7 ms·

As an aside, if you’re using company-provided computers and phones your default behavior should be to assume they are spying on you to the degree that they are

As an aside, if you’re using company-provided computers and phones your default behavior should be to assume they are spying on you to the degree that they are recording every action you take in those devices. It’s a spectrum—many companies don’t do this at all—but you would be doing well by yourself by assuming they record and track everything. You should also assume all of your traffic while at the office (if your comapny is old school and you only have a desktop) is being recorded.

AndrewBissell 8y ago
> The tip from Sean Gouthro, the former head of Tesla's global security operations center and investigations, was filed on January 24 and corroborates a tip filed in August from Karl Hansen ... Hansen's tip claimed that Tesla did not disclose to shareholders the theft of raw materials and the unauthorized surveillance and hacking of employee cellphones and computers. This is not a tip about Tesla watching what its employees are doing on its own equipment and data networks.
- dontbenebby 8y ago
  >This is not a tip about Tesla watching what its employees are doing on its own equipment and data networks. I'm curious about details on this. Modern phones (well, iPhones at least) are pretty hard to break into. I wonder if it was something like having them install a root certificate to use the company wifi, then using that root cert to spy on other traffic traversing the network (such as leaks to reporters)
  - deleted 8y ago
    [deleted]
  - lozaning 8y ago
    Anymore these days its been my experience that cert pinning prevents this from working. Adding a new root cert does not force any of the apps to use the root cert if they've enabled pinning.
    - dontbenebby 8y ago
      Interesting tidbit, I'll stash that for the next time an SRE argues that pinning requires too much overhead (in terms of managing/paying for the certs rather than CPU) :)
  - GuB-42 8y ago
    It is very easy when the phone is left unlocked... I suspect millions of affairs have been discovered using that elaborate hacking technique. The same thing can be done at work. Looking over the shoulder is another low tech but quite effective option.
  - thinkharder 8y ago
    Most MDM's install both a cert and a profile on iOS devices that allow the MDM admin to do just about anything. Any company-owned device is going to come to the user with this pre-installed, and non-removable by the user. I'd be astounded if a company the size, and with the security stance of Tesla didn't use the most intrusive MDM available.
  - elliekelly 8y ago
    A statement from the whistleblower's attorney said Tesla had hired former members of Uber's intelligence team (that had been spying on drivers, regulators, and competitors a while back) and referenced a proposed settlement agreement for the wire tapping & corporate espionage charges that outlines the tactics (allegedly) used by Uber.[1] It also mentions Tesla installed "specialized router equipment within its Nevada Gigafactory designed to capture employee cell phone communications and/or retrieve employee cell phone data." Sounds like some sort of man in the middle attack? I didn't catch any similar references in the Uber document but its heavily redacted and the entirety of my knowledge in this area comes from Dinesh's criminal girlfriend so it's very possible I missed it. [1]https://www.scribd.com/document/367287753/Uber-Jacobs-Letter#from_embed https://www.scribd.com/document/367287753/Uber-Jacobs-Letter...
    - dontbenebby 8y ago
      >It also mentions Tesla installed "specialized router equipment within its Nevada Gigafactory designed to capture employee cell phone communications and/or retrieve employee cell phone data." I might be not using the right term but sounds like a... stingray? (Well, some sort of cell site simulator)
benj111 8y ago
You could 'hack' any spying tendency though, just set up a system to send emails early morning, late at night, at weekends. Then come annual review time, your boss can be impressed by your dedication. This is off the top of my head, and does have the obvious flaws of being obviously automated from the sending machined perspective, and emails might not be a sign of work in your particular job. It probably has unobvious flaws as well, so isn't career advice.
- bdamm 8y ago
  Right, and I would counter that if you're doing this, it's time to look for a new job. It's not good for your own personal career, it isn't good for your company, it isn't good for your relationship with your manager, and it is illegal is many locales. So, no, please don't do this.
  - aceperry 8y ago
    Just wondering what part is illegal. I'm not familiar with this sort of thing.
    - bdamm 8y ago
      Fraud is lying to get paid. The employee is lying about their work (generating fake emails to fluff up email counts) with knowledge that the information is used to gauge work done. Their employment continuance, or bonuses, are partially factored based on this metric. Thus, they are lying to get paid. That is fraud.
      - darkpuma 8y ago
        If a salaried employee lets his boss see him when he comes into the office early, then when out of sight sips coffee and relaxes until his coworkers arrive, is that also fraud? If you caught one of your employees doing that, would you call the cops and report him for fraud?
      - fbemployee1234 8y ago
throwawaynonce 8y ago
> You should also assume all of your traffic while at the office I fell out with my manager at FANG and she got back at me with the lowest rating possible for the year-end review. I chose to get my concerns across to HR about how this was unfair and challenged them to validate her critical feedback with peer engs. Didn't happen. Instead what followed was, I was investigated for violation of company rules such as putting company laptop to personal use, violating social media policy, holding on to company documents for more time than company's policy permits... among a lot of such trivial other things (I was astonished at the intelligence they had built up, I guess, by using responses to internal surveys, predicting probability to have done something via browsing patterns, keeping tabs on laptop disk usage etc). Once they had built "a case" they would go on to engage legal and terminate my employment with what I presume now qualifies as "just cause" and avoid having to pay any severance. Has worked wonders for them, this tactic. I have since heared that a few other employees have been handled in a similar manner and that I was not the only one.
- hobs 8y ago
  Pretty normal whenever HR has decided you need firing. Its similar to the police (in america anyway), make enough rules and you can fire all but the most model employee on a long enough timeline without any effort.
  - fromthestart 8y ago
    Sounds like the legal space in the Soviet Union. You can get rid of anyone if you make enough illegal. That said, I don't think it's quite so bad in the US.
    - alistairSH 8y ago
      Maybe not as bad as the USSR, but here are some examples that really shouldn't be felonies... https://mic.com/articles/86797/8-ways-we-regularly-commit-felonies-without-realizing-it#.g5jOHRhbN https://mic.com/articles/86797/8-ways-we-regularly-commit-fe... And a Twitter account that highlights mostly ridiculous laws... https://twitter.com/crimeaday?lang=en https://twitter.com/crimeaday?lang=en
deleted 8y ago
[deleted]

AndrewBissell 8y ago

> The tip from Sean Gouthro, the former head of Tesla's global security operations center and investigations, was filed on January 24 and corroborates a tip filed in August from Karl Hansen ... Hansen's tip claimed that Tesla did not disclose to shareholders the theft of raw materials and the unauthorized surveillance and hacking of employee cellphones and computers. This is not a tip about Tesla watching what its employees are doing on its own equipment and data networks.

dontbenebby 8y ago
>This is not a tip about Tesla watching what its employees are doing on its own equipment and data networks. I'm curious about details on this. Modern phones (well, iPhones at least) are pretty hard to break into. I wonder if it was something like having them install a root certificate to use the company wifi, then using that root cert to spy on other traffic traversing the network (such as leaks to reporters)
- deleted 8y ago
  [deleted]
- lozaning 8y ago
  Anymore these days its been my experience that cert pinning prevents this from working. Adding a new root cert does not force any of the apps to use the root cert if they've enabled pinning.
  - dontbenebby 8y ago
    Interesting tidbit, I'll stash that for the next time an SRE argues that pinning requires too much overhead (in terms of managing/paying for the certs rather than CPU) :)
- GuB-42 8y ago
  It is very easy when the phone is left unlocked... I suspect millions of affairs have been discovered using that elaborate hacking technique. The same thing can be done at work. Looking over the shoulder is another low tech but quite effective option.
- thinkharder 8y ago
  Most MDM's install both a cert and a profile on iOS devices that allow the MDM admin to do just about anything. Any company-owned device is going to come to the user with this pre-installed, and non-removable by the user. I'd be astounded if a company the size, and with the security stance of Tesla didn't use the most intrusive MDM available.
- elliekelly 8y ago
  A statement from the whistleblower's attorney said Tesla had hired former members of Uber's intelligence team (that had been spying on drivers, regulators, and competitors a while back) and referenced a proposed settlement agreement for the wire tapping & corporate espionage charges that outlines the tactics (allegedly) used by Uber.[1] It also mentions Tesla installed "specialized router equipment within its Nevada Gigafactory designed to capture employee cell phone communications and/or retrieve employee cell phone data." Sounds like some sort of man in the middle attack? I didn't catch any similar references in the Uber document but its heavily redacted and the entirety of my knowledge in this area comes from Dinesh's criminal girlfriend so it's very possible I missed it. [1]https://www.scribd.com/document/367287753/Uber-Jacobs-Letter#from_embed https://www.scribd.com/document/367287753/Uber-Jacobs-Letter...
  - dontbenebby 8y ago
    >It also mentions Tesla installed "specialized router equipment within its Nevada Gigafactory designed to capture employee cell phone communications and/or retrieve employee cell phone data." I might be not using the right term but sounds like a... stingray? (Well, some sort of cell site simulator)

benj111 8y ago

You could 'hack' any spying tendency though, just set up a system to send emails early morning, late at night, at weekends. Then come annual review time, your boss can be impressed by your dedication. This is off the top of my head, and does have the obvious flaws of being obviously automated from the sending machined perspective, and emails might not be a sign of work in your particular job. It probably has unobvious flaws as well, so isn't career advice.

bdamm 8y ago
Right, and I would counter that if you're doing this, it's time to look for a new job. It's not good for your own personal career, it isn't good for your company, it isn't good for your relationship with your manager, and it is illegal is many locales. So, no, please don't do this.
- aceperry 8y ago
  Just wondering what part is illegal. I'm not familiar with this sort of thing.
  - bdamm 8y ago
    Fraud is lying to get paid. The employee is lying about their work (generating fake emails to fluff up email counts) with knowledge that the information is used to gauge work done. Their employment continuance, or bonuses, are partially factored based on this metric. Thus, they are lying to get paid. That is fraud.
    - darkpuma 8y ago
      If a salaried employee lets his boss see him when he comes into the office early, then when out of sight sips coffee and relaxes until his coworkers arrive, is that also fraud? If you caught one of your employees doing that, would you call the cops and report him for fraud?
    - fbemployee1234 8y ago

throwawaynonce 8y ago

> You should also assume all of your traffic while at the office I fell out with my manager at FANG and she got back at me with the lowest rating possible for the year-end review. I chose to get my concerns across to HR about how this was unfair and challenged them to validate her critical feedback with peer engs. Didn't happen. Instead what followed was, I was investigated for violation of company rules such as putting company laptop to personal use, violating social media policy, holding on to company documents for more time than company's policy permits... among a lot of such trivial other things (I was astonished at the intelligence they had built up, I guess, by using responses to internal surveys, predicting probability to have done something via browsing patterns, keeping tabs on laptop disk usage etc). Once they had built "a case" they would go on to engage legal and terminate my employment with what I presume now qualifies as "just cause" and avoid having to pay any severance. Has worked wonders for them, this tactic. I have since heared that a few other employees have been handled in a similar manner and that I was not the only one.

hobs 8y ago
Pretty normal whenever HR has decided you need firing. Its similar to the police (in america anyway), make enough rules and you can fire all but the most model employee on a long enough timeline without any effort.
- fromthestart 8y ago
  Sounds like the legal space in the Soviet Union. You can get rid of anyone if you make enough illegal. That said, I don't think it's quite so bad in the US.
  - alistairSH 8y ago
    Maybe not as bad as the USSR, but here are some examples that really shouldn't be felonies... https://mic.com/articles/86797/8-ways-we-regularly-commit-felonies-without-realizing-it#.g5jOHRhbN https://mic.com/articles/86797/8-ways-we-regularly-commit-fe... And a Twitter account that highlights mostly ridiculous laws... https://twitter.com/crimeaday?lang=en https://twitter.com/crimeaday?lang=en

deleted 8y ago

[deleted]