11 ms·

You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guara

by harryh 9y ago

You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. With so much to lose and so little to gain internal leaks of this sort are extremely rare.

specialist 9y ago
Who watches the watchers? #1 - There's always a back door. I did some medical records stuff for a while. I looked myself up, just to confirm for myself how trivial it was to do. Yup, there I was. Which is why I insist that all data at rest is encrypted. (I have yet to win this argument.) #2 - Our "portal" product had access logs for auditing. Plus permissions, consent trees, delegation. The usual features. Alas. We also had a "break the glass" scenario, ostensibly for emergency care, but was more like the happy path. And to my knowledge, during my 6 years, none of our customers ever audited their own logs. #3 - My SO at the time worked in a hospital and went to another disconnected hospital for care because she knew her coworkers routinely, illegally looked up patient records, and she didn't want them spying on her.
- underwater 9y ago
  As an ex-employee, I feel much more confident in Facebook's processes than the company you're describing. Facebook would have no problem terminating people who do what you're describing.
  - mehrdadn 9y ago
    As an ex-employee could you please also confirm whether or not the average employee is able to access user data, and what kinds of permissions (if any) this requires?
    - renaudg 9y ago
      Another ex-FB employee here. I can't believe this is even a thing people are wondering about. Of course not the average employee can't access user data, it's an immediate firing offense.
      - mehrdadn 9y ago
        > Another ex-FB employee here. I can't believe this is even a thing people are wondering about. Of course not the average employee can't access user data, it's an immediate firing offense. Ironically, you're undermining your own point. The fact that they would be fired afterwards in no way contradicts the notion that they could access such data, and in fact suggests they can (hence the firing policy).
        renaudg 9y ago
        Are you genuinely asking a question you would like to know the truthful answer to, or are you just interested in confirming the strong preexisting bias on display in each of your comments on this story ? You asked about the "average employee" having access to user data, and the answer is unequivocally "no", with both technical and disciplinary safeguards. There are only a few roles (moderation) who can access the relevant tools, and while engineers may technically have programmatic access (how would you expect things to work if nobody did ?), this is thoroughly logged and you'd better have an ironclad justification not to get fired on the spot.
        mehrdadn 9y ago
        No, I'm interested in knowing the truthful answer. It's just that I've received plenty of seemingly truthful responses (both here and elsewhere, e.g. [1]) that seem quite consistent with the notion that an average-employee(-turned-malicious) would be capable of accessing user data, punishments and all notwithstanding. > You asked about the "average employee" having access to user data, and the answer is unequivocally "no", with both technical and disciplinary safeguards. (a) How do you know, and (b) so what is your explanation of stories like [1]? They're just hoaxes? > and while engineers may technically have programmatic access (how would you expect things to work if nobody did ?) Again you are wording this in quite a vague, lawyer-y manner, which again raises my eyebrows. "May" as in "might", or as in "do"? And "engineers" as in what fraction of them? There is a lot of wiggle room between "nobody" and "all engineers". It's quite strange that I can't get a straightforward, crystal-clear denial to a non-weasel-worded claim from you who seem to be confidently contesting what I'm saying. Please don't keep muddying the waters. [1] https://news.ycombinator.com/item?id=16675664 https://news.ycombinator.com/item?id=16675664
  - robrenaud 9y ago
    Imagine you are the Egyptian government. You want to squash a social media fueled rebellion, lead by some anonymous person. How hard is it to get one of your bright and loyal minds hired by Facebook? How much data could such a person exfiltrate before getting fired? The 'We will log your access and fire you' line of defense prevents nothing from someone who only has a job for the purpose of moving data out.
    - taurath 9y ago
      They don’t fire you, they arrest you. And then they find out who you work for.
      - gruturo 9y ago
        Doesn't matter. At the first hint of trouble you escaped back to your country, protected by the government which had sent you there in the first place, and now the rebels have been murdered thanks to the data you got out.
    - underwater 9y ago
      Batch scrapping or drip feeding data via a monitored internal tool? I doubt they’d get much out at all. It’s inherently a low bandwidth and very obvious channel. Someone in that position would be much better off building a back door into the system. But if they could also build a backdoor into iCloud, or scrape Gmail data from within Google. I assume that Facebook has mechanisms to check that new hires (especially foreign nationals) are legitimate.
  - specialist 9y ago
    If data at rest is unencrypted, I don't believe you. Sorry. Someone, somewhere is peeking at the naughty bits. This is the best resource I've found for protecting such things: Translucent Databases: Confusion, Misdirection, Randomness, Sharing, Authentication And Steganography To Defend Privacy http://a.co/eLgQACC http://a.co/eLgQACC Maybe differential privacy stuff will supersede, compliment these techniques. I'm keeping an open mind.
- sulam 9y ago
  HITRUST CSF is a framework for auditably proving HIPPA compliance. It prescribes controls such as encrypting data at rest. If you have a business relationship with a company which provides you PHI without explicit user consent you must have an agreement (a BAA) with the third party which puts them under the same requirements (backed up with third party audits). Everything you’re describing sounds like it’s either incredibly fly by night, not in the US, or substantially out of date. If the last two aren’t true, you have a situation that is literally illegal.
  - aianus 9y ago
    Surprise: regulating and legislating doesn’t actually make bad behaviour go away. I too have had the experience of interning at a medical software company where security and patient privacy were a joke.
    - sulam 9y ago
      That sucks, but you might consider next time talking to people and seeing if they are working to improve things and, if not, being a whistleblower.
      - jacquesm 9y ago
        You might as well connect that whistle to an aircompressor if my experience is anything to go by. Very few companies have their house in order, and healthcare is definitely not an exception to this.
  - ubernostrum 9y ago
    I've worked in health care a couple of times now. And while the companies I've worked for have gone well beyond the minimum required for legal compliance, the scary bit really is the sorts of things you could, if you were lazy enough, do and still legally be compliant.
    - sulam 9y ago
      Yeah, HIPPA has some holes you could drive a truck through. I also hate OAuth (so much focus on access, so little focus on what gets done with that access).
- evgen 9y ago
  Facebook has a long history of employees doing sketchy shit like peeking at the profile/timeline of the new SO for their former SO. This has been one of the top threat scenarios internally for more than a decade and they have built significant security infrastructure to protect against this sort of problem. Yes, there is 'always a back door', but that back door has gotten smaller and much harder to find over the years. It is always a possibility, and while the system will prevent attempts to exfil large chunks of data for smaller breaches like this the audits/alarms will probably take a day or so before you are sitting in someone's office with HR present to have a discussion regarding your user data access patterns. So compromise the security infra you say? Yeah, there are other systems watching for that too... -Former custodiet of the custodes
deleted 9y ago
[deleted]
jMyles 9y ago
> so little to gain wait, what? There's quite a lot to be gained. Enough to incentivize a very powerful attacker, possibly even a nation-state level actor who can extract the mole and protect / reward them. The stakes are not low here; I can't imagine why you've said that.
JumpCrisscross 9y ago
> With so much to lose and so little to gain internal leaks of this sort are extremely rare I recently downloaded my Facebook archive [1]. If it were legal, I would certainly pay thousands if not tens of thousands of dollars for certain peoples' archives. I can think of several practical contexts in which an unethical actor would find it profitable to pay a Facebook employee a million dollars for someone's Facebook archives. [1] https://www.facebook.com/help/131112897028467/ https://www.facebook.com/help/131112897028467/
- harryh 9y ago
  I would certainly pay thousands if not tens of thousands of dollars for certain peoples' archives Really? For what purpose?
  - JumpCrisscross 9y ago
    > For what purpose? On the upside, any case where one is engaging in high-value transactions (broadly speaking). Knowing a negotiating counterpart's likes, dislikes, communication style, et cetera can help one avoid mistakes, build a personal connection and draft (and frame) terms correctly on the first try. More seedily, such information about a political opponent (whether a politician, rival on a commercial or non-profit board, or commercial competitor) is useful. As a risk mitigation tool, such data would find a natural home in a due diligence file. Prospective executives, board members, business partners, political donation recipients, et cetera expose one to reputational risks. Catching those in advance is already worth tens of thousands of dollars of legal time. I would hate to live in a country where the above is legal. We should recognize the value of the information every single single Facebook employee has routine access to.
  - pjc50 9y ago
    Re-sell to news media for hundreds of thousands of dollars?
- heavenlyblue 9y ago
  I could find several unethical contexts where the same actor is paid a million dollars to kill the same person and the legal framework we live in does nothing to stop this. Well, apart from post-factum incarceration.
mehrdadn 9y ago
> You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. That's not enough by any means (edit: and as [1] pointed out, I don't even think it's true). There needs to be more to security than mere deterrence. I'm pretty sure at Google, etc. it's simply impossible for a single rogue employee to mess with customer data (except for a few in very privileged positions), and my impression has been that Facebook is not like this at all (unless it has changed recently). [1] https://news.ycombinator.com/item?id=16675494 https://news.ycombinator.com/item?id=16675494
- harryh 9y ago
  That sort of access limitation is what I meant by "pretty strict internal controls." Having never worked there, I can't speak to how it works at FB but I would imagine that there are a lot of limitations on what rank and file employees can do. I guess I could be wrong. Perhaps someone with direct knowledge will chime in.
  - mehrdadn 9y ago
    > I can't speak to how it works at FB but I would imagine that there are a lot of limitations on what rank and file employees can do. I guess I could be wrong. Cool, now read this: https://news.ycombinator.com/item?id=16675503 https://news.ycombinator.com/item?id=16675503 Any changes to your thoughts?
dannyw 9y ago
I hope so, but keep in mind Facebook has a magical password that worked for every account for almost a decade.
- cornellwright 9y ago
  Source?
  - iamdave 9y ago
    http://theweek.com/articles/474339/facebookinsider-memoir-skeletonkey-password-4-other-revelations http://theweek.com/articles/474339/facebookinsider-memoir-sk...
    - cornellwright 9y ago
      I think the previous commenter must have meant "had" as that says as of sometime before the 2012 date on that article the master password allegedly no longer worked. Still egregious if that sort of early stage stuff hung around that long, but not the same as it being there today.
    - prostoalex 9y ago
      That password only worked from Facebook's corporate IP addresses.
tptacek 9y ago
most companies have pretty strict internal controls for this sort of thing This does not ring true to me at all.
- harryh 9y ago
  It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here. EDIT/NOTE: https://news.ycombinator.com/item?id=16675493 https://news.ycombinator.com/item?id=16675493
  - Mc91 9y ago
    > It's certainly true at financial institutions It's certainly not true at financial institutions. By financial institutions I mean Fortune 100 financial institutions, as well as smaller financial institutions. If by "pretty strict internal controls" you mean they can, like Prince Potemkin, point to such things existing in some chimeric form, then yes, I suppose you are right. But in any real sense, no, there are no effective controls in the real world. About 25 years ago I assumed it was early days for a lot of these things and they would sooner or later be closed up, but they haven't been. Things are wide open - as the recent Facebook/Analytics things have shown. In a very small and indirect way at that. The first major book on this broad subject was Donn Parker's "Crime by Computer" published in 1976. The book opens by saying that a company's biggest enemies in terms of computer crime is its own employees. This is still true 40+ years later - the biggest enemy of the people who own companies are the people who do the work at them.
  - mehrdadn 9y ago
    > It was true at Google. Yes, because Google is not your average company. It takes security extremely seriously... in fact it's about as awful of an example as you can give for a blanket statement you made about "most companies".
    - kerng 9y ago
      I'm not sure if Google even has an internal red team that performs breaches, last time I talked with someone there at a conference they didn't (that was 2016). So I am not sure Google has metrics on how easy it is to gain access by an adversary.
krasin 9y ago
Recent news ([1]): Facebook security boss says its corporate network is run "like a college campus" 1. http://www.zdnet.com/article/leaked-audio-facebook-security-boss-says-network-is-like-a-college-campus/ http://www.zdnet.com/article/leaked-audio-facebook-security-...
hinkley 9y ago
Facebook is not most companies, though.
hyperpallium 9y ago
Unfortunately the criminal charge would be theft of facebook's proprietary information.
jimjimjim 9y ago
proper companies that have been around for a while and expect to be around for a while do this. companies that move fast and break things don't give a shit. I want more companies of the first type and less of the second.
patmcc 9y ago
In any organization there is some number of people, who, if sufficiently motivated, could work together to pull off a 'data heist' and not be immediately uncovered. At a good company that number is high, at a bad company that number is 1. What do you think the number is at facebook? At google? At your bank? At your healthcare provider?

by harryh 9y ago

specialist 9y ago

Who watches the watchers? #1 - There's always a back door. I did some medical records stuff for a while. I looked myself up, just to confirm for myself how trivial it was to do. Yup, there I was. Which is why I insist that all data at rest is encrypted. (I have yet to win this argument.) #2 - Our "portal" product had access logs for auditing. Plus permissions, consent trees, delegation. The usual features. Alas. We also had a "break the glass" scenario, ostensibly for emergency care, but was more like the happy path. And to my knowledge, during my 6 years, none of our customers ever audited their own logs. #3 - My SO at the time worked in a hospital and went to another disconnected hospital for care because she knew her coworkers routinely, illegally looked up patient records, and she didn't want them spying on her.

underwater 9y ago
As an ex-employee, I feel much more confident in Facebook's processes than the company you're describing. Facebook would have no problem terminating people who do what you're describing.
- mehrdadn 9y ago
  As an ex-employee could you please also confirm whether or not the average employee is able to access user data, and what kinds of permissions (if any) this requires?
  - renaudg 9y ago
    Another ex-FB employee here. I can't believe this is even a thing people are wondering about. Of course not the average employee can't access user data, it's an immediate firing offense.
    - mehrdadn 9y ago
      > Another ex-FB employee here. I can't believe this is even a thing people are wondering about. Of course not the average employee can't access user data, it's an immediate firing offense. Ironically, you're undermining your own point. The fact that they would be fired afterwards in no way contradicts the notion that they could access such data, and in fact suggests they can (hence the firing policy).
      - renaudg 9y ago
        Are you genuinely asking a question you would like to know the truthful answer to, or are you just interested in confirming the strong preexisting bias on display in each of your comments on this story ? You asked about the "average employee" having access to user data, and the answer is unequivocally "no", with both technical and disciplinary safeguards. There are only a few roles (moderation) who can access the relevant tools, and while engineers may technically have programmatic access (how would you expect things to work if nobody did ?), this is thoroughly logged and you'd better have an ironclad justification not to get fired on the spot.
        mehrdadn 9y ago
        No, I'm interested in knowing the truthful answer. It's just that I've received plenty of seemingly truthful responses (both here and elsewhere, e.g. [1]) that seem quite consistent with the notion that an average-employee(-turned-malicious) would be capable of accessing user data, punishments and all notwithstanding. > You asked about the "average employee" having access to user data, and the answer is unequivocally "no", with both technical and disciplinary safeguards. (a) How do you know, and (b) so what is your explanation of stories like [1]? They're just hoaxes? > and while engineers may technically have programmatic access (how would you expect things to work if nobody did ?) Again you are wording this in quite a vague, lawyer-y manner, which again raises my eyebrows. "May" as in "might", or as in "do"? And "engineers" as in what fraction of them? There is a lot of wiggle room between "nobody" and "all engineers". It's quite strange that I can't get a straightforward, crystal-clear denial to a non-weasel-worded claim from you who seem to be confidently contesting what I'm saying. Please don't keep muddying the waters. [1] https://news.ycombinator.com/item?id=16675664 https://news.ycombinator.com/item?id=16675664
- robrenaud 9y ago
  Imagine you are the Egyptian government. You want to squash a social media fueled rebellion, lead by some anonymous person. How hard is it to get one of your bright and loyal minds hired by Facebook? How much data could such a person exfiltrate before getting fired? The 'We will log your access and fire you' line of defense prevents nothing from someone who only has a job for the purpose of moving data out.
  - taurath 9y ago
    They don’t fire you, they arrest you. And then they find out who you work for.
    - gruturo 9y ago
      Doesn't matter. At the first hint of trouble you escaped back to your country, protected by the government which had sent you there in the first place, and now the rebels have been murdered thanks to the data you got out.
  - underwater 9y ago
    Batch scrapping or drip feeding data via a monitored internal tool? I doubt they’d get much out at all. It’s inherently a low bandwidth and very obvious channel. Someone in that position would be much better off building a back door into the system. But if they could also build a backdoor into iCloud, or scrape Gmail data from within Google. I assume that Facebook has mechanisms to check that new hires (especially foreign nationals) are legitimate.
- specialist 9y ago
  If data at rest is unencrypted, I don't believe you. Sorry. Someone, somewhere is peeking at the naughty bits. This is the best resource I've found for protecting such things: Translucent Databases: Confusion, Misdirection, Randomness, Sharing, Authentication And Steganography To Defend Privacy http://a.co/eLgQACC http://a.co/eLgQACC Maybe differential privacy stuff will supersede, compliment these techniques. I'm keeping an open mind.
sulam 9y ago
HITRUST CSF is a framework for auditably proving HIPPA compliance. It prescribes controls such as encrypting data at rest. If you have a business relationship with a company which provides you PHI without explicit user consent you must have an agreement (a BAA) with the third party which puts them under the same requirements (backed up with third party audits). Everything you’re describing sounds like it’s either incredibly fly by night, not in the US, or substantially out of date. If the last two aren’t true, you have a situation that is literally illegal.
- aianus 9y ago
  Surprise: regulating and legislating doesn’t actually make bad behaviour go away. I too have had the experience of interning at a medical software company where security and patient privacy were a joke.
  - sulam 9y ago
    That sucks, but you might consider next time talking to people and seeing if they are working to improve things and, if not, being a whistleblower.
    - jacquesm 9y ago
      You might as well connect that whistle to an aircompressor if my experience is anything to go by. Very few companies have their house in order, and healthcare is definitely not an exception to this.
- ubernostrum 9y ago
  I've worked in health care a couple of times now. And while the companies I've worked for have gone well beyond the minimum required for legal compliance, the scary bit really is the sorts of things you could, if you were lazy enough, do and still legally be compliant.
  - sulam 9y ago
    Yeah, HIPPA has some holes you could drive a truck through. I also hate OAuth (so much focus on access, so little focus on what gets done with that access).
evgen 9y ago
Facebook has a long history of employees doing sketchy shit like peeking at the profile/timeline of the new SO for their former SO. This has been one of the top threat scenarios internally for more than a decade and they have built significant security infrastructure to protect against this sort of problem. Yes, there is 'always a back door', but that back door has gotten smaller and much harder to find over the years. It is always a possibility, and while the system will prevent attempts to exfil large chunks of data for smaller breaches like this the audits/alarms will probably take a day or so before you are sitting in someone's office with HR present to have a discussion regarding your user data access patterns. So compromise the security infra you say? Yeah, there are other systems watching for that too... -Former custodiet of the custodes

deleted 9y ago

[deleted]

jMyles 9y ago

> so little to gain wait, what? There's quite a lot to be gained. Enough to incentivize a very powerful attacker, possibly even a nation-state level actor who can extract the mole and protect / reward them. The stakes are not low here; I can't imagine why you've said that.

JumpCrisscross 9y ago

> With so much to lose and so little to gain internal leaks of this sort are extremely rare I recently downloaded my Facebook archive [1]. If it were legal, I would certainly pay thousands if not tens of thousands of dollars for certain peoples' archives. I can think of several practical contexts in which an unethical actor would find it profitable to pay a Facebook employee a million dollars for someone's Facebook archives. [1] https://www.facebook.com/help/131112897028467/ https://www.facebook.com/help/131112897028467/

harryh 9y ago
I would certainly pay thousands if not tens of thousands of dollars for certain peoples' archives Really? For what purpose?
- JumpCrisscross 9y ago
  > For what purpose? On the upside, any case where one is engaging in high-value transactions (broadly speaking). Knowing a negotiating counterpart's likes, dislikes, communication style, et cetera can help one avoid mistakes, build a personal connection and draft (and frame) terms correctly on the first try. More seedily, such information about a political opponent (whether a politician, rival on a commercial or non-profit board, or commercial competitor) is useful. As a risk mitigation tool, such data would find a natural home in a due diligence file. Prospective executives, board members, business partners, political donation recipients, et cetera expose one to reputational risks. Catching those in advance is already worth tens of thousands of dollars of legal time. I would hate to live in a country where the above is legal. We should recognize the value of the information every single single Facebook employee has routine access to.
- pjc50 9y ago
  Re-sell to news media for hundreds of thousands of dollars?
heavenlyblue 9y ago
I could find several unethical contexts where the same actor is paid a million dollars to kill the same person and the legal framework we live in does nothing to stop this. Well, apart from post-factum incarceration.

mehrdadn 9y ago

> You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. That's not enough by any means (edit: and as [1] pointed out, I don't even think it's true). There needs to be more to security than mere deterrence. I'm pretty sure at Google, etc. it's simply impossible for a single rogue employee to mess with customer data (except for a few in very privileged positions), and my impression has been that Facebook is not like this at all (unless it has changed recently). [1] https://news.ycombinator.com/item?id=16675494 https://news.ycombinator.com/item?id=16675494

harryh 9y ago
That sort of access limitation is what I meant by "pretty strict internal controls." Having never worked there, I can't speak to how it works at FB but I would imagine that there are a lot of limitations on what rank and file employees can do. I guess I could be wrong. Perhaps someone with direct knowledge will chime in.
- mehrdadn 9y ago
  > I can't speak to how it works at FB but I would imagine that there are a lot of limitations on what rank and file employees can do. I guess I could be wrong. Cool, now read this: https://news.ycombinator.com/item?id=16675503 https://news.ycombinator.com/item?id=16675503 Any changes to your thoughts?

dannyw 9y ago

I hope so, but keep in mind Facebook has a magical password that worked for every account for almost a decade.

cornellwright 9y ago
Source?
- iamdave 9y ago
  http://theweek.com/articles/474339/facebookinsider-memoir-skeletonkey-password-4-other-revelations http://theweek.com/articles/474339/facebookinsider-memoir-sk...
  - cornellwright 9y ago
    I think the previous commenter must have meant "had" as that says as of sometime before the 2012 date on that article the master password allegedly no longer worked. Still egregious if that sort of early stage stuff hung around that long, but not the same as it being there today.
  - prostoalex 9y ago
    That password only worked from Facebook's corporate IP addresses.

tptacek 9y ago

most companies have pretty strict internal controls for this sort of thing This does not ring true to me at all.

harryh 9y ago
It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here. EDIT/NOTE: https://news.ycombinator.com/item?id=16675493 https://news.ycombinator.com/item?id=16675493
- Mc91 9y ago
  > It's certainly true at financial institutions It's certainly not true at financial institutions. By financial institutions I mean Fortune 100 financial institutions, as well as smaller financial institutions. If by "pretty strict internal controls" you mean they can, like Prince Potemkin, point to such things existing in some chimeric form, then yes, I suppose you are right. But in any real sense, no, there are no effective controls in the real world. About 25 years ago I assumed it was early days for a lot of these things and they would sooner or later be closed up, but they haven't been. Things are wide open - as the recent Facebook/Analytics things have shown. In a very small and indirect way at that. The first major book on this broad subject was Donn Parker's "Crime by Computer" published in 1976. The book opens by saying that a company's biggest enemies in terms of computer crime is its own employees. This is still true 40+ years later - the biggest enemy of the people who own companies are the people who do the work at them.
- mehrdadn 9y ago
  > It was true at Google. Yes, because Google is not your average company. It takes security extremely seriously... in fact it's about as awful of an example as you can give for a blanket statement you made about "most companies".
  - kerng 9y ago
    I'm not sure if Google even has an internal red team that performs breaches, last time I talked with someone there at a conference they didn't (that was 2016). So I am not sure Google has metrics on how easy it is to gain access by an adversary.

krasin 9y ago

Recent news ([1]): Facebook security boss says its corporate network is run "like a college campus" 1. http://www.zdnet.com/article/leaked-audio-facebook-security-boss-says-network-is-like-a-college-campus/ http://www.zdnet.com/article/leaked-audio-facebook-security-...

hinkley 9y ago

Facebook is not most companies, though.

hyperpallium 9y ago

Unfortunately the criminal charge would be theft of facebook's proprietary information.

jimjimjim 9y ago

proper companies that have been around for a while and expect to be around for a while do this. companies that move fast and break things don't give a shit. I want more companies of the first type and less of the second.

patmcc 9y ago

In any organization there is some number of people, who, if sufficiently motivated, could work together to pull off a 'data heist' and not be immediately uncovered. At a good company that number is high, at a bad company that number is 1. What do you think the number is at facebook? At google? At your bank? At your healthcare provider?