5 ms·

This is all too common. I teach "Security 101" onboarding to new hires at my company and this is one of my slides: - Google Engineer Stalked Teens, Spied on Ch

This is all too common. I teach "Security 101" onboarding to new hires at my company and this is one of my slides: - Google Engineer Stalked Teens, Spied on Chats: http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats http://gawker.com/5637234/gcreep-google-engineer-stalked-tee... - Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-allegation-that-employees-abused-customer-data https://www.theinformation.com/articles/lyft-investigates-al... - Uber Employees Allegedly Use Data to Stalk Exes, Celebs: http://www.newser.com/story/235409/lawsuit-uber-employees-use-data-to-stalk-celebs-exes.html http://www.newser.com/story/235409/lawsuit-uber-employees-us... - Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employee-used-privile-1825666305 https://gizmodo.com/facebook-investigating-claim-that-employ... - Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees-abused-data-access-spy-on-users-snaplion https://www.vice.com/en_us/article/xwnva7/snapchat-employees... I suspect the vast majority of these abuse cases never make it to the public.

walshemj 7y ago
Maybe you should add the Case in the UK where some one bribed some BT call centre employee to look up address of the parents of some one in witness protection. Parents where then killed by a hitman - bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that.
- stordoff 7y ago
  > During the investigation of the Stirland murders, police found that corrupt BT workers had given out details of where the couple had moved. As a direct result, Gunn was able to track them down. Of note, not witness protection: > The couple declined to join a witness protection programme and instead decided to leave their Nottingham council estate. > The pair, originally from Nottingham, were forced into hiding when Mrs Stirland's son, Michael O'Brien, murdered a man connected to a criminal gang in 2003. [the son was in jail: https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickbarkham https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickba...] https://www.theguardian.com/uk/2008/feb/22/ukcrime1 https://www.theguardian.com/uk/2008/feb/22/ukcrime1 > bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that. At least two of the employees got a suspended sentence: > Kelly and Pickering later admitted computer misuse and were given suspended jail sentences. Both were sacked by BT. http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.stm http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.s... I can't find what happened to the first - the one who had direct contact with the gang.
  - walshemj 7y ago
    Ah it might have been the main one - the reason I think the UK has such weak is is a large number of NUJ members would be in jail
caycep 7y ago
these are all social media companies, but what about similar abuses or security holes as such for those of us who are thinking about putting our small business data online to cloud drives/storage lockers. I.e. the google suite drive, dropbox business, backblaze backups of the world?
- joshuamorton 7y ago
  https://support.google.com/a/answer/9230979?hl=en https://support.google.com/a/answer/9230979?hl=en may be relevant (I work in cloud, but am not familiar with that tooling, other than knowing of it's existence). AWS might provide something similar, but I don't know what it is.
  - worik 7y ago
    Not really. The problem is unauthorised access by users with sufficient privileges to do what ever they want. That would include turning off audit logs. Do you think that when Google serves your data up to the secret police that shows up in audit logs?
    - scarmig 7y ago
      It depends on your threat profile. Are the secret police more likely to target you than a vengeful ex who happens to work at Google? Obviously Google doesn't provide any real defense against court ordered snooping, but everyone (should) know that at this point. No sufficiently large company will provide any real defense, and going with no name companies doesn't help either.
    - dodobirdlord 7y ago
      Do you imagine that engineers at Google just wander around with unaudited ability to disable audit logs?
      - markholmes 7y ago
        Do you imagine this to be an impossibility? It would only take one.
ngokevin 7y ago
I know a student programmer at the university data center that got caught sniffing through the network logs of other students.
- mixmastamyk 7y ago
  Student: bad, corporation/government: business as usual.

walshemj 7y ago

Maybe you should add the Case in the UK where some one bribed some BT call centre employee to look up address of the parents of some one in witness protection. Parents where then killed by a hitman - bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that.

stordoff 7y ago
> During the investigation of the Stirland murders, police found that corrupt BT workers had given out details of where the couple had moved. As a direct result, Gunn was able to track them down. Of note, not witness protection: > The couple declined to join a witness protection programme and instead decided to leave their Nottingham council estate. > The pair, originally from Nottingham, were forced into hiding when Mrs Stirland's son, Michael O'Brien, murdered a man connected to a criminal gang in 2003. [the son was in jail: https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickbarkham https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickba...] https://www.theguardian.com/uk/2008/feb/22/ukcrime1 https://www.theguardian.com/uk/2008/feb/22/ukcrime1 > bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that. At least two of the employees got a suspended sentence: > Kelly and Pickering later admitted computer misuse and were given suspended jail sentences. Both were sacked by BT. http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.stm http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.s... I can't find what happened to the first - the one who had direct contact with the gang.
- walshemj 7y ago
  Ah it might have been the main one - the reason I think the UK has such weak is is a large number of NUJ members would be in jail

caycep 7y ago

these are all social media companies, but what about similar abuses or security holes as such for those of us who are thinking about putting our small business data online to cloud drives/storage lockers. I.e. the google suite drive, dropbox business, backblaze backups of the world?

joshuamorton 7y ago
https://support.google.com/a/answer/9230979?hl=en https://support.google.com/a/answer/9230979?hl=en may be relevant (I work in cloud, but am not familiar with that tooling, other than knowing of it's existence). AWS might provide something similar, but I don't know what it is.
- worik 7y ago
  Not really. The problem is unauthorised access by users with sufficient privileges to do what ever they want. That would include turning off audit logs. Do you think that when Google serves your data up to the secret police that shows up in audit logs?
  - scarmig 7y ago
    It depends on your threat profile. Are the secret police more likely to target you than a vengeful ex who happens to work at Google? Obviously Google doesn't provide any real defense against court ordered snooping, but everyone (should) know that at this point. No sufficiently large company will provide any real defense, and going with no name companies doesn't help either.
  - dodobirdlord 7y ago
    Do you imagine that engineers at Google just wander around with unaudited ability to disable audit logs?
    - markholmes 7y ago
      Do you imagine this to be an impossibility? It would only take one.

ngokevin 7y ago

I know a student programmer at the university data center that got caught sniffing through the network logs of other students.

mixmastamyk 7y ago
Student: bad, corporation/government: business as usual.