past 15 years has had documents I was required to sign on my first day as a condition of starting employment. Most also had some other documents I had to sign to accept the offer, but those were not comprehensive.

It is pretty normal in SV to not see your actual contract before you start. I think I have only ever signed one ahead of time, and that was an unusual situation in other ways.

(Normal, not right. And I started working here in the early 90s.)

(Not Google) My first job out of college I was asked to sign quite a bit of paperwork on my first day, after I had relocated to their city.

This does happen regularly, and employees should never do it (for precisely this reason).

Don't quit your job, move cities, etc etc without a signed contract.

What good is that if you're an "at-will" employee? They can just change the rules at any time for any reason and fire you if you don't agree to them.

I have enough experience to know absolutely nothing about me employer is guaranteed/permanent in the US.

Relevant story for the HN crowd: I worked for a small company (~250 employees). Real chill place. Six months after I start they were suddenly bought out by a huge multinational corporation. First order of business is everyone needs to sign a non-disclosure agreement and an agreement that the company owns all the code you write while employed with them, even if you do it on your own time. There were some people who were reluctant to sign, it was made extremely clear that if they didn't sign they would be unemployed.

That one didn't bother me, I only code at work anyway. What did bother me was at another employer right after I became eligible for the employer's (generous) match on my 401(k) (after 1 year employment) an email went out a few weeks later saying "Sorry, we won't be matching 401k contributions anymore."

I know a guy (very senior engineer) who negotiated that he would be working from home 3-4 days a week before taking a new job. Employer agreed. Few months later line manager notices that employee is not logged into whatever work chat they use in the middle of the day. Not habitually, once. Next day it was announced that there will be no more working from home.

I mean, I completely agree with you. As a non-American, the concept of "at-will" employment is utterly bizarre to me.

But, as a matter of practicality, it's less likely that, after you've signed your contract, Google comes to you on your first day and says "I'm altering the terms of our deal, pray I don't alter it further".

This is all mostly about managing unexpected risks, and my point is that it's actually pretty common for contracts to contain/omit clauses that you really take issue with. I'm just saying it's prudent to know what you're getting yourself into before you up stakes and move cities.

>But, as a matter of practicality, it's less likely that, after you've signed your contract, Google comes to you on your first day and says "I'm altering the terms of our deal, pray I don't alter it further".

It's been my experience that benefits change very regularly, sometimes significantly. For example, my current employer updates their compensation plan every year at the very least.

It's been my experience whenever the company I worked for ends up in a position where they are financially strapped benefits and work conditions change suddenly, drastically, and very frequently.

If you don't work for a big company (or even if you do) there is a good chance where you work will be acquired if you work somewhere long enough and that changes everything. I know some people I used to work with who experienced 4 acquisitions at the same job.

I would assume that if they do decide to "change the rules" then the penalty clauses in the contract kick in, such as payment in lieu of notice. Jesusland does actually enforce contracts, right?

> the penalty clauses in the contract kick in, such as payment in lieu of notice

Penalty clauses in a non-union job in the US!??? How on earth does one get such a clause?

I've had five software jobs and four non-skilled jobs and never seen anything even approaching this sort of clause in an employment agreement, or heard of anyone ever having this sort of clause in their employment agreement, unless you're talking about like CEOs.

The only employment agreements and/or offer letters I've ever seen (from both myself and my spouse) were more-or-less "here's your starting salary and you are employed at will." In fact, the last offer letter I signed literally said something along the lines of "this offer letter is not an employment contract or a guarantee of continued employment."

I'd love to see/read these mythical supposedly "contracts" sometime to see the exact verbage. I very seriously doubt that one just gets to walk away with a big payday just because their employee changed the benefits plan. Not in the US.

Where is "Jesusland"? (I'm from a small, deep blue, Acela corridor state that the current President-elect hails from, so pardon me for not knowing where this place is located).

Likely they're referring to https://en.wikipedia.org/wiki/Jesusland_map

Well, if "Jesusland" = red state USA, it seems to me the blue states have exactly the same kinds of employment contracts.

As one of the people who gave a counterexample, let me just say that I don't support people downvoting you, and I would much rather live in your reality than this one. (Thank you for treating your employees better than most.)

I learned this the hard way, and now insist upon a contract before agreeing to move to a company (i.e. I dont tell my previous job or give a start date until I see a contract).

So far, it hasn't been a problem.

Isnt this job switching 101? you don't have a new job until you've signed. Your notice doesn't happen until you have signed.

"Signed" isn't what you think it is. You can sign the offer letter, and possibly a couple other things, but most companies will also have more documents that you must sign on your first day of employment, and won't give them to you before then.

Interesting. That's not how it works in Australia at all.

Here, salary expectations are given in the first screening call. If they can't meet the expectation or you won't be happy with their lower offer things end there.

Interviews / code tests happen.

Offer comes over phone or email. This includes salary.

There is no signature at this stage and nothing is set in stone, its just an offer. If you accept the offer a contract is drawn up. Still nothing is certain.

Changes to the contract can happen here.

Once both parties sign. That is when you're "signed".

This happens well before your start date, usually you would stipulate the start date in the contract, so if you need to give a month's notice to your employer your new contract with a start date from a month is signed before you even hand in your notice.

There is a 3 month trial period on all employment where they can walk without much repercussions, but this is more of a concession on your part because employment is very well protected.

Any weird IP bullshit or other conditions of employment that need signing would be in the contract you signed on for.

They can't bait and switch like what you're discussing. Any NDA's are discussed up front and at least their existence is disclosed in the contract giving you a chance to see them early.

Basically you can't put new conditions of employment on people after the fact, and if you did it wouldn't be valid in court anyway, contract law trumps contract content here no matter what.

Things don't have to work exactly like this, you might want to leverage the offer for a higher pay at your current job, counter offering is commonplace here but I wouldn't ever accept one. They'll be looking for your replacement as soon as you accept.

That hasn't been my experience in the US. When I joined, I signed everything along with the offer letter. Full 10-15 pages of contract. Nothing to sign on the first day.

I'm guessing that you've only worked at / interviewed at large firms. They're large and your prospective role there wasn't senior enough for them to afford you special treatment.

I've only worked at small to mid sized firms. Either way, Knowing what the agreement is before I agree is special treatment? I'm not asking to modify the contract, merely to see it before I give notice and upend my families life.

Anything outside of what they consider to be their norm is special treatment. There aren't enough lower level people who ask to see employment agreements ahead of time.

Why is it “special treatment” to want to read what you’re about to sign when it directly involves ones means of living?

Surely a contract can't be valid if one of the parties hasn't had a chance to read it.

It's like if you bought a car, signed and paid, and discovered there is an extra agreement to actually use it, and that one says any ideas you have while driving belong to BMW.

Sounds like a great time to consider the differences between positive and negative liberty.

Negative liberty: no one can get in my way of doing whatever I want! Google has the right to rootkit my life and I have the right to ignore it and work at a bodega because all tech giants eventually agreed this is a good practice for them

Positive liberty: corporations can't infringe on my right to a private life and must protect my liberty to be a free unconstrained being

I don't know about you but I'd much prefer a world where everyone is guaranteed certain freedoms than one where big companies can use positive liberty arguments to exploit people in new and novel ways.

I've heard it phrased the other way around. Positive liberty is about things that are guaranteed (e.g. health care, food, human dignity). Negative liberty is about things that may not be done (e.g. no punishment for speech, no limitations on buying guns, no environmental regulations).

We are in agreement about which type is better, so this is solely a quibble about the names.

I think you're thinking positive vs negative rights (which are like what you're describing).

I just flipped them, reading the wiki on the terms I see I had them backwards.

My partner always corrects me and I think they have them wrong :P at least we agree on which one is better too

How about: "Hey, this is your first day, now you need to take this final difficult test and if you fail we will fire you"?

I have always been the type to have a natural aversion to signing anything. Except for my marriage license, I've always done it under duress. But you know what's even worse? When employers or vendors ask you to sign lengthy contracts, and express a range of emotion from concern to outrage when you insist on reading what you are signing up to!

The person redlined a contract instead of spending +$2000/yr (out of a likely $250,000+ salary) on a second personal phone. Such short-sidedness is a bad trait in an employee.

Second, their protest is laudable. But their decision was consciously: "the legal department of this $xxx billion company (that spends $xx million maintaining this employment contract template) will bend to my will, or I will {quit OR relent}". If they'd quit? Job well done. If they'd relent? Then why try? You're screaming into a void, and if you didn't recognize this prior to redlining, you have a bad trait for an employee.

All scenarios point to a competent red-liner achieving their desired outcome -- an ethical win in whatever case. Only an incompetent/shortsighted/kneejerk/low-critical-thinking red-liner would achieve an undesired outcome, because they didn't consider the game before playing.

Agreed, this is not a factory job for a few dollars here and there.

Honestly, that is the sort of solution I would expect the legal department to suggest as a counter-offer, with Google paying the difference. Having the legal department review contract changes is something I would expect to be standard for them, not a deal breaker. It is the reason for having the legal department there in the first place.

Some details of an offer & acceptance of employment are trivial and not worth spoiling good will.

Me: "Hey manager, can I make an expense report for this work phone?" No matter the response, I'm ok with it, because I make Google money, and that's policy. I should work towards becoming management if I want that to change. But I probably have better things to do than such a trivial disagreement.

I wish corporations were less psychopathic, too, but this is not the hill I'd die on. Or, I'd be damn sure ready to die if I redlined as a "nice to meet you" first act.

I think I'd agree that it is a weird spoiling of goodwill, but would put this one entirely as Google's fault. Requesting a minor change to a contract the first time you see it is the expected behavior, not an outlier. That's the entire point of contracts, in order to come to a meeting of the minds. This is the equivalent of haggling at a flea market, and being thrown out as a result.

I'd agree if this redline didn't require several departments to sign off costing $x million. Internal developers, internal security ops, legal, and C-suite coordinating these departments.

Also Google is very special in that their employees are extremely sophisticated and curious, so they need ~complete~ control of any electronics that access their networks.

Just fill your personal device with dick pics.

They'll stop looking pretty quick.

Only partially joking.

> I'd agree if this redline didn't require several departments to sign off costing $x million.

Straw man. If a small change like this costs a company any more than a thousand bucks, they are Doing it Wrong.

You might argue that $1k is also a lot to expect, but consider that the company has likely already spent north of $25k (and sometimes a lot more than that) on the recruiting process that brought them this new employee. If they're going to throw that away to avoid an internal approval process that costs another thousand, that sounds like a bad financial decision to me.

So if your first paragraph is correct, what are we to make of the HR person saying "But that isn't how we use it, we would never access your personal data."? Were they lying? Or was there a real internal rule about "never" accessing personal data? A rule that was in disagreement with the $x million worth of coordinations of legal documentation?

And if your second paragraph is correct, then "Google HR lies to you on your first day as policy - if you ask certain questions" seems to be the only logical conclusion.

Perfectly determining company data from personal data on a personal device is impossible. "We would never access your personal data" means "we would never access your personal data deliberately, only accidentally in the course of an investigation of your work-related activities". Obviously no company is ever going to sign an agreement promising to do something impossible like perfectly avoid inspecting any personal data during a device audit. The person from the story might as well have been asking for the moon.

If they make verbal assurances that they'll do nothing bad, perhaps they'd be willing to write them down on the contract.

The upstream comment says that not only did they refuse to back up their verbal assurance that "they'll do nothing bad" with anything in writing, they withdrew the job offer over it.

It's been some time since "Do no evil" meant anything there...

It's the equivalent of haggling of the flea market, and being told to give back the goods you are holding because there is no agreement on the price.

Alternative analogy. The haggling at the flea market already occurred (compensation negotiation), and the price was agreed upon. As you are picking up the goods, the seller shouts at you that he also gets to rifle through your phone, no take-backs, and you definitely agreed to it because you're picking up the goods.

One party here is altering the verbal agreement, and expecting the other party to accept without additional negotiation.

It's more like trying to haggle over the price of some bananas at Safeway.

maybe if bananas cost six figures people would negotiate over them.

I'm not a privacy nut, but I am concerned about a company owning my ideas when I'm working on personal projects.

I'm careful about that.

Would that be a deal breaker even at a dream job, yes.

I admire that and wish more employees looked after their interests, too, so that the commons weren't so poisoned with corporation-morality rather than humanity-morality.

Practically speaking, I think giving The Guardian or some pro-union think tank/lobbyist a copy of internal corporate policies would move the needle a lot more than a personal stand, but the personal stand is admirable nonetheless. Currently my financial freedom supersedes that level of moral freedom and agency.

Tech Solidarity collected those years ago. I think he came to the conclusion that you can't get anyone in tech to organize for anything so it didn't really matter.

Although it does seem like Googlers organize for their own comfort; they don't seem to bother doing it for their users though.

> I wish corporations were less psychopathic, too, but this is not the hill I'd die on. Or, I'd be damn sure ready to die if I redlined as a "nice to meet you" first act.

And what does Google (and most companies) do as a "nice to meet you" first act? Present you with adhesion contracts that you must sign with barely enough time to go over them. Nice.

Google already will pay for you to have a separate corporate phone (the hardware and the data plan).

Not universally.

They will pay for a phone if they expect you to use it for company purposes. If they don't then feel free to never use your phone for your job.

I’m sure they would. Bulk enterprise plans are on the order of $8-$10/month. That’s not even a rounding error compared to an employees compensation.

> The person redlined a contract instead of spending +$2000/yr (out of a likely $250,000+ salary) on a second personal phone. Such short-sidedness is a bad trait in an employee.

This isn't a solution, but a covert work-around.

Upon re-reading, I too wonder if Google means they'll rootkit any employee phone that comes onto company property. I hope they only rootkit phones with proprietary data on them.

Also, super important context: Of all the companies in the world, which ones would have employees, say, designing a rootkit to exfiltrate trade secrets, or for fun, or...? Google, certainly. So I get Google's position, as long as you're allowed a personal phone free of corporate intrusions.

> designing a rootkit to exfiltrate trade secrets, or for fun

Exfiltrating data is comically trivial, it wouldn't be any fun...

Problem is that if two anti Google activists joins the same team they could leak a huge amount of user data before stopped. Pretty sure a lot of people would find that "fun", and pretty sure their punishment would be very mild compared to for example Snowden even though their crime would be bigger.

You have to root the phone to login to your corporate Google account. If you don't want to login to your corporate account you don't have to root the phone. If your manager wants you to have a phone with corp access then he will get you a corporate phone to do it. However many would rather root their phone than have a separate phone for their private life so Google provides that option. If that starts being a legal problem for Google I'm pretty sure they will stop rooting phones and just require people to get corp phones instead.

This is just name calling and blaming the victim, which is almost every employee of every tech job in the world, while celebrating the power of the employer. Insisting that a contract be negotiable when it comes to complete and total spying on you, in the context of an article where the employer is illegally spying on you, is not the trait of a bad employee

Kathryn Spiers did a man-in-the-middle attack on company property, like how some ISPs used to insert their own popups into HTML crossing their wires. Google tracked Spiers down and fired her for it, 100% justified. Separately, Google's hiring of a union-busting firm is fair game for disagreement, absolutely.

Also, I don't consider an employer having total visibility into its devices to be a power-trip. The onus is on the employee to keep their personal stuff out if they don't want it getting swept up. Of all companies, even Google couldn't design machine learning or quarantining sufficient to wall off personal data from company data inside someone's phone during their forensic prevention and investigation. So the legal department sure isn't going to promise they can unbake the cake that is your voluntarily mixed-use device.

> Also, I don't consider an employer having total visibility into its devices to be a power-trip.

That's fair, and I agree with that (as long as it's company-owned hardware and not personal hardware under a BYOD program). But I personally do not want to (and currently do not) work for a company that trusts me so little that it needs to spy on every activity I do on the hardware they give me to do my job.

I get that some people are fine with that, and that's ok, but I'm not, and I don't think I'm alone in this.

Sounds like google is doing something bad if they need to enforce this.

The power inbalance you speak of is why unions are probably needed.

You were a special snowflake in the 90s/early 2000s now you are a cog.

A cog being paid $160k or more

What would "negotiation allowed" mean? Negotiation includes saying "no". The remedy for that is labor law, not some right to negotiate.

An interesting labor law challenge is "one side repeatedly making assertions that don't accord with contract, and I rely on those assertions, or the other side should be punished for making statements that suggest bad faith."

It's not much of a "negotiation" when the power imbalance is such that the employer can say no to your every request, but if you say no to any of theirs, you're unemployed.

Not only unemployed, but potentially unemployed in a new city, and liable for returning the relocation package. There is zero leverage in such a position if a company alters the deal, and tells you to pray they don't alter it further. Thankfully that that didn't happen to me, but it was in the back of my mind that after moving, I wasn't in the greatest of positions if there were to be any objectionable clauses.

It's especially not much of a negotiation if they fire you for daring to negotiate, rather than saying "no".

Here's my question for everyone on this thread: what are you going to do about it?

My rough guesses of what you could do:

- unionize your shop / commit to working at unionized shops (addresses the power imbalance between individual employees and the employer by treating employees as a group)

- use the power you have as an employee to drive change at your workplace, if you're one of those employees who is well-treated by your employer and doesn't need to unionize

- advocate for stronger labor protections in law / vote for lawmakers who will create them

- advocate for existing labor/contract protections to be interpreted the way you want (e.g. advocate or vote for judges who share that interpretation, donate to or create non-profits who can file amicus briefs or write law review articles advocating for this interpretation)

If this is what's at the top of the HN discussions on a barely-related article, it's pretty clear to me that tech workers, a relatively powerful group, feel pretty strongly about this issue. So why don't we do something about it?

As tech workers, likely making American wages, many of the folks here would be better served paying a congressperson and joining a PAC than they would be by paying union dues.

Don't kid yourself. Your employer will always be better connected and more influential politically than you, unless you organize.

You'll be fired for donating to that PAC if it's actually becoming controversial and effective. Fortunately, unions have the same status in campaign contribution laws as PACs, so your best bet to do some lobbying as a worker is to join a union and use it as a PAC.

I watched my parents suffer throughout their careers because their Unions were politically toxic and also deigned it necessary to keep their wages below market in order to apply pressure on the employer to raise the wages of others in the bargaining unit. As though a lineman and a telecontrol technologist are similarly skilled and trained.

My father spent the better part of a decade trying to hire his replacement because the union wage was so attrociously below market for his labour.

And then the politics, favouritism, bullying and abuse that occurs under a union; because the shop steward et al formed a social clique to get themselves and their buddies the best hours and best positions.

My two siblings went to work in unions and now regail me with similar tales.

No, I'm happy working for small and independent game studios and negotiating for myself, thanks. I happily donate the money to political organizations that would otherwsie be used to pay union dues.

If you actually want to be effective, the solution is to fix the union, not to engage in completely inoffensive tactics.

I don't doubt that a great many unions are horrible. For a great many reasons, unions are often, but not always, structured horribly with badly mismatched incentives, almost no democracy, and poor accountability. There are reasons for this, that can and have been addressed.

You're simply never going to be able to outcompete your employer in legalized bribery. It won't happen.

Also, if the PACs you're talking about ever get actually influential, there will be just as much politics involved. And you still haven't adresses the most important point, which is that your employer can retaliate against you for doing so without any problem.

In any case, unions can be and often are better, and can be and indeed often are hundreds of time more effective than what you're describing ever can be.

How could they not be toxic? The ability to advocate for yourself has been given to someone else, over something as intimately personal and important as the labour you undertake for the majority of your waking hours. They are your only advocate, in the absence of strong regulation and legislation, because in a union arrangement it is inappropriate for the employer to advocate for the employee against the union.

I don't need to outcompete on donations; I need to collectively pool my cash with other like-minded individuals in order to pay for political activity that will coerce and convince legislators. Those with the most money don't necessarily win, but money is the key to gaining access. I've had my representative read to Parliament an exerpt of a letter that I wrote; there was nary a need for money to get that response, only access.

My employers have never been interested in what I do with my money, and I suspect they would be _far_ more interested if I were to begin organizing a union.

The solution to employee abuse is legislation and regulation, not yet another layer of political bureaucracy.

Your employers are interested in their interest. If you're going to be using your money in an interest category where your win is their loss, they were care proportionally to your effectiveness, no matter the methods.

Now :

>How could they not be? The ability to advocate for yourself has been given to someone else, over something as intimately personal and important as the labour you undertake for the majority of your waking hours.

You can structure a union in such a way that hierarchy is very weak and involvement is direct. The reasons why this often isn't the case are interesting, and you should read about them.

The root if the issue is this : your ability to advocate for yourself is almost nil. You need to get together with your fellow workers to have any impact. By doing so, you will lose some of the flexibility in your advocacy, but will receive greatly increased power.

Literally the only politically effective lobbying group for the average person is a union. There have been many studies done about it.

I have second hand experience with four unions, and first hand experience with two. All but one were great, and the one that wasn't was clearly deficient for obvious structural and social reasons thah could be addressed.

In any case, you're free to continue wasting your money. You will be contributing to PACs that will eventually get bureucratized, ossified, ostracized, and turned against you, and because you plan on aligning yourself with extremely narrow organizations that lack the power to withold labour, they will collapse and crash.

Not only that, but success in such politics is a question of money and connections. The entire tech sector, totalling tens of trillions of dollars in valuation, is better connected than you are, will be able to vastly outspend you, and will do so in a much more efficient way than you can via a heterogenous network of PACs.

I mostly donate to NGOs and political parties directly; I get to see my dollars go directly to those who help those in need, and as a party member I get the opportunity to shake hands with legislators and talk policy with them directly. I helped get the husband of a friend elected mayor of my city. This has had a meaningful impact.

I see unions having enormous utility for those living where there is effectively one employer, and who have no real market for their labour. That's where unions shine.

Unions don't have to be limited to a single employer, and their actual advantage isn't any of that, their actual advantage is that they allow you to effectively withhold your labour, which is even more effective if you are in high demand.

In any case, I wish you the best of luck in your endeavors.

If I'm in high demand then I don't need any help finding leverage; other, potential employers are leverage enough.

> If you actually want to be effective, the solution is to fix the union, not to engage in completely inoffensive tactics.

This made me laugh. If you have to fix the union, then really all you've done is worsen your situation.

"And now you have two problems."

Sometimes, when you want to fix a problem, you have to fix another problem before. It sucks but it's life. Thankfully, one of those is much easier than the other.

I don't know why but it seems that unions are very different between Europe and the US.

It seems to me you've also taken the concrete action of only working for small/indie companies where the relative power between a single employee and the employer is much greater than at a place like Google. I think that's also an entirely reasonable action, and if everyone did that, many of these problems would go away.

Unions are democratically controlled. With extremely high probability, some of them will be mismanaged and abusive. We see the same in democratic government. But we don't tend to then say "wow, that elected leader was terrible - better replace it all with philosopher kings". Unionization at least gives workers the chance to influence the business, even if that chance can be squandered.

Here's what I do:

- Refuse to work for a company that treats privacy as a commodity that can be bought and sold.

No one has to work at Google. Anyone who gets an offer from them has ample opportunity to work elsewhere.

From the standpoint of a European, this would have been totally fine some 200 years ago

Negotiation doesn’t mean that you get your way and they agree to your demands

Sounds like both parties had a hard line on what they would accept

I think the takeaway is that the hard line for Google is being able to rootkit your phone

Then don't give your phone to Google. Don't use personal phone for work. Ask them for a phone if they want you to use it.

Why is this difficult? Why complain about something that is 100% in your control?

Employer that has thousands of employees don't have the time to amend contracts on per employee basis. Seems fair to me.

Google has HIPA-level access for personal data, even some medical data about people, security is tight. They don't want some righteous asshat arguing about contract agreements.

IDK the legal details of the contract, but Google has root level access to all Android phones with gapps installed. It's definitely possible for them to figure out which phone you use privately and rootkit it.

This is an extremely broad claim, do you have anything to back that up with?

Saying that Google would snoop your personal phone (which doesn't have your Google work account) as a Google employee needs some hard facts to back that up.

Since you don't know the legal details of the contract, how about we stop speculating conspiracy theories? Please keep the discussion factual and reasonable.

> This is an extremely broad claim, do you have anything to back that up with?

My claim is that it's possible for them, not that they are necessarily doing it. The technology is there.

My advice is: if you have any sort of fight with any big tech corp that gets the high levels involved, stay away from their products as far as you can.

Microsoft at least has spied on a private account's data to resolve some IP theft. https://thehackernews.com/2014/03/microsoft-admits-spying-on...

Another prior art: it's well documented that nation states do such stuff all the time. Group of diplomats from country A visits country B to discuss a big treaty with them. They stay over at the Hotel and discuss their strategy. The Hotel is bugged so country B gets an advantage during the negotiations.

People absolutely negotiate successfully with Google. New hires fresh out of uni do. Tens of thousands of more dollars.

It just seems that invading their employees privacy is table stakes for them.

You can (and should) negotiate salary, they expect that and have the authority to bump up your pay.

However, trying to negotiate the legal terms of a contract with a FAANG is highly unlikely to succeed, since HR is not authorized to change anything and Legal doesn't give a shit about you.

Moving to the UK from Norway was a shock to me in the sheer length of employment contracts. Prior to that most of my contracts had been a single page: Norwegian law regulates default terms so strictly that long contracts are rarely needed. In fact, they are hard to make enforceable, because any additional concession to the employer needs to be justified, usually by extra consideration. But many rights are inalienable.

It's a recognition that few employer-employee relationship approaches a negotiation between equals.

From what I've seen, the ratio is quite different. They'd rather make many less good hires who do as they're told than a more complicated one, even if that person were better at all the attributes. You can tell people a lot about culture and how some things are just formalities, but the contract is what remains, everything else changes with the next reorg.

From the point of view of the person at legal it makes sense (too much complexity and extra work), from higher management it makes sense (potential risk with someone who can think for themselves and won't accept everything that is handed to them), and the hiring manager will probably not pick a fight for someone who's not even on the team yet.

Oh I "understood" it, California is a "Right to Work" state and signing the agreement was clearly a requirement of working and by not signing the unchanged agreement, it was a voluntary action of elimination etc etc. So Google was well within their rights to rescind their job offer as they did.

That said, it was at a time where Google was complaining bitterly about how hard it was to hire engineers, and their much vaunted hiring process would only offer 1 in 10,000 applicants.

That they would have a candidate who had made it through the gauntlet, and some manager was waiting for them to show up, be turned away at the last minute based on an explicit clarification of a clause that Google, through the HR rep at the intake session, had already said was consistent with the intent of the agreement? That surprised me.

If the HR rep was speaking truthfully, then I would have expected to Google legal to just adopt the updated text in this agreement and all future agreements. It literally got tweaked at least once a year so the problem of "multiple agreements" wasn't really a problem.

So my amazement was first the cognitive dissonance between what they said and what they did, then the realization that what was written was what they meant, and thus what HR had said was a misrepresentation of the intent.

I don't know how many people have lawyers review these things, I do, but I may be unusual in that regard. My lawyer said that there were a number of things in the agreement that were unenforceable, and a few that were likely unlawful, but when they came up I would probably already be on my way out so it wasn't particularly harmful to sign. And some advice on how to avoid getting on the wrong side of the agreement and thus giving them a reason to separate me "for cause." (legal or not).

And now we have this story where the NLRB which suggests that Google is not above doing illegal things to protect their interests.

California is not a Right to work state. It is an At-will employment state (as are all states). "Right to Work" laws concern union contracts requiring all employees to pay union dues.

Thanks for the correction!

> If the HR rep was speaking truthfully, then I would have expected to Google legal to just adopt the updated text in this agreement and all future agreements. It literally got tweaked at least once a year so the problem of "multiple agreements" wasn't really a problem.

I'm definitely not defending the actions of Google here but I do understand them - it's quite likely this HR rep couldn't legally agree to this contract modification and it's entirely possible that when it was forwarded to legal they didn't have the power to approve this change without consulting up the legal ladder and possibly passing the question by upper management.

To contrast, if this person had said "I can't agree to that clause for my personal property but I am happy to be issued and exclusively use (for business purposes) a phone from you folks." - that problem has a solution that's pretty negligible in cost when compared to the cost of employing someone and it doesn't go against the contract they've been asked to get people to sign on to.

> To contrast, if this person had said "I can't agree to that clause for my personal property but I am happy to be issued and exclusively use (for business purposes) a phone from you folks."

And indeed this is a thing that many people at Google do.

> To contrast, if this person had said[...]

I mean, Google could also have made that their response, rather than terminating the relationship right there.

"We're sorry we can't change the contract; would it work for you to use a work phone? We can pay for that."

Absolutely - and it seems likely their rejection may not have been due to the contract change request but due to the fact the potential employee rocked the boat... Which is quite not okay in my eyes.

> I'm definitely not defending the actions of Google here but I do understand them - it's quite likely this HR rep couldn't legally agree to this contract modification and it's entirely possible that when it was forwarded to legal they didn't have the power to approve this change without consulting up the legal ladder and possibly passing the question by upper management.

I'd be kinda surprised if legal couldn't approve a change like that. Isn't it the bread and butter of legal departments to review all kinds of contracts (with customers, vendors, etc.)?

If you make a system where people are unable to behave reasonably, you still get to be responsible for their behavior.

I think there's a difference between "intent" and "only intent". I don't think Google's M.O is to snoop through all its employees' phones, trying to find reasons to fire everyone.

BUT, I don't doubt that if someone high up at Google wants to fire you (like they know you're union organizing - for example), then they /could/ query your data and /possibly/ find an excuse.

>That said, it was at a time where Google was complaining bitterly about how hard it was to hire engineers, and their much vaunted hiring process would only offer 1 in 10,000 applicants.

my understanding that is just a propaganda. They would do very low offers much more frequently than that, and the people like me and some others i know of would just not take those offers.

>a candidate who had made it through the gauntlet

it seems like they actually have special low complexity interview track for low offers - so called "benchwarmers" - and i found nothing special about their interview for the resulting L5 offer.

So, it seems that Google really has an excess of people, and thus until a new hire is an unique star in his field it is just an easy replaceable cogs which is much simpler and cheaper to drop than to deal with its even slightly different shape.

And a great reason for collective bargaining from the employees.

If the security folks don’t get to dictate corporate strategy, why do the legal folks? I mean, is this company making widgets for money, or legal briefs?

how do you know it's just an extension of that?

Agreed. It's not surprising at all since they don't want to manage a bunch of different contracts. However, I'm of the opinion (and I am a lawyer) that the contracts should then always be especially construed even more strictly than usual against the drafter.

Google isn't as selective as it's made out to be.

Or they do in fact want that clause just as it is. By design. They simply don't want to change it.

This likely isn’t about having different contracts for different hires. Its about their intrinsic need, or more precisely, their deep requirement, to have that clause in.

Yea, this shouldn't be surprising at all. Every company I've ever worked had some wiggle room with salary and equity, but when it came to the legal terms, they were not negotiable. I tried the cute "redlining" thing a few times, and without exception it always ended up with a stern letter from Legal: "Sign it unmodified or GTFO!"

I don't know who all these Captains Of Industry are who claim to be able to actually negotiate any of these terms with their company's legal department. Unless you are some kind of unicorn super-star or exec, I don't see any company wanting to deal with the hassle of negotiating a special snowflake contract for you.

> different employment contracts

Then make all contracts explicit with such a fair statement? How many employees would one imagine, objecting to it?

Even if there are contract variations, Google has resources and talent to manage it with tools.

Was this supposed to be on a work phone or a personal phone? If a personal phone, was it a requirement to use it for work purposes?

Most times, I believe a change to the employment agreement made by the employee would result in the employer not going forward with the hire, unless it was agreed upon in the negotiation phase. So unfortunately I am not surprised at the outcome.

What surprises me is how common it is to not provide full contracts during the negotiation phase. How can you know if there is a clause that needs to be negotiated out without first seeing what clauses there are?

> by installing a rootkit

On what? A phone or laptop? They should provide the device, if so.

As long as they are providing the hardware and I'm not forced to carry it around during personal time, I don't see a problem with it; I just wouldn't log into my personal accounts with it, and maintain separate personal hardware.

I completely agree. They can put whatever they want on a work phone that I don't need to take with me without it being an explicit part of the job. I very much mind on a personal device.

I wonder if Google legal department's hires also have that clause in their contract.

I’m sure Google isn’t going to reject a legal department hire for negotiating their contract.

I’d be surprised if any lawyer hires DON’T redline their contract.

Fact is: at a BigCorp you are a “human resource”. You are barely different to a node in their datacentre.

I don't have any knowledge of the matter but I can say with absolute confidence that yes, of course Google's legal department employees have corporate management software on their (corporate) devices, because Google's IT security department is not run by a bunch of volunteers working for the middle school PTA.

You'd think they'd offer the guy a job still, but without the contract changes, instead of immediately pulling out. It sounds like he was firm, but given a chance to take the job without said changes, he may still have accepted. Geez.

It is unreasonable and in bad faith to completely like a candidate and then reject them for merely asking for a contract change.

It sounds like he didn't just ask for a contract change: He simply crossed it out and expected them to take it.

I'm honestly surprised people do that. I always go with the assumption that a job offer comes with the implication that you agree to the legal stuff as you are signing it: If you don't, you have refused the job. If you don't agree to something that has been updated, you have quit. The only thing that might actually protects you in the last scenario is something like a job contract, but a lot of places in the states simply don't have them for everyone.

Haven't you ever thought it odd that the document is entirely authored on one end and hence entirely nothing but a list of terms advantageous to one party? From this perspective, a single deletion is a pathic barely countable concession at best.

Imagine B2B contracts were written this way...whatever company has the bigger ego authors every last word and walks away the moment a detail is questioned. You could only afford negotiation tactics at that abuse level if you literally have customers begging it the alter of death to buy your product at a willingness to surrender all in order to make it happen. Plus they would sign but still hate you can hope to end the relationship with 0 loyalty the moment an alternative appeared on the market.

This is essentially the same outcome.

They start relationships with everyone poorly and they pay the price.

There is a reason stuff like the danmore debacle can even happen.

They're a huge echo chamber.

> entirely nothing but a list of terms advantageous to one party

The obvious counterpoint is that usually a job offer involves getting paid.

Which is why people take the job but which doesn't relate much to a large part of the negotiation being rigged in favour of one party.

You could say the same about when the Silicon Valley salary cartel was uncovered. "yeah it's anticompetitive and negatively impacts workers but,....but these companies offer you food at work and comfortable workplace and all that."

the company gets value often many times the employee's compensation, so it's a value exchange. it's entirely valid to negotiate the terms of that exchange. what's not valid is tolerating, even encouraging, the highly asymmetric negotiating positions between corporation and individual.

They assumed his assumption. Waltzing in and saying "Hey, I made this change", discussing it, and saying "okay, it seems we are aligned" is all part of the negotiation dance. G would have every right to ponder his suggestion for a few days, then respond to it.

We don't reject candidates for asking for more compensation; this should've been treated the same way. G could've said, "Sorry, we don't wish to change that contract term. What else can we do?" but, per the story, they pulled the plug entirely.

Asking or negotiating is different: Crossing something out and handing it back isn't the same.

Asking is part of the activity that is negotiating. You might verbally asking for the change, and then specifically outline the additions and removals with a pen on the contract itself.

I think you’re unaware with the way contract negotiations are done, because crossing it out and handing it back is exactly how the business world negotiated contracts.

For small changes it’s more polite than wasting time with preambles and introductory emails.

> It sounds like he didn't just ask for a contract change: He simply crossed it out and expected them to take it.

I believe that's how one typically asks for contract changes.

https://blog.pandadoc.com/what-is-contract-redlining-and-con...:

> The term “redlining” commonly refers to the editing and negotiation process during document and business contract management where contributors mark text and track changes collaboratively. As part of the redlining process, one party receives the document and makes additions or annotations, and the redlined text will appear in a special color so the other party (or parties) can easily track changes without needing to spend time searching for modifications.

That is exactly how it works.

I've changed every contract I've ever signed like this.

Usually those bullshit lines about employer owning all code I write, even on the weekend type stuff.

I've only had to walk from one job over it. Bullet dodged.

I've done this as well, though I only needed to once. They didn't even look at the contract I turned in. Just slapped it in a file and went on with things. Never came up again.

Don't both parties need to agree to (e.g initial) the redlined sections?

If you make the changes and they sign (or maybe even just signal acceptance), then I think they accepted them.

letting go of a prospective employee for trying to protect his or her privacy and apparently being able to read their contract carefully and think through it tells you all you need to know about what Google stands for today.

Never let SV compensation packages or relaxed workplace culture distract you from the fact that the interests of the owners and workers at those companies don't have the same interests.

Does this mean you are required to have an Android phone? What if you have an iPhone? Rootkit required there, too?

Google probably has their corporate app for iOS too.

Just have a phone with an obscure OS and escape all compatibility with their corporate crap. They should provide you with a phone if they want you to install their corporate app.

So, as a Google employee, they do. If you don't want to run corp software, you can easily just request a corporate phone and that's that.

It is unfortunate (and a reflection of the power imbalance in US employment) that Google doesn't simply offer a corporate phone as a matter of practice - it benefits both the employee and the employer in the long run (with dishonest actions put aside).

Some people don't like carrying two phones.

Those people aren't barred from suffering from invasions of privacy and rootkits for the sake of a minor convenience.

Most places outside of tech folks with tolls need to carry company tools where they go - doctors carrying hospital beepers was essentially a meme in the 90's.

Are you saying they should be barred?

Not at all - I'm saying it's an option. In the US right now you surrender a lot of rights on devices you use to produce to transmit employer information (depending on contracts) but that employer right has been upheld. You should never work on a personal device and if you do there are very real costs associated with it.

I am just explaining why they don't just give everyone a phone right away.... my company asks you if you want a work phone or to use your personal phone and get a stipend

Companies have the ability to make this option accessible or obscure, given the anecdote it sounds a lot like google was going out of their way to make it obscure and I'd suspect it was done for dishonest reasons.

I think it's fine to choose to use a personal device, but employee education around personal devices is very poor - no one sits you down and goes through your rights as a worker and companies benefit by keeping those rights obscure.

You can accept the risk if it's worth it for you and that's fine - but a lot of people aren't aware of the risks and their employer certainly won't tell them.

Yeah seriously. The company I work for doesn't allow corporate stuff on personal phones, but they do give them to everyone who asks for them. It's pretty nice, you get a choice of android or iOS phone and they just ship new ones out directly from AT&T.

What would suck is if you're not allowed to bring your personal phone at all on campus. Then if you have to reach family you have to do it from your work phone.

It does (as do other companies). It's part of the onboarding, along with what kind of desktop, laptop, etc. You can decline the phone and use your own (with the software installed). Many people choose to do this out of convenience.

I expect the employers would actually prefer to just give everyone a phone the companies owns. They are doing the work profile on a personal device because many workers strongly prefer that.

Google lets employees request a corporate phone if they want one. It just doesn’t provide one by default, because many employees do not want or need them.

It's nice not having a corporate phone. Nobody can message you during off-hours without taking the extreme step of calling you at your personal number (which in the modern day is basically unthinkable).

I have always been able to get a phone when working at Google by just asking for it and pointing out that I occasionally answer questions or help debug big problems outside of work hours.

You aren't required to have any phone. If you have a phone and want it to have access to corp resources, you need to agree to some conditions.

I have coworkers who choose to keep their phone personal only, and others who choose to have the company pay for them to have a separate work phone.

(Disclosure: I work for Google, speaking only for myself)

I did that. I had a company laptop and phone. I usually left them at the office.

For extra privacy, I stopped my personal phone from connecting to the company WiFi. Then Google bought my home ISP (WebPass). Now I use a router-based VPN.

> For extra privacy, I stopped my personal phone from connecting to the company WiFi.

In a large enough campus, wouldn't the company also operate the cell tower? (I feel like I should know this, but I don't.)

> Now I use a router-based VPN.

This is not really useful except as a way to make your internet really slow. VPN providers are a lot less trustworthy than ISPs, that's why they can afford all those podcast ads.

I use a VPN provider [0] located in my state. They claim not to spy and I believe them. My state (California) which has some privacy laws and consumer protection functions which would make things very difficult for the VPN provider if they were caught spying. I picked this VPN provider because they finance WireGuard development.

AT&T, Verizon, and other ISPs spy and sell the data they collect. They also spend large amounts of money influencing lawmakers to keep spying allowed.

[0] https://www.privateinternetaccess.com

Isn't laptop enough? What the phone does?

Some things I use corporate access on my phone for:

* Receiving pages when on call

* Team chat notifications

* Meetings while walking around the neighborhood

* Filing android bug reports

* Testing unreleased software

This is not a rare policy.... but they give you a work phone, and you only use it for work. If they don't pay you for being available after work, you turn it off after you stop working, and turn it back on in the morning.

You don't have to put the corp stuff on your device. They will provide you with a company phone that you can then use for only company stuff.

Why not just get a work phone?

They have no shortage of people wanting to work for them. Why bother taking on a 'difficult' person?

Why take on a person who reads things closely, thinks about them carefully, values privacy, and has a sense of integrity?

There are a bunch of reasons. But the business one is that modern companies can't concentrate power at the top if they want to be successful in the long term. Innovation and adaptation don't happen because the SEVP of whatever has a brainstorm. They happen because people doing the work are intelligent, well informed, and care about the customers, their colleagues, and the company. If the most important characteristic in hiring is "agree instantly with all authority figures" that's a recipe for organizational rigidity and stagnation.

Some of the best hires I've made have been "difficult". Because some kinds of "difficult" are just taking values seriously.

> values privacy

I'd expect this to be a negative for a company whose entire business is based on stalking people.

Rank and file Googlers used to be interesting people.

Now they are mostly mediocre engineers who excel at jumping through hoops -- and much less interesting as people.

Luckily for Google, they just need to keep the juggernaut moving rather than functioning optimally.

One reason would be: Negotiating contract terms in good faith proves that it's not a contract of adhesion. By making the contract non-negotiable in this way, Google also risks its existing employment contracts being deemed unenforceable, having certain terms voided, or being read in the least favourable interpretation in court.

So it's in Google's interest to at least pretend to negotiate.

Potential employees asking for special provisions in employment contracts would be a red flag. Nobody deals with tracking every employee and the slight differences in the terms they agreed to.

I guess the person didn't really want the job. If they wanted it, they could have just gotten a company phone and laptop, used them only for work, and kept them in the office.

Company devices are occasionally stolen for their internal data: emails, docs, code, and config. This data can be useful to investors and competitors. Companies hire expensive people to limit the amount of data exposed in theft incidents. Understandably, they don't let individual employees opt-out of their expensive data security processes.

Also, these companies (not just Google) face the very real threat of outside groups (and nation states) attempting to infiltrate them via new hires. They need full control and detailed forensics for all authorized access devices.

> When they showed up HR started with "But that isn't how we use it, we would never access your personal data."

So, what, was HR lying?

More to the point, Google shouldn't be putting critical business information on personal devices, that's a security risk. If they're that worried about it, they should be issuing every employee a separate phone.

"We don't trust you enough to have your own device without a rootkit, but we somehow still think it's a good idea to send sensitive company emails to somebody's random custom-ROM 3rd-party Android phone or Macbook, which might have who-knows-what 3rd-party malware installed on it."

Why would you want to put company secrets on the same device that somebody is using to play Pokemon Go, Among Us, and to connect to whatever IoT disaster that they've just been gifted for Christmas?

Google Security has a list of supported devices & OS versions that can run their rootkit. Google corporate accounts cannot sign in on other devices. When a device gets too old and rolls off the supported list, they automatically log it out and wipe any company data on it. I believe most large companies operate like this.

Google is actually more flexible than most companies: Any employee can get a company phone and employees are allowed to use their personal phones if they want (and don't mind the rootkit and spying). Surprisingly, a lot of people opt for the rootkit & spying to avoid carrying two phones. This saves the company some money on phones & mobile service contracts. And it makes those employees happy.

Why do people need company stuff on their phone anyway?

I very purposefully avoid any work email or slack or apps on my personal device.

Sure, you could interpret it as HR lying. Frequently when people speak using natural languages it is possible to interpret something in ways other than what were meant. It's clear that the HR person meant that Google's rootkit-enabled security software would make a good faith effort not to intrude on personal data. Then the person in the story proposed changing the contract wording to "May only access Google related information and no personal information." This no doubt got forwarded on to a lawyer who said "No can do, that's a legal promise that the security software is 100% bug-free." That would also require wading into the murk of what is "personal data" and what is "Google related information". Does putting your commute schedule on your personal calendar make your personal calendar "Google related"? Are chat messages in which you sexually harass your coworker "personal information"? No lawyer is ever going to sign off on this.

This is why I'm so surprised that other commenters are surprised. If you've ever worked for a Big Serious Company (especially the defense sector, but increasingly just about everywhere), they have an IT Security department, and that IT Security department has a data loss prevention plan. Part of that plan is endpoint protection software, and that endpoint protection software has to be a rootkit, by any reasonable definition of the word.

I guess the crux of the problem is that the modified/redlined language might have made sense to the GP's friend at the time, and the HR person might have thought it made sense, but you can't tell the DLP software "no personal information" -- if there's an incident and the company needs to perform a forensic investigation, they can't be responsible for determining what they're "allowed" to look at. As other commenters have said, if you don't want your employer seeing your personal data, don't put that data on the same device as your employer's data.

Google is the expert at scaling, and that probably applies to hiring as well. If someone takes too long to get through onboarding, kicking them out is preferable to allowing it to disrupt onboarding other engineers. Would you waste time trying to debug an oddly broken kubernetes node, or just drop it and bring up a new one?

This is probably the most overlooked comment here. I'm guessing that Google just DGAF about any individual employee. They're not short of candidates, so why waste even a tiny amount of time customizing their contract terms when they can just revoke it and move to the next in line.

That's not actually what happened, Google, much like any company wants to hire people that are "good team players" "will be loyal to the company", "don't cause trouble", and "show gratitude for the opportunity given to them". So either you play the game or you have enough leverage to get special treatment(or you work somewhere else). They want good corporate drones, not individualists that protest when privacy rights are signed away.

There's also the option to just not install corporate apps on your personal device.

Exactly, they want cattle, not pets.

It’s a shame they didn’t figure something practical out! For me, I didn’t want Facebook to have access to my phone, so I just used my personal phone for personal issues instead of using my corporate phone for everything in my life. That worked fine, I just had to pay for my own phone.

If they did that after the person turned down other job offers and possibly incurred explicit financial expenses in reliance on Google accepting the redlined changes - assuming they highlighted the changes when they provided them instead of trying to sneak it past - Google could possibly be liable for damages caused by that reliance if they were to be sued or arbitrated against.

It says really bad things about the corporatist labor culture in the US that Google doesn't have any reason to fear that type of lawsuit in practice. (I.e., they could make it too expensive to win, they'd still hire without a problem going forward, and the person who sued them would have trouble getting jobs even if they win.)

This actually makes me glad I never got a google job

I think the very existence of such a person would be giant trouble maker red flag.

Wouldn't be surprised if they wanted to get rid of him as soon as they noticed it.

Big companies never want to give you a changed contract. It's a power trip thing and generally has nothing to do with what you actually want to change.

One thing that happens in SV is:

* Employer says "hey, we have all these convenient corporate app, wouldn't it be nice to be able to check work messages and work docs on your mobile? Just install our app to "corp-ify" your phone"

* Employer now views your mobile device as containing sensitive company IP and therefore they have the right to snoop on anything on your phone.

If you install corp on your phone, Google views it as a right to rootkit your phone, view all your private messages, etc. I learned this the hard way. Whether this is ethical, or legal, I don't know, but it's one of those things that seem obvious to some and not obvious to others.

If your employer expects you to use a mobile device at work, have them pay for your phone and only use it for work purposes, assume that HR can view EVERYTHING on your phone, because they can, especially at a company like Google that has both deep mobile expertise and insane paranoia around things like IP protection and stopping whistleblowers.

This is exactly why I don't even have my work email on my personal phone.

100% agree. People laugh at me why I carry two phones but this is the main reason. If my employer needs me to have a mobile phone they are paying for separate device and plan. It’s a little silly I need to carry 2 phones around but it makes my life so much more convenient. Unknown call on my work phone guess I’ll answer. If it’s on my personal then it’s spam. Leave company, no need to update or port my number. Want to go on vacation and still have my phone but not be bothered by company emails and calls. Leave my work phone at home.

With android work profiles I don't think it's that big a deal.

It's isolated from my phone, my employer can't see anything outside the profile and I just disable it on weekends/vacations.

> With android work profiles I don't think it's that big a deal.

It's not a big deal... until it is. Like when your boss/coworker gets involved in a work dispute and you get dragged into a deposition.

You misunderstood - Android Work profile doesn't allow the employer to access any of your personal information. It keeps work and personal things separate by a wall.

iOS doesn't allow that however - there the Apple will give everything over to employer if they so ask.

No, I don't misunderstand. A deposition won't care whether things are separated by a software wall. A deposition will want everything on the device. So it's better to just not mix the two at all.

The ony way that would be possible is by them physically taking the device off you and asking for all your pin codes / passwords. The 'work profile' feature uses app-sandbox which in effects means every app runs as a Linux type isolated UID (not to differnt to a container), there is no breach around that unless some zero day attack comes to light, which would bw patched way before acme corps IT department picks it up.

They need you to hand it over. If its your personal device, you just say piss off, no you can't have it.

>> They need you to hand it over. If its your personal device, you just say piss off, no you can't have it.

That's not how a subpoena works if it's on the same physical device. Good luck finding a judge who understands the concept of a "software wall."

So you're saying that judge will ignore the separate profiles but it'll magically stop from depositioning all your phones that might contain work conversations?

That's a tall order.

Also, the title says that GOOGLE spied on someone - which is not a deposition, is it?

I'm not sure how these subpoenas usually are worded specifically, but it doesn't seem like that contrived of a situation. Like, if you aren't the suspect and are ordered to hand over all devices used to communicate to <suspicious co-worker X>, if you have a separate device you just hand the thing over. If you hand over a personal phone, they are presumably going to bump into your walled off section and have some questions. Plus, you don't have a phone, while they are working on the thing, which seems like a pain.

This is assuming you aren't in a "hand over all electronic devices" kind of situation.

>> So you're saying that judge will ignore the separate profiles but it'll magically stop from depositioning all your phones that might contain work conversations?

Yes.

Source: Been subpoenaed three times and my attorneys have had restrictions placed on what can/cannot be searched... like I am assuming most competent attorneys can provide. The party has to have reasonable indication that relevant data is on personal devices so the opposing counsel doesn't go goldfishing through a bunch of stuff to turn up potentially unrelated dirt in discovery.

US centric, but courtrooms don’t have time to hear about the technicalities that show something isn’t possible. They only care that they think it’s possible. Judges aren’t programmers and the law isn’t black and white like code.

Also, you can’t just not respond to a deposition or refuse to hand over your phone as evidence in a crime. That’s obstruction of justice and possibly contempt of court.

Basically, you can sit there for hours on end explaining that it’s impossible to break the “wall”, but that’s time and time in money in the court system (literally), or you can just fork over the phone because it’s not your personal one.

What does that have to do with accusation that Google read the messages? From the topic?

This far into the thread, it changed to justifying two phones for reasons of possible deposition. I was explaining why it’s a good idea to do that.

That doesn't make sense. They can request both of your phones just as easily as they can request access to your personal profile on an Android phone.

The idea is based on the idea (heh) that warrants must be tailored to the crime. I can’t get a warrant for your dining room then go upstairs into your bedroom to explore. Now, if a cop saw, say, drug paraphernalia in the kitchen while looking for something else, that’s fine, but they can’t go on random searches (also why they can’t search your car for no reason).

That idea extended to civil procedure and phones is that the discovery process for a civil case would be for things related to the lawsuit of which your personal phone might not be. They could certainly request it, but a good lawyer would argue that your personal phone has no connection to the work phone (of which the lawsuit is about) as evidenced by the fact that you have two phones (you intend to separate the two matters). Separate profiles on the same computer (phone) would be harder to argue.

It’s not a clear cut matter and would certainly depend on how the judge is feeling, but if there’s a possibility of keeping your personal and work life separate, why not do so? Don’t put all your eggs (data) in one basket (phone) and the like.

Make phones that self-destruct all data if the device is handed over. It should be hardcoded to do so and that should not be an editable setting by the user.

The primary reason for this would be against thieves, but it would work against courts as well, and the user wouldn't have a choice.

Again. Destruction of evidence is a crime. Even if it’s not a choice for the user, the usage of such a feature would be a crime. And also again: the law and the courts don’t care about technicalities, no matter your opinion on that matter.

People here are choosing to make things harder for themselves by coming up with ideas to skirt the law, but it doesn’t work and will only make the police go harder on you. The law (and precedent) is not on your side in this battle.

Are you sure? This is a nuanced issue. Ehat counts as "usage". Intentionally destroying evidence is a crime, but broadly automatically destroying data before you have any knowledge of an allegation is not. (Otherwise, thinks lke GDPR would be illegal in the US)

We’re talking about depositions, so the knowledge of an investigation followed by destruction of the data (whether intention or not) by handing the device over would be a crime. I can’t hand my phone over to the police and remote wipe it with iCloud, for example.

Destruction when handing to a mugger is still ok.

Well it wouldn't be the user destroying data.

Judge: "Hand over that phone right now"

You: "Sure, I can hand it over, but all data will then get wiped by the device automatically due to Google/Apple/Samsung's anti-theft design and I don't have a choice"

After that it's upto the Judge whether to proceed with the handover or not. It will be the judge who destroyed the data if so.

Let me know how that goes for you if you ever have the unfortunate opportunity to try it.

Judges don't appreciate clever tricks of any kind, and neither does the law. Anything you think of that sounds like a clever trick is not something you should actually try.

No, it wouldn't even be my trick. It would be a feature of the design of the phone and I, the user, would not even have a choice in that implementation.

The primary motive of that design would be against thieves, but it would incidentally happen to work on judges as well. The owners of the phones would have no choice.

It doesn’t matter. Judges don’t care and they have very broad authority to get what they want. You’re not getting off on a technicality. It’s that simple.

As I said before: technicalities don’t work. You’re not getting out of this. If you told the judge that, he’d change his order to hand over the data in a different way. Have fun sitting down with the police while they copy all of the data off by hand while you show them each item.

> The ony way that would be possible is by them physically taking the device off you and asking for all your pin codes / passwords.

Which is likely legally allowed for a deposition.

> They need you to hand it over. If its your personal device, you just say piss off, no you can't have it.

Telling the courts/lawyers to piss off is not a viable option. That's not how depositions work. You might be able to get a lawyer to file legal motions with expert testimony attached pointing out they shouldn't need access to the whole phone for the reasons you said, but 99% of people will not bother getting a lawyer for something like this.

Or you could just get really drunk and lose your phone. Happens all the time. The phone company will verify you called for a replacement and the bar will verify you got trashed.

IANAL but this strikes me as bad advice.

IANAL, but isn't that obstruction of justice and/or contempt of court?

Yes, probably. That would presumably be why this suggestion includes details that would make proving your intent difficult.

Is that how depositions work though? Being deposed means being asked questions in a very official manner by opposing counsel. During discovery, they can issue a subpoena/warrant which gives them permission to take your possessions.

> Telling the courts/lawyers to piss off is not a viable option. That's not how depositions work. You might be able to get a lawyer to file legal motions with expert testimony attached pointing out they shouldn't need access to the whole phone for the reasons you said, but 99% of people will not bother getting a lawyer for something like this.

No, that is now how subpoenas and depositions work. I've been involved in a few. The judge needs a specific reason to approve inclusion of your personal device: like a record of information having been sent to it specifically or being used in a context relevant to the case at hand. And the information request will have to be specific to the case at hand, so you can just return with "There is no information on those devices relevant to the subpoena parameters" (said under oath).

If they demand your personal device anyway, because the subpoena is too broad or something, you can fight it with the judge and argue why it shouldn't be included.

If you never, ever mix personal and work then you should have no difficulty getting your personal devices excluded from a work related inquiry.

Does a deposition care when you say you didn't use your personal phone for work? Why wouldn't they ask for your so-called personal phone?

IANAL. I just have some knowledge/experience.

A deposition about a work related issue may ask to see all devices that you use in connection with your employer. So yes, a deposition will care when you say you didn't use your personal phone for work if you can prove it by it not being on any device list found with work-related services.

A device list can be obtained (usually easily, sometimes with a court order) through many services you use. G Suite, Github, Microsoft Account, Slack, Reddit, etc... these all track what devices have logged into them with your account. Signal and Telegram have your phone number. And of course any email sent has a list of addresses to which it was sent. So make sure your personal devices aren't found to be communicating with coworkers or vendors and you'll have a valid argument for "I didn't use my personal device for work".

Whether it will stick will largely depend on how good the lawyers are because that's just one way your device can be in scope for a deposition. Another way would be if any messages from coworkers are sent to/from your personal email or phone number then that can also bring your devices into the scope of a deposition. It might depend on whether the content or context of the messages suggests that they're related to the subject of the deposition and that the conversation had been moved (eg, an attempt to hide it). Again, it largely depends on the quality of the lawyers involved.

Depositions don't assume you are honest.

I would still be concerned that laws are still focused on physical things. Even if there’s a personal / work virtual barrier, I wouldn’t want the presence of work information anywhere on a personal device transmuting that device into a work device in the eyes of the law.

When vulnerabilities are found which meltdown (pun intended) those barriers perhaps it's not such a bad idea that the law is oldschool here. It's a sobering reminder that those walls are indeed only imaginary.

> iOS doesn't allow that however - there the Apple will give everything over to employer if they so ask.

Regular MDM used to do that (just as Android used to do that), but Apple has been working on the same "wall" to separate work and personal info.

https://www.apple.com/business/docs/resources/Managing_Devic...

https://simplemdm.com/apple-user-enrollment/

It is utterly insane to me how confused people are in the rest of this thread. There are people getting paid like $200,000 a year, and they can't be bothered to pay a lawyer $3,000 to read their employment contract once and explain any of this to them?

What's the point of a $3000 contract review if the employer's response will be "Not changing it, sign or walk."

Well, it helps you decide whether to sign, or to walk, right?

But who would pay $3K for a contract review??

...someone whom Google is about to make a millionaire?

Employment contracts are fairly uniform, and just not that complicated. A simple contract review is not expensive. One or two hours, a few hundred dollars per -- if you're feeling fancy.

Special cases are special. But most cases are not special.

What we know is one person said that's what happened.

I certainly know of people who have suggested and gotten changes to agreements like this. But you need to be professional about it.

What do you mean by professional here? My guess is some mix of emotional detachment, serious tone and use of the right jargon and vocabulary?

Put bluntly, being a PITA when it wasn't at all necessary, as corp-issued devices are common. If I were a manager hiring this guy and heard that he kicked back the standard contract everyone else has for a pointless reason that had a workaround everyone already knows about, I'd have ended it right there because it casts their judgment in a poor light and I could see them causing me or my department issues in the future.

"Poor culture fit".

This is not an answer to the above thread.

"What do you mean by professional here?", the answer to which is "not being a PITA for no reason". Seems pretty direct to me.

The comment I replied to claimed that being professional about requesting a change to your contract can get you the requested change approved, implying that being unprofessional will get you kicked out. My question was, how to be professional in the way that will get your change more likely to be accepted. If you claim that you can not get the change approved in any way, then you are not answering me, but contradicting the comment I was replying to. Sorry if breaking it down like this seems condescending.

No offense taken. My point here is that this entire process of "changing the contract" was unnecessary on its face, and everyone involved knew it. The professional thing to do would have been to not spend the cycles even pursuing it.

It's like asking what the best way to write a lisp in INTERCAL would be. The best way is to not do it.

The thing is, from many sources I keep hearing that the suggested unchangability of terms and pay is just a negotiation tactic. They will come to you with printed documents, with policies that things totally cannot be changed, it's like that in the system, there is just no way. Then in many cases magically there are suddenly ways to change all those things after some more negotiation. You obviously need a strong position for this, good alternative offers etc, but you don't have to be Michael Jordan for the above story to happen.

A lot more things are open to negotiation than some people imagine. Even including buying a fridge at your local chain store or similar. Not every time, and not to everyone who merely says "I want".

I'd get a lawyer to advise on the text and the change, make sure it really means what you think it does. And talk to them about your concerns, explain why you want the change. Make it clear you are open to other reasonable solutions.

Depends on the application. We run Blackberry UEM, and good luck it seeing profiles. The application just wants to take over the entire phone doesn't matter if it is an iPhone or Android.

I walk around with two phones now, one for work and my personal one.

Probably not applicable in OP's case. If XYZ company was my employer, the last tools I'd use to protect my data and communications would be any of XYZ's products.

Fun fact: If a judge orders you to surrender your phone because it might contain evidence relating to a case, it doesn't matter how you've segregated data on your phone.

Sometimes businesses literally put some services on different physical boxes in case a court sees fit to collect the entire machine. If you had a bunch of other VMs on it... shrug.

We need an OS that self-destructs all data if surrendered, and that should be a hardcoded feature of the OS.

Something like a fingerprint scanner that needs to be scanned at least once every 24 hours or all data gets erased.

This still means you don't have your personal phone if you have to surrender your work one, and they live on the same hardware.

Even if you wiped the data, if the government wants to seize your crud, they're still gonna take it.

You just buy a new personal phone in that case. At least the data is wiped the moment they seized it.

Imagine a hypothetical phone that is covered in fingerprint sensors where if it senses foreign hands touching it, it auto-deletes everything. That might not be the most feasible hardware implementation but I'm sure we can think of something to that effect.

Only if it is a state owned (diplomatic) device. Without diplomatic protection, you can be can be charged with, depending on jurisdiction and circumstance, anything from evidence tampering, obstruction of justice, to contempt of court. Technical hacks to human problems are only viable when you are shielded by sovereignty.

Typically what I've seen is if something is policy before hand, then it's legal, such as retention policies for email. In this case to do something similar, you would need the phone to not retain more than 24 hours of information or similar or be jumped and have your devices forcibly taken a away and get into some sort of 5th amendment edge case where you don't have to give the contents of your mind / say anything.

Judge: "Hand over that phone right now"

You: "Sure, I can hand it over, but all data will then get wiped by the device automatically due to Google/Apple/Samsung's anti-theft hardware design and I don't have a choice in the software settings to disable that"

After that it's upto the Judge whether to proceed with the handover or not.

At this point, if the judge proceeds with the handover, it will be the judge who destroyed evidence.

>We need an OS that self-destructs all data if surrendered, and that should be a hardcoded feature of the OS.

You want to automate the destruction of evidence? I understand thats typically treated as confirming whatever is the most damaging possibility.

Google is a special case, via play store the effectively have complete control of almost every android phone.

Its foolish to think they wouldn't use it.

yeah android phones are totally safe from google

Another important thing: under US law should there be any legal dispute, or investigation involving your employer you might be required to submit your work phone for search. If you don't want court, SEC or FBI going through your private stuff then it's better to keep those things on a different phone.

Ditto. I find it bizarre that there's people who use the same device to span pictures of their weekends and their kids, as photos of whiteboards with highly-confidential trade secrets. Tawdry jokes with friends and family alongside messages from your manager.

We use the same mind, same hands, same eyes for all of those things as well.

People view and use their phone as an extension to their body. I don't think it's possible to change that.

It’s a tool, like any other. If you use a tool for work or even a serious hobby, you are quite likely to end up with two or more of them.

To build on your analogy, in some cultures people use exclusively one of their hands to eat, and the other to clean their butts. We could learn do the same with two phones, I guess.

This. And not just two phones but two laptops as well, unless the employer forbids bringing a personal one at work (which would be a reason to dump them in my case). Leave work stuff to work hardware and never ever use company assets for anything personal. A friend of mine who works for a big multinational telco (unrelated to Google) installed an open source tool on his company laptop; when he connected back on the corporate network, that tool got automatically deleted in a matter of minutes because it wasn't allowed for some reason and he got a notice about it. I can't recall the software used to keep control of corporate laptops, but according to what I heard from him it's widely used around and it catches everything: sites visited, software installs and runs, time spent working, screenshots, etc.

Why would you bring a personal laptop to work?

In case you need to do something personal that can't wait until you get home. More of an issue with a longer commute. Might have to pop down to a local coffee shop or use the personal phone's hotspot to avoid using corp net.

I've had to check an account while at work to deal with my kid attempting to pay college tuition with one of my credit cards. Also looked up records so he could call the DMV to rectify something. Yeah, sometimes they're things that can wait a day, but a break from bug hunting can be nice.

It’s this sort of thing that makes me really appreciate my cell-connected personal iPad, with keyboard cover. It’s a “personal laptop” in 50% of the volume that I can ~always have with me.

I sometimes need to do time critical things, or use sites or services, and I'm never giving personal credentials of any kind to client/employer hardware.

My personal laptop comes everywhere with me. Doesn't yours?

Nope. I find the personal phone sufficient. If corporate IT wants to know when I'm browsing linkedin, im fine with that.

Also, corporate has given itself the right to search any and all devices on me while at work, so that's double incentive to leave the home laptop at home.

Sometimes your work computer is so locked down that some work tasks are made much easier by having a machine you have full access to.

For example we needed to program an Arduino-type board, but that's not possible with our work laptops (no admin rights, USB ports disabled, etc); we never found a solution other than a personal laptop. Or a colleague needed to run a supplier's simulation tool that needed admin rights, and couldn't get an exception fast enough. Or you need to run a Linux tool.

> Sometimes your work computer is so locked down that some work tasks are made much easier by having a machine you have full access to.

This is not very persuasive. What you really have there is two work laptops.

Even better. I have zero phone. Do you really need a phone in 2020? No. I refuse to own a computer I can't write a code running on it and distribute it freely.

I didn’t know HN implemented RFC 2549

I admire you for this, I have thought about doing the same thing many times. And also making a habit of only bringing the corporate phone (and not the personal one) with me when crossing into the US for work. "Sure, feel free to search away on this phone, have at it..."

Don't you take both phones to work though? I could totally see a zealous legal team asking for both, and that being an annoying thing to deal with. Same thing with personal hardware used at home, but the company allowing at work from home.

>> People laugh at me why I carry two phones but this is the main reason.

I carry three. One is from work, the other is from a different department in that same work. They both insist I have a particular type of phone running particular software. But work never calls me on those phones. They always call my personal phone.

Do you accept work calls on your personal number? - if so that’s sounds more like training issue.

Ill bring that up with my commander.

I'm kind of surprised by the option to use a personal phone anyway. Whenever I've worked at big tech, there has never been an option to use a personal device or laptop. Even getting a USB port enabled takes a VP to ok it often. But this tends to be in R&D depts.

> 100% agree. People laugh at me why I carry two phones but this is the main reason.

I technically carry 4 phones...

I'm far more practical, I use my own phone, or I can use work phone me for personal use without restriction and without rootkits.

If you require rootkits then the work phone is now a desk phone.

I also don’t take my work phone with me outside of work hours unless I’m oncall.

Anyone who laughs at a professional keeping a physical security barrier between work and personal data isn't a professional themselves and can be safely ignored.

I usually have four phones: Work, Personal, Personal (other country sim), emergency backup (in a buddy pouch, powered off).

Two phones, even two laptops and you're probably still carrying less weight then an original cellular phone with a strap.

>Want to go on vacation and still have my phone but not be bothered by company emails and calls. If you use a work profile on Android, you can disable it, eg at holidays or weekends. Not sure about the privacy.

When it's convenient to add a corp profile to a personal phone, buy a new personal phone exclusively for that, don't put your own profile on it at all.

Use Swappa or similar. Used phones are not that expensive. And you can just Hotspot from your personal phone, you don't need data for it.

YMMV, but that worked well for me.

Oh yea def. Used mobile devices that are most assuredly not rooted

Fascinating. Do you have examples where someone thinks they're factory resetting an Android phone, but it turns out the device is still capable of a) running a corporate profile, and b) performing man-in-the-middle or any other attacks that "rooting" would allow? Or is this just a hypothetical?

Yes. It’s called xhelper and it can survive factory resets.

https://resources.infosecinstitute.com/topic/xhelper-malware...

Unless the factory image and firmware are completely immutable they can be infected. There have been other non phone malware that can survive on certain chips on computer motherboards which would exist independently of both RAM and hard disks. Even GPUs can be infected if they have memory that does not clear when the capacitors discharge.

https://arstechnica.com/information-technology/2020/11/intel...

It's ironic that such things are made possible by the degree to which computers are being locked down --- a "factory reset" isn't really, if all it does is reinstall from a "recovery" on the device itself.

xhelper certainly won't survive a full reimage, which is an actual "factory reset" and only available to those with fully unlocked phones such as some of the Mediatek-based ones. That's done by holding down a button while plugging into USB with the battery disconnected, which causes it to go into BootROM mode (and this is really a ROM). Then SPFlashTool can be used to erase and rewrite the entire internal eMMC.

http://networkingathome.blogspot.com/2017/04/restoring-mtk-b...

Don't pay for that out of pocket. It's their responsibility.

At my company, in order to get access to the corporate email and such on your phone, they require you to install their app on the phone.

Then you're required to sign a document acknowledging that when you leave the company they will remotely wipe your phone, including all of your personal apps, documents, photos, etc.

Mixing personal and work hardware is never a good idea.

Yes, my last two employers have been similar. And given the requirements, both provide company phones.

I run into coworkers who then decide to use the company phone as their only phone, because the company phone is usually the top of the line iPhone or Samsung Galaxy replaced every 2 years when their personal phone otherwise is some mid range Android or 2+ year old iPhone.

Even when pointed out that the company can wipe it when they leave or even if they just suspect its been compromised, they don't seem to care. I just don't get it.

> Even when pointed out that the company can wipe it when they leave

If someone intends to leave, they can first revoke the company's access to their phone.

Not if it was set up with corporate deployment methods. Look into what Apple MDM is capable of on an iPhone, for instance.

Yeah, this is exactly the opposite of reality. It is not "company's access to their phone", it is "company's control of their phone". I think you misunderstand what's being required of many people in exchange for access corporate information from their phone.

If someone intends to leave, they can first revoke the company's access to their phone.

If the company has the software installed to remote wipe a phone, they have the software to stop you from locking them out.

I personally keep separate devices, but I understand the idea of only having the employer-provided phone. All of our important data is in the cloud on Google or Apple's servers. Your pictures, messages, emails, and everything else are off-site. It doesn't matter if the company wipes your phone since there's nothing on it other than thin-client apps.

> they don't seem to care

Maybe their lives are just not tethered to their phones. I use my phone for phone calls, texting, and maps/navigation. That's about it. It would be a bit inconvenient to lose my contact list without warning, but I export those periodically in case I lose my phone.

On Android, the work profile is supposed to solve that problem: you only add your corp account and install corp apps in work profile, and it's (at least supposed to be) isolated from your personal, default profile on your phone. This is even explicitly stated in work profile enabling flow.

The spy activities described in the article is not about actual personal activities on the phone. One is looking at other's corp calendar, which can only be done inside corp profile (you need your corp account to be able to look at other's calendar); The other is making changes on the corp proxy type of thing, which obviously also can only be done with corp account.

> the work profile is supposed to solve that problem: you only add your corp account and install corp apps in work profile

Wait until your personal phone, with its work profile, comes into scope of a work-related deposition.

You'll find just how paper thin that argument is.

Yeah, you haven't lived until you've had all your work email subpoenaed. Been there, done that.

This isn't a legal argument as much as a technical one. Work profiles prevent employers from accessing non-work-profile information

And as a non-legal argument, it won't hold up in a context where anything non-legal essentially doesn't matter.

Why would my personal phone come under a work-related deposition? Work emails written on my phone might be, but those are accessible without physically taking my phone.

Because some lawyer convinced a judge that there may be pertinent information on it. If there's any suspicion that you may have used your personal device to communicate with co-workers, then they'll want to see it. You can't prove you didn't without turning it over. If they find you didn't use it, then thanks. If they find you did, game over. That's the point of the discovery process. They don't know what information is out there, so they're going to get as much of it as they can and sort it out later.

> If there's any suspicion that you may have used your personal device to communicate with co-workers, then they'll want to see it.

No, they'll want to see the communication. Which the company will be compelled to provide. The device isn't relevant. (In my, admittedly limited, experience, this is how these processes actually work)

The original discovery request may be something along the lines of "please submit all communications that occurred in an electronic format via printed copies, blah blah leaglese". You then wait until the last day allowed in the discovery request, and then send over what ever print outs you have decided to release. If opposing counsel feels you've left something out (intentionally or otherwise), they can/will go to a judge to get a warrant. That warrant will not state "collect print outs of communications from personal devices". It will state "collect any personal electronic devices".

> If opposing counsel feels you've left something out

No, this isn't correct. If opposing counsel has evidence[0] that the personal devices have relevant communications not already provided, they can file for a subpoena to have you turn over personal electronic devices. Your counsel can file a counter-motion, and you'll probably have a hearing.

No where will there be a warrant, unless you're in criminal proceedings.

Like I said already: as far as I know, litigation holds and discovery are fairly common, and what you're describing is not. To clarify, this is all assuming you use a work profile and a personal profile.

[0]: I don't necessarily mean evidence in the legal standard, but they need some basis for this. "A feeling" isn't enough.

If they take my phone in court I'm not too concerned. I just don't want them to be able to sniff my personal profile info without me knowing.

> I just don't want them to be able to sniff my personal profile info without me knowing.

They will, and you won't. (I've been there.)

Care to elaborate? Was this using work profiles?

But that's no longer "spying", is it? You just shifted the goal post.

> You just shifted the goal post.

Arguably. I don't see it as such though. I see it as: if my phone would be fine in a deposition then I don't have to worry about work spying on their device. But if I have to worry about what work might find out on a device then I'd be a lot more worried about what might show up in a deposition.

What's said in private is supposed to stay private. It helps to demonstrate that it has stayed private if it can't be compelled especially from unrelated circumstances. Whether "private" means discussions with your family, your friends, your coworker, your boss, your commander, your patient, your client...

...it's very important to keep work separate.

Does this apply to just having Slack on your phone?

Slack records a device id when you log in -- have you noticed that you get a notification saying that you've logged in from that device? And a lawyer won't care that it's your personal device. They'll want to see it because it shows up in an audit log from your employer. They'll want to check: have you saved any work content? Have you copy/pasted work messages elsewhere? Just about anything is fair game once the device is identified.

Well that settles it. Next time I switch companies, I'm getting a separate secondary slack device. Also probably important for keeping the company out of your side-projects.

Let's say I don't care about a deposition, but I am only scared of my company spying on my personal activity. Should I be worried if I use a work profile?

iOS offers 'work profile' support for this as well, as of mid-2018. Specifics can be found on page 8 of https://www.apple.com/business/docs/resources/Managing_Devic...

As per your second point, realistically it was probably even done on work devices and not personal phone anyways. As for the second example, the person actually submitted a change to a corp extension, so that must've also been done on a work device. So none of these example have anything to do with personal devices.

Best Buy did this when they released their employee app. In signing up for it, it said they had the ability to view everything on the phone, and to wipe it clean if need be. I used my employee discount to buy a cheap secondary phone with no SIM to use in the store, and eventually decided not to load the app even onto that.

We need "permissions" for employment, a standardized listing of privileges you give up when you sign your employment contract. If your employer breaches this, you get a fat payout courtesy the NLRB. You could say, "Sounds like you should just read your employment contract," and I would reply, "Sure, and I guess we don't really need Miranda rights either."

You may be interested in reading Private Government by Elizabeth Anderson. In it, she explores the scope and implications of employer power in the US and compares them with the power of governments.

Exactly. If they want you available on the move, buy you a new phone that is only for work.

If I'm required to be on call (and I don't mind being on call; I write the software so I should answer questions when it fails), I require a work phone. I never, ever, put work comm on my personal phone (or laptop, etc). Period. What company that can afford me cannot afford a phone for me?

Does it flag me as an old that the last thing on earth I want to do is check work messages/docs from my phone? There's a concept of 'checking out for the day and going home' that's important to not going crazy, especially now. If something goes wrong, or there's an emergency, folks have a number they can text/call. But constantly check messages? No way.

Maybe I'm old too.

I used to keep work email and calendar on my personal phone. A few years later, I disabled the email because it distracted from life. I leave the calendar simply to let me know when I have an early meeting (my day normally begins at 9, but work with teams in India, so occasionally have earlier meetings).

That's my point of view. I definitely want the information available on my phone, but I never want it to interrupt me. Even if I get a slack message during the day, for example. To me, part of getting older is the more frequent "was that meeting tomorrow morning at the crack of dawn or the day after tomorrow..." and I don't want to go check my laptop. ;)

I don't even have my full calendar on my personal phone, I just share the "busy" status calendar as a public calendar then subscribe to it on my phone. I can see when my first meeting is, but nothing else!

I gave up a phone, 4 years ago due to the fact that I am involved in anti-child trafficking and while it is not a grave risk, the reality is there are bad people that traffic in children and the less trackable I am, the more that risk profile goes down.

Anyways, that is just backstory to say, getting rid of my phone was the best thing I ever did, I have a burner with a few hundred minutes on it, in my truck for emergencies but I honestly never use it.

A good deal of people could actually untethered themselves from their phone dependency and actually find out that they enjoy it a lot more than being leashed to one.

I'd probably be fired if I didn't have a cell.

Then the company better being paying/providing said cell to you. If a company requires something to be used, they need to provide it.

They won't ever admit it. It's like if you were hiring someone: most people won't hire someone who doesn't have a phone number because that would be an inconvenience to them, but they can always make up another excuse for why not to hire the person.

Fortunately in my line of work it's not that uncommon to have anything other than a burner phone and even then a lot of people don't even have that. I went completely without one for about 2 years and then decided to get a burner when I had to walk back to my house to get some tools to fix an issue with my truck. Figured I at least needed one for those kind of situations.

I wish there was a cal sync different from mail and the rest. Having to login to a secure device to check meetings for the next morning in an annoying ritual.

My office allows the standard iPhone apps to connect to Exchsnge. I don’t see a profile installed on the phone. As far as I can tell, the only change is a required PIN (which I would have anyways).

I'm in the middle. I have developers that work whenever they feel like it, and they email me with questions at all hours. I like to be there for them when I can (but I don't feel bad when I can't).

I've set up my email client on my phone, so that it only notifies me if one of my developers emails me. I use the VIP feature of Samsung's email client, which seems to be unique to that specific client, since I haven't been able to find another with it. I can check the email (if I can), and decide to answer right away (if I can), or just snooze the notification for later.

Everyone else can KMA after hours. Or text, if it's an emergency - but they better say what the emergency is in the text, or they may not get a reply.

> I've set up my email client on my phone, so that it only notifies me if one of my developers emails me. I use the VIP feature of Samsung's email client, which seems to be unique to that specific client, since I haven't been able to find another with it.

Maybe not quite as simple to set up, but you should be able to get something similar on most clients with a folder and a filter. I've done this for some of my important/urgent folders, with K9-Mail set to only show notifications from those folders (notification class).

Readdle's Spark mail client for iOS/MacOS has many of these features. Doesn't help for your samsung, but in case any other iOS folks are scrolling by. :)

This is my mentality. Sadly it means I'm only a midlevel after 8 years. Apparently I don't have enough dedication to move up the ladder since I don't have Teams on phone and don't work 9+ hours per day.

If you're forgetful like me, it's really helpful to be able to check what time the first meeting is tomorrow when I set my alarm before bed.

Now that work from home is a thing, I also like having an standard way to communicate with work and be at least partially productive in case my laptop dies. I have my Do Not Disturb settings set so that the work profile doesn't show me email or chat settings outside of work hours on weekdays so I can start email triage during my morning bowel movement if I want, but it won't nag me if I'd rather spend that time in quiet contemplation.

Not only they can see it all, they can choose to wipe it all at any time. Some goofball can lose their laptop in a coffee shop and corporate decides better safe than sorry, and then oops there goes all your pictures of your baby. Or your blood sugar measurements, or whatever else.

You're absolutely correct- any device that work expects you to do work on, should be bought and paid for by them.

(And I'm sorry, but "profiles" do not cut the mustard.)

1) This is why I never have and probably never will work at a giant company, because those tend to be the ones that think this way (and have the resources to do something about it)

2) This is why I only ever sign into Slack on my phone, not my work email. It neatly compartmentalizes work stuff, and isn't subject to the device-wide security policies that you sometimes have to agree to when signing into company email.

Same here. I have been on the other side of the equation too, having to impliment and admin MDM, and every time it made me feel dirty knowing the power it really gave me over an employees personal phone. The worst part about it, especially the more I have adventured into SV land, is how often the culture pretends "we dont do that sort of thing" but being the kind of person who knows lots of lawyers, I read the legal docs and yep, sure enough, the handbooks and vast array of other docs all talk about it in the fine print. So there are employees that balk when I tell them why I don't use company email on my personal phone... and I get a bit frustrated that these are the people who ought to understand this sort of thing!

I will always want separate phones for employers that want to use MDM on the device, or else I just won't do any work on the phone... which unfortunately in some companies is looked down on. Glad I'm in a better environment these days (mdm exists on the sly, but I am not pressured to use email outside work hours) That said, this is also why I don't want to shift into the management path either, because that changes once you are in mgmt.

> assume that HR can view EVERYTHING on your phone, because they can

Patently false, for many values of ‘everything’ and ‘phone’.

An MDM has zero visibility into an iPhone’s browsing history, iMessage content, or the content of any app not installed directly by the MDM. So things like Signal, WhatsApp, and even the default mail app are off limits.

Why is this being downvoted? Is it not accurate? If so could someone explain where djrogers is wrong?

It is correct, with the exception that MDM can erase your phone and can install a VPN on it. But you can easily check if it did or not.

An MDM can install a root certificate + VPN and snoop on your network traffic (which would disclose a lot of things).

> If your employer expects you to use a mobile device at work, have them pay for your phone and only use it for work purposes, assume that HR can view EVERYTHING on your phone, because they can, especially at a company like Google that has both deep mobile expertise and insane paranoia around things like IP protection and stopping whistleblowers.

This also goes for company-issued computers. I've run into more than a couple people that learned the hard way that they were being monitored through company equipment.

So you learned this the hard way but you don't have any opinion on whether it's ethical?

For what it's worth your comment is technically wrong and misleading - really, it's FUD.

Android is very specific about company-owned vs personally-owned phones. Personally-owned lets you setup devices with a work profile where very little non-work data is available to the employer. They don't know your personal apps, they dont know your IP address, and they dont know where these apps go (ie no personal network logs). They have no access to these either.

Even for company-owned devices (which require a specific setup, if you bring in your own device that means factory reset and things like hitting 7x the white screen on the first new setup page), the mobile device management api doesn't give you all that much. There's no remote access/rootkit, you can't see private messages (they can see messages you send over a work chat app they own, so if its google hangout chat f.e., by looking at the hangout service itself)

Here are the different modes: https://developers.google.com/android/work/terminology and you can follow the API links to see what they do if you want to verify what I just wrote.

Except that in the Employment Agreement that Google made me sign when I worked there (I don't know if it is still like this) Google specifically called out that they reserve the right to rootkit your personal devices that access "Google's corporate information" (basically that means accessing your work email because you needed to use your corp laptop if you wanted to access the internal network)

But I agree that if they were talking about the "Android" feature, an employer could choose not to go that route.

When you signed your agreement, that Android technology didn't exist, so reserving themselves the right to get root on your devices accessing corporate information was the closest, yet very blunt, approximation. Personal devices were highly discouraged or even forbidden for a long time, but employees kept asking about them, for the convenience. These use cases and internal dogfooding were major factors in the eventual development of Android Enterprise and related products.

That doesn't track. By the time they pulled this crap (including the "you didn't sign it, would you sign it again?" and it turned out to be different), we had been given at least one Android phone (ADP1) and maybe the second as well (N1).

I dogfooded pretty much everything from the G1 to the N5, Xoom included. Until Lollipop or Marshmallow arrived, we were discouraged or forbidden from having corporate accounts on personal phones, because there weren't the necessary Blackberry-style features yet, e.g. remote wiping. I remember Honeycomb (the Xoom) having only encryption, but no wiping. At some point you could add your work account as the primary on your personal gift phones (dogfood ones were a different story), but that meant that the device got bricked when you left the company, forcing you to a factory reset — and there was still no good isolation.

I definitely had my personal account as the primary on my N5 along with a work profile and I believe that's the first device/OS combo where it was feasible, if you ignored the annoying duplicate app icons in the launcher. The first truly "tolerated" personal devices were probably the Christmas gift Chromebooks from a few years earlier, as long as you used Yubikeys.

Didn't the policies even predate Android? They definitely were there well before Lollipop. Unless they were introduced post-Aurora, in 2010 — i.e. in the N1/Eclair days, keeping the phone vintage theme.

Seeing how well corporate IT apps work on my work laptop (slowness, constant updates and general clunkiness), the main reason I'd never install one on my phone is that I'm afraid they'll make the phone completely unusable - not thru malice, but thru sheer incompetence.

I never install anything work related on my phone. Company has to provide a phone that can be looked at with backdoors rootkits etc. Articles like this just confirms that this is the right course of action.

Yes, this. If an employer wants me to install an app, they had better provide the hardware, too.

Also, never use employer-supplied computers for personal stuff, and don't login to your personal accounts with it. If you work at Google you can afford a laptop that you truly own.

Seems weird. We have MDM at my company and there's no way I can "spy" on your phone or otherwise perform rootkit like work. It all goes through a work profile, which is isolated from your personal apps/ information.

If you can push and run an executable, you can theoretically root a phone or laptop whenever you need to. It doesn't even need to be root, a background process accessing the right things can be enough. It's not rootkit right now, but rootkit later.

Who is dumb enough to install employer spyware on their phone? If the company mandates such insanity then simply don’t bring your phone to work. The only way this could make any sense is if they provide you the phone AND pay for the service plan.

People who aren’t starting and ending their days reading HN, probably.

The down votes beg to differ.

The article doesn't mention anything about mobile devices though?

Is this based on the article or is it speculation?

I have Teams installed on my iPhone. How does that give my company access to anything of mine?

Most corp IT teams require employees to install a mobile device management profile, which enables you to then run teams, get email access etc. it’s also what gives your company privileges on your phone.

Some MDM profiles can have pretty nasty access enabled (e.g. route all IP traffic via Corp net, access device location at all times, remote wipe etc).

Take a look at what your MDM profile says if you have one installed.

Can you be more specific? It's really hard to find information on this and I'm 90% sure I'm ok but I can't see what they're seeing.

I see. I have Teams installed through the app store; my company doesn't have much guidance on mobile usage so I guess I'm safe.

This is exactly right. When my employer started requiring apps on my phone, they started paying that phone bill and I got a another one.

Completely aside from denying observability to shitbag panty-sniffers like Google HR, it is important to me to be able to wipe that phone when I leave to know there is no remaining access/sensitive info/etc. while also not wiping anything important to me.

Same reason I keep personal stuff off my work laptop and vice/versa.

Oh wow, is this not common knowledge?

Simple solution just use a $20 4yr phone that only has WiFi access and you only use for work, no cellular data

Old smartphones are cheap these days

Can't upvote this enough. Never give these remote administration rights to an employer on any personal device (phone typically, but any).

The whole thread here seems to revolve around whether or not Spiers should have been fired for what she did. And while I have a clear opinion on that and had fun sparring with y'all here about it, can we also talk about how unionization is actually something that we need to think about as a profession / group of professions?

The days where "being in IT" made you a rockstar that could command a premium in individual negotiations are, best I can tell, way in the past. Open source frameworks and industry standards, while certainly excellent from a standpoint of work de-duplication and stability, have made it much easier (at least for bigger corps) to replace engineers, or to simply hire someone who's cheaper and less likely to make trouble (read: people more vulnerable to exploitation).

There are certainly still exceptions to this, and there will continue to be. For example, the mythical 10x people among you will never have to worry about this, because they're simply that good. Or if you happen to be working on rust for a year before it breaks into the mainstream, then you'll have a head start for a while. But don't expect that to last.

Overall: we will either realize and act on the fact that we are now for the most part a skilled labor like any other, or we will see our precious privileges erode and our incomes and work conditions deteriorate. And like it or not, but for many among us who are not "the gift of god to coding" the rational strategy will be to not fight on our own.

To bring this back to the current case: the NLRB decided that Spiers got illegally spied on. Whatever your take on her actions before that: illegal stays illegal, and as such don't blame her for it "because she had it coming." Blame google, for blatantly pushing against workers knowing and demanding their rights. If you see what they did here, and the context of this whole story, can you really take their argument at face value that she got fired for misappropriating company property or some such? Doesn't it seem much more likely that they simply made an example of her for informing her co-workers of their rights?

> The days where "being in IT" made you a rockstar that could command a premium in individual negotiations are, best I can tell, way in the past.

Are you kidding? Salaries have never been higher in tech. Senior engineers make more than $400k (sometimes way more) at Google and other large companies.

It is likely that engineers at FAANG companies would make less money if they join a union, because the union would level people out by negotiating a standard salary for workers at similar levels at all companies. I haven't seen anyone refute this.

Uh, no. Nope. Google has been suppressing wages progressively for years. They made an illegal no poach agreement with their peers that led to one of the largest settlements in history.

Just this past cycle they pushed down compensation for top performers. There was an internal slide deck someone found where they laid out plans to reduce pay by slowing down promo to senior levels.

A union would mean the ability to negotiate as a group rather than just taking whatever Google decided to offer us.

Uh, no. Nope. http://levels.fyi will prove you wrong.

The fact that google is suppressing wages today won't show up on levels.fyi today. It will show up 5 years from now, and by then it'll be a lot harder to unionize.

He says it's been happening for years so it should already be showing up. Care to prove it?

The point is that they've had anti-wage practices for years, but that they recently reduced top-level payout. I'm not able to find a year-by-year comparison for pay bands at Google on levels.fyi, so I'm not sure what your point is with that site.

I don't work at Google, so proving that Google specifically is cutting wages isn't something I'm able to do. At the same time, I don't think you need to prove that Google's incentivized to maximize profits. They're a publicly traded company; there will always be motivation for them to reduce costs. If you're in search of proof, the anti-poaching lawsuit[0] is not something to take lightly.

And either way, I don't see you bringing up any strong arguments against collective action. Just because Google might not be doing something to reduce compensation right this second doesn't mean they don't have the power to do that in the future.

[0]:https://www.cnet.com/news/apple-google-others-settle-anti-po...

> A union would mean the ability to negotiate as a group rather than just taking whatever Google decided to offer us.

One of the highest salaries on the planet, and they still have several competitors?

Yeah, this is very short sighted. The system works, and tech employees need unions for salary negotiations less than nearly everybody. This doesn’t end how you hope, and just reeks of unearned entitlement. If you don’t like the offer, don’t work there. Nobody owes you anything.

https://en.wikipedia.org/wiki/Knights_of_Labor how about how you learn some labor history, and how organization efforts spearheaded by the most privileged workers, however odious in some respect, did beget trends good for all.

Here's some more labor history for you: https://en.wikipedia.org/wiki/Jimmy_Hoffa

Is this supposed to convince people that unions are bad?

It's almost as if single links to Wikipedia don't really prove anything, isn't it?

Collective employment agreements mandate minimums, not maximums.

> Collective employment agreements mandate minimums, not maximums.

Collective employment agreements can mandate whatever is negotiated between the union and management, within the bounds of contract law and labor law. Of course they can include maximums.

What is likely to happen is that a salary range would be defined for each engineering level. The top of that range is likely to be lower than what many engineers at large companies currently earn, yet higher than what many engineers at startups currently earn. Therein is the leveling effect.

Leveling is good if you level up, but bad if you level down. Many engineers at large companies would level down, if they were to join a union. So why should they support unionization?

Workers don’t have an incentive to negotiate a maximum. In practice, it’s minimums that get negotiated.

It’s also not like wages come from a fixed budget. They can be increased by lowering profits. This is after all all about class struggle.

Maybe. This is how I've felt about unions since the grad students tried to unionize at my university, and all the hard science grad students would have lower salaries if the union came to fruition. So it's an effect that I would expect in general if good devs get grouped in with non devs. However, a former roomate's father owned a construction company and I was talked to him about unions once. I took the stance that he must be frustrated about unions as a business owner, and he said "no way". He said he loved the 3 unions he had on site because without them he wouldn't have access to the best talent. Apparently if you're a skilled tradesman you have a much higher earning potential in a union than out of a union, so the most skilled will be in a union.

Now that said, that's the current equilibrium in the construction world. I have another anecdote from a former employer that had to deal with unions, and unions were a pain for that company to work with. I think the owner would have happily squashed the union if he could, but this was in a shrinking industry that had a glut of talent. Definitely a different equilibrium there.

So you could very well be correct that unions would pull down salaries for high paid devs in the short term, and even in the long term. I'm just not as convinced as I was when I was younger.

Unions have very different relationships with different employers.

I was friends with a Teamsters organizer and he told me that in fields like construction and warehousing, they would ask the Teamsters to organize the place because it was better labor discipline.

>This is how I've felt about unions since the grad students tried to unionize at my university, and all the hard science grad students would have lower salaries if the union came to fruition

How would they know what their salaries would be if they chose to unionize?

Most likely the union organizers said they'd do X, Y and Z if created. That included a more standardized salary across the board which benefits those making the least but hurts those making the most.

Someone claiming to know what salary you'll get before bargaining is even an option is full of shit.

Parent comment read like some externalized imposter syndrome, but I agree unions are useful for extracting more value from employers. What isn't to love about that?

The fact that the people who get that value may not be you and that the employer may take value away from you to make up the difference.

Those high salaries aren't the result of individual negotiations, though. FAANMG+ companies pay very well, but salaries for the vast majority of engineers are determined by black box formulas, and in cases where blocs of employees think there's something unfair about their compensation (for instance, people in one location being paid more than people in another) there's absolutely nothing they can do about it. The scale of these companies is such that even senior engineers have an essentially nonexistent negotiating position.

Is it really a black box though? The majority of these companies have spreadsheets where people share their salaries, and from what I've seen, it's a fairly basic formula based on 3 factors: Level, rating and location. Yes, there's maybe a few % of wiggle in there, but generally it's fairly consistent from what I've seen.

You could argue that the way you get a rating, or even the way you get promoted are a black box, but compared to most non-tech companies, it actually tends to be quite a bit better.

> The majority of these companies have spreadsheets where people share their salaries

You mean a group of employees collectively organized?

If you call that “collectively organizing”, I guess that proves we don’t need unions. The labor law was all that we needed and it worked as expected. Problem solved!

It's possible I don't understand your point, but it seems fairly obvious to me that doing a little bit of a thing doesn't mean you can't benefit immensely from doing more of it.

Hungry? Eat a cracker and you may be less so—and it may even make a material difference to your survival in an extreme situation—but it won't replace a full meal.

I agree that we should continue doing more things like the example given, also without using a labor union.

A union is often how these sorts of things get passed into law.

I don't mean to imply that it's not predictable—I just think it's relevant to note that it's completely unaccountable. You get a number, and that's your number.

Nor do I mean to imply that it's awful, or worse than X. I know from experience how unfair individual negotiation can be, having been on both ends of massive pay ranges for the same title and responsibilities at the same company. It's not all sunshine and roses in my current job as a software engineer at $BIGCORP, but I do appreciate the relative fairness with regard to pay, and the magnitude doesn't hurt either.

Still, it's worth pointing out that a) unions have done great things for workers across many industries, b) that tech workers usually have no institutionalized collective bargaining power, c) that many tech workers have essentially no individual bargaining power either, and d) that tech work has been following a trend of increasing commodification.

The point is that you have exactly zero say in it. The comp team spits out a number using a formula that changes year over year, then your manager has a little bit of wiggle room to allocate to high performers, and then you get your number. With zero advance warning they can absolutely just say "sorry, your performance review ratings are now worth 50% of what they were last year" and there is nothing you can do about it.

With a union it'd be possible to ensure that the comp formulas are made public ahead of time and that nontrivial changes to the formulas are reviewed by the union.

Other than the formula being public (Which again doesn't make a difference since we already roughly know it), how much wiggle room would you have in a company with 50k+ employees? Would you have any more of a wiggle room than you did before? Is the union going to argue for your personal individual salary?

I think you're inflating an issue that happens when a company is really large, to an issue with lack of union.

I think the point here is that if $BIGCORP makes some unpopular compensation change that affects many employees (e.g. reducing the weighting of performance in the pay formula, reducing base pay relative to RSUs, etc.), a union would give employees a way to push back on those changes and/or negotiate for some other concessions in return.

Actually, I imagine a $BIGCORP workers' union to be much more involved in this kind of negotiation than e.g. in demanding that wages be flat with no room for pay increases based on merit, which is the usual FUD that anti-union folks roll out in these conversations.

> Is the union going to argue for your personal individual salary?

Probably not. But they might be able to prevent the company from suddenly reducing everybody's equity compensation by 20% or whatever. A huge amount of compensation at large tech companies is completely discretionary. Nothing prevents large tech companies from eliminating huge swathes of bonus and equity pay, other than people leaving the company. A union can make it so you have other recourse.

The higher salaries are the result of getting multiple offers and the companies bidding against each other.

They say they don't do it, and of course they all in fact do it (to some extent).

>Are you kidding? Salaries have never been higher in tech. Senior engineers make more than $400k (sometimes way more) at Google and other large companies.

and they would be even higher if google and apple didn't conspire to force them lower.

No they wouldn’t. That was over a decade ago.

Then why did they take such steps to surpess wages, to save a few bucks for a quarter?

Here's a refutation: Microsoft spends $250k/employee/year on stock dividends and buybacks. That's quite a large slice of the pie the union could negotiate for.

> Here's a refutation: Microsoft spends $250k/employee/year on stock dividends and buybacks. That's quite a large slice of the pie the union could negotiate for.

Those buybacks increase the stock price, and employees are compensated in stock, so stock buybacks benefit employees already.

I find it hard to believe that the company would just give that money as salary instead -- and even if they did, that would mean that employees of some companies are paid way, way more than employees at other companies. That is exactly the situation we have today, without unions! So again, why do employees at large companies need unions, considering they are already paid more than everyone else?

Incidentally, I get stock compensation at my job and getting cash instead would have been worse. The stock I was granted has increased in value. Cash is just cash, and loses value to inflation. I would rather have salary plus RSUs than just a large salary. I don't know if a union would see the value in that.

As an employee I might have $100k in MSFT stock after five years. Those buybacks gave me what, a few hundred/thousand bucks at most? Come on. For such a supposed math-literate profession this objection is weirdly common.

If you get cash you can turn around and buy company stock. Nobody is stopping you. Unions would also certainly see the value in employee ownership of stock, which broadly aligns with ideas of workers capturing more of the value they produce.

A union enables workers, in aggregate, to capture more of the value they produce - value which would otherwise flow to the pockets of shareholders, the overwhelming majority of whom contributed nothing to its creation. Talk about employee salary distribution is orthogonal to this debate.

People also seem to think that RSU grants somehow appreciate in value before they vest. They do not. If you sign for 400k of RSUs over 4 years with a 1 year cliff and the stock rockets up 2x just before your first vest and then plateaus, you’re still getting only 400k.

There’s literally no difference to a regular salary except you get paid out twice and it makes taxes more annoying because you have to pay estimated taxes quarterly instead of doing it once like normal people.

Netflix has also proven this obsession with RSUs is unnecessary. You can have strong growth without it and in large public companies, the theory that this somehow incentivizes employees in any meaningful way has a severe lack of any evidence.

That's entirely dependent on the company. Google grants RSUs based on a dollar value when the grant is approved.

> People also seem to think that RSU grants somehow appreciate in value before they vest. They do not. If you sign for 400k of RSUs over 4 years with a 1 year cliff and the stock rockets up 2x just before your first vest and then plateaus, you’re still getting only 400k.

This happens at some places and happens based on number of RSUs at other places.

FB grants RSUs based on an initial value at hire time translated into a total number of stock units that then vests over 4 years. So if the stock doubles, your comp doubles.

> contributed nothing to its creation.

no, they contributed capital. This capital came from somewhere - e.g., they took a risk and borrowed it. Or they took their own saved capital from their own past working life (or inherited, which is just the past working life of their parents).

When speaking of labour and value creation, the concept of capital is often seen as "nothing", and is certainly wrong. Without capital, labour is useless. Without labour, capital is useless.

If you buy a share of a publicly-traded company you are not "investing" in the company, "contributing capital", whatever. The company does not use your money to build out its infrastructure; generally they don't see a dime of it. There are a few exceptions like with Tesla who issue new shares to cash in on their inflated stock price, but this is generally rare. Most companies are doing the opposite: buying more of their stock, not selling it.

> If you buy a share of a publicly-traded company you are not "investing" in the company

no you are - because it's a chain of capital investment that is linked all the way to IPO (or private investment pre-IPO).

You purchase a share publicly from _someone_ who has purchased it from someone else. This chain of purchases leads all the way back to the initial share offering.

Just because your dollar doesn't go directly to the company doesn't mean this form of funding structure isn't "contributing capital". Your public share purchase allows an existing share holder to exit - without which they would not have purchased the initial share in the first place.

that all sounds like an incredibly roundabout way of inflating ownership structures rather than contributing meaningfully to value. how much fidelity can be assumed by this, over time? Unless you assume that value traded in a market is perfectly efficient (which it's not) the value signal is going to degrade over time. so, how long can you trust that the "chain of investment" faithfully represents value added? a year? ten years? how about investments in companies that have been around for 50, 75, 100 years? Why is it that we take as a given that ownership of value necessarily connotes the owner is themselves valuable?

That's not how salaries work. Microsoft would just say no. Are microsoft employees really willing to strike? Seems unimaginable to me at their salaries.

There are a lot of tools in a union's negotiation toolkit. A full-union work stoppage is the most extreme, rarely deployed. Other measures include rolling work stoppages, delaying response to manager emails, not attending meetings with management, not answering non-customer-impacting on-call pages during certain hours (I'm sure support would be widespread for this one in particular lol) - you can come up with more ideas on your own. My brother, an EMT, is part of a union that does "plainclothes" strikes where they just wear street clothes instead of their uniform, for a softer example from another field.

There are a lot of tools in a union's negotiation toolkit.

When the French train drivers go on strike they continue to run the normal service but simply don’t collect fares. Hurts management but keeps the ordinary people on their side.

I'm sorry, I should have been clearer: the times where simply being IT made you a rockstar are over.

These days you have to be employed by FAANG, or in a company in their direct vicinity with sufficient funds to keep up. Many companies, and many places, are not that, but they still need IT.

Could you provide some evidence for this rather remarkable claim?

> It is likely that engineers at FAANG companies would make less money if they join a union, because the union would level people out by negotiating a standard salary for workers at similar levels at all companies. I haven't seen anyone refute this.

More than one union exists in the world, they also compete with each other to offer their members the largest benefits. I don’t see why unionisation would reduce pay competition, if anything it should increase it by ensuring that anti-poaching agreements never happen.

Sectoral bargaining is rare, its typically within individual employers or workplaces, even if we decide to do sectoral bargaining unions are democratic, and we could change what we bargain for or refuse to participate in sectoral bargaining

The problem I have with trade unions is that those usually start mandating how work is performed, rather than just acting as protectors of workers' rights. As a silly example, an IT Union could mandate that we all use tabs for indentation. In general the idea of unionising is appealing, but I don't want to end up in such a degenerate situation. I want an organisation that will protect my rights as a human being while on the job, while also giving me some amount of power to steer the corporation that profits from my labour. It would be nice if this could be done as one generic overarching union that all workers are a part of and that guarantees basic rights for everyone, which could perhaps then be further refined by profession if strictly needed. My thought is that a generic union will not have a desire to meddle in the actual work process, but keep their activity on the political level.

Unions are democratic organisations, the whole point of them is for workers to gain power together. You’ll only get tabs enforced if the majority of workers agree that’s a useful rule to have.

This just reiterates what the parent comment said. In this case up to 49% of all workers who did not want to use tabs will be forced to.

That's not gonna be a very successful union then. The unions I know that actually work are near-universal, but you're never technically required to join. However, at certain levels of unionization, peer pressure kicks in because the "freeriders" effectively get protection from the union without pulling their weight.

> peer pressure kicks in because the "freeriders" effectively get protection from the union without pulling their weight.

I would much rather the peer pressure be applied to those writing the checks, by their competition.

Their peers have the same material interests to keep wages low in order to keep profits high, so they rarely side with the workers. There are many documented cases of explicit collusion, even.

It's why it's important for workers to act collectively. Since they can threaten the owners' profits through strike, there is much more leverage.

I'm wary of centralized power of any kind, but explicitly coordinated centralized power (in the form of industry-wide unions) scares me just as much as explicitly-illegal-to-coordinate-but-aligned-incentives power in the form of a set of a few gigantic employers.

And yet the unions are democratic, but the employers are not. You can vote out the union leadership and all important decisions require a ballot.

Power structures can be abused, but they can also be a way to concentrate the will of many to achieve something that cannot be done individually.

What's important is the material incentives of those involved. Even if they were to be insincere (in which case they often are removed), union leadership are incentivised to raise the wages of all members since dues are the main way they are funded. Employers are always incentivised to reduce wages as much as they can get away with, since they wish to maximise profits.

> The unions I know that actually work are near-universal, but you're never technically required to join

"that actually work" - what does this mean?

There are lots of functioning unions that require you to join, to work. Teacher's Unions & Screen Actor's Guild immediately spring to mind.

The alternative is having no democratic power over the workplace at all. Being in the 49% that disagreed with something is still better than your boss mandating the choice instead.

In practice, it’s also quite rare for workers to strongly disagree among themselves. Disagreements tend to happen between groups with different material incentives, so largely between workers and owners/management.

> Being in the 49% that disagreed with something is still better than your boss mandating the choice instead.

No, it really isn't because of ecosystem effects. Per-company unions find themselves rapidly affiliated with industry unions and then pan-industry unions. The net effect of this is that in non-union industries you can go somewhere else and negotiate with a new boss. In union industries you go somewhere else and you're still subject to the same 51%.

If there are other bosses available. If they are in any way different. If you’re lucky to stand out.

In practice, you’re far more likely to agree with fellow workers than with bosses. You have material interests largely in common, not largely opposed. That’s why unionised workplaces and industries have measurably better pay and conditions.

Operating in the aggregate is a fool's game. I am not the arbitrary worker who has more in common with the arbitrary worker. I am an immigrant with many immigrant friends from various countries. The arbitrary American worker wants me out and wants my friends out. He is no ally of mine. I will not stand with him.

There are other bosses. They are different. And my industry is superior to most unionized industries so I don't care.

I’m also an immigrant.

It is true that the workers of rich countries are “bribed” with less exploitation to pit them against those in or from poor countries. But even their condition can be improved, so it’s possible to build solidarity. I’ve seen it myself.

Ultimately, all value is created by workers and that is where profits are extracted from. If we can foster solidarity with one another, we can force bosses to keep less of our labour as profits.

It’s individualism that is foolish, since it lets the bosses divide us. Collective action is much more effective.

Acting collectively with a guy standing with his knife poised above your back is a strategy you are welcome to. I don't think it's hard for you to see why I'm not keen on it.

But there is a simple way to solve this. If your union has, as a bylaw, "It is an immutable rule of this union that it shall never act to decrease or keep constant the number of immigrants to the USA. If this union acts in that manner, it shall be immediately dissolved and all membership rolls shall be destroyed after refunds for that month's membership fees", then I won't oppose it.

Considering that we are to act in solidarity, all I'm asking is for that measure of good faith. Just put down the knife and go stand in front. That's all I'm saying.

Most unions have anti-racism and anti-xenophobia in general as a central part of their organisation. Explicit rules exist in most, but many go further with resisting deportations, exposing discrimination in workplaces, solidarity strikes with workers in exploited countries, etc.

I'd recommend you contact some local trade unionists, you'll find that they're overwhelmingly pro immigration and anti-racist. You'll also find that marginalised groups (including immigrants) are vastly over-represented in the labour movement in general, since we are exploited more.

It isn't about what it is today when life is good. It's about what it can become if life gets hard. If everyone agrees this is a good thing they'd all adopt the poison pill. After all, if the poison pill triggers, the organization is clearly acting against its principles and dissolution is better than continuation.

The fact that they won't, and instead use toothless codes that can be repealed when things change make it clear they don't believe this is an immutable part of them but is a marketing ploy.

Life is hard right now and unionised workers all over the world are fighting to make it better.

How would such a "poison pill" even be enforced? If the majority decides something they can always do it, worst case by creating a new organisation which they then all join.

The US is very racist and such attitudes persist even in the labour movement. Historically, US reformist unions used to exclude non-citizens from membership, which is why the IWW started organising all workers including immigrants. The result of this democratic struggle is that US unions now organise all workers.

You're not losing anything by joining a union. It's possible that you may not gain as much as you'd like because of bigotry where you work, but that can also be fought against.

The idea of Google exploiting its programmers is an insult to actual exploited labor. These aren't coal miners. There's no factories.

The programmers where I work have too much power. We're exploiting the company. If I don't feel like writing code, I just do github stuff and answer questions. In fact that's what I did yesterday and the day before. No one notices or cares because, among other things, they couldn't replace me because there aren't thousands of hyper-educated new college grads after my job. I think many of the Google employees who are unhappy at Google due to "exploitation" would be happier working at a smaller, less famous company. Of course there's a pay cut and you lose that special feeling when everyone instantly recognizes you employer and assumes you're a genius.

In theory, I would love an IT union. But in practice it's likely to turn into another extortion racket by a small cabal of sleazy fat men. And they will stay in power appealing to the lowest of the low flattening salaries and destroying meritocracy. With sadness I have to say, no thanks.

Unions are democracies, unions only get that way when people dont engage

Yes, and for a hierarchy of competence the lazy bottom feeders who are in IT only for the big salary end up out-voting career people who care about doing a good job. No, thank you.

People should be allowed to unionize but I'll oppose it at every front. Because mass power means mass power that can be turned against me. 2016 taught me something. There are a large contingent of anti-immigrants out there. Should you allow the creation of a mob, a day will come when the populists will take control of it.

In moments, the mob can break generations of integration. The best defence against it is prevention of its formation.

No, should you gain any appreciable fraction of power to unionize, I think there's a lot of my money I would throw into the opposite effort. No populist mobs. Never again. No group should have that power.

The problem is there already is a single "mob of power", and that’s the employer. If your employer decides it’s anti-immigrant, that’s bad for you.

Unions are an attempt to create a "mob" to counter the "mob" of the employer.

This part is true. The employer does have more power than most employees. However, the employer isn't permitted the kind of cross-company monopsony that unions are permitted to form. Employers would like to try this and have done so (Apple+Google famous anti-poach being an example). Anti-poaching agreements are illegal and when they take place they've been slapped down.

However, unions have no such restriction. A Google union would affiliate itself with a Facebook union and those with a Kickstarter union and those with a Random Startup union and before you know it you can't go anywhere without being subject to the wisdom common to Google+Facebook. This makes sense to the union: increased power comes with increased size.

If my employer decides they're anti-immigrant I will go elsewhere and be paid just as well. They will lose.

> However, the employer isn't permitted the kind of cross-company monopsony that unions are permitted to form.

Sure they are. That's just called industry practice. Multiple corporations can decide that certain policies towards workers all favor them, even without a formalized agreement (clandestine or not). They can even all choose to enshrine these policies through lobbying groups and PACs.

I was planning to argue with this, but I only feel sorry that you see something as historically useful as unionising in such a light.

Thanks for sharing your position in any case. Historic anti-immigrant stances by America's biggest unions are close to why I feel this way.

What about unions like the UFW which were among the greatest champions of immigrant rights in the US. The accepted line in unions these days is anti immigration efforts divide workers

That's right. These days. Could change again. But they could demonstrate immutable faith by adopting a clause like what I mention here https://news.ycombinator.com/item?id=25284296

If they are pro immigrant it shouldn't be much of a problem.

Well you could get involved in the labor movement to make sure that doesnt happen, after all unions are democratic.

Unions turning against immigration is very unlikely, even relatively conservative unions like the teamsters are on board now

today being pro immigration is being pro union and being anti immigration is being anti union

What is your opinion as to the likelihood of your union adopting the poison pill that I mentioned above? Do you personally find it convincing that unions that are anti-xenophobic should have poison pills that protect against them becoming vehicles for xenophobia?

Your obsession with a poison pill is quite bewildering, because you're constructing an elaborately implausible scenario where:

1. union power is increased (let alone maximized to pre-70s levels) in the United States

2. the software industry is unionized

3. the unions turn hard right and start adopting 19th century attitudes towards immigrants

In this wildly fantastical situation, would you even say that a poison pill could even do anything against such a reactionary wave? If American society had somehow gone so xenophobic, unions would probably be the last thing we would have to worry about in such a dystopia. Not to mention that any legal fig leaf like your poison pill would be no more protective than a parasol in a tempest.

By-the-by, I would suspect that the essential elements of your vaunted "poison pill" is already part of the bylaws and charters of most modern unions. Take the SEIU constitution for instance: https://d3jpbvtfqku4tu.cloudfront.net/img/constitution-2016....

> We believe our strength comes from our unity, and that we must not be divided by forces of discrimination based on gender, race, ethnicity, religion, age, physical ability, sexual orientation, or immigration status.

Do you think a tech union would be in favour of immigrant labour?

Depends entirely on the union and who is part of it.

Mobs are a fact of life, you can either live in denial, or you can try and make things better

Well, right now all tech worker organization is crappy right now. The mob dissipates its energy in online rage about whiteboard interviews and hatred of foreigners. That kind of mob I like. Oderunt et metuunt, as one might most hope for. And they are powerless in their rage.

With sufficient work they can be kept like that. Either at peace or powerlessly angry.

Maybe so, but the mob im organizing with is groups like no tech for ice which have stopped companies from contracting with ICE. Or the kickstarter union which secured good terms for workers laid off during covid

Congratulations and good luck to you.

lol so every individual should stand alone, while the employer (Google in this case, but mega corps in general) will bend the government to steamroll your rights.

Can you tell me concrete ways in which the average googler SWE's life will improve if they join a union?

Union workers have better pay, better benefits, more job security, etc

You don't get fired like this?

https://twitter.com/timnitGebru/status/1334341991795142667

It sounds like someone said "Do X or I quit", and the management chose the latter. What exactly is wrong with that?

Regardless of whether or not IT professionals should be worried about their salaries, labor power isn't just about compensation.

Unions could negotiate for better parental leave (which is still atrocious throughout the US, even in relatively cushy jobs).

Unions could empower tech workers to actually push back on unethical policies and projects, as opposed to right now where they get to make a statement and then nothing changes.

Organization is about changing a power balance; it's not just about money.

>Organization is about changing a power balance; it's not just about money.

Maybe I fundamentally misunderstand unions having only been in one for a short amount of time but I didn't feel any more empowered by having a union. It was a bunch of union fat cats arguing with corporate fat cats and all in all it just made the work more insufferable.

I've heard widely varying things about different individual unions. But I think this is true of any power structure: whenever power is acquired, it can be abused by the few - be they politicians or CEOs or union leaders - or it can be held onto by the many and used for the general improvement of circumstances. There's always the risk of corruption. But speaking very broadly, the higher the number of different powerful parties competing with each other, the better.

In literal terms: I'd tend to think having union fat cats arguing with corporate fat cats is better than having only corporate fat cats, who are free to do whatever they please.

Union workers have better pay, better benefits, more job security, etc. Many unions are shitty, but even a job with a shitty union is better than a job with no union

Since this article is about a union for Googlers, let's look at google specifically:

> Unions could negotiate for better parental leave

They get 14 weeks parental leave + some amount for medical leave for people who give birth [0].

> Unions could empower tech workers to actually push back on unethical policies and projects

Googlers pushed back on Dragonfly[1] and got it canceled. And they pushed back on Maven[2] and got management to agree to not renew any contracts associated with it.

What exactly would change for Googlers who joined a union?

[0] https://www.cnn.com/2020/04/16/tech/google-family-leave-poli...

[1] https://en.wikipedia.org/wiki/Dragonfly_(search_engine)#Term...

[2] https://www.nytimes.com/2018/06/01/technology/google-pentago...

The ability to maintain that negotiation power and pressure on a reliable basis, as opposed to ad-hoc and reactively as problems arise. One could also ask why people form companies to solve problems when they can just work as individual contractors and arrive at the same conclusion.

They could do all that again in the future without having to walk out and risk their jobs.

You shouldn’t need to put your job on line just to make your employer act ethically.

With a union maybe Google wouldn’t have thought paying the aggressor of sexual assault $90mil was a good idea. God knows why anyone thinks paying someone $90mil is good way to punish sexual assault.

>Organization is about changing a power balance; it's not just about money.

True. Not just... but money is a big factor.

A lot of the interest in organizing big tech is related to profitability. Theres a lot to bargain for.

Parental leave is part of compensation. It's just extra cash but with strings attached.

Things like parental leave are exactly why some people don't like collective bargaining. It means you get stuck being compensated with something you're not going to use instead of cash.

To be clear, you are against other workers benefiting from something if you yourself don't benefit?

Absolutely not.

I'm against giving up my ability to negotiate for myself to someone who is going to negotiate for compensation that I can't use at the expense of compensation I can.

Also, weird take. In a scenario where compensation has no lifestyle strings attached to it, both the childless person and the child having person can use that money. Pushing for heavy parental leave is the "fuck you, getting mine" option.

It's only that way if you think of money and time as equivalent, which I assume from your tone you do. For many parents, time with their child during those early months is invaluable, and no money compensation can compare, so it's not really a viable option for them to "get theirs" while you don't "get yours". I think collective bargaining could solve this better by asking for an option to either have the cash or the time... but getting only cash is also saying to parents "fuck you, getting mine", just with the added "and you get it too, even if you don't want it".

Overall, I think grouping together to have a more powerful negotiating position is better for the group as a whole... It's a classic Nash Equilibrium problem, and obvious to many people that grouping together even if you don't want the exact same things is still better.

I'm not sure why people who advocate for staying "alone" in your negotiation think that the outcome will be better by leaving the employer in the state of having more power in the negotiation by you being alone. Can you explain if you see it as better for any reason other than that you prefer to "have yours" even if "yours" is more for you at the cost of less for us all?

Parental leave is about more than just money. It's about to leave your work for 3-4 months in a row. Employers tend to hand out cash rather than time away.

You must dislike taxes funding schools too. And taxes funding roads in states you'll never visit.

As a former union employee, the idea of tech unionizing is completely unnecessary and unthinkably dumb in my opinion. I suspect advocates of this idea have very little real world experience with unions.

An American tech union, full of Americans who have never been in a union, would probably not be like other American unions for just that reason!

Also think how great it'd be if politicians were interested in things that'd help us instead of our landlords.

we will either realize and act on the fact that we are now for the most part a skilled labor like any other, or we will see our precious privileges erode and our incomes and work conditions deteriorate

HN is largely blind to this but outside of a few hotspots like SV programming is just another white collar office job, with pay and conditions not really any better than any other white collar office job. And it will go the same way in SV too eventually. The time to act is when the ball is in your court, not when it’s too late.

>Spiers was fired after she created a pop-up for Google employees visiting the IRI Consultants website. “Googlers have the right to participate in protected concerted activities,” the notification read

I remember that case. Yeah - she deserved to be fired. She used an internal security tool to push her personal political views. How could that not be a fire-able offense?

"Googlers have the right to participate in protected concerted activities" is not a personal political opinion, it is the law.

If you want to play that game, you could spam people with the text of all sorts of interesting laws. It's still an abuse of authority.

But I wonder if anyone would be have been fired if it were an April fools prank?

Where's the evidence of "spamming?" Is Google "spamming" its employees on a regular basis with their "approved" messages?

When a Googler visits particular domains, she gets a message from the internal security tool like "Do not upload user data to third-party services. Use secure alternatives instead." This is to prevent employees from inadvertently causing a PII incident or violating contractual obligations to external customers.

And?

I think the point here is "...used internal security tools...", Not the particulars of the message she was pushing.

If that was the point, then why was the other bit included in such obvious service to the "point"?

That is the stated reason but we all know that is not the real reason. If they added an ascii art of a dinosaur or a message on another topic to that internal security tool, they wouldn't have been fired, probably not even a slap on the wrist, at most an annoyed "take that off" request.

> we all know that is not the real reason

No, that is not true. Some of us take security seriously.

Can you contextualize who you are, so that I can better understand “us”? You mention seriousness as an absolute virtue, but if it fires people for a harmless, easily correctable mistake in an internal tool, it is just misguided and an excuse especially if it “happens” to serve some ulterior motive.

It's not harmless. Google is very concerned about internal security, and putting irrelevant messages in security notifications makes them more likely to be ignored in the future. Your ASCII dinosaur hypothetical is a good way to think about it, and I wouldn't be surprised or outraged if that also resulted in the offender being fired.

Security is a broad topic and can include avoiding legal liabilities.

Substituting your equivalence:

> She used an internal security tool to push the law

Even for messages I agreed with, I would still find this a questionable activity and disruptive as an employee.

You find it questionable and disruptive that someone would encourage people to know and enforce the law? How very peculiar.

Seems like if that's the status quo, it should be disrupted.

So someone with technical access (if actively bypassing review) should be allowed to replace the www.google.com homepage with a copy of the US constitution and that's just fine and dandy?

"Oh, I'm just informing people of their constitutional rights? What's the problem? I thought this was 'merica"

By your logic, an employee should be protected if they decided to add a political statement to the homepage of google.com? No?

So if she instead put "Nobody has the right to enter this country illegally" it would be fine because she's just restating the law?

That would be appropriate (in this analogy) if the website was advising employees on how to jump over border walls.

What about a website for lawyers who defend illegally-entered immigrants?

ICI consultants isn't a criminal organization as far as I know, and without really knowing anything about them, I would assume the consulting services they provide don't tell companies to perform illegal acts.

"Entering the country illegally is illegal" is restating the law. Such a statement would likely take on more meaning given the context in which it was said.

"Nobody has the right to ..." is your opinion.

Well, "nobody has the legal right to..." is restating. And to me, the "legal" is rather obviously implied.

I don't agree the implication is obvious at all. Interpreting it that way make it a total truism - nonsensical unless interpreted within a greater context.

And it looks to me that's just what the GP poster was trying to do - challenge others to argue with a truism while pretending that the context in which it was stated isn't relevant.

INAL but it is your right to illegally cross the border of a Geneva convention signatory country and seek an asylum. So no, not the same.

Yes, you have a right to participate in unionization and politics. But you don't have a right to alter company software to spread your political message. There's a big difference between holding a "Vote X" sign on a street corner on your own time, and using your position as a developer to put up "Vote X" signs on your company's website.

I think apt comparison is - if some Apple or Google engineer would push a non-authorized OTA update to all Apple/Google phones which would add a permanent political banner to homescreen - would you consider this to be a firing offense or not?

And to people who are trying to justify this by process being "technically possible" - there is a non empty set of Apple and Google employees who can technically push any code to your phone remotely. Is it still acceptable for them to use that to push their political agenda?

Because it comes down to trust. You trust people who can push code to your devices to not abuse it.

Pushing a banner to all phones with a political message would be a brazen abuse of one's engineering position.

This developer's change was much more narrow, it modified an internal tool that only Google employees see. But it's still breaching professionalism. If the message instead was, "Unions are corrupt and deprive people of individual agency" would that be acceptable? Especially with the unique position Google is in as our gateway to information, it's prudent to avoid employees that cannot refrain from making changes to production software to further personal politics.

> using your position as a developer to put up "Vote X" signs on your company's website.

To state the law* for internal users who visit one specific website

But developers at Uber and Lyft can spam drivers and riders with "Tap to support Prop 22" every time they want to use their apps with no consequence? I don't see how anyone can get upset with employees notifying fellow employees of their legal rights when the same tech companies will abuse their platforms to literally broadcast their political beliefs.
https://www.theverge.com/2020/11/4/21549760/uber-lyft-prop-2...

Do you believe those messages were done by developers, on their own initiative? Or by company PR people whose profession is to manage public messaging? The point is, somebody used checked in code to further personal political aims. I highly doubt that is what occurred at Lyft and Uber.

The developers in your example are doing it with the express approval of the company and management. The ones at Google were not.
So yes, there is a big difference.

> same tech companies will abuse their platforms to literally broadcast their political beliefs.
if the owners of the company feels the desire to, they can instruct their employees to perform work to broadcast/promote their (owner's) political beliefs. This is just a case of a company using its resources for a purpose designated by the owner.
An employee co-opting company resources without owner approval to broadcast their (employee's) political message is not allowed, unless explicitly given permission by the owners.
Why people cannot tell the difference between the two situations above is beyond me - it's not like they are similar or confusing.

But the NLRB ruled that what Spiers did was perfectly within their rights, so you’re completely wrong in this specific case. However correct you may believe yourself in the abstract, entirely relies on the lawfulness of the specifics.

> Spiers did was perfectly within their rights
no that's not what the article says.
The article claims: > NLRB has found Google’s policy against employees looking at certain coworkers’ calendars is unlawful.
Google claimed that she abused security notification system for websites to show a non-security related message (see https://www.theguardian.com/us-news/2019/dec/17/fifth-google...). She could, within her rights, send emails to organize a company wide meeting, or write up a public document to talk about unionization. If google had banned this, then they would fall afoul of the law.
May be google is really using the excuse that she abused security notification systems to fire her. That's something I'm not privy to, and only litigation will reveal this (if it even does).

You’re incorrectly conflating the two cases described in the article. Berland was fired for viewing other’s calendars, Spiers for the notifications.
The NLRB ruled both firings were illegitimate and their actions protected under labor law. So no, she was within her rights and the NLRB said she’s to be reinstated.
The NLRB has no direct enforcement power, so how it resolves itself will be dependent on if the NLRB pursues Google in the U.S. Court of Appeals, they settle out of court, or otherwise. My guess is that they settle because an NLRB ruling against you isn’t likely to work in your favor in the event of an employment lawsuit. But regardless, what Spiers did stands as a favorable precedent for workers in the event of other disputes with similar circumstances.

There is also a big difference in saying "Vote for X" vs. "You are allowed to vote."

Ok. So it's OK if your webhost provider replaces your homepage with the phrase "you are allowed to vote"?

If she had used a company printer to print pro-union fliers and then shared them I'm 90% she could be fired for misuse of company resources. At to my intuition this feels like using the company printer without permission.

> If she had used a company printer to print pro-union fliers and then shared them I'm 90% she could be fired for misuse of company resources. At to my intuition this feels like using the company printer without permission.
Until Trump's NLRB overturned the precedent late last year, workers had stronger protections than getting fired for a minor slip-up in the course of organizing. But today, your intuition would be correct.

So I am not going to update my opinion, this was legal but morally dubious on Google's part. On her part it sucks but she easily could have avoided the situation.

No, changes cannot be retroactive (in general) meaning the prior law applied at that time.

Yep, and case law dictates what is acceptable participation. Generally, using company time and infrastructure to perform concerted activities is prohibited. That's why union voting and meetings are done off the clock and off-site. Once protected by union membership, the protections tend to increase since you're not acting alone.

Laws are political.

A little more than that even. They have the right to participate in concerted activities. But those activities must usually be performed in a way that would not impact the business during working hours. Unionization and voting etc must usually be performed off-site.

> Unionization and voting etc must usually be performed off-site.
Sounds like a non profit startup opportunity, to provide tools to empower workers to unionize and vote remotely. With remote normalizing, as long as you stay off corp gear (stay off corp gear for any activities not directly related to your employment!), your employer isn't going to know you're working towards organizing, preventing them from interfering with your organizing activities (which does them a favor, considering that's illegal under US labor law).

Unit [ https://unitworkers.com/about ] is interested in helping establish small, locally-run unions.

Original link + comments: https://news.ycombinator.com/item?id=21813619

I don't think it's so black and white: the "security tool" is a chrome extension for sending notices to employees about the site they are visiting.
An analogous situation seems like if the company had a big cork board for safety/security messages and someone posted a paper with that sentence on it next to something the company posted that was perceived as anti-union.
It's unclear to me if that other scenario is protected or not: I understand that you're legally protected when posting notices informing your peers of certain rights on company property, but presumably you couldn't stick such notices just anywhere.

I don't think the cork board analogy really works here. This sounds like a person (ab)used their position and access to the backend of a security tool (Chrome extension or not) to broadcast a non-security related message.
I think we can generally agree that if they were on a team maintaining protocol buffers and they baked an unnecessary ignored message into the encoded stream (about whatever) there should be repercussions for lack of good judgement.
Generally speaking, I am for workers self-organizing if they feel it is appropriate. It's not clear to me that Spiers should have been fired for this seemingly minor offense.

> broadcast a non-security related message.
I don't think it was broadcast, it was displayed if one particular website was visited. That seems very analogous to permitted organizing activities such as using your employers email system to organize or posting on a cork board.
> they baked an unnecessary ignored message into the encoded stream (about whatever) there should be repercussions for lack of good judgement.
Would you be fired? I'm not so sure. It is pretty obvious that this firing was not unrelated to the messaging.
I'm glad that the very conservative interpretation of labor law that most on HN seem to believe is not the reality of labor law in the US, although more should still be done.

Presumably in this scenario the employee was one of a small group of people that was responsible for maintaining the cork board, and used it for their political beliefs

I find it funny how people assert that she used it for her political "beliefs" (when the message was simply informing people of their rights) but seem to take at face value Google's assertion that they acted on this because she (ab)used the infrastructure, as opposed to what she used it for.

I'm going to go ahead and assume that a similar circumvention of company policy for non-labor union purposes would not have been met with immediate termination. Unless Google can say that this was normal punishment or was part of a pattern of behavior, it's kinda hard for it not to look like retaliation.

> political beliefs
Informing employees of their legal right to organize isn't a political belief.

Would you feel the same way if she added a banner that suggested her fellow employees exercise their 2nd amendment rights?

Bad faith argument aside, informing people of the rights they do have is not really having a political stance. Those rights exist regardless of what one personally supports. Obviously, this holds true for USA's 2nd amendment rights as well as any other provisions granted by the law.
Companies have active interests in suppressing this sort of information, and put forth efforts to try and convince people that literally stating the laws of the country that one resides in is somehow pushing a political agenda.

It was the parent comment's language. I was more taking issue with the "cork board" metaphor

"...presumably you couldn't stick such notices just anywhere."
Nor use company resources/infrastructure to distribute it.

I really hope you're not making an infrastructure cost argument here. Would be kind of laughable.

Cost wouldn't matter. The idea is that you can't use the company's resources for your personal projects, especially if that project is being used against them. So let's say you want to put up a single flyer about unionizing. You can do that in the appropriate area, such as off the company property or potentially on a bulletin board in the break room. What you can't do is type it up while on the clock and print it on the company's printer.

The other way (and it seems the NLRB sees it this way too) is that she didn't materially hurt google by doing so, and on the flipside used this system to make sure that laws are known and can be followed.
This is (a bit) like google buying property around polling stations and then preventing anyone from passing through to vote. They're not hurting google by passing through, but they keep shouting "get off my land!" Why would we let them weaponize property law to prevent others from enforcing their rights vis-a-vis google?

Did she make the change on company time? If so, her wages would be material damage. Even if made off the clock, it could still be considered material because Google needs to pay someone to fix it.
Your voting/property analogy is completely off-base. It completely ignores right of ways and public property. And if you have people actually trespassing on private property on the way to a polling place then they are in violation of the law and can be cited. I see no legal way that you can "weaponize" property law to prevent access to a polling location. Also, there's nothing stopping employees from exercising their right to concerted efforts off company time and property.

I think the far more substantial damage is from Google customers wondering what else the employee or some malicious insider could have done. You can bet that this came up in internal audits and customers' security assessments.

Actually, when she was fired, this was not the case. The NLRB ruled a day or two after she went public about being fired that company communications couldn't be used for this type of thing. Before that companies had to allow it.
https://www.post-gazette.com/business/career-workplace/2019/...

Ah, so this was before they amended the rule allowing communication to be restricted.
I wonder what the restrictions were before. It specifically says emails were allowed. But I wonder if a person maintaining an intranet site could post a banner on it with the same message. I'm guessing not since it isn't designed for that type of communication. I'm not sure where the plugin would fall. Seems like the message didn't fit the intended plugin scope.

Yeah, hard to say, one could certainly make an argument that it did fall under that though. It would need to be decided in court.

How could that message, on that site, fall into the scope of the plugin? I could maybe see if it was a site that employees were actually using it to perform concerted activities. If the firm was hired by the company, then they can't also represent the workers. Thus, what could employees do on that site for concerted activities?
I would also guess the plugin only covers prohibited use and does not cover allowed uses (ie does the plugin say you have 1st ammendment rights when visiting Facebook?). I doubt the documentation states that the plugin shall provide users with their rights. It probably says something like the purpose is to provide users with policy or law information related to the site they are visiting so they don't break the law/policy.

Is it even the case that you are legally protected when you inform you coworkers that they have constitutional rights? I would have assumed only informing them of workplace rights specifically would be protected.

Only if it's a concerted effort to improve the workplace and even then it depends on how it is accomplished.
The message merely stated that employees have the right to organize. Without additional context, I don't see how that is a concerted effort to improve the workplace. There would have to be a "unionize to improve health coverage, or wages, etc" type message. Otherwise, I could just stand at my desk all day and tell people as they walk by that they have the right to free speech, to own a gun, and protections from unreasonable searches, etc. It's not a concerted effort to make the workplace better, so it doesn't matter if I'm telling people about their rights (not to mention I would not be doing my job while on the clock).
Using a plugin to communicate that message is likely a subversion of it's intended purpose and would be inappropriate - similar to if she were maintaining the company intranet site and posted a banner with that information. They aren't mediums for individual communication (such as email or chat apps) but rather for company-to-employee messaging and for the sole use of the company. In this case, she misused company-to-employee infrastructure outside of its scope for her own communication purposes.

> I remember that case. Yeah - she deserved to be fired. She used an internal security tool to push her personal political views. How could that not be a fire-able offense?
If you read the next sentence in the linked article, the NLRB disagrees:
Spiers was fired after she created a pop-up for Google employees visiting the IRI Consultants website. “Googlers have the right to participate in protected concerted activities,” the notification read, according to The Guardian. The company said Spiers had violated security policies, a statement that hurt her reputation in the tech community. Now, the NLRB has found the firing was unlawful.

The trick is that there's an auditable trail of things that she did. Notably, she bypassed restriction in our code change system which would've required review. The policy around bypassing that is explicitly to only be used in emergencies.
Again, reasonable for her to be fired.

Is there anyone else that has every bypassed this step, but wasn't fired? What's the definition of an emergency?
Also it seems reasonable to me her complaint that this hurt her reputation, after all you're a Google employee and here you are smearing her in a public board. I know you're gonna say "I don't speak for my company", to which I will reply: It seems you're a Google employee, and you're speaking as a Google employee. It's distasteful that a Google employee find the need to accuse her in public like this. Is that a view shared by your co-workers? Do you all usually go in public boards to speak ill of past employees? To reveal why they were fired?

Not a Googler, but probably "to fix the json in case someone leaves out a comma causing the notification system to no longer work".

People bypass this step all the time. The difference is they all have a good faith belief their managers would approve the change if they were available. Spiers 100% knew her changes wouldn't be approved by project leadership, and she used an emergency push to bypass their review.
Honestly, the fact that she has the gall to complain to the NLRB about this firing is pretty despicable. Google should be suing her for defamation.

> Honestly, the fact that she has the gall to complain to the NLRB about this firing is pretty despicable. Google should be suing her for defamation.
This is such an ill-informed understanding of how labor law works I'm not sure where to even start. You have a legal right to assert your legal rights, as was done here. The NLRB is akin to a trial court that makes the determination and issues judgements.
Winning a legal case is not "defamation".

NRLB cases are not "legal cases", they are administrative proceedings from which one has pretty much no actual legal recourse.

The have redress through the U.S. Court of Appeals for noncompliance with their decisions, so this really isn’t true at all.

The other side have no real recourse, though.

I work at Google, but have no inside knowledge of these events.
I doubt that Google spontaneously published the reason for the firing. AFAICT, the former employees went to the press following their firing, and the "violation of security policies" explanation was the response to articles initiated by the former employees. It's not clear to me how the parent's comments are a smear, unless the statement that "she bypassed restriction in our code change system" is not factual (which I don't know, but I have no reason to doubt it).

She got approval from her manager and passed a code review.
What more was she meant to do?
She didn't bypass anything.

> Again, reasonable for her to be fired.
The NLRB is where decisions like this are argued. They weighed the evidence, with a much fuller view than any of us here, and came to the conclusion that the firing was illegal.

> Notably, she bypassed restriction in our code change system which would've required review.
[Googler, opinions my own]
This is not true. The code changes in question were done normally. The policy "exemptions" were in regard to the rollout of the resulting binary, which are well described here[0].
[0]: https://news.ycombinator.com/item?id=25280028

They claim Google spied on Spiers and did something illegal. This might be the case, but they don't disclose what they exactly did. Maybe we'll know later on.

Companies had to allow communication tools to be used for collective action when she was fired for this. The NLRB overturned that 5 year precedent a day or two after she went public about being fired.
https://www.post-gazette.com/business/career-workplace/2019/...

That headline does not match the article contents. That is definitely the headline from the article, but it simply repeats the claim and doesn't even link to the complaint or provide ANY details.
> Spiers was fired after she created a pop-up for Google employees visiting the IRI Consultants website.
Didn't she inject code into an unrelated internal extension? That sounds like a legit security issue no matter how just her cause. Like it's awesome you're for unionization, but that doesn't mean you get to roll code across the org - what if it had been a bitcoin mining script?

If she had injected a BitCoin miner, for personal profit, that would have been an entirely different situation, wouldn't it?

Not sure why you are being downvoted. You've (correctly) pointed out that the parent comment has constructed a strawman to punch at, rather than the actual events.
Arguments of the form, "Person did X. Imagine if they had done Y! (Where Y is some obviously unethical thing.)" are fallacious and they lead the discussion to useless dead ends. The point is that the person did do X, and NOT Y.

vorpalhex is stating action X was wrong in the first place, and describing a situation Y as an example to show why action X is wrong.
I have policies at my workplace that disallow something because it's impractical to judge every single situation and then have to deal with the gray area.

That's a fair perspective, but that's not applicable here. The punishment isn't because of how much she violated the policies, it's to send a message.
At Google, someone once disruptively modified the root permissions for the entire company-wide monorepo to show off that the permissions scheme was fallible. They were left off with a verbal warning, even though on paper they massively abused their position, and could have made the point without actually doing it.
The engineer in the OP took a much smaller action, that was closer to the scope of her actual duties, but was punished more severely.

> That's a fair perspective, but that's not applicable here.
It's exactly applicable. If you violate say, finance reporting laws (KYC) then you've violated finance reporting laws. If you've added unauthorized code to an internal tool, well, you've added unauthorized code to an internal tool.
And had it been part of a security disclosure, well, that might be different (did they try other disclosure avenues?), but pushing a political viewpoint isn't. Imagine instead if the employee had added the message "Trump 2020" - how would you feel about that?

But X is also unethical. Not sure why you're seemingly ignoring that.

I'm not. I'm explicitly saying you should discuss X. Adding Y just muddies the discussion.

Abusing your position as a developer and turning your software into a political soapbox is not much better. People are trying to spin this as some sort of union busting move. I don't see it, this behavior is unacceptable regardless of what message is being spread.
Would it have been fine if she added a message to say "Affirmative Action is racist" when people browsed information about Proposition 16 on the 2020 California ballot? Sure, she definitely has the right to spread that message on her own time. But adding this message is definitely breaching expectations of professionalism, and abusing her developer role to spread a personal political message. And given that Google/Alphabet is widely suspected of political bias, I it's fair to let go of employees who cannot refrain from modify software to advance their political views.

A better way to think of it in my eyes is, employer pays you to write an app that shows cats. You start and you're like, yeah, no fuck that, and you write an app that shows dogs instead. Employer comes back to you and says "we pay you to show cats, since you don't wanna do it we'll find someone else".
Sucks but seems logical to me.
That's unrelated to the claims of spying and illegal procedures of course, that the new article claims. Very curious to see what they did that was illegal / what kind of spying they would have done. But right now its just claims.

My recollection is that the extension was for notifying employees of relevant policies and laws regarding websites they were viewing. So no, it was not an unrelated extension.

Isn't the extension actually about the laws or policies related to using the site in question? Not necessarily about laws pertaining to things that happen outside of the use of the site, such as unionizing.

IIRC, the website the notice was added to was specifically a the site of law firm that Google had contracted with regards to the ongoing concerns of unionization. It seems like there's a fair argument to be made that it was related to the site, although there are arguments against that as well.

But in that case, the notice would fall out of scope of the plugin - which is to notify Google employees of the relevant laws or company policies about the use of a site. This would be about the generic right to unionize, which wouldn't relate to that site specifically. What actions would a user be taking on that site in that capacity, especially if that firm is representing the opposition?

She was reminding management (who are also employees) that anti-union stuff is illegal?

Not all anti-union stuff is illegal. Hiring a law firm to consult on employee management and unionization would not be illegal. If anything, they should be learning the correct and legal actions that they can take based on the consultant's recommendations.
Not to mention, the comment the plugin displayed wasn't saying anything against illegal actions, but rather stating that concerted activities are protected. I don't see how that has any bearing on the use of a law firm's website.

"Injecting code," is not the way I'd describe making changes to a product that it's your job to maintain.

did the change have anything to do with their job? No, so it's basically injecting code.

(am Googler but obviously not speaking in an official capacity)
My understanding from articles I've read is that it wasn't her job to maintain the product. It was her first time interacting with that code base, and she intentionally altered the defaults of the code review tool so that the team responsible for the extension wouldn't be informed of her changes.

> Didn't she inject code into an unrelated internal extension?
Depending on your definition of code, that's probably not the case. She added an entry to a config file that contained a mapping of urls to messages. Such as:
dropbox.com/upload -> Friendly reminder: please don't upload internal documents to dropbox
Also, Google generally trusts engineers and it's not that unusual to have an engineer writing and deploying code. So essentially it was her job to work on and deploy this extension. I believe that had the message been an April fools day joke she wouldn't have been fired.
So in my opinion arguments that others have made (not you) that: "this was a unauthorized code change therefore obviously she should be fired on security grounds and charged with violating the CFAA too, it doesn't matter what the message was" don't really hold water. There's also an argument that she used some sort of "emergency" deployment mechanism, but that doesn't really hold water either. Honestly it's not that unusual to see people deploy some package when they need it rather than wait for a scheduled job to deploy it.
I think the grey area she was operating in boils down to: She had a platform to distribute certain types of messages internally and she put a message in there that probably wasn't the normal type of message distributed. If I were her manager I probably would have taken some action but it wouldn't have been firing.

> There's also an argument that she used some sort of "emergency" deployment mechanism, but that doesn't really hold water either. Honestly it's not that unusual to see people deploy some package when they need it rather than wait for a scheduled job to deploy it.
I disagree. The emergency process was highly unusual, in that it had never been done before for this extension, and was very rarely done in general. Triggering a deploy is normal, triggering a deploy that goes immediately to 100% is not.
> essentially it was her job to work on and deploy this extension
The extension wasn't something she had previously worked on.
> I believe that had the message been an April fools day joke she wouldn't have been fired.
I agree, and don't think she should have been fired for this either.
(Disclosure: I work for Google, speaking only for myself)

You should read about the conspiracy to kill ie6.
The magical access to add stuff and just have fun was what made google a fun place to work at.
In this case adding stuff for your own corporate employees didn’t hurt the company’s customers and users. It shouldn’t have resulted in a termination. Had the person put a hate message they would have been terminated or penalized for hate but not for adding insecure code.

Google is mostly run by sticklers for the rules and has been for a long time (just ask Googlers about their code review process...). In practice most of the time individuals overlook transgressions, but if there is a formal complaint they don't. In this case the manager who hired the anti union org certainly got noticed about this since the notice popped up on their site, I'm pretty sure that person filed a formal complaint. And as Googles employee handbook says that doing things like this will get you fired she got fired, even though it was pretty innocent.
Similarly if someone made anti union messages pop up when you visit union sites I am 100% sure they would get fired as well, for the same reasons. You can talk about almost anything internally, (People like Damore aren't uncommon at all, the outside world just got hung up on him for some reason), just take your job and company code seriously.

The point is that she took a company communication channel and used it for personal reasons.
That's inappropriate.

I'm curious if you've ever looked at a company slack or corporate email system and noticed any not strictly work related purposes?

This was a tool designed to notify employees of security alerts, not a chat app. These are not the same. It feels like people are being purposefully dense at this point.

Got to be honest. If the security team is all like "Install this extension. It'll help you with security" and then it's gonna pop up all sorts of crap, I'm going to uninstall your shitty extension and after that I'm going to treat any software from this so-called 'security' team as some Bonzibuddy crap.

> Bonzibuddy crap
funny name to give to something on the grounds of an engineer in the team pushing for unionization

It isn't about the topic. Like if you tell me it's going to give me computer security tips and instead it's advocating for peace in the middle east I genuinely don't give a fuck. It's bonzibuddy crap. It's getting blacklisted.
I'd prefer you don't get fired for doing dumb shit like that because whatever, it's not going to kill someone, but I'm not going to use that team's adware shit anymore.

Oh wow, I just looked up Bonzibuddy and I guess I learned something today! :D
Sorry, I misunderstood this to allude to "Bonze" a German/French derogatory translating to "fat cat".
https://en.wiktionary.org/wiki/Bonze

Haha, well, I guess I learned a new German derogatory term so it's a win-win all around :D

Google or other tech companies don't allow you disable security extensions, otherwise that would defeat the purpose. It's installed by default.

Right but they also know how I feel about them so they know that I'll ignore all their messages after they've Bonzibuddied me for their pet crap. Then they'll know they've desecuritified that piece of their strategy. It will be ignored by all.

How was it an unrelated extension?

I'm confused, what exactly is the allegation of illegal spying? The article just says:
> Google violated US labor laws by spying on workers who were organizing employee protests, then firing two of them, according to a complaint to be filed by the National Labor Relations Board (NLRB) today.
And then talks about the circumstances around the firing of those employees.
> “This week the NLRB issued a complaint on my behalf. They found that I was illegally terminated for trying to help my colleagues,” Spiers said.
This also doesn't refer to spying.
Is this title/article just clickbait or is there any substantiation or further information around the "spied on workers" claim? I've done a quick bit of reading on other news sites and can't find any mention of spying elsewhere.

One of those people was fired for looking at someone's calendar.

So the claim is that Google looking at its access logs constitutes illegal spying? I'd like to see that claim fleshed out a bit more, I can see where this could be considered problematic to a non-technical person, but it's also common-place for most large companies (or small tech companies) to have internal tools that log employees' behavior.

I also didn't understand, because the article doesn't actually mention Google's "spying" or explain it at all. It does link to the NLRB complaint, though. It's a real slog to read through but I think the actual salient points are:
* Management "viewed an employee slide production in support of the union drive" (§7), no details but I'd assume that they somehow accessed it without an invitation?
* The firing was nominally because the employee looked at another employee's calendar, but the claim is that this rule is selectively enforced (§11b)
So the only "spying" I can figure out is if, say, one of the claimants made a Google Slides presentation about the union, then one of their bosses went poking around in the employee's Drive (?) and reading their presentations without explicit permission. If the boss abused privileged access to read what was supposed to be a "private" document, I could see how that's illegal "spying". (Although, hey, maybe don't use your employer's software to make your union presentation?)

We are in general long overdue for an overhaul of how corporations are run. The current model of hierarchical decision making and control parallels the monarchies and tyrannies of old. The worker is asked to be a corporate robot for 8 hours every day - think only corporate thoughts, perform only corporate actions. Except "corporate" here is defined as "whatever the people above in the hierarchy say". There is little fairness and justice inherent in such a system - the worker's productivity enriches the corporation without the worker having a say in how their contributions should be used.
The alternative is a democratically-run corporation, one in which everyone has a stake and can influence the direction of, e.g. https://www.wsj.com/articles/SB117729012338178557 . In an ideal world this model would be partly enforced by law and employees' speech regarding company politics would be as protected as their political speech in public. Yes, right now a wise CEO would listen to their employees like how a wise ruler listens to their subjects, but there is no requirement for that. Tyranny is not only allowed, but rewarded and employees' only recourse is leaving one life of serfdom for another. Obviously, the current situation is better than what it used to be, but corporations are still entirely structured for the enrichment of the ruling class at the expense of the working class. We can do better, maybe.
Even this very comment I am writing, I would not dare to write under my real name for fear of retribution. I am extremely thankful for the somewhat obscuring nature of pseudonymous internet communications, but the fact that I can only voice my thoughts in this format is somewhat of a problem itself.

This headline is super confusing. I interpreted it as meaning Google spied on people and then fired them. However, what the article itself seems to be saying is that Google fired people for spying on others. The spying was, "for reviewing other employees’ calendars." The NLRB then found that illegal.
At least, that's how I'm interpreting this article. Otherwise there's no actual explanation of what spying actually occurred.

>Google violated US labor laws by spying on workers who were organizing employee protests, then firing two of them, according to a complaint to be filed by the National Labor Relations Board (NLRB) today.
This part of the article seems pretty clear. It also sounds like one of the fired employees did something involving looking at other people's calendars, but that the core reason that they were fired was for union-related activities.

But in order for Google to catch people spying on other people by viewing their calendars, Google would have to surveil the activity of the people doing the spying. Maybe that's what the headline is referring to, but the article doesn't spell that out explicitly (which makes it a very poor piece of journalism in my opinion).

As an aside, I really dislike this pattern of deliberately misleading headline.
Make it appear that you're asserting a point of fact, Google illegally spied on workers before firing them, knowing that's how the reader will read it, then modify it at the last minute to dial down your commitment to the claim, with US labor board alleges.
You'd never use this structure in conversation, you'd just say it the natural way, US labor board alleges Google illegally spied on workers before firing them.
Unfortunately even the BBC uses this style sometimes.

Speak of the devil: https://news.ycombinator.com/item?id=25290009

It is super convenient to have work stuff with you all the time. So you can step out and be available.
Google work profiles solve this for me. I deal with sensitive information anyway. So it is separated so much that it is hard to even share links with colleagues but once you switch to work profile on Android phone (OnePlus FTW!) it works well. I am surprised this is issue in Google.

I'm very curious if the work profiles are as containerized as they are advertised as.

If I intentionally used my discretion as a developer to check in code that works against my employer, I'd be fired faster than you could say "unionization". I think it is a credible goal to inform people about their rights, but there has got to be a better way.

If company wants to have your time outside work then should they pay for 24h instead of just 9-5? I find it fascinating that employees are okay with it. After 5 it shouldn't be employer business what employee do. Some even forbid you from having a second job.

Always maintain a strict separation of employer and non-employer related computing. That includes your smartphone, laptop, desktop, don't cross the streams.
You're just opening yourself up to all sorts of potential problems when you break this simple rule.

Curious what comes first: actual spying to find out whom to fire vs. finding all information on an employee who is on the firing list? I think it is the later. And collecting information (through IT) gets them to all the browsing information on the phone.
Another aspect is getting caught in an IT system triggered alert. Typically being non-compliant with company sensitive information.
This is not only at Google, but most big companies. Hence I am curious.

Anyone have a link to the original NLRB filing that is presumably the source for this article?

I think it was acquired by media ahead of time.. they say the complaint will be released today

So the workers could organize and rise up an arms about such tactics, except that they are spending all their protest energy being up in arms about naming conventions of internal tools. Cui bono?

When I was hired by Microsoft in 2001, I crossed out and changed language in the documents I was required to sign. Nobody said a word. I suspect nobody looked at the originals.

What's even crazier is that I have coworkers (that are paid very well) that install the "management" software on their personal phones so that they get the cellphone stipend. The other option is to get a work phone but then they'll miss out on the money...Blows my mind why they would allows their employer to install spyware on their phone for a couple hundred dollars extra a year.

I used to hold Google in the highest esteem, definitively cracks in the wall. Is "don't be evil" still the company motto?

Wonderbar!

Anyone else notice the language in statements from companies like this sound like something you'd expect to hear from the government? Give me a break. Its ironic that a company built on top of orchestrating value where there is none elicits the same tactics in every other aspect of their existence. Im afraid regulatory capture will not be coming however, broh

The best time to break up Google was 15 years ago, the second best time is now.

"Spiers" getting "spied on" makes for an ironic and confusing read.

Man! What did she expect, treading into unionization topics on company systems?

"What did they expect" is a knee-jerk response to a lot of things that completely avoids thinking about who is responsible for what.
I suspect you meant it sarcastically, here, but a lot of people don't. I think it leads to a sort of moral degradation, where wrongdoing is "expected" or "normal" and so not worth pushing back against.

She probably expected her legal rights under the National Labor Relations Act to be protected, as Google has been punished by the NLRB on many occasions, including having to issue a notice to all employees notifying them of these legal rights.
This finding by the NLRB is that Google has yet again violated those rights.

Great title, makes me want to be biased when I read the article.

It seems like the NLRB is alleging that it is or should be illegal to have a policy against employees spying on each other for non-business reasons at work and using company tools?

It's interesting that someone found my summary of the article threatening enough that they wanted to vote it down. For context, here's a direct quote from the article describing what the complaint is: "NLRB has found Google’s policy against employees looking at certain coworkers’ calendars is unlawful"

> Spiers was fired after she created a pop-up for Google employees visiting the IRI Consultants website.
What does this mean? Was this for an IRI portal on Google's intranet, or did they display the pop-up if the public website was being visited by a Google employee? How was it determined that the visitor was a Google employee?

See this comment that explains the kind of config Kathryn changed: https://news.ycombinator.com/item?id=25279578

It's a Chrome extension deployed to Chrome browsers on Google-corporate machines. So when they visit certain Internet sites, they see messages Google wants to remind employees while they are on those sites.

Reply on news.ycombinator.com