6 ms·
You are wrong. > In reality they have no incentive to police this kind of behaviour until they are called out on it. Access to personal information of users i
by Maro 8y ago
You are wrong.
> In reality they have no incentive to police this kind of behaviour until they are called out on it.
Access to personal information of users is "policed" internally, proactively, and you can get fired over it. It's one of the things they hammer into your head the first month of bootcamp after you join. The internal tooling and frameworks have all sorts of built-on heuristics to catch this [1], and there's internal teams who're continuously improving these security measures.
[1] this = accessing information not related to your job duties
- Cogito 8y agoHappy to be wrong. Are you saying this person was fired before it became public that they had misused data? Or was it reactionary?
- Maro 8y agoI don't know about this case. But I know for a fact you can get fired for this without any public/PR issue, by internal triggers/investigation only.
- Cogito 8y agoFor what it’s worth, I believe you. I sincerely believe that people would have been fired for inappropriate use/access of data. My comment is a deeper one. The incentive in general is to improve value produced, and identifying bad actors is not a short term way to increase value produced. Long term it probably is positive, but because those outcomes are somewhat removed from the immediate here and now I expect them to be disincentivised. I would love to see evidence or reason for why they aren’t, but that’s the thrust of my thinking.
- downandout 8y agoThe guy's job was apparently to check out profiles of people that may present a security threat. So if his job was to look at profile data all day, in this specific case his firing would almost have to be reactionary, because his nefarious activities would have looked like normal job activity to any auditing program. We only know his activities were nefarious because he said so. A developer or people in almost any other position for that matter would likely have been caught proactively.
- wmblaettler 8y agoThis is the very scenario that gives rise to the question "Who watches the watchers?"
- bertil 8y agoI am absolutely convinced that whatever loophole he found, it is already patched with addition controls over that team.
- gambiting 8y agoI mean, even if he never accessed any user data, bragging that he can is still problematic for the company - it looks bad on the outside.
- deleted 8y ago[deleted]