16 ms·

Former employees say Lyft staffers spied on passengers

440 points by dhruvarora013 9y ago

lhorie 9y ago
Someone I know was just commenting that from convos w/ people in other companies, it seems many startups have benefitted from not being under the limelight, and thus had the chance to quietly clean up their own messes while Uber was taking all the heat from the media.
- tzahola 9y ago
  So basically Uber is the Weinstein of startups.
  - dx034 9y ago
    But it appears that Weinstein helped to clean up the industry a lot. Would be great if Uber helps to make startups more responsible (I doubt that).
- dominotw 9y ago
  I always suspected that uber flames were fanned by its many competitors.
  - IncRnd 9y ago
    That may be, but the fires were caused by Uber.
  - mrkurt 9y ago
    Uber's dumpster fire didn't need any fanning.
  - Apocryphon 9y ago
    What a day for Waze Carpool, then.
- 303space 9y ago
  Does anyone else find this whole thing more than a bit hypocritical? Lyft is always telling you they are the better/ethical/woke ridesharing option - now their employees are reporting a culture of abusing customer privacy. I wish they had taken a look at their own practices before running million dollar ad campaigns full of celebrities celebrating their ‘wokeness’.
  - azernik 9y ago
    Uber had the kicker that invasion of privacy was a top-down policy explicitly used by management. Lyft still done fucked up, but not to the level that Uber did.
    - andrestan 9y ago
      Which news story about Uber makes invasion of privacy seem like a top-down policy?
      - azernik 9y ago
        Tracking a journalist: https://www.theverge.com/2014/11/19/7245447/uber-allegedly-tracked-journalist-with-internal-tool-called-god-view https://www.theverge.com/2014/11/19/7245447/uber-allegedly-t... About the company specifically designing and building an internal tool to make this process easier: https://www.theverge.com/2014/11/19/7245447/uber-allegedly-tracked-journalist-with-internal-tool-called-god-view https://www.theverge.com/2014/11/19/7245447/uber-allegedly-t... That whole "greyball" story, which involved personal tracking of law enforcement officers: https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html https://www.nytimes.com/2017/03/03/technology/uber-greyball-...
        mattmanser 9y ago
        And don't forget they got hold of the medical records of a woman who'd reported she'd been raped by an Uber driver: https://www.recode.net/2017/6/7/15754316/uber-executive-india-assault-rape-medical-records https://www.recode.net/2017/6/7/15754316/uber-executive-indi...
maybeiambatman 9y ago
I can completely see this happening. I have interned at small startups in the past where practice like this was rampant.
- tzahola 9y ago
  Yeah, and it’s usually called “data science” and “personalized targeting”.
cronjobma 9y ago
Whether it’s Uber or the NSA stories of staff spying on people for a variety of reasons... it always comes down to people who seem to have access to things that they probably shouldnt have gotten access to in the first place. Users should be protected by having their data encrypted and anonymized so no other human being (staffers, governments or hackers) can connect an ID to the data. This way they can still access the data and use it for what ever work related purpose, with less risk of these things happening
- joshuamorton 9y ago
  (I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver. There absolutely should be data privacy guarantees that are as strong as possible. But "encrypt and anonymize everything" doesn't work. (edit: and note, I think this is an unfortunate truth, but still a truth).
  - jonknee 9y ago
    Obviously when you make a support request your record should be displayed for the customer service agent, but this is the other way around where they can seek out people. I don't think that's a valid use case and there's the obvious abuse case.
    - joshuamorton 9y ago
      Right, but the solution to that isn't 'encrypt everything', its 'define reasonable (and this definition may vary, but its certainly not "none") access controls for user data and pii'.
  - cronjobma 9y ago
    You could completely anonymize when certain key variables are met. In your example, when the ride is successfully completed and both parties confirmed this, the data can be anonymized.
mpolichette 9y ago
When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also should be setting good policy and culture to not abuse access. Basically, I think its reasonable to both allow many people access and expect them to not abuse it.
- toomuchtodo 9y ago
  I’m at a financial services firm, and we have an entire internal risk department to ensure employees aren’t exceeding their authority. Surfing the wrong websites? Badging in and out at abnormal hours? Accessing internal apps in ways you shouldn’t? Access immediately flagged for human intervention and you’re locked out. Our data scientist team improves on the heuristics constantly. At some point, organizations with data have to learn how to manage IAM [1] properly. [1] https://en.wikipedia.org/wiki/Identity_management https://en.wikipedia.org/wiki/Identity_management
  - desireco42 9y ago
    That sounds like fantastic place to work :), how come you are not locked out for posting on HN? (I am assuming you are doing this during work hours)
    - LeifCarrotson 9y ago
      Probably is on the data science team...
      - deleted 9y ago
        [deleted]
    - toomuchtodo 9y ago
      I’m on our cloud security team; our leadership chain gives us wide latitude (Hacker News A-OK) since our entire job is to be subject matter experts. Literally “Know All The Things” was how my job req was described to me.
jonknee 9y ago
What circumstance would be needed to have a view where an employee can find riders by name and look at their whole history? If there is a complaint it should allow the customer service agent to see the ride and perhaps some history (ratings make sense, but including full locations/times seems unwise), but I can't think of a reason why this would ever need to be a process started by a Lyft agent and not the customer or driver.
- mithr 9y ago
  This kind of system usually comes into place because an organization combines a number of different pieces of software to make a cohesive whole, rather than designing a single all-in-one solution with perfect foresight. While the customer can open a support ticket in the ticketing system, that system is probably not directly connected to the service that allows support agents to view ride data. This may be because either of these systems weren't (or at least weren't initially) built in-house, or just because this kind of thing is harder to implement and wasn't a design priority back in the day. So a support agent sees a customer issue, and then goes looking for relevant data in another system. If the issue ends up being a bug, and that bug seems to depends on customer data, engineering might need to look at it in order to reproduce and resolve it. It's great if the support person or engineer can look only at the very narrow slice of data they actually need to address the problem they're working on, but often that's not possible (for example, the system could be set up to tightly control ride history access, but once you've been granted that privilege, you can access the _entire_ ride history for that customer.) The company ends up creating policies for data safety, and teams to enforce those policies, but there's always a balance between being able to quickly triage and address a problem (be it a customer reporting that they feel unsafe and need help quickly, a hard to find bug that only seems to happen for people with last names having certain accented characters, or a customer complaining that certain parts of their ride history have mixed-up addresses) and having to go through established channels to justify your need for access. And it's hard to perfect this process. I'm not claiming any of this is ideal, and all in all it sounds like some of Lyft's policies were too lax or too loosely enforced. But I definitely understand _how_/_why_ it could happen.
- Theodores 9y ago
  I used to be in the habit of taking my cat to the vet in a regular taxi, with a local company. I always got the same guy and the same car as they always 'knew' where I was going. The guy I got liked cats, didn't mind waiting around and made sure everything was looked after. Others were allergic to cats or only doing airport trips, so I had no problem with them looking at my history and doing their best for me.
msoad 9y ago
Since when a Blind post is a credible source for news?
- joeblau 9y ago
  Heh, were you around for the Secret days? So much "news" came from that app.
mattmanser 9y ago
Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information See, that's a complete lie and that's the attitude that needs to sop. No-one needed access. Analytics definitely didn't. Engineers never did. Customer services should have to request permission from the customer before accessing sensitive data, with a valid reason. Insurance definitely did not. And "trust and safety", just like customer service, should have had to get customer permission first. What's the need? These are the laws that need to come into place, if your company is bigger than X, safeguards on personal data must be in place to stop anyone accessing a customer's personal data without explicit permission from the customer/senior (legally culpable) manager or as needed to fulfil an order.
- jtmcmc 9y ago
  What's the need for anything? Your argument seems to be predicated on a very specific definition of what need is which is somewhat at odds with most of the rest of the world.
  - s73ver_ 9y ago
    I think it's more that the absolute "need" has not been demonstrated.
  - mynameisvlad 9y ago
    Can you actually refute the parent comment's argument? Because it seems more than reasonable to me. Analytics and Engineering definitely don't need this level of data access for any sort of day-to-day work. I work on analytics tools, and at best, anonymized and generalized data is needed, but never specific customer data. We specifically strip out any PII on data that might reach developers and need to request permission to access any sort of customer data (and I haven't had to do that in a long time). CS/T&S/Insurance might need per-customer data, but they also don't need blanket access to all customers' data. If they need to handle a specific customer's data, there should be a request made that is logged and audited, and ideally with customer approval.
ilamont 9y ago
That sure changes the Uber vs. Lyft media narrative.
- djsumdog 9y ago
  Not really. Uber created the Hell Map, Greyball, and had the two harassment memos. This just seems to be a failure to actively monitor their audits and do permissions correctly .. something that Uber got hit with and fixed too. Lyft just needs to deal with this issue now that it's public, not it's not specific to Lyft. It's really difficult to effectively scan for abuse, even when you audit everything. I've seen similar issues at many companies. This Lyft situation might be more oversight where Uber seems to be more malice.
- OliverJones 9y ago
  Disagree. This press report, rather, tries to piggyback on the Uber narrative. Hey, it got me to click! It's clear from the stuff in the report that Lyft prohibits misuse of PII. The substance of the article is "sometimes people violate our prohibition." The substance of Uber's problems is "our executives and everybody else have free rein on the PII we collect." It's different.
mattdodge 9y ago
None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver feedback isn't PII at all. I suppose it might be a bit questionable if Lyft was creating and providing tools to make it easy to look this stuff up and promoting it within the company but that doesn't sound like the case either.
- ageitgey 9y ago
  > None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?
  - mattdodge 9y ago
    Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.
    - morogop 9y ago
      Names and addresses are both personal data under almost all regulatory regimes. A reasonable rule of thumb is that if you _could_ use the data to identify a person or a household, then it's personal data, whether or not you do so.
    - zephyrus1985 9y ago
      various state by state. The above does qualify as PII in california
    - s73ver_ 9y ago
      I absolutely would say it would, especially where there's a very good chance that the home and work addresses are part of that list, and the idea that someone would use a database like that to spy on an ex and harass and/or assault them is an actual thing that happens.
Animats 9y ago
You used to be able to get info like that by putting a scanner on taxicab radio channels. Few people bothered.
nkkollaw 9y ago
I was talking about this with my girlfriend at dinner tonight. While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time..? With us being tracked with data and video all the time nowadays we are safer--or the companies that have the footage are safer--but of course there is a lot of room for abuse and improper usage.
- duxup 9y ago
  "the minimum-wage employees that checks those" Does anyone even look at them? I just assume most video gets recorded and then recorded over or somehow discarded. Outside of situations like say an airport or casino I doubt anyone is actively watching most of the cameras unless something happens after the fact.
  - nkkollaw 9y ago
    Perhaps not actively, but I bet in case of a hot woman or something weird going on they'll know where the monitors are. I also have two separate family members that have businesses with cameras, and they both look at what's going from an app on their iPads while they watch TV in the evening (actually, having seen them do it is probably why I know videos at businesses are not handled properly).
    - averagewall 9y ago
      Don't public places like shops have to have a sign saying there's CCTV? So customers know they're watched just like in the street.
      - tomschlick 9y ago
        No
      - 9y ago
retox 9y ago
I thought 'staffer' was only used when talking about people working in government or for a political party. Aren't 'staff' or 'employees' just as good for the headline?
- dragonwriter 9y ago
  > I thought 'staffer' was only used when talking about people working in government or for a political party. Nope. > Aren't 'staff' or 'employees' just as good for the headline? No. Staff has a different connotation; as a mass noun, it implies things that are true generally* of the staff. “Employees” would be about as good as “staffers”; the latter is shorter, though, which often is preferable in headlines.
  - retox 9y ago
    Employees is already used in the headline, so the editor would have been looking for a different word to use anyway.
- fjsolwmv 9y ago
  "execs".
mmanfrin 9y ago
The screenshots from the leaker mention that they are using "redshift", which is the name of Amazon's RDB product. Which means this is about people who have access to the database. This is unsurprising that they could access customer data given access to their database. I'm not sure how you prevent this without preventing access to the db (and there are legitimate reasons people within the company would have access -- DBAs, Engineers who are writing direct queries, etc). Not defending people accessing PII, but just saying there are legitimate reasons why someone could have access.
- gresrun 9y ago
  You can't prevent access but you can log all access and require a written reason for access. That, followed up by routine audits of access logs will reduce and discourage abuse as described in the article.
  - cookiecaper 9y ago
    This is about Redshift, Amazon's cloud-based data warehousing tool. Auditing and logging every individual access made by data analysts, engineers, and others making use of Redshift would make their jobs impossible. One day of queries would take weeks to audit and validate a legitimate use case for all the individual data that got touched, and if you're just going to say "oh they needed everyone's PII because it was a big analytical query like they do all day", you're back at square one. The reality is that some people are going to need wide-reaching access. You could monitor for certain problematic access patterns, like someone who is supposed to be doing primarily aggregate queries doing a lot of specific ones, and I'm sure that'd be a good thing to do, but to be honest there are probably much higher priorities since employees who need sensitive access are probably going to be able to avoid that type of detection.
- sargun 9y ago
  Eh, I think the only thing that works is you kill your velocity and institute a bunch of processes, and bureaucracy or put up light gates and hire people that you trust to do the right thing. It sounds like they have some gating, but perhaps they need better auditing, and logging? Anyone who can access that database can _probably_ deploy code too. If you can deploy code, you can sneak in whatever you want.
throwawaylyfty 9y ago
I worked there. I was an engineer and definitely needed access to these data. Fraud and abuse is constantly evolving and touches every part of the business. Everything was audited and I never saw or heard of a single abuse of access. Privacy was talked about seriously at onboarding and other trainings. I have no doubt if somebody was caught abusing this they’d be fired.
- lovich 9y ago
  The article is indicating that what you are saying is at least not universally true in Lyft
  - djsumdog 9y ago
    It's really difficult to audit all this stuff. I was at a health insurance company where someone used su to go to a different user on a box they had root on and it did get picked up by the security team, but only a few weeks after it happened. I was offered a security job at one shop and turned it down, keeping my development role. They had 3 security people for the company (total IT size was 500) and it involved a ton of log parsing, DDoS work, and they were starting to develop an internal white listing application tool. They wanted to bring me on because the desperately needed a developer to add some automation parsing the important from the chaff. (A younger me would have probably done this back when I wanted to be a Pen-tester. I only got interviewed/offered the position because I made the mistake about talking about going to Defcon on a company Slack channel and the security guy insisted I interview).
- deleted 9y ago
  [deleted]
- dx034 9y ago
  Why do you need access as an engineer? Databases for testing should have all sensitive information removed (you can still debug errors). I cannot think of many cases where an engineer will need to have read access to the production database.
Avshalom 9y ago
Just a reminder: "The Kinder Gentler XXXX" or "XXXX but more Ethical" is no the same as "Kind and Gentle" or "Ethical"
pc2g4d 9y ago
Strange coincidence that this headline shares the top spot with an announcement of a new Waze Carpool service... which seems to compete with Lyft?
cbsmith 9y ago
I don't know if I blame the company for this. Anecdotal queries are useful debugging tools. Or makes more sense for employees to just have some sense of decency.
benmmurphy 9y ago
requiring a second person to verify/supervise access to confidential data solves a lot of this problem (at a cost though). like it doesn't prevent a strong adversary from getting access to data they shouldn't but it prevents normal people from abusing power they have stumbled upon. require two logins + audit and a lot of the abuse goes away. people are less inclined to lose their job because their colleague wants to check up on their girlfriend.
ryan_j_naughton 9y ago
Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to talk to the encryption service to decrypt data. - thus all data that would normally be considered very sensitive (e.g. credit reports) can be stored or passed around the services because values like SSN and others are tokenized. - our services with UI's like our CRM, wherein the customer service rep needs so see the data unencrypted, works perfectly bc the response from the API proxy outbound decrypts the data, but selectively so based on the person's permissions through our abstracted auth layer. Thus in the Lyft example, the majority of employees could have access to "God view" but with all the PII encrypted (so they couldn't search their friend's account by email, for example) but they can still look at rides and transactions, while just those who need to see the decrypted PII could be given those permissions. Of course, this assumes that the encrypted PII is sufficient for anonymization. If you can look for all rides within a block of an address in their God view, then you could quickly figure out which person was your friend by narrowing down to rides originating from his house and his work. But again that comes down to properly limiting certain search capabilities in the UI. I don't get why more companies don't follow our approach. I've seen way too much personally sensitive data in plaintext in databases over the years.
- jjeaff 9y ago
  While I like that, and is a cool approach, what is really the difference between just storing PII encrypted in the same database and then keeping your keys locked down based on permission levels? The API proxy would be great if you have a trusted 3rd party in charge of it or something. But abstracting it out to a separate layer doesn't seem necessary since it's all within the same company anyway, and developers will need access anyway
  - brisance 9y ago
    Probably due to granularity of permissions, key revocation etc reasons. Parent's method is analogous to a high school hall pass to access the restrooms; your proposal is to tell the janitor a "secret" password.
outworlder 9y ago
Form TFA: "I have tried to change that from within" Uh oh. This will probably narrow down enough so that they can have a pretty good idea of who posted this...
erulabs 9y ago
I can't even imagine how much PII is sitting in AWS Redshift from various startups... It's brutally slow if you don't tune the encoding types _extremely carefully_, which no one ever does. One has to wonder, if this is such a big deal, what the access rights from AWS' perspective looks like xD Imagine the data team convincing the rest of the company that they're doing anything to make their redshift _slower_. Encryption? People want their graphs, damnit!
asow92 9y ago
Who honestly finds this surprising?
- spydum 9y ago
  Very very few people I hope. There is no economic incentive for companies to invest in secure design/architecture. The costs of building it right almost always lose to other product owner features and timelines. Until we can actually get incentives aligned, companies will continue to build leaky, poorly designed apps with no layered controls. Yes, someone will jump on me and say "but my company does is right!". Great for you! Share your knowledge! You are a snowflake, and probably fortunate to have ethical leadership! The rest of us are doomed.
wfbarks 9y ago
I hate that word "Staffers", immediately makes me think of politics.
- anigbrowl 9y ago
  That's you. It's not particular to any industry.
pfarnsworth 9y ago
This is the biggest point I've been making to all my friends. What they believe Uber is so evilly doing, it will probably show that companies like Lyft and Didi and Grab, etc are all engaged in the same sorts of actions. Uber is the whipping boy for ridesharing, but I'm willing to bet that they are do basically the same thing. My question for Steve Yegge is: He seems to somehow believe that Grab has the moral high ground over Uber and Lyft. What is he going to do when he finds out that Grab behaves in exactly the same manner as Uber?
mys_throwaway 9y ago
I happen to know that the former country manager of Uber in Malaysia used driver personal information to bully and then swindle a gig worker at another (but not competing) gig-economy startup. Long story short, he pressured the worker into doing a gig for free if he could guess his birthday. Not quite a fair gamble considering he knew the guy's birthday from when he'd signed up as a driver for Uber. This would still be a terrible misuse of confidential information if he'd stopped at the poorly executed joke, but the highest ranked Uber employee in Malaysia instead insisted the marginally employed freelancer hold to the agreement.
- 0xB31B1B 9y ago
  What does this have to do with lyft?
  - mys_throwaway 9y ago
    - The linked article alleges employees at Lyft abused information. - Lyft is a direct competitor of Uber. I think my account of an employee at Uber, and not just any employee, but a country manager, committing a worse abuse is fairly relevant to the topic.
Kiro 9y ago
And here we go. Hopefully people will finally understand that there's nothing uniquely evil with Uber and that all players in this sector are rotten.
lorddoig 9y ago
The sixth word in this article is ‘scandal’—is it just me or is a cab company knowing your pick up and drop off locations really not that outrageous?
nicky0 9y ago
A tangent, but why "staffers" and not "staff"?
DerBesserWisser 9y ago
Organisational data protection is no data protection at all.
OliverJones 9y ago
Protection of PII has, for a long time, been a central tenet of USA-based health care IT (due to the HIPAA / ARRA-2009) regulations. It's possible to do that fairly well, and still leave need-to-know exceptions. (The subsititute nurse on the intensive care unit needs to know if a particular patient has Crohns disease, for example). My point is, PII CAN be protected reasonably well. It takes executive will to do so, and training, and monitoring. I worked in a hospital for a while. They had good training on how to avoid misusing PII. It starts with "don't look up your ex or your senator" and goes into ways to keep patient data safe. When there IS a leak HIPAA-covered operations are obliged to disclose it. See here for the catalog of recent disclosures. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf Doing privacy right is systemically possible. But it's a systemwide task, not just a one-off training or audit. (Now, we can talk about whether HIPAA's main point--preventing insurers from abusing patient data--is working or not. Your doc makes you sign a permission slip letting insurers see your information, so you waive that protection in return for reimbursement. But that's a different issue.)
- rmc 9y ago
  > PII CAN be protected reasonably well. It takes executive will to do so These is where the EU's new data protection law (GDPR) could help. It has large fines, and the ability for NGOs to sue you on behalf of users. When the alternative is a big fine, it's easier to find the will.
buildbuildbuild 9y ago
Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look it up, but the fact that it is even possible for insiders to access internal production databases makes me suspect this problem is far more widespread than just at ridesharing companies. I wonder who at Fastmail can read user emails? Who at Heroku can access my code or ENV secrets? Can bank employees see recent transactions, bypassing ACH verification deposits’ “Security”? Sad how rare end to end encryption is as a feature in 2018.
- dx034 9y ago
  Many companies have userdata access heavily restricted and audit every access. It's not that hard to log all queries to production that don't come from the system. And if a developer runs queries against the production database that should pop up somewhere immediately. Not different in banks, any lookup of customer accounts is monitored and checked. Looking up a friend's account will get you fired immediately (or worse).
  - buildbuildbuild 9y ago
    What I worry about is whether the logging is at the application level or database level. Would not be surprised if my banker’s crusty windows XP teller software’s auditing could be bypassed by an unexpectedly-savvy insider.
    - dx034 9y ago
      Logging is done at every level. OS, network and multiple times on a db level (access log plus execution log).
lakechfoma 9y ago
This is a shame for obvious reasons but I don't like the comparison to "god view". Uber designed a UI around accessing PII for their employees to use wanton, Lyft sounds like they need to get their data access under control, stop making excuses for why anyone "needs" real user data, and actually run audits.

440 points by dhruvarora013 9y ago

Someone I know was just commenting that from convos w/ people in other companies, it seems many startups have benefitted from not being under the limelight, and thus had the chance to quietly clean up their own messes while Uber was taking all the heat from the media.

tzahola 9y ago
So basically Uber is the Weinstein of startups.
- dx034 9y ago
  But it appears that Weinstein helped to clean up the industry a lot. Would be great if Uber helps to make startups more responsible (I doubt that).
dominotw 9y ago
I always suspected that uber flames were fanned by its many competitors.
- IncRnd 9y ago
  That may be, but the fires were caused by Uber.
- mrkurt 9y ago
  Uber's dumpster fire didn't need any fanning.
- Apocryphon 9y ago
  What a day for Waze Carpool, then.
303space 9y ago
Does anyone else find this whole thing more than a bit hypocritical? Lyft is always telling you they are the better/ethical/woke ridesharing option - now their employees are reporting a culture of abusing customer privacy. I wish they had taken a look at their own practices before running million dollar ad campaigns full of celebrities celebrating their ‘wokeness’.
- azernik 9y ago
  Uber had the kicker that invasion of privacy was a top-down policy explicitly used by management. Lyft still done fucked up, but not to the level that Uber did.
  - andrestan 9y ago
    Which news story about Uber makes invasion of privacy seem like a top-down policy?
    - azernik 9y ago
      Tracking a journalist: https://www.theverge.com/2014/11/19/7245447/uber-allegedly-tracked-journalist-with-internal-tool-called-god-view https://www.theverge.com/2014/11/19/7245447/uber-allegedly-t... About the company specifically designing and building an internal tool to make this process easier: https://www.theverge.com/2014/11/19/7245447/uber-allegedly-tracked-journalist-with-internal-tool-called-god-view https://www.theverge.com/2014/11/19/7245447/uber-allegedly-t... That whole "greyball" story, which involved personal tracking of law enforcement officers: https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html https://www.nytimes.com/2017/03/03/technology/uber-greyball-...
      - mattmanser 9y ago
        And don't forget they got hold of the medical records of a woman who'd reported she'd been raped by an Uber driver: https://www.recode.net/2017/6/7/15754316/uber-executive-india-assault-rape-medical-records https://www.recode.net/2017/6/7/15754316/uber-executive-indi...

maybeiambatman 9y ago

I can completely see this happening. I have interned at small startups in the past where practice like this was rampant.

tzahola 9y ago
Yeah, and it’s usually called “data science” and “personalized targeting”.

cronjobma 9y ago

Whether it’s Uber or the NSA stories of staff spying on people for a variety of reasons... it always comes down to people who seem to have access to things that they probably shouldnt have gotten access to in the first place. Users should be protected by having their data encrypted and anonymized so no other human being (staffers, governments or hackers) can connect an ID to the data. This way they can still access the data and use it for what ever work related purpose, with less risk of these things happening

joshuamorton 9y ago
(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver. There absolutely should be data privacy guarantees that are as strong as possible. But "encrypt and anonymize everything" doesn't work. (edit: and note, I think this is an unfortunate truth, but still a truth).
- jonknee 9y ago
  Obviously when you make a support request your record should be displayed for the customer service agent, but this is the other way around where they can seek out people. I don't think that's a valid use case and there's the obvious abuse case.
  - joshuamorton 9y ago
    Right, but the solution to that isn't 'encrypt everything', its 'define reasonable (and this definition may vary, but its certainly not "none") access controls for user data and pii'.
- cronjobma 9y ago
  You could completely anonymize when certain key variables are met. In your example, when the ride is successfully completed and both parties confirmed this, the data can be anonymized.

mpolichette 9y ago

When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being. Lyft should be checking on this, running audits and whatnot, but they also should be setting good policy and culture to not abuse access. Basically, I think its reasonable to both allow many people access and expect them to not abuse it.

toomuchtodo 9y ago
I’m at a financial services firm, and we have an entire internal risk department to ensure employees aren’t exceeding their authority. Surfing the wrong websites? Badging in and out at abnormal hours? Accessing internal apps in ways you shouldn’t? Access immediately flagged for human intervention and you’re locked out. Our data scientist team improves on the heuristics constantly. At some point, organizations with data have to learn how to manage IAM [1] properly. [1] https://en.wikipedia.org/wiki/Identity_management https://en.wikipedia.org/wiki/Identity_management
- desireco42 9y ago
  That sounds like fantastic place to work :), how come you are not locked out for posting on HN? (I am assuming you are doing this during work hours)
  - LeifCarrotson 9y ago
    Probably is on the data science team...
    - deleted 9y ago
      [deleted]
  - toomuchtodo 9y ago
    I’m on our cloud security team; our leadership chain gives us wide latitude (Hacker News A-OK) since our entire job is to be subject matter experts. Literally “Know All The Things” was how my job req was described to me.

jonknee 9y ago

What circumstance would be needed to have a view where an employee can find riders by name and look at their whole history? If there is a complaint it should allow the customer service agent to see the ride and perhaps some history (ratings make sense, but including full locations/times seems unwise), but I can't think of a reason why this would ever need to be a process started by a Lyft agent and not the customer or driver.

mithr 9y ago
This kind of system usually comes into place because an organization combines a number of different pieces of software to make a cohesive whole, rather than designing a single all-in-one solution with perfect foresight. While the customer can open a support ticket in the ticketing system, that system is probably not directly connected to the service that allows support agents to view ride data. This may be because either of these systems weren't (or at least weren't initially) built in-house, or just because this kind of thing is harder to implement and wasn't a design priority back in the day. So a support agent sees a customer issue, and then goes looking for relevant data in another system. If the issue ends up being a bug, and that bug seems to depends on customer data, engineering might need to look at it in order to reproduce and resolve it. It's great if the support person or engineer can look only at the very narrow slice of data they actually need to address the problem they're working on, but often that's not possible (for example, the system could be set up to tightly control ride history access, but once you've been granted that privilege, you can access the _entire_ ride history for that customer.) The company ends up creating policies for data safety, and teams to enforce those policies, but there's always a balance between being able to quickly triage and address a problem (be it a customer reporting that they feel unsafe and need help quickly, a hard to find bug that only seems to happen for people with last names having certain accented characters, or a customer complaining that certain parts of their ride history have mixed-up addresses) and having to go through established channels to justify your need for access. And it's hard to perfect this process. I'm not claiming any of this is ideal, and all in all it sounds like some of Lyft's policies were too lax or too loosely enforced. But I definitely understand _how_/_why_ it could happen.
Theodores 9y ago
I used to be in the habit of taking my cat to the vet in a regular taxi, with a local company. I always got the same guy and the same car as they always 'knew' where I was going. The guy I got liked cats, didn't mind waiting around and made sure everything was looked after. Others were allergic to cats or only doing airport trips, so I had no problem with them looking at my history and doing their best for me.

msoad 9y ago

Since when a Blind post is a credible source for news?

joeblau 9y ago
Heh, were you around for the Secret days? So much "news" came from that app.

mattmanser 9y ago

Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information See, that's a complete lie and that's the attitude that needs to sop. No-one needed access. Analytics definitely didn't. Engineers never did. Customer services should have to request permission from the customer before accessing sensitive data, with a valid reason. Insurance definitely did not. And "trust and safety", just like customer service, should have had to get customer permission first. What's the need? These are the laws that need to come into place, if your company is bigger than X, safeguards on personal data must be in place to stop anyone accessing a customer's personal data without explicit permission from the customer/senior (legally culpable) manager or as needed to fulfil an order.

jtmcmc 9y ago
What's the need for anything? Your argument seems to be predicated on a very specific definition of what need is which is somewhat at odds with most of the rest of the world.
- s73ver_ 9y ago
  I think it's more that the absolute "need" has not been demonstrated.
- mynameisvlad 9y ago
  Can you actually refute the parent comment's argument? Because it seems more than reasonable to me. Analytics and Engineering definitely don't need this level of data access for any sort of day-to-day work. I work on analytics tools, and at best, anonymized and generalized data is needed, but never specific customer data. We specifically strip out any PII on data that might reach developers and need to request permission to access any sort of customer data (and I haven't had to do that in a long time). CS/T&S/Insurance might need per-customer data, but they also don't need blanket access to all customers' data. If they need to handle a specific customer's data, there should be a request made that is logged and audited, and ideally with customer approval.

ilamont 9y ago

That sure changes the Uber vs. Lyft media narrative.

djsumdog 9y ago
Not really. Uber created the Hell Map, Greyball, and had the two harassment memos. This just seems to be a failure to actively monitor their audits and do permissions correctly .. something that Uber got hit with and fixed too. Lyft just needs to deal with this issue now that it's public, not it's not specific to Lyft. It's really difficult to effectively scan for abuse, even when you audit everything. I've seen similar issues at many companies. This Lyft situation might be more oversight where Uber seems to be more malice.
OliverJones 9y ago
Disagree. This press report, rather, tries to piggyback on the Uber narrative. Hey, it got me to click! It's clear from the stuff in the report that Lyft prohibits misuse of PII. The substance of the article is "sometimes people violate our prohibition." The substance of Uber's problems is "our executives and everybody else have free rein on the PII we collect." It's different.

mattdodge 9y ago

None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver feedback isn't PII at all. I suppose it might be a bit questionable if Lyft was creating and providing tools to make it easy to look this stuff up and promoting it within the company but that doesn't sound like the case either.

ageitgey 9y ago
> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?
- mattdodge 9y ago
  Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.
  - morogop 9y ago
    Names and addresses are both personal data under almost all regulatory regimes. A reasonable rule of thumb is that if you _could_ use the data to identify a person or a household, then it's personal data, whether or not you do so.
  - zephyrus1985 9y ago
    various state by state. The above does qualify as PII in california
  - s73ver_ 9y ago
    I absolutely would say it would, especially where there's a very good chance that the home and work addresses are part of that list, and the idea that someone would use a database like that to spy on an ex and harass and/or assault them is an actual thing that happens.

Animats 9y ago

You used to be able to get info like that by putting a scanner on taxicab radio channels. Few people bothered.

nkkollaw 9y ago

I was talking about this with my girlfriend at dinner tonight. While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time..? With us being tracked with data and video all the time nowadays we are safer--or the companies that have the footage are safer--but of course there is a lot of room for abuse and improper usage.

duxup 9y ago
"the minimum-wage employees that checks those" Does anyone even look at them? I just assume most video gets recorded and then recorded over or somehow discarded. Outside of situations like say an airport or casino I doubt anyone is actively watching most of the cameras unless something happens after the fact.
- nkkollaw 9y ago
  Perhaps not actively, but I bet in case of a hot woman or something weird going on they'll know where the monitors are. I also have two separate family members that have businesses with cameras, and they both look at what's going from an app on their iPads while they watch TV in the evening (actually, having seen them do it is probably why I know videos at businesses are not handled properly).
  - averagewall 9y ago
    Don't public places like shops have to have a sign saying there's CCTV? So customers know they're watched just like in the street.
    - tomschlick 9y ago
      No
    - 9y ago

retox 9y ago

I thought 'staffer' was only used when talking about people working in government or for a political party. Aren't 'staff' or 'employees' just as good for the headline?

dragonwriter 9y ago
> I thought 'staffer' was only used when talking about people working in government or for a political party. Nope. > Aren't 'staff' or 'employees' just as good for the headline? No. Staff has a different connotation; as a mass noun, it implies things that are true generally* of the staff. “Employees” would be about as good as “staffers”; the latter is shorter, though, which often is preferable in headlines.
- retox 9y ago
  Employees is already used in the headline, so the editor would have been looking for a different word to use anyway.
fjsolwmv 9y ago
"execs".

mmanfrin 9y ago

The screenshots from the leaker mention that they are using "redshift", which is the name of Amazon's RDB product. Which means this is about people who have access to the database. This is unsurprising that they could access customer data given access to their database. I'm not sure how you prevent this without preventing access to the db (and there are legitimate reasons people within the company would have access -- DBAs, Engineers who are writing direct queries, etc). Not defending people accessing PII, but just saying there are legitimate reasons why someone could have access.

gresrun 9y ago
You can't prevent access but you can log all access and require a written reason for access. That, followed up by routine audits of access logs will reduce and discourage abuse as described in the article.
- cookiecaper 9y ago
  This is about Redshift, Amazon's cloud-based data warehousing tool. Auditing and logging every individual access made by data analysts, engineers, and others making use of Redshift would make their jobs impossible. One day of queries would take weeks to audit and validate a legitimate use case for all the individual data that got touched, and if you're just going to say "oh they needed everyone's PII because it was a big analytical query like they do all day", you're back at square one. The reality is that some people are going to need wide-reaching access. You could monitor for certain problematic access patterns, like someone who is supposed to be doing primarily aggregate queries doing a lot of specific ones, and I'm sure that'd be a good thing to do, but to be honest there are probably much higher priorities since employees who need sensitive access are probably going to be able to avoid that type of detection.
sargun 9y ago
Eh, I think the only thing that works is you kill your velocity and institute a bunch of processes, and bureaucracy or put up light gates and hire people that you trust to do the right thing. It sounds like they have some gating, but perhaps they need better auditing, and logging? Anyone who can access that database can _probably_ deploy code too. If you can deploy code, you can sneak in whatever you want.

throwawaylyfty 9y ago

I worked there. I was an engineer and definitely needed access to these data. Fraud and abuse is constantly evolving and touches every part of the business. Everything was audited and I never saw or heard of a single abuse of access. Privacy was talked about seriously at onboarding and other trainings. I have no doubt if somebody was caught abusing this they’d be fired.

lovich 9y ago
The article is indicating that what you are saying is at least not universally true in Lyft
- djsumdog 9y ago
  It's really difficult to audit all this stuff. I was at a health insurance company where someone used su to go to a different user on a box they had root on and it did get picked up by the security team, but only a few weeks after it happened. I was offered a security job at one shop and turned it down, keeping my development role. They had 3 security people for the company (total IT size was 500) and it involved a ton of log parsing, DDoS work, and they were starting to develop an internal white listing application tool. They wanted to bring me on because the desperately needed a developer to add some automation parsing the important from the chaff. (A younger me would have probably done this back when I wanted to be a Pen-tester. I only got interviewed/offered the position because I made the mistake about talking about going to Defcon on a company Slack channel and the security guy insisted I interview).
deleted 9y ago
[deleted]
dx034 9y ago
Why do you need access as an engineer? Databases for testing should have all sensitive information removed (you can still debug errors). I cannot think of many cases where an engineer will need to have read access to the production database.

Avshalom 9y ago

Just a reminder: "The Kinder Gentler XXXX" or "XXXX but more Ethical" is no the same as "Kind and Gentle" or "Ethical"

pc2g4d 9y ago

Strange coincidence that this headline shares the top spot with an announcement of a new Waze Carpool service... which seems to compete with Lyft?

cbsmith 9y ago

I don't know if I blame the company for this. Anecdotal queries are useful debugging tools. Or makes more sense for employees to just have some sense of decency.

benmmurphy 9y ago

requiring a second person to verify/supervise access to confidential data solves a lot of this problem (at a cost though). like it doesn't prevent a strong adversary from getting access to data they shouldn't but it prevents normal people from abusing power they have stumbled upon. require two logins + audit and a lot of the abuse goes away. people are less inclined to lose their job because their colleague wants to check up on their girlfriend.

ryan_j_naughton 9y ago

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to talk to the encryption service to decrypt data. - thus all data that would normally be considered very sensitive (e.g. credit reports) can be stored or passed around the services because values like SSN and others are tokenized. - our services with UI's like our CRM, wherein the customer service rep needs so see the data unencrypted, works perfectly bc the response from the API proxy outbound decrypts the data, but selectively so based on the person's permissions through our abstracted auth layer. Thus in the Lyft example, the majority of employees could have access to "God view" but with all the PII encrypted (so they couldn't search their friend's account by email, for example) but they can still look at rides and transactions, while just those who need to see the decrypted PII could be given those permissions. Of course, this assumes that the encrypted PII is sufficient for anonymization. If you can look for all rides within a block of an address in their God view, then you could quickly figure out which person was your friend by narrowing down to rides originating from his house and his work. But again that comes down to properly limiting certain search capabilities in the UI. I don't get why more companies don't follow our approach. I've seen way too much personally sensitive data in plaintext in databases over the years.

jjeaff 9y ago
While I like that, and is a cool approach, what is really the difference between just storing PII encrypted in the same database and then keeping your keys locked down based on permission levels? The API proxy would be great if you have a trusted 3rd party in charge of it or something. But abstracting it out to a separate layer doesn't seem necessary since it's all within the same company anyway, and developers will need access anyway
- brisance 9y ago
  Probably due to granularity of permissions, key revocation etc reasons. Parent's method is analogous to a high school hall pass to access the restrooms; your proposal is to tell the janitor a "secret" password.

outworlder 9y ago

Form TFA: "I have tried to change that from within" Uh oh. This will probably narrow down enough so that they can have a pretty good idea of who posted this...

erulabs 9y ago

I can't even imagine how much PII is sitting in AWS Redshift from various startups... It's brutally slow if you don't tune the encoding types _extremely carefully_, which no one ever does. One has to wonder, if this is such a big deal, what the access rights from AWS' perspective looks like xD Imagine the data team convincing the rest of the company that they're doing anything to make their redshift _slower_. Encryption? People want their graphs, damnit!

asow92 9y ago

Who honestly finds this surprising?

spydum 9y ago
Very very few people I hope. There is no economic incentive for companies to invest in secure design/architecture. The costs of building it right almost always lose to other product owner features and timelines. Until we can actually get incentives aligned, companies will continue to build leaky, poorly designed apps with no layered controls. Yes, someone will jump on me and say "but my company does is right!". Great for you! Share your knowledge! You are a snowflake, and probably fortunate to have ethical leadership! The rest of us are doomed.

wfbarks 9y ago

I hate that word "Staffers", immediately makes me think of politics.

anigbrowl 9y ago
That's you. It's not particular to any industry.

pfarnsworth 9y ago

This is the biggest point I've been making to all my friends. What they believe Uber is so evilly doing, it will probably show that companies like Lyft and Didi and Grab, etc are all engaged in the same sorts of actions. Uber is the whipping boy for ridesharing, but I'm willing to bet that they are do basically the same thing. My question for Steve Yegge is: He seems to somehow believe that Grab has the moral high ground over Uber and Lyft. What is he going to do when he finds out that Grab behaves in exactly the same manner as Uber?

mys_throwaway 9y ago

I happen to know that the former country manager of Uber in Malaysia used driver personal information to bully and then swindle a gig worker at another (but not competing) gig-economy startup. Long story short, he pressured the worker into doing a gig for free if he could guess his birthday. Not quite a fair gamble considering he knew the guy's birthday from when he'd signed up as a driver for Uber. This would still be a terrible misuse of confidential information if he'd stopped at the poorly executed joke, but the highest ranked Uber employee in Malaysia instead insisted the marginally employed freelancer hold to the agreement.

0xB31B1B 9y ago
What does this have to do with lyft?
- mys_throwaway 9y ago
  - The linked article alleges employees at Lyft abused information. - Lyft is a direct competitor of Uber. I think my account of an employee at Uber, and not just any employee, but a country manager, committing a worse abuse is fairly relevant to the topic.

Kiro 9y ago

And here we go. Hopefully people will finally understand that there's nothing uniquely evil with Uber and that all players in this sector are rotten.

lorddoig 9y ago

The sixth word in this article is ‘scandal’—is it just me or is a cab company knowing your pick up and drop off locations really not that outrageous?

nicky0 9y ago

A tangent, but why "staffers" and not "staff"?

DerBesserWisser 9y ago

Organisational data protection is no data protection at all.

OliverJones 9y ago

Protection of PII has, for a long time, been a central tenet of USA-based health care IT (due to the HIPAA / ARRA-2009) regulations. It's possible to do that fairly well, and still leave need-to-know exceptions. (The subsititute nurse on the intensive care unit needs to know if a particular patient has Crohns disease, for example). My point is, PII CAN be protected reasonably well. It takes executive will to do so, and training, and monitoring. I worked in a hospital for a while. They had good training on how to avoid misusing PII. It starts with "don't look up your ex or your senator" and goes into ways to keep patient data safe. When there IS a leak HIPAA-covered operations are obliged to disclose it. See here for the catalog of recent disclosures. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf Doing privacy right is systemically possible. But it's a systemwide task, not just a one-off training or audit. (Now, we can talk about whether HIPAA's main point--preventing insurers from abusing patient data--is working or not. Your doc makes you sign a permission slip letting insurers see your information, so you waive that protection in return for reimbursement. But that's a different issue.)

rmc 9y ago
> PII CAN be protected reasonably well. It takes executive will to do so These is where the EU's new data protection law (GDPR) could help. It has large fines, and the ability for NGOs to sue you on behalf of users. When the alternative is a big fine, it's easier to find the will.

buildbuildbuild 9y ago

Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look it up, but the fact that it is even possible for insiders to access internal production databases makes me suspect this problem is far more widespread than just at ridesharing companies. I wonder who at Fastmail can read user emails? Who at Heroku can access my code or ENV secrets? Can bank employees see recent transactions, bypassing ACH verification deposits’ “Security”? Sad how rare end to end encryption is as a feature in 2018.

dx034 9y ago
Many companies have userdata access heavily restricted and audit every access. It's not that hard to log all queries to production that don't come from the system. And if a developer runs queries against the production database that should pop up somewhere immediately. Not different in banks, any lookup of customer accounts is monitored and checked. Looking up a friend's account will get you fired immediately (or worse).
- buildbuildbuild 9y ago
  What I worry about is whether the logging is at the application level or database level. Would not be surprised if my banker’s crusty windows XP teller software’s auditing could be bypassed by an unexpectedly-savvy insider.
  - dx034 9y ago
    Logging is done at every level. OS, network and multiple times on a db level (access log plus execution log).

lakechfoma 9y ago

This is a shame for obvious reasons but I don't like the comparison to "god view". Uber designed a UI around accessing PII for their employees to use wanton, Lyft sounds like they need to get their data access under control, stop making excuses for why anyone "needs" real user data, and actually run audits.