21 ms·

Former Twitter Employees Charged with Spying for Saudi Arabia

712 points by grzm 7y ago

ComodoHacker 7y ago
So that mysterious Gitlab customer's demand to protect their data was... not unreasonable.
- alpb 7y ago
  It was unreasonable. 1. You can build systems in a way that every access is strictly logged and audited. 2. Many companies like Facebook or Google employ engineers who could be possibly spying for Russia or China. But the systems and trust models are designed with this in mind. Here we see unrestricted access to user data, not even sure there’s audit logging in place.
  - ComodoHacker 7y ago
    You can but most don't, even Twitter size, that's the lesson. And audit doesn't protect from leakage. Please note, I'm not saying Gitlab response was appropriate, I totally agree with your second point. I'm saying the demand was genuine.
  - dannyw 7y ago
    Google or Facebook employees in China do not have access to overseas data. Gitlab doesn’t really serve China and has no need for support engineers with in China.
    - alpb 7y ago
      Correct, they do not have overseas data (at least in China). However, GitLab's restriction also prevented them from employees moving to China as well. Many companies employ people in Asia/Europe timezones as a night-time on-call engineers and support. Not to mention, the list (China, Russia) is a list of countries made up by GitLab, with no particular backing that's officially recognized by any particular government or organization, which makes the situation discriminatory.
drawkbox 7y ago
I wonder if this is in addition to or was part of the McKinsey scandal where they targeted Saudi dissidents on Twitter for Saudi Arabia [1]. I wouldn't be surprised if getting people on the inside like this was part of it though just conjecture. > Role in Saudi clampdown on dissidents > In October 2018, in the wake of the assassination of Jamal Khashoggi, a Saudi dissident and journalist, The New York Times reported that McKinsey had identified the most prominent Saudi dissidents on Twitter and that the Saudi government subsequently repressed the dissidents and their families. One of the dissidents was arrested. Another dissident's family members were arrested, and the cell phone of the dissident was hacked. McKinsey issued a statement, saying "We are horrified by the possibility, however remote, that [the report] could have been misused. We have seen no evidence to suggest that it was misused, but we are urgently investigating how and with whom the document was shared." In December 2018, The New York Times reported that "the kingdom is a such a vital client for the firm — the source of nearly 600 projects from 2011 to 2016 alone — that McKinsey chose to participate in a major Saudi investment conference in October 2018 even after the killing and dismemberment of a Washington Post columnist by Saudi agents." [1] > On the 12th of February 2019, the European Parliament Greens/EFA group presented a motion for a resolution on the situation on women’s rights defenders in Saudi Arabia denouncing the involvement of foreign public relations companies in representing Saudi Arabia and handling its public image namely McKinsey & Company. [1] McKinsey also supports authoritarian regimes if they ask for reports and have the money. > Support of authoritarian regimes [1] > McKinsey's business and policy support for authoritarian regimes came under scrutiny in December 2018, in the wake of a lavish company retreat in China held adjacent to Chinese government internment camps where thousands of Uyghurs were being detained without cause. In the preceding few years, McKinsey's clients included Saudi Arabia's absolute monarchy, Turkey's autocratic leader Recep Tayyip Erdogan, ousted former President of Ukraine Viktor Yanukovych, and several Chinese and Russian companies under sanctions. [1] McKinsey one of the Big Three management consulting firms [4] is widely used to use plausible deniability for private equity leveraged buyouts and corruption like the Enron scandals. [2] > Enron was the creation of Jeff Skilling, a McKinsey consultant of 21 years, who was jailed after the company collapsed. McKinsey reportedly "fully endorsed the dubious accounting methods that caused the company to implode in 2001." Enron reportedly used McKinsey on 20 different projects, and McKinsey consultants had "used Enron as their sandbox." McKinsey was also a big part of the plausible deniability for big banks and funds during the Great Recession. [3]. Very questionable ethics at McKinsey, hard to trust anyone from there. > McKinsey is said to have played a significant role in the 2008 financial crisis by promoting the securitization of mortgage assets and encouraged the banks to fund their balance sheets with debt, driving up risk, which 'poisoned the global financial system and precipitated the 2008 credit meltdown'. Furthermore, McKinsey advised Allstate Insurance to purposefully give low offers to claimants. The Huffington Post revealed that the strategy was to make claims "so expensive and so time-consuming that lawyers would start refusing to help clients." Next to this, 2016 McKinsey partner Navdeep Arora was convicted for illegally depleting State Farm of over $500,000 over a period of 8 years, in collaboration with a State Farm employee. [1] https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_Saudi_clampdown_on_dissidents https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_S... [2] https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_corporate_accounting_scandals https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_c... [3] https://en.wikipedia.org/wiki/McKinsey_%26_Company#2008_financial_crisis https://en.wikipedia.org/wiki/McKinsey_%26_Company#2008_fina... [4] https://en.wikipedia.org/wiki/Big_Three_(management_consultancies) https://en.wikipedia.org/wiki/Big_Three_(management_consulta...
tempsy 7y ago
I would be shocked if there weren't a handful of spies working for various countries at every large tech company at this very moment. I have no idea how a company would screen for that but it would make little sense to not embed insiders into each of these companies.
- dannyw 7y ago
  Don’t screen; how can you? Principle of least access.
sarcasmatwork 7y ago
Not pay walled: (Please stop posting paywall sites) https://abcnews.go.com/Technology/wireStory/us-saudis-recruited-twitter-workers-spy-users-66803199 https://abcnews.go.com/Technology/wireStory/us-saudis-recrui...
- thenewnewguy 7y ago
  It might be because of my blocker addon but the article linked isn't paywalled for me.
rksgs 7y ago
Ahmad Abouammo and Ali Alzabarah you say? Not even the simplest employee vetting: names??
- tempsy 7y ago
  I can’t tell if you’re being serious or not but what you just said is incredibly racist.
celticninja 7y ago
I wonder if GitLab will add Saudi Arabia to their employee region block?
- madisfun 7y ago
  Saudi Arabia is a US ally, so family region block against them is unlikely. Even if it is a country that tolerates and promotes open slave trade (look up #maidsfortransfer on BBC).
Mizza 7y ago
This was talked about in the great PBS Frontline documentary about MBS: https://www.pbs.org/video/crown-prince-saudi-arabia-1jt2ey/ https://www.pbs.org/video/crown-prince-saudi-arabia-1jt2ey/
- AndrewBissell 7y ago
  Interesting that MBS has ties to both Jack Dorsey and Jeff Bezos, CEOs of the companies where these spies were placed.
FillardMillmore 7y ago
It's probably more difficult for social media companies like Twitter to prevent something like this than it is to actually properly secure and protect user data.
- thrower123 7y ago
  Even Twitter money pales in comparison to sheik money. I'm not sure you can defend against somebody giving an engineer with admin access a suitcase with $300k in it. Not to mention any other pressures that MBS could potentially have brought to bear in these cases.
  - chii 7y ago
    How do banks defend against insider trying to rob it? I'm sure twitter can do it - it's a matter of cost vs benefits. They don't want to spend the money required to secure access and audit.
    - toomuchtodo 7y ago
      Insider risk controls and oversight, two person systems, data loss prevention, etc.
      - smcl 7y ago
        Think that was a rhetorical question
  - henryfjordan 7y ago
    That is GP's point, that no engineer should have admin access to PII when you are operating at Twitter scale. Or at least not without a lot of red tape to make it very easy to catch rule breakers.
    - thrower123 7y ago
      Part of it is, Twitter doesn't fully think of itself as Twitter-scale. It's not that long ago that Twitter was fail-whaling around, a non-serious place for stream-of-consciousness shitposting by anonymous egg accounts. It's still move-fast-and-break-things. Someone else made the comparison to banks, and well, banks deal with real money and have always been dead serious, and they've got decades of head start on handling this stuff properly.
abbracadabbra 7y ago
It would be interesting to know what Saudi Arabia asked Abouammo to do at Amazon as well.
nautilus12 7y ago
Ive always wondered if social media companies had any nefarious parts to play in the arab spring, since it all started on social media and this was before the accute awareness of bots to cause crazes on social media. Things like this make me wonder more.
- buboard 7y ago
  makes you wonder how it all stopped rather
- Mizza 7y ago
  They absolutely did - at the behest of the US State Department. Twitter was scheduled to have some planned downtime during the Egyptian Arab Spring, but they postponed it at the request of State. Evgeny talks about this.
  - rrdharan 7y ago
    Since I wasn't sure who this was referring to: https://en.wikipedia.org/wiki/Evgeny_Morozov https://en.wikipedia.org/wiki/Evgeny_Morozov
  - im3w1l 7y ago
    I wouldn't call that nefarious.
    - Mizza 7y ago
      That depends on your perspective. I support the intentions of the Arab Spring, but I still think it's inherently nefarious for a private technology company to partner with the US government in order to overthrow governments. I also seriously doubt that they were simply sitting idly by and hoping that the revolution went their way, as we now see that most all world governments have their own online propaganda divisions.
      - lonelappde 7y ago
        Would it be nefarious if the State Department asked Twitter to stay open during a hurricane? Or on Election Day?
bhouston 7y ago
What other tech companies have in house spies. NordVPN? Wikipedia? Facebook? Gmail?
- x220 7y ago
  Every company that collaborates with the NSA (including Microsoft, Google, Facebook, Apple, and Dropbox) has in house spies. We don't like to think about it this way because the spies are on "our side".
- retrovm 7y ago
  It seems like there is an inverse relationship between sophistication and risk. If everything is full-custom then it may be quite easy to integrate auditing tools for who accessed user data. If an org uses mostly off-the-shelf software then it's pretty much impossible to audit e.g. who connected to what mysql server and ran which queries. So I'd be a lot more worried about a Twitter (fairly unsophisticated deployments of standard software stacks), moderately worried about Facebook (hacks upon the usual stack) and not very worried about Google (literally everything written in-house).
  - NullPrefix 7y ago
    >who connected to what mysql server and ran which queries I'm pretty sure that is not really a hard task
    - vast 7y ago
      It is quite common that sql servers run just with a few accounts. Helpful audit logs on critical systems have a high cost. So technically it is not hard but practically it is.
      - mc32 7y ago
        True but they can have systems which execute on the behalf of an authenticated user and pass that to the SQL server but the system in the middle would have logs of that query and by whom. Now, to be fair, there are usually holes that allow direct access as well.
daseiner1 7y ago
not a good time to be a foreign tech worker in the US
- gtoprak 7y ago
  I don't think it's fair to generalize on a sensitive topic like this. People are already scrutinized enough when it comes to getting a working visa.
  - jolmg 7y ago
    Rather they might be sympathizing because it might be inevitable for others to generalize like that.
  - daseiner1 7y ago
    my point is innocent people are going to be unduly scrutinized further. plus our current admin as-is doesn’t exactly love foreign workers (a massive understatement)
    - remarkEon 7y ago
      I don’t doubt that this will happen, but it’s perfectly within the rights of the United States to apply more scrutiny to e.g. Chinese nationals seeking employment at tech companies. We’re in a trade war with them and a de facto state of cyberwar. It’s not at all unreasonable to expect the US Government to look a little more closely at people coming here to work in tech, especially for roles in sensitive positions.
      - longerthoughts 7y ago
        Nobody said it wasn't reasonable. They're saying this will make your life suck more if you're a foreign worker regardless of whether or not you're a spy. Even if you view it as a necessary evil, it can still suck for people doing nothing wrong.
- xienze 7y ago
deleted 7y ago
[deleted]
gtoprak 7y ago
Should anyone have access to the actual data at their company? I feel like this is an indication of maybe scrubbing the said data is a "must" before it goes into the hands of employees. Then again, what type of side-affects would that have on the quality of the products moving forward.
- fastball 7y ago
  Someone needs to have access to the data...
  - pfooti 7y ago
    that's not entirely true - it's possible for all the data of that nature to be in an audit-logged data store, and to require specific business cases for access to the data. So you can only see a user's private information if there's a specific bug you're working on, and even then the access is audited. I mean, the data is still accessible, it's just not easy to get it willy-nilly without setting off alarms.
    - throwawaybbb 7y ago
      Someone needs to build and maintain the audit log software.
      - JoshTriplett 7y ago
        True, but you don't need access to production data to build an audit logger. And any commits to it should involve code review.
    - justinclift 7y ago
      Backup/restore of audit data can make things complicated. eg the ability to overwrite incorrect/damaged audit data (etc) So far, I've not yet come across a system where some level of direct admin access isn't needed for at least "last resort" situations. (obviously, only available to a very specific set of trusted people)
yowlingcat 7y ago
I smell a fall guy or two. What do you think the odds are that the token optics of this can be replayed as "standing up" for free speech? Not that what actually happened wasn't sketchy (it was) -- just that I have a sense this slap on the wrist will be enough for some to say "At least we can say we tried"
- Railsify 7y ago
  Slim to none, the article claims they accessed info of people close to the murdered journalist.
sneak 7y ago
It's interesting to see how the phrasing of the headline makes this seem totally different. "Saudi Spies Managed To Infiltrate Twitter as Employees" reads very differently than "Former Twitter Employees Charged with Spying for Saudi Arabia". It again raises my periodic wonder: how many spies, both for the USA, as well as the intel agencies of others, are employed in sensitive roles at Apple, Amazon, Microsoft, Google, and others? How many of them work on the cloud platforms? How many of them have access to HSMs and other internal systems that are used as trust roots? Can we assume that any major platform provider's highest level keys haven't been stolen, perhaps without their own knowledge? It's safe to assume that if they were stolen by their own government's agents, they probably wouldn't tell anyone even if they found out (even if they weren't gag ordered, which they probably would be). You can trust a company down to the ground but still necessarily realize that everyone who hires engineers is going to be vulnerable to this. AWS' GovCloud that only permits US citizens physical access to the facilities doesn't even totally solve the problem, it just (somewhat) reduces the risk, because even US citizens like bribes.
- rozab 7y ago
  How do those titles sound different to you? Seems pretty similar to me. Anyway, from the article it seems at least some of them were groomed after becoming Twitter employees, so it wouldn't be quite accurate.
  - cwkoss 7y ago
    Are they: employees who happened to become spies or spies which happened to become employees
Romanulus 7y ago
Isn't a large part of Twitter owned by Saudi interests?
- freddie_mercury 7y ago
  Nope. You could have just Googled "twitters largest stockholders" but the answer is: The largest stockholders of Twitter are all US mutual funds. Vanguard owns 10%, Morgan Stanley owns 5%, BlackRock owns 5%, StateStreet owns 4%, Fidelity owns 2%, etc. Really nothing comes to close to the index funds. Vanguard, BlackRock, State Street own 20% of pretty much every company.
  - drak0n1c 7y ago
    That's not a complete picture, Prince Alwaleed owned 4.9% of Twitter as recently as the end of 2016 (the alleged espionage happened before this). It is unknown how much he owns now after his late 2017 detainment, presumably shares were either sold off, seized by Saudi authorities, or both. It's not unusual for ownership to be split among smaller entities, and there is no requirement for US companies to consolidate myriad unknown foreign stock holders into specific entities in their reports. https://www.cnbc.com/2017/11/05/citigroup-twitter-held-by-detained-billionaire-alwaleed-bin-talal.html https://www.cnbc.com/2017/11/05/citigroup-twitter-held-by-de...
buboard 7y ago
end to end encrypted everything.
neonate 7y ago
http://archive.is/byhRv http://archive.is/byhRv
deleted 7y ago
[deleted]
x0948fklmen 7y ago
Seemed rather a weird coincidence that after leaving(or being fired from) Twitter, Ali was appointed the CEO of MBS's MiSK Foundation – which is essentially a mafia organization for his loyalists.
danso 7y ago
The complaint [0] is both very interesting – particularly the details on how sloppy/non-existent Twitter's user-access-control was back in 2015 – and pretty funny, such as how one of the suspects tried to fake a digital document but didn't fake the timestamp, and the FBI noticed the receipt having a creation date the same day of their interview with him (pg 13). According to one of the suspects' LinkedIn, he left Twitter in 2015, and then worked at Amazon for 3 years in marketing and social media. While I have little doubt Amazon's internal auditing and access control are better than Twitter's, it'd be nice to hear confirmation from Amazon that he didn't access any private user data. [0] https://context-cdn.washingtonpost.com/notes/prod/default/documents/ab8276a2-2185-4345-956b-26cd1e52b228/note/e5624393-c7e9-4c7e-93e4-30d8fff6c28a.pdf#page=1 https://context-cdn.washingtonpost.com/notes/prod/default/do...
- tjungblut 7y ago
  Also interesting is on pg 17 where they search through his Apple ID account (notes specifically).
- thaumasiotes 7y ago
  Tangent, but one of the most interesting things in the complaint -- to me -- was this language: > Many Twitter users live in Saudi Arabia and some users of Saudi nationality or descent live outside of Saudi Arabia, including in the United States. It's kind of surreal to use "Saudi" as the demonym for the people of Arabia. "Arab" would be normal. The language is Arabic, the country is Arabia, and those are both named after the people, the Arabs. The "Saudi" in the name of the country refers to the royal house, the House of Saud, and I would expect a "person of Saudi descent" to be Arabic royalty, not just any old Arab.
  - barry-cotter 7y ago
    Arabia is a peninsula. Qataris, Yemenis and Emiratis among others would not appreciate Saudis attempting to appropriate Arabian to refer to those from Saudi Arabia. And Arab refers to people from Morocco to Iraq so it’s equally unsuitable.
AndrewBissell 7y ago
Interesting story here from someone who may have been targeted for an in-person "warning" from Saudi security forces in New Delhi after posting critical remarks from an anonymous Twitter account: https://mobile.twitter.com/marxatfarpoint/status/1192198749331824645 https://mobile.twitter.com/marxatfarpoint/status/11921987493...
TwoBit 7y ago
There needs to be multi-person authorization required for account spelunking. Engineer files a DB lookup request, and it must be signed by other personnel.
- swalsh 7y ago
  Won't work, people probably need to query details of accounts hundreds of times a day just in the course of daily business. Bad actors would just make the request look like another standard query. People would likely become numb to it after having to approve so many requests. I know at a previous company, we needed a business signoff, and a technical sign off on every deploy. While the technical sign off was usually painstaking, the business sign off was rubber stamped. The guy who signed off on my tickets was so overloaded, he barely even read the titles of the tickets.
  - dannyw 7y ago
    Your processes are broken if an individual needs to query hundreds of accounts for private information a day. That is a gigantic problem in itself. Support tickets can be exempt because they’re initiated by user interaction.
linusnext 7y ago
Could Jamal Khashoggi might have been a victim of this?
- boomboomsubban 7y ago
  There's really no part of his assassination that needs a connection to Twitter to explain.
codedokode 7y ago
The best way to protect dissidents would be not to ask unnecessary personal information like phone numbers. Sadly, it is difficult to find a messenger or web email service that doesn't require it.
- sneak 7y ago
  It's hard to deduplicate spam users without an identifier that is at least slightly costly to get. There's no easy/practical way to do "charge $0.02 per signup". If you get 10k new accounts in 5 minutes and they're all from some VoIP provider in a tiny corner of the second or third world, you have some data to work with there.
  - brongondwana 7y ago
    That and, everyone doesn't want you to have any way to uniquely identify them and contact them right up until the moment they forget their password.
  - devin 7y ago
    Could someone who downvoted explain their disagreement? There seems a kernel of truth here that more than a few of us could agree on.
    - sneak 7y ago
      I think I have attracted someone’s ire, that seems to happen to all or most of my comments within a short window after posting.
      - remotecool 7y ago
        This happened to me for awhile too. I think people that disagreed with you on a previous post are using bots to downvote you.
        mandelbrotwurst 7y ago
hnuser77 7y ago
A few comments about how a non-negligent company handles user data: * They wouldn't respond to "emergency disclosure" requests from the Kingdom of Saudi Arabia about random users * The average developer has zero access to user data besides names in crash logs and things that the developer has been explicitly copied on in the support system. * Every command run on production servers by developers requires approval by someone above your org chart level (up to the executive level, when you just need someone at your level) and is logged forever. * SREs who have to shell in to servers use Unix accounts that have no access to user data. Root access, which should hardly ever happen, requires org chart approval. * Test environments use synthetic or anonymized data * There is a separate team of dozens of highly paid people whose only job is it to identify, classify, and monitor access to user data. This is not even the same as the infosec team, who also would be looking for insider breaches.
arch1717 7y ago
I had to command-f for "isp" and "comcast" because that's the stuff that should scare you. The kind of data someone can get and the ease of which they can get it while not even going through so much as a background check should scare you. We had internal tools, such as the aptly named Xray, which would give you a pretty detailed profile on someone, everything from the names of the devices attached to their wifi network, places that they used Xfinity Wifi, and even what they ordered on Pay-per-view. Going further down the rabbit hole, we had access to logging that could tell you what you passed into your voice remote, what channels you watched and for how long, and what you were downloading. To me, it is a matter of time until a tool like this is abused and you find out that some NFL star was watching scandalous pornography, or even worse, using the Xfinity wifi hotspots to get an idea on where someone was in the US.
ENOTTY 7y ago
This is a very interesting article and complaint. Worth reading to get insights into Twitter's insider threat countermeasures and their compliance regime, at least as of 2014-2015.
woander 7y ago
Is anyone surprised considering the amount of saudi money flooding around traditional and social media? Now lets look into israel and their spying/influence in traditional and social media. It was amazing the amount of "news" and social media spam we got about russia ( We were always at war with eurasia ). It's amazing the amount of "news" and social media spam we are getting about china ( We were always at war with eastasia ). But one hardly ever hears a peep about israel or saudi arabia. Considering what is happening to the palestinians, yemenis, etc, you would think you'd hear a lot more "news" about them. Especially about saudi arabia from the feminist/lgbt traditional media considering the saudis probably treat women and the lgbt as badly as any nation on earth. How come the "news" industry isn't going apeshit over more than half of the state and the US house of senate pushing unconstitutional anti-BDS laws? https://www.aclu.org/blog/free-speech/rights-protesters/new-israel-anti-boycott-act-still-unconstitutional https://www.aclu.org/blog/free-speech/rights-protesters/new-... https://www.timesofisrael.com/us-house-overwhelmingly-passes-anti-bds-resolution/ https://www.timesofisrael.com/us-house-overwhelmingly-passes... A country founded on boycotts banning its corporations from boycotting a foreign country?
- rumanator 7y ago
  > Now lets look into israel and their spying/influence in traditional and social media. https://en.wikipedia.org/wiki/Tu_quoque https://en.wikipedia.org/wiki/Tu_quoque
  - raxxorrax 7y ago
    If it isn't used to defend the action (spying), establish it as justified and therefore clear the offender from guilt, the fallacy doesn't really apply. The statement is bullshit on its own though.
    - rumanator 7y ago
      > If it isn't used to defend the action No, it's still a fallacy. Just because you feel the need to deflect attention towards your personal targets it doesn't mean your argument is sound.
cryptozeus 7y ago
This sounds like a great script for movie.
midnitewarrior 7y ago
If I were spying at Twitter for Saudi Arabia, I'd stream Trump's real-time location back to my handlers, as the Twitter app gathers location data and Trump's online habits are lax.
samirillian 7y ago
> who the CIA has concluded likely ordered the assassination of journalist Jamal Khashoggi in Istanbul last year. More crack work from the cia.
throwAwayNotPC 7y ago
Throw away account since this is not a PC question that is seen as acceptable to ask in the Bay Area even though it relates to national security: We hand out H1B visas by the thousands almost indiscriminately to citizens from communist countries who then become engineers here in the USA at top tech companies - citizens from countries that are the geopolitical adversary of the USA. If a citizen from a foreign communist country (or otherwise) is told to exploit their access into their US tech employer, nothing is really stopping them. There is a treasure trove of IP and PII that can easily be sent back home. (Example - whereabouts of the President, app-based taxi ride of almost anybody etc) The fact of the matter is that most of the Bay Area tech companies I have seen are staffed by a majority foreign nationals. Despite what you would hope to be the case, most engineers at companies where sensitive data is being managed know how to access it even if they aren't supposed to use that access under normal circumstances. I once brought this up and the reaction I got from someone was that I was being racist so I never mentioned it again.
formertwitter 7y ago
I worked directly with Ahmad at Twitter on the international media team. All I can say is I now understand how the next door neighbor to a serial killer can say "but he always seemed like the nicest guy." He really was very nice to everybody, worked hard, and seemed genuine. They were definitely tools available to all of us that allowed this type of access to personal data and more. Specifically a lot of the lists that were generated about who to follow suggestions were manually curated at the time and we could put whoever we wanted on the list. We were expected to put people that were relevant in our industry on those lists, but I think Ahmed actually got in trouble for putting himself on that list to build up his Twitter following. At the time it was certainly a major initiative to rebuild the legacy systems to fix exactly this type of problem. There were strong mandates from the top of the company that were made abundantly clear to us that while they were fixing these things we were all under agreement and NDA to keep all of this data private. The systems were broken no question, but the message was clear. That just makes it even more disappointing to see what he did. He has a very young family at home that is now going to be totally broken.
- wheelerwj 7y ago
  > All I can say is I now understand how the next door neighbor to a serial killer Hey, i get it, its a little surprising and scary. But this is just a quick reminder that we do the whole innocent until proven guilty thing here in the US. He hasn't been convicted yet, just keep that in mind when thinking about your colleague.
  - threatofrain 7y ago
    Innocent until proven guilty is for the US courts though. Real life operates by a different principle -- use your eyes and don't f* up. There are accusations that a teacher sexually molested somebody, but the investigations never went anywhere; do you hire that teacher? I don't think parents are about to blame you for not hiring that teacher.
    - chmod775 7y ago
      So you think it's fine to not hire someone and possibly ruin their career and life based on unsubstantiated allegationts? What if you got falsely acussed of sexual assault? Will you go "well that sucks" and start collecting food stamps for the rest of your life?
appleflaxen 7y ago
This is why people who work in IT must be very careful with their loyalties. If the charges are true for these two individuals, Kashoggi's blood is on their hands. We all need to be circumspect about the effects of our own actions, especially as it relates to climate change, mass extinction, and the military industrial complex.

712 points by grzm 7y ago

ComodoHacker 7y ago

So that mysterious Gitlab customer's demand to protect their data was... not unreasonable.

alpb 7y ago
It was unreasonable. 1. You can build systems in a way that every access is strictly logged and audited. 2. Many companies like Facebook or Google employ engineers who could be possibly spying for Russia or China. But the systems and trust models are designed with this in mind. Here we see unrestricted access to user data, not even sure there’s audit logging in place.
- ComodoHacker 7y ago
  You can but most don't, even Twitter size, that's the lesson. And audit doesn't protect from leakage. Please note, I'm not saying Gitlab response was appropriate, I totally agree with your second point. I'm saying the demand was genuine.
- dannyw 7y ago
  Google or Facebook employees in China do not have access to overseas data. Gitlab doesn’t really serve China and has no need for support engineers with in China.
  - alpb 7y ago
    Correct, they do not have overseas data (at least in China). However, GitLab's restriction also prevented them from employees moving to China as well. Many companies employ people in Asia/Europe timezones as a night-time on-call engineers and support. Not to mention, the list (China, Russia) is a list of countries made up by GitLab, with no particular backing that's officially recognized by any particular government or organization, which makes the situation discriminatory.

drawkbox 7y ago

I wonder if this is in addition to or was part of the McKinsey scandal where they targeted Saudi dissidents on Twitter for Saudi Arabia [1]. I wouldn't be surprised if getting people on the inside like this was part of it though just conjecture. > Role in Saudi clampdown on dissidents > In October 2018, in the wake of the assassination of Jamal Khashoggi, a Saudi dissident and journalist, The New York Times reported that McKinsey had identified the most prominent Saudi dissidents on Twitter and that the Saudi government subsequently repressed the dissidents and their families. One of the dissidents was arrested. Another dissident's family members were arrested, and the cell phone of the dissident was hacked. McKinsey issued a statement, saying "We are horrified by the possibility, however remote, that [the report] could have been misused. We have seen no evidence to suggest that it was misused, but we are urgently investigating how and with whom the document was shared." In December 2018, The New York Times reported that "the kingdom is a such a vital client for the firm — the source of nearly 600 projects from 2011 to 2016 alone — that McKinsey chose to participate in a major Saudi investment conference in October 2018 even after the killing and dismemberment of a Washington Post columnist by Saudi agents." [1] > On the 12th of February 2019, the European Parliament Greens/EFA group presented a motion for a resolution on the situation on women’s rights defenders in Saudi Arabia denouncing the involvement of foreign public relations companies in representing Saudi Arabia and handling its public image namely McKinsey & Company. [1] McKinsey also supports authoritarian regimes if they ask for reports and have the money. > Support of authoritarian regimes [1] > McKinsey's business and policy support for authoritarian regimes came under scrutiny in December 2018, in the wake of a lavish company retreat in China held adjacent to Chinese government internment camps where thousands of Uyghurs were being detained without cause. In the preceding few years, McKinsey's clients included Saudi Arabia's absolute monarchy, Turkey's autocratic leader Recep Tayyip Erdogan, ousted former President of Ukraine Viktor Yanukovych, and several Chinese and Russian companies under sanctions. [1] McKinsey one of the Big Three management consulting firms [4] is widely used to use plausible deniability for private equity leveraged buyouts and corruption like the Enron scandals. [2] > Enron was the creation of Jeff Skilling, a McKinsey consultant of 21 years, who was jailed after the company collapsed. McKinsey reportedly "fully endorsed the dubious accounting methods that caused the company to implode in 2001." Enron reportedly used McKinsey on 20 different projects, and McKinsey consultants had "used Enron as their sandbox." McKinsey was also a big part of the plausible deniability for big banks and funds during the Great Recession. [3]. Very questionable ethics at McKinsey, hard to trust anyone from there. > McKinsey is said to have played a significant role in the 2008 financial crisis by promoting the securitization of mortgage assets and encouraged the banks to fund their balance sheets with debt, driving up risk, which 'poisoned the global financial system and precipitated the 2008 credit meltdown'. Furthermore, McKinsey advised Allstate Insurance to purposefully give low offers to claimants. The Huffington Post revealed that the strategy was to make claims "so expensive and so time-consuming that lawyers would start refusing to help clients." Next to this, 2016 McKinsey partner Navdeep Arora was convicted for illegally depleting State Farm of over $500,000 over a period of 8 years, in collaboration with a State Farm employee. [1] https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_Saudi_clampdown_on_dissidents https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_S... [2] https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_corporate_accounting_scandals https://en.wikipedia.org/wiki/McKinsey_%26_Company#Role_in_c... [3] https://en.wikipedia.org/wiki/McKinsey_%26_Company#2008_financial_crisis https://en.wikipedia.org/wiki/McKinsey_%26_Company#2008_fina... [4] https://en.wikipedia.org/wiki/Big_Three_(management_consultancies) https://en.wikipedia.org/wiki/Big_Three_(management_consulta...

tempsy 7y ago

I would be shocked if there weren't a handful of spies working for various countries at every large tech company at this very moment. I have no idea how a company would screen for that but it would make little sense to not embed insiders into each of these companies.

dannyw 7y ago
Don’t screen; how can you? Principle of least access.

sarcasmatwork 7y ago

Not pay walled: (Please stop posting paywall sites) https://abcnews.go.com/Technology/wireStory/us-saudis-recruited-twitter-workers-spy-users-66803199 https://abcnews.go.com/Technology/wireStory/us-saudis-recrui...

thenewnewguy 7y ago
It might be because of my blocker addon but the article linked isn't paywalled for me.

rksgs 7y ago

Ahmad Abouammo and Ali Alzabarah you say? Not even the simplest employee vetting: names??

tempsy 7y ago
I can’t tell if you’re being serious or not but what you just said is incredibly racist.

celticninja 7y ago

I wonder if GitLab will add Saudi Arabia to their employee region block?

madisfun 7y ago
Saudi Arabia is a US ally, so family region block against them is unlikely. Even if it is a country that tolerates and promotes open slave trade (look up #maidsfortransfer on BBC).

Mizza 7y ago

This was talked about in the great PBS Frontline documentary about MBS: https://www.pbs.org/video/crown-prince-saudi-arabia-1jt2ey/ https://www.pbs.org/video/crown-prince-saudi-arabia-1jt2ey/

AndrewBissell 7y ago
Interesting that MBS has ties to both Jack Dorsey and Jeff Bezos, CEOs of the companies where these spies were placed.

FillardMillmore 7y ago

It's probably more difficult for social media companies like Twitter to prevent something like this than it is to actually properly secure and protect user data.

thrower123 7y ago
Even Twitter money pales in comparison to sheik money. I'm not sure you can defend against somebody giving an engineer with admin access a suitcase with $300k in it. Not to mention any other pressures that MBS could potentially have brought to bear in these cases.
- chii 7y ago
  How do banks defend against insider trying to rob it? I'm sure twitter can do it - it's a matter of cost vs benefits. They don't want to spend the money required to secure access and audit.
  - toomuchtodo 7y ago
    Insider risk controls and oversight, two person systems, data loss prevention, etc.
    - smcl 7y ago
      Think that was a rhetorical question
- henryfjordan 7y ago
  That is GP's point, that no engineer should have admin access to PII when you are operating at Twitter scale. Or at least not without a lot of red tape to make it very easy to catch rule breakers.
  - thrower123 7y ago
    Part of it is, Twitter doesn't fully think of itself as Twitter-scale. It's not that long ago that Twitter was fail-whaling around, a non-serious place for stream-of-consciousness shitposting by anonymous egg accounts. It's still move-fast-and-break-things. Someone else made the comparison to banks, and well, banks deal with real money and have always been dead serious, and they've got decades of head start on handling this stuff properly.

abbracadabbra 7y ago

It would be interesting to know what Saudi Arabia asked Abouammo to do at Amazon as well.

nautilus12 7y ago

Ive always wondered if social media companies had any nefarious parts to play in the arab spring, since it all started on social media and this was before the accute awareness of bots to cause crazes on social media. Things like this make me wonder more.

buboard 7y ago
makes you wonder how it all stopped rather
Mizza 7y ago
They absolutely did - at the behest of the US State Department. Twitter was scheduled to have some planned downtime during the Egyptian Arab Spring, but they postponed it at the request of State. Evgeny talks about this.
- rrdharan 7y ago
  Since I wasn't sure who this was referring to: https://en.wikipedia.org/wiki/Evgeny_Morozov https://en.wikipedia.org/wiki/Evgeny_Morozov
- im3w1l 7y ago
  I wouldn't call that nefarious.
  - Mizza 7y ago
    That depends on your perspective. I support the intentions of the Arab Spring, but I still think it's inherently nefarious for a private technology company to partner with the US government in order to overthrow governments. I also seriously doubt that they were simply sitting idly by and hoping that the revolution went their way, as we now see that most all world governments have their own online propaganda divisions.
    - lonelappde 7y ago
      Would it be nefarious if the State Department asked Twitter to stay open during a hurricane? Or on Election Day?

bhouston 7y ago

What other tech companies have in house spies. NordVPN? Wikipedia? Facebook? Gmail?

x220 7y ago
Every company that collaborates with the NSA (including Microsoft, Google, Facebook, Apple, and Dropbox) has in house spies. We don't like to think about it this way because the spies are on "our side".
retrovm 7y ago
It seems like there is an inverse relationship between sophistication and risk. If everything is full-custom then it may be quite easy to integrate auditing tools for who accessed user data. If an org uses mostly off-the-shelf software then it's pretty much impossible to audit e.g. who connected to what mysql server and ran which queries. So I'd be a lot more worried about a Twitter (fairly unsophisticated deployments of standard software stacks), moderately worried about Facebook (hacks upon the usual stack) and not very worried about Google (literally everything written in-house).
- NullPrefix 7y ago
  >who connected to what mysql server and ran which queries I'm pretty sure that is not really a hard task
  - vast 7y ago
    It is quite common that sql servers run just with a few accounts. Helpful audit logs on critical systems have a high cost. So technically it is not hard but practically it is.
    - mc32 7y ago
      True but they can have systems which execute on the behalf of an authenticated user and pass that to the SQL server but the system in the middle would have logs of that query and by whom. Now, to be fair, there are usually holes that allow direct access as well.

daseiner1 7y ago

not a good time to be a foreign tech worker in the US

gtoprak 7y ago
I don't think it's fair to generalize on a sensitive topic like this. People are already scrutinized enough when it comes to getting a working visa.
- jolmg 7y ago
  Rather they might be sympathizing because it might be inevitable for others to generalize like that.
- daseiner1 7y ago
  my point is innocent people are going to be unduly scrutinized further. plus our current admin as-is doesn’t exactly love foreign workers (a massive understatement)
  - remarkEon 7y ago
    I don’t doubt that this will happen, but it’s perfectly within the rights of the United States to apply more scrutiny to e.g. Chinese nationals seeking employment at tech companies. We’re in a trade war with them and a de facto state of cyberwar. It’s not at all unreasonable to expect the US Government to look a little more closely at people coming here to work in tech, especially for roles in sensitive positions.
    - longerthoughts 7y ago
      Nobody said it wasn't reasonable. They're saying this will make your life suck more if you're a foreign worker regardless of whether or not you're a spy. Even if you view it as a necessary evil, it can still suck for people doing nothing wrong.
xienze 7y ago

deleted 7y ago

[deleted]

gtoprak 7y ago

Should anyone have access to the actual data at their company? I feel like this is an indication of maybe scrubbing the said data is a "must" before it goes into the hands of employees. Then again, what type of side-affects would that have on the quality of the products moving forward.

fastball 7y ago
Someone needs to have access to the data...
- pfooti 7y ago
  that's not entirely true - it's possible for all the data of that nature to be in an audit-logged data store, and to require specific business cases for access to the data. So you can only see a user's private information if there's a specific bug you're working on, and even then the access is audited. I mean, the data is still accessible, it's just not easy to get it willy-nilly without setting off alarms.
  - throwawaybbb 7y ago
    Someone needs to build and maintain the audit log software.
    - JoshTriplett 7y ago
      True, but you don't need access to production data to build an audit logger. And any commits to it should involve code review.
  - justinclift 7y ago
    Backup/restore of audit data can make things complicated. eg the ability to overwrite incorrect/damaged audit data (etc) So far, I've not yet come across a system where some level of direct admin access isn't needed for at least "last resort" situations. (obviously, only available to a very specific set of trusted people)

yowlingcat 7y ago

I smell a fall guy or two. What do you think the odds are that the token optics of this can be replayed as "standing up" for free speech? Not that what actually happened wasn't sketchy (it was) -- just that I have a sense this slap on the wrist will be enough for some to say "At least we can say we tried"

Railsify 7y ago
Slim to none, the article claims they accessed info of people close to the murdered journalist.

sneak 7y ago

It's interesting to see how the phrasing of the headline makes this seem totally different. "Saudi Spies Managed To Infiltrate Twitter as Employees" reads very differently than "Former Twitter Employees Charged with Spying for Saudi Arabia". It again raises my periodic wonder: how many spies, both for the USA, as well as the intel agencies of others, are employed in sensitive roles at Apple, Amazon, Microsoft, Google, and others? How many of them work on the cloud platforms? How many of them have access to HSMs and other internal systems that are used as trust roots? Can we assume that any major platform provider's highest level keys haven't been stolen, perhaps without their own knowledge? It's safe to assume that if they were stolen by their own government's agents, they probably wouldn't tell anyone even if they found out (even if they weren't gag ordered, which they probably would be). You can trust a company down to the ground but still necessarily realize that everyone who hires engineers is going to be vulnerable to this. AWS' GovCloud that only permits US citizens physical access to the facilities doesn't even totally solve the problem, it just (somewhat) reduces the risk, because even US citizens like bribes.

rozab 7y ago
How do those titles sound different to you? Seems pretty similar to me. Anyway, from the article it seems at least some of them were groomed after becoming Twitter employees, so it wouldn't be quite accurate.
- cwkoss 7y ago
  Are they: employees who happened to become spies or spies which happened to become employees

Romanulus 7y ago

Isn't a large part of Twitter owned by Saudi interests?

freddie_mercury 7y ago
Nope. You could have just Googled "twitters largest stockholders" but the answer is: The largest stockholders of Twitter are all US mutual funds. Vanguard owns 10%, Morgan Stanley owns 5%, BlackRock owns 5%, StateStreet owns 4%, Fidelity owns 2%, etc. Really nothing comes to close to the index funds. Vanguard, BlackRock, State Street own 20% of pretty much every company.
- drak0n1c 7y ago
  That's not a complete picture, Prince Alwaleed owned 4.9% of Twitter as recently as the end of 2016 (the alleged espionage happened before this). It is unknown how much he owns now after his late 2017 detainment, presumably shares were either sold off, seized by Saudi authorities, or both. It's not unusual for ownership to be split among smaller entities, and there is no requirement for US companies to consolidate myriad unknown foreign stock holders into specific entities in their reports. https://www.cnbc.com/2017/11/05/citigroup-twitter-held-by-detained-billionaire-alwaleed-bin-talal.html https://www.cnbc.com/2017/11/05/citigroup-twitter-held-by-de...

buboard 7y ago

end to end encrypted everything.

neonate 7y ago

http://archive.is/byhRv http://archive.is/byhRv

deleted 7y ago

[deleted]

x0948fklmen 7y ago

Seemed rather a weird coincidence that after leaving(or being fired from) Twitter, Ali was appointed the CEO of MBS's MiSK Foundation – which is essentially a mafia organization for his loyalists.

danso 7y ago

The complaint [0] is both very interesting – particularly the details on how sloppy/non-existent Twitter's user-access-control was back in 2015 – and pretty funny, such as how one of the suspects tried to fake a digital document but didn't fake the timestamp, and the FBI noticed the receipt having a creation date the same day of their interview with him (pg 13). According to one of the suspects' LinkedIn, he left Twitter in 2015, and then worked at Amazon for 3 years in marketing and social media. While I have little doubt Amazon's internal auditing and access control are better than Twitter's, it'd be nice to hear confirmation from Amazon that he didn't access any private user data. [0] https://context-cdn.washingtonpost.com/notes/prod/default/documents/ab8276a2-2185-4345-956b-26cd1e52b228/note/e5624393-c7e9-4c7e-93e4-30d8fff6c28a.pdf#page=1 https://context-cdn.washingtonpost.com/notes/prod/default/do...

tjungblut 7y ago
Also interesting is on pg 17 where they search through his Apple ID account (notes specifically).
thaumasiotes 7y ago
Tangent, but one of the most interesting things in the complaint -- to me -- was this language: > Many Twitter users live in Saudi Arabia and some users of Saudi nationality or descent live outside of Saudi Arabia, including in the United States. It's kind of surreal to use "Saudi" as the demonym for the people of Arabia. "Arab" would be normal. The language is Arabic, the country is Arabia, and those are both named after the people, the Arabs. The "Saudi" in the name of the country refers to the royal house, the House of Saud, and I would expect a "person of Saudi descent" to be Arabic royalty, not just any old Arab.
- barry-cotter 7y ago
  Arabia is a peninsula. Qataris, Yemenis and Emiratis among others would not appreciate Saudis attempting to appropriate Arabian to refer to those from Saudi Arabia. And Arab refers to people from Morocco to Iraq so it’s equally unsuitable.

AndrewBissell 7y ago

Interesting story here from someone who may have been targeted for an in-person "warning" from Saudi security forces in New Delhi after posting critical remarks from an anonymous Twitter account: https://mobile.twitter.com/marxatfarpoint/status/1192198749331824645 https://mobile.twitter.com/marxatfarpoint/status/11921987493...

TwoBit 7y ago

There needs to be multi-person authorization required for account spelunking. Engineer files a DB lookup request, and it must be signed by other personnel.

swalsh 7y ago
Won't work, people probably need to query details of accounts hundreds of times a day just in the course of daily business. Bad actors would just make the request look like another standard query. People would likely become numb to it after having to approve so many requests. I know at a previous company, we needed a business signoff, and a technical sign off on every deploy. While the technical sign off was usually painstaking, the business sign off was rubber stamped. The guy who signed off on my tickets was so overloaded, he barely even read the titles of the tickets.
- dannyw 7y ago
  Your processes are broken if an individual needs to query hundreds of accounts for private information a day. That is a gigantic problem in itself. Support tickets can be exempt because they’re initiated by user interaction.

linusnext 7y ago

Could Jamal Khashoggi might have been a victim of this?

boomboomsubban 7y ago
There's really no part of his assassination that needs a connection to Twitter to explain.

codedokode 7y ago

The best way to protect dissidents would be not to ask unnecessary personal information like phone numbers. Sadly, it is difficult to find a messenger or web email service that doesn't require it.

sneak 7y ago
It's hard to deduplicate spam users without an identifier that is at least slightly costly to get. There's no easy/practical way to do "charge $0.02 per signup". If you get 10k new accounts in 5 minutes and they're all from some VoIP provider in a tiny corner of the second or third world, you have some data to work with there.
- brongondwana 7y ago
  That and, everyone doesn't want you to have any way to uniquely identify them and contact them right up until the moment they forget their password.
- devin 7y ago
  Could someone who downvoted explain their disagreement? There seems a kernel of truth here that more than a few of us could agree on.
  - sneak 7y ago
    I think I have attracted someone’s ire, that seems to happen to all or most of my comments within a short window after posting.
    - remotecool 7y ago
      This happened to me for awhile too. I think people that disagreed with you on a previous post are using bots to downvote you.
      - mandelbrotwurst 7y ago

hnuser77 7y ago

A few comments about how a non-negligent company handles user data: * They wouldn't respond to "emergency disclosure" requests from the Kingdom of Saudi Arabia about random users * The average developer has zero access to user data besides names in crash logs and things that the developer has been explicitly copied on in the support system. * Every command run on production servers by developers requires approval by someone above your org chart level (up to the executive level, when you just need someone at your level) and is logged forever. * SREs who have to shell in to servers use Unix accounts that have no access to user data. Root access, which should hardly ever happen, requires org chart approval. * Test environments use synthetic or anonymized data * There is a separate team of dozens of highly paid people whose only job is it to identify, classify, and monitor access to user data. This is not even the same as the infosec team, who also would be looking for insider breaches.

arch1717 7y ago

I had to command-f for "isp" and "comcast" because that's the stuff that should scare you. The kind of data someone can get and the ease of which they can get it while not even going through so much as a background check should scare you. We had internal tools, such as the aptly named Xray, which would give you a pretty detailed profile on someone, everything from the names of the devices attached to their wifi network, places that they used Xfinity Wifi, and even what they ordered on Pay-per-view. Going further down the rabbit hole, we had access to logging that could tell you what you passed into your voice remote, what channels you watched and for how long, and what you were downloading. To me, it is a matter of time until a tool like this is abused and you find out that some NFL star was watching scandalous pornography, or even worse, using the Xfinity wifi hotspots to get an idea on where someone was in the US.

ENOTTY 7y ago

This is a very interesting article and complaint. Worth reading to get insights into Twitter's insider threat countermeasures and their compliance regime, at least as of 2014-2015.

woander 7y ago

Is anyone surprised considering the amount of saudi money flooding around traditional and social media? Now lets look into israel and their spying/influence in traditional and social media. It was amazing the amount of "news" and social media spam we got about russia ( We were always at war with eurasia ). It's amazing the amount of "news" and social media spam we are getting about china ( We were always at war with eastasia ). But one hardly ever hears a peep about israel or saudi arabia. Considering what is happening to the palestinians, yemenis, etc, you would think you'd hear a lot more "news" about them. Especially about saudi arabia from the feminist/lgbt traditional media considering the saudis probably treat women and the lgbt as badly as any nation on earth. How come the "news" industry isn't going apeshit over more than half of the state and the US house of senate pushing unconstitutional anti-BDS laws? https://www.aclu.org/blog/free-speech/rights-protesters/new-israel-anti-boycott-act-still-unconstitutional https://www.aclu.org/blog/free-speech/rights-protesters/new-... https://www.timesofisrael.com/us-house-overwhelmingly-passes-anti-bds-resolution/ https://www.timesofisrael.com/us-house-overwhelmingly-passes... A country founded on boycotts banning its corporations from boycotting a foreign country?

rumanator 7y ago
> Now lets look into israel and their spying/influence in traditional and social media. https://en.wikipedia.org/wiki/Tu_quoque https://en.wikipedia.org/wiki/Tu_quoque
- raxxorrax 7y ago
  If it isn't used to defend the action (spying), establish it as justified and therefore clear the offender from guilt, the fallacy doesn't really apply. The statement is bullshit on its own though.
  - rumanator 7y ago
    > If it isn't used to defend the action No, it's still a fallacy. Just because you feel the need to deflect attention towards your personal targets it doesn't mean your argument is sound.

cryptozeus 7y ago

This sounds like a great script for movie.

midnitewarrior 7y ago

If I were spying at Twitter for Saudi Arabia, I'd stream Trump's real-time location back to my handlers, as the Twitter app gathers location data and Trump's online habits are lax.

samirillian 7y ago

> who the CIA has concluded likely ordered the assassination of journalist Jamal Khashoggi in Istanbul last year. More crack work from the cia.

throwAwayNotPC 7y ago

Throw away account since this is not a PC question that is seen as acceptable to ask in the Bay Area even though it relates to national security: We hand out H1B visas by the thousands almost indiscriminately to citizens from communist countries who then become engineers here in the USA at top tech companies - citizens from countries that are the geopolitical adversary of the USA. If a citizen from a foreign communist country (or otherwise) is told to exploit their access into their US tech employer, nothing is really stopping them. There is a treasure trove of IP and PII that can easily be sent back home. (Example - whereabouts of the President, app-based taxi ride of almost anybody etc) The fact of the matter is that most of the Bay Area tech companies I have seen are staffed by a majority foreign nationals. Despite what you would hope to be the case, most engineers at companies where sensitive data is being managed know how to access it even if they aren't supposed to use that access under normal circumstances. I once brought this up and the reaction I got from someone was that I was being racist so I never mentioned it again.

formertwitter 7y ago

I worked directly with Ahmad at Twitter on the international media team. All I can say is I now understand how the next door neighbor to a serial killer can say "but he always seemed like the nicest guy." He really was very nice to everybody, worked hard, and seemed genuine. They were definitely tools available to all of us that allowed this type of access to personal data and more. Specifically a lot of the lists that were generated about who to follow suggestions were manually curated at the time and we could put whoever we wanted on the list. We were expected to put people that were relevant in our industry on those lists, but I think Ahmed actually got in trouble for putting himself on that list to build up his Twitter following. At the time it was certainly a major initiative to rebuild the legacy systems to fix exactly this type of problem. There were strong mandates from the top of the company that were made abundantly clear to us that while they were fixing these things we were all under agreement and NDA to keep all of this data private. The systems were broken no question, but the message was clear. That just makes it even more disappointing to see what he did. He has a very young family at home that is now going to be totally broken.

wheelerwj 7y ago
> All I can say is I now understand how the next door neighbor to a serial killer Hey, i get it, its a little surprising and scary. But this is just a quick reminder that we do the whole innocent until proven guilty thing here in the US. He hasn't been convicted yet, just keep that in mind when thinking about your colleague.
- threatofrain 7y ago
  Innocent until proven guilty is for the US courts though. Real life operates by a different principle -- use your eyes and don't f* up. There are accusations that a teacher sexually molested somebody, but the investigations never went anywhere; do you hire that teacher? I don't think parents are about to blame you for not hiring that teacher.
  - chmod775 7y ago
    So you think it's fine to not hire someone and possibly ruin their career and life based on unsubstantiated allegationts? What if you got falsely acussed of sexual assault? Will you go "well that sucks" and start collecting food stamps for the rest of your life?

appleflaxen 7y ago

This is why people who work in IT must be very careful with their loyalties. If the charges are true for these two individuals, Kashoggi's blood is on their hands. We all need to be circumspect about the effects of our own actions, especially as it relates to climate change, mass extinction, and the military industrial complex.