Hacker News Reader

Comment by arkadiyt | Hacker News Reader

I hope the HN crowd doesn't write this off because it's Russia - employee abuse of customer data is all too common in tech:

- Google Engineer Stalked Teens, Spied on Chats: https://gawker.com/5637234/gcreep-google-engineer-stalked-te...

- Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-al...

- Uber Employees Allegedly Use Data to Stalk Exes, Celebs: https://www.newser.com/story/235409/lawsuit-uber-employees-u...

- Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employ...

- Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees...

- Yahoo Engineer Used Insider Access to Get Private Photos of Women: https://www.vice.com/en_asia/article/59nwyk/yahoo-engineer-u...

Most occurrences likely never even make it into the news.

View on HN

It's a real big problem. Employees from our version of the cdc (ggd) were caught selling peoples data who were tested positive for covid. including social security numbers.

https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/ha...

Who would be buying this info? Are Dutch insurers allowed to procure such information?

If you have a name, phone number and BSN (Dutch SSN) you can easily do lage-scale identity fraud

Can you? I don't have any Dutch examples of that, but seeing the high prices the information sells for, I guess I'm missing something.

Your employer is very possibly doing it to you and other employees as well, and it's perfectly legal for them to do it. I keep any work-issued equipment I have at home powered off if I'm not actually working.

In many places in the world, they can't. In Europe, the matter of employers monitoring employees is highly regulated.

never thought of this level of paranoia!

you think they would record audio/video, or just log the keystrokes?

I’m aware of at least one case of a school installing software that allowed them to remotely access the webcams of students, and they admitted to using the software on 40+ occasions. I wouldn’t be surprised if this practice existed in the corporate world as well.

There was the Robbins v. Lower Merion School District case, where a student sued after being disciplined for "taking drugs" in his bedroom (it was actually candy).

They'd remotely activated the webcam on his school-issued laptop. And, frankly, spying on a teenage boy in his bedroom, they're lucky they didn't face felony charges.

I know of a fairly large employer in the pharmaceutical space that installs spyware on company computers that employees take home, and uses that spyware to keep tabs on what websites were visited on the machines. They made decisions to fire certain employees based on it, too.

Earlier today: "I saw you spun up an Ubuntu instance on Azure...". (I'm not super paranoid but I find the timing funny).

Not saying it does not occur in tech in general, but there is a difference in scale between selling the data and abusing it for personal reasons. The examples you provided are exclusively the latter.

The mentioned employee sold access to 4,887 email accounts.

I don't want to speak to the other companies, but that Google link is over a decade old.

They absolutely have very strict access control now — it would be 100% impossible for a Google employee to do this nowdays.

- eBay employees stalk and harass bloggers https://www.nytimes.com/2020/09/26/technology/ebay-cockroach...

I'm pretty sure unless the system is based on minimum-privilege strict audit (with audit logs regularly reviewed by a dedicated inspector team) - which I never ever seen happening anywhere - somebody out of lots of people that have access will be tempted.

And the reason why most of "unicorns" likely do not have strict audit system for PI is because it costs many $$$$ but brings exactly $0 in revenue. And until it becomes many $$$$ in potential lawsuit liability exposure, it will continue so, because nobody would invest serious effort in something that is only hurting the bottom line.

Also, plenty of employees in car dealerships and finance companies in the US sell access to credit reports (i.e. they make a new credit report search on demand, not a previously stolen one). Just go to any of the darkweb markets and you'll find them there, with a lot of glowing "reviews".

If the money is there, and it can be done anonymously, people will keep doing it.

There are more:

https://www.reuters.com/article/us-usa-surveillance-watchdog...

Not mentioning that to get the blue mark on Instagram, you can pay a facebook employee that will give you the badge. This is surreal

https://mashable.com/2017/09/01/instagram-verification-paid-...

The Facebook allegation looks incredibly weak. I’m not trying to defend anyone here, but it sounds like the employee was canned over a cringey bad joke text to a tinder date.

Was there any actual evidence of wrongdoing? All I’m seeing is a screenshot of a text message circulating on the Twitter outrage circuit.

Not sure if this would make anyone feel better or worse, but you can find these kinds of examples everywhere. Abuse of position, often with results way, way worse than a hacked account, is extremely common in every single industry. We're all human, after all.

Best approach to data is that if it can't be seen or read (through any means) then that data can't be abused or misused.

This is why end-to-end encryption should be a first choice for pretty much everything.

Interestingly Navalny and Bellingcat used the leaky Russian data systems (leaky because corrupt employees/police offer access to data for money) to trace his poisoners and who they communicated with. A fascinating case of exploiting a corrupt system against itself.. https://www.bellingcat.com/resources/2020/12/14/navalny-fsb-...

"I hope the HN crowd doesn't write this off because it's Russia"

Sorta. I worked next to them in Burlingame, CA.

Yandex is not russian. It is developed by a company in switzerland and primarily targets the russian market.

I don't see anything that backs that up on the Wikipedia page. Their headquarters is in Moscow and it was founded by two Russians. They have a sales office in Lucerne.

https://en.wikipedia.org/wiki/Yandex

Yandex is a company registered at the Netherlands, 99% of the company's developers are located in Russia. So, technically Yandex is Russian.

What, you're joking surely? Yandex was founded by three Russians and the HQ is in Moscow, and they obviously target the Russian market. If Yandex is not Russian, what is?

Like saying Google is Irish because they have some center there for the EU business. Google is surely a US-based company.

From their wikipedia page [0]:

>Yandex is a Russian Dutch-domiciled multinational corporation providing Internet-related products and services, including transportation, search and information services, eCommerce, navigation, mobile applications, and online advertising.

>The firm is registered in Schiphol, the Netherlands as a naamloze vennootschap (Dutch public limited company), but the company founders and most of the team members are located in Russia.

So yes, technically the company is registered outside of Russia (Netherlands, not Switzerland like you claimed), but their HQ and heavy majority of their workforce and the founders are located in Moscow. I would definitely count it as a Russian company.

0. https://en.wikipedia.org/wiki/Yandex

It's also a service whose users are mostly in Russia and neighboring countries. The country selector on their .com home page links to localized sites for Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Turkey -- neither Switzerlands nor the Netherlands are an option.

And it was banned in Ukraine for being a national threat (which, as a Ukrainian, I fully support). Should also be a hint

Sadly that you are supporting the censorship of yourself. Especially about banning Yandex whose maps showed Crimea as Ukrainian's for any visitor with Ukrainian IP.

While I am, overall, fully with you on censorship and don't think it is acceptable, this specific case is a bit different.

It is one thing to censor something due to a hypothetical possibility of a threat or due to some "dangerous ideas". But it is another thing to censor a tech giant from an authoritarian country (with the government of which that said tech giant is almost definitely collaborating) that is literally physically invading your borders by force and taking your territory using shady tactics and excuses ("these are not our soldiers, they are just some unmarked militia that has access to our top tier weaponry... oh wait, jk, we lied, it was our troops all along").

Especially given the fact that tech giants in Russia are all, pretty much, under a thumb of the government. Just check up on what happened to Pavel Durov (the Telegram guy, previously known for creating another russian tech giant VK.com aka russian version of FB), he ended up having to give up his company and flee the country, because he didn't collaborate with the regime readily.

And no, I am not a russophobe, I grew up in Russia myself, and I am not the kind to fall for the "every hack is now attributed to russian government-funded hackers" hysteria that seems to have polluted mass media in the west recently. Which is why, imo, it is important to emphasize when the real threats happen and address them, just like Ukraine did with the Yandex ban.

I find it funny when companies are registered in Schiphol.

It means they can literally run their mandatory board meetings in the transit lounge at the airport.

Ferrari has a similar structure at Schiphol, but I think it’s also because Italy has a “speculator tax” on stock transactions, so they just register elsewhere.

Reply on news.ycombinator.com