26 ms·

> Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI

by cj 7y ago

> Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.” So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website. And Google fires her with the reasoning: > “We dismissed an employee who abused privileged access to modify an internal security tool,” a Google spokeswoman said in a statement, adding that it was “a serious violation.” I'm not at all opposed to Google employees organizing. But injecting javascript into an employer's internal chrome extension does seem like something that warrants some type of action by Google in response...

gbronner 7y ago
Almost irrespective of the website that it was triggered on, it represents a huge waste of her time, as well as that of the hapless employees forced to click through her automatically-created popups. It also weaponizes the internal browser to advocate for political causes. It shows such stunningly bad judgement that they are entirely justified in firing her.
- givinguflac 7y ago
  IMHO its absurd to think stating a law/fact is advocating a political cause, unless you consider the law a political cause? In which case, wow.
  - noirbot 7y ago
    I mean, I know I'd be highly annoyed if I got a "Don't post copyrighted material" popup every time I visited Stack Overflow. It's the law, but it doesn't mean I want an addon nagging me about my legal obligations. In the same way, I know I have a right to vote, but I definitely felt it was annoying when I had a coworker who would regularly spam us to remind us to vote. It's not necessarily Political, but it's advocacy. I only have so much mental bandwidth - hijacking it to have my read a message of your choosing is cause advocacy whether I agree with it or not. Advocating a certain level of involvement/mindfulness of specific issues is political - Most of the difference between folks in the same party/ideology is just in if they think about or prioritize certain issues over others. Do you care more about Union Rights or the Environment? International Wars or domestic policing? Pushing people towards one over the other is political even if they already agree with you on the underlying issue.
    - givinguflac 7y ago
      Perhaps I'm misunderstanding you, but it sounds like you're saying telling people facts about reality they should know is advocacy, and advocacy is somehow inherently political? By extension of this logic teaching children math is a political act.
      - jesuschristy 7y ago
        Would you be ok with her putting the 2nd amendment on there? Or perhaps a message on how to legally immigrate?
      - noirbot 7y ago
        So, teaching anything is certainly advocacy in the literal sense. Your math teacher is an advocate for you learning math, and the importance of math. I wouldn't say that's political advocacy, because most people would agree that the rules and facts around of algebra generally aren't something that's commonly debated by governments. That said, if I was taking a world history class, and my teacher spent the whole class for a year exclusively going over US war atrocities and rights abuses, I think you could argue that would be political, even if it was all factual and correct. They chose to present a set of facts that leads people towards a specific ideology and worldview that influences how they observe politics and the government. Telling people truths can still be political. Having a popup at work, or a chat message, that informed me of a political candidate's policy positions would be "telling people facts about reality they should know", but is definitely political advocacy. Just because that candidate happens to be in favor of workers rights, or union power, or parental leave, doesn't mean that it's now a relevant work topic. In a perfect world, everyone would know all their rights and all the laws that are relevant to them, but most people don't. Trying to impose that I take time at work to inform myself about them is thus innately political advocacy. That's not to say that it's a bad thing - I appreciate folks who remind people to vote/registration deadlines, or post informative information about relevant local laws, but it doesn't mean it's not political advocacy to do so when you're doing it in a targeted manner. It's possible to both think that what this person did was political activism, and to believe that it probably shouldn't have been punished this hard.
  - jesuschristy 7y ago
    What if the browser extension showed a quote of the 2nd amendment. Would your opinion change? Edit: I’m not expecting a response here but hopefully it’ll give some of y’all some self awareness.
Maxion 7y ago
If you further read the article, she went through the standard approval process for changes. She did it by the book. That's hardly "injecting code".
- mytailorisrich 7y ago
  > Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension That sounds like code review approvals, not actual project/management approval of the 'feature'. We have the same: Cannot commit any code change unless 2 other team members have reviewed it. That has nothing to do with having actual project/management approval for the change.
  - CodeMage 7y ago
    Did you read what the extension is for?
    - Maxion 7y ago
      It feels like a lot of astro-turfing going on here. Why would any sane person be against unions?
      - JumpCrisscross 7y ago
        > Why would any sane person be against unions? I have no horse in this race. But as a counterpoint, pretty much everything in New York is more expensive due to heavy unionisation, particularly around construction and public services.
        take_a_breath 7y ago
        Could also be because of its density and GDP. Are there “cheap” alpha cities? https://financesonline.com/10-wealthiest-cities-in-the-world-its-not-new-york-or-london-at-the-top https://financesonline.com/10-wealthiest-cities-in-the-world...
Touche 7y ago
It's still worth discussing if their reaction warranted the offense. Would they have fired her had she added a pop-up on Earth Day encouraging employees to recycle? Or would she have received a slap on the wrist for that. In other words, how much of what she was advocating was part of the decision to fire?
- ninly 7y ago
  > Or would she have received a slap on the wrist for that. Or would she have received a pat on the back, given that she went through the Standard Procedure for adding a feature to the browser plug-in?
  - ddalex 7y ago
    Sounds like she went through standard procedure to add code, but the feature was not sanctioned by management.... i.e. if you work on a payment system, add you add code to siphon sub-cent rounding "errors" to a "settlement" account, said code may pass review (because it looks legit to code reviewers), but I bet management would be pissed at the change if not prior approved.
    - JoeAltmaier 7y ago
      Not cool to equate a notification of rights, to a crime (theft).
    - loopz 7y ago
      So do nothing until management orders it, is that how they want it now? This is what they'll get!
- TravHatesMe 7y ago
  That is a good question. Is this a fireable offense regardless of the content? If not, what kind of content is fireable, subject matter that is political, religious, vulgar, or offensive? Putting this into an internal tool does seem unprofessional in my opinion. Why bite the hand that feeds you?
ocdtrekkie 7y ago
This is a mischaracterization, if you read what the extension is used for: Showing popups when people visit certain sites. For example, popping up a notice to remind users not to upload Google data to Dropbox when they visit Dropbox. So no, she wouldn't have "added arbitrary JavaScript". She would've added an additional message and triggering website to an existing script.
skywhopper 7y ago
Sure, but the question is, would they react this way if the injected content was something else?
- mc32 7y ago
  So.... this is interesting. The answer is if they are strict authoritarians and go by the book, yes. There is no leeway. If they are flexible and are open to interpretation and intent then no... but then that leaves them open to risk. Because of that most companies over time become very strict and unforgiving.
  - CPLX 7y ago
    The trope that says "asking for rules to be enforced in a sane and human manner leads to authoritarianism" is a pretty recognizable form of bullshit.
- orangecat 7y ago
  That's the most important question, and there's a pretty good case to be made for "yes". It's a severe error in judgment for a security engineer to co-opt an security notification system in order to spread personal messages. Not only is it spam, it desensitizes users to real warnings. (Imagine an email from Google where the subject is "SECURITY ISSUE WITH YOUR ACCOUNT" and the content is an ad for a Pixel). I probably would have given a strong warning rather than firing, but it's not unreasonable to be especially strict when dealing with security matters.
  - loopz 7y ago
    So Security isn't a career move and this wasn't to stifle unionization at all?
ninly 7y ago
Certainly bold and perhaps ill-advised, but I would hardly characterize this as "injection" > Spiers told NBC News that she was inspired to create a digital notification because “a poster in the cafeteria is not the best way of reaching the majority of Googlers.” > The message included a link to a statement that the NLRB required the company to post for employees following the settlement of a complaint that was filed against Google in 2016. > Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension. Another source at Google familiar with the update approval process confirmed to NBC news that those two approvals are standard practice for a browser extension update.
- Touche 7y ago
  Prefixing this by saying I am not siding with Google (since people make assumptions). The standard approval process sounds like most merge review processes on any engineering team. There's a sort of assumed good-faith for this process. The fact that 2 coworkers were fine with your change doesn't mean it was made in good-faith and was within the bounds of normal types of changes. Any engineer with the freedom to make changes without manager approval knows that adding features or making major changes isn't not the sort of thing you just do on your own. You'd go through another process for that. So I don't buy this argument at all. This was a knowing violation. That does not, however, mean that they punishment was warranted, I don't think that it was.
  - impalallama 7y ago
    Yeah let's be real, if she programmed a popup to appear over twitter with a message like "Don't slack off dummy UwU" and or something equally ill informed she would have been rebuked at worst. To say that it wasn't the union overtones that got her fired is naive.
    - qaq 7y ago
      I know 0 large companies who would tolerate what you just described from a security team member.
SkyBelow 7y ago
When a cop pulls speeders but strongly focuses on one demographic group, even though each pull is justified in that the one pulled was violating the law, the pattern that emerges shows a greater level of injustice and the actual reasoning used is quite different than the stated reasoning because the stated reasoning is not consistently being applied. In this particular case, does Google consistently apply the stated reasoning? Google says it does, the engineer says they don't. Do we just trust Google despite a very long history of corporations taking illegal or unacceptable actions against employees engaging in similar actions, or do we let it go before a court to be decided?
- bad_user 7y ago
  That justice isn't equally applied doesn't excuse the perpetrator. If you're speeding over the limit and the cops pull you over, you still deserve the fine, simply because that's the law. This doesn't mean that the cops themselves are innocent of any wrongdoing, but the two issues are separate. And of course civil disobedience can be justified if the law or its application are unjust, but using it as an excuse after the fact is lame.
  - SkyBelow 7y ago
    >That justice isn't equally applied doesn't excuse the perpetrator. If you can prove it isn't being applied fairly it can result in rewards that more than cancel out any such penalty. Such discrimination cases can be hard to prove but can result in significant rewards magnitudes greater than the ticket fine.
sidcool 7y ago
Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension.
- raiyu 7y ago
  Spiers wasn't fired for adding code, Spiers was fired for using a pop-up and that simply isn't the Google way.
  - JohnJamesRambo 7y ago
    Should have been an AMP page.
JumpCrisscross 7y ago
> injecting javascript into an employer's internal chrome extension The purpose of the extension is to serve site-specific pop-ups. Spiers added a pop-up to an existing pop-up tool using existing, precedented processes. The analogy to a poster in a cafeteria, which is explicitly protected by federal law, passes a first-order smell test.
- c0achmcguirk 7y ago
  Is this a precedent that Google or any company wants to have, though? Engineers with access to company-wide tools or extensions can put political or divisive content into them? This is more than just a "poster in the cafe" because of the reach and invasiveness of the approach. Disclaimer: I work for Google, speaking for myself only.
  - JumpCrisscross 7y ago
    > Is this a precedent that Google or any company wants to have, though? Google is free to pull the tool or change the documented process. (I admit, the process seems lax.) Instead, they fired the employee. That’s an aggressive response. > the reach and invasiveness of the approach It’s a pop-up generated when one visits the site of the “firm that Google hired this year amid a groundswell of labor activism at the company”. That sounds like a reasonable scope. Again, using a tool whose entire purpose is to serve site-specific pop-ups. [1] https://www.nbcnews.com/news/all/security-engineer-says-google-fired-her-trying-notify-co-workers-n1103031 https://www.nbcnews.com/news/all/security-engineer-says-goog...
- extropy 7y ago
  These popups are security popups, the ones you would get from your antivirus/firewall and carry a certain Management endorsement weight. It's not a free for all space to put random messages into.
  - JumpCrisscross 7y ago
    > random messages into Federally-protected content isn’t random speech. There are reasonable arguments on both sides. Looking forward to seeing them play out at the NLRB and in the courts. The only solid takeaway at this time is, if you think this is black-and-white, you’re missing salient detail.
iandanforth 7y ago
This isn't how extension development works? The APIs for calling the notify methods already exist. Depending on how their tools work the diff could have been 1. A list of one website on which to notify 2. The static content to display on that website in a predefined (provided by the browser) popup context. While I grant what you're saying is possible given the dev's access rights, it's not required for the functionality described in the article.
minimuffins 7y ago
What do so many of you get out of taking authority's side at every possible turn? She added a message. "Injecting arbitrary javascript." Please.
debt 7y ago
The concerning thing is she seems to call out that employees have the right to “concerted activities” which means Google sung only opposed to unionization efforts but to any “concerted action” by their employees. Even so much as organizing could be viewed as a threat by Google’s management.
crazygringo 7y ago
Indeed. And there are a ton of comments here saying it's OK because "she went through the standard approval process, which requires two co-workers to greenlight changes." But that doesn't mean it was OK. It just means the co-workers might have greenlit it without taking a close look, or were misled as to what they were approving, or that they were approving it because the code was correct technically, and approval isn't about judging the code's product purpose. If this tool was NOT meant to be used as the equivalent of "posters on the wall" and she modified it, regardless of co-worker code approval, it DOES seem to be an abuse of privileges. If her manager had given her the OK, then she's in the right. Otherwise, I have a hard time seeing how this isn't abuse of one's position.
- loopz 7y ago
  Unless managers are authorizing all changes, employees must assume their own judgement. Thus not firing offence.
helen___keller 7y ago
I agreed with this at first, but according to her medium post ( https://medium.com/@ksspiers/google-fires-another-worker-for-exercising-her-rights-and-protecting-coworkers-from-illegal-b86c41ef91b9 https://medium.com/@ksspiers/google-fires-another-worker-for... ) "Part of my job was to write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web" If this is true and her job is literally to create javascript notifications of company policy, then I think it's entirely reasonable what she did considering it IS company policy (well, law really) that you have a right to organize. Link to the popup: https://miro.medium.com/max/2000/0*1BTVYLTvuHiJVvp_.jpg https://miro.medium.com/max/2000/0*1BTVYLTvuHiJVvp_.jpg
- dqv 7y ago
  You're right. It literally links to (what appears to be) an internal company document. go/nlrbnotice
  - deleted 7y ago
    [deleted]
  - kettro 7y ago
    Yeah, the go/ is a shortener for goto.google.com/, and is the main way of sharing links internally.
  - wetmore 7y ago
    Just because it's a go link doesn't make it an internal document. A go link is just a shortened url. You can make a go link point to a non-internal web page.
    - dqv 7y ago
      >It also included a link to a list of employee rights and protections that Google agreed to post as part of a settlement with the National Labor Relations Board this year.[0] But in this case it appears to be a link to an internal notice. [0]: https://www.bloomberg.com/news/articles/2019-12-17/another-google-worker-says-she-was-fired-for-labor-advocacy https://www.bloomberg.com/news/articles/2019-12-17/another-g...
justinmchase 7y ago
Wouldn't she have had to make a pull request? Since when can't a developer make a controlled change to code?
- ummonk 7y ago
  Yes, and needed the approval of two reviewers, which she got.
paggle 7y ago
Yikes. That is straight up black hat shit. What ever happened to posters and bullhorns?
sequoia 7y ago
> But injecting javascript Come now. It's a browser extension, it's written in JavaScript, and knowingly installed by employees. No "injecting" went on here, let's not try to make this sound more nefarious than it was (not very). Fireable? Perhaps. But not because of a security concern. (edit: reading more, it's clear that the only thing that makes this "fireable" in google's view is that it promotes union organizing that they oppose. Any other such message would probably not cause firing unless it caused a PR problem, and perhaps not even then.)
quotemstr 7y ago
This isn't the first time either. Just before the walkout, a group of employees force-changed everyone's desktop background to an advertisement for the walkout. That particular change, while obnoxious, was harmless --- but that change could have been anything, including very difficult to detect spyware. It's essential that company-wide code and configuration changes occur only with official approval and process. Emotional and activism do not constute reasons to bypass this process.
- neonate 7y ago
  Is that true? Amazing if so. I had not heard this before.
  - kalleboo 7y ago
    She mentioned it herself in the Medium post > This kind of code change happens all the time. We frequently add things to make our jobs easier or even to just share hobbies or interests. For example, someone changed the default desktop wallpaper during the walkout last year so that the Linux penguin was holding a protest sign. The company has never reacted aggressively in response to a notification such as this in the past. It’s always been a celebrated part of the culture https://medium.com/@ksspiers/google-fires-another-worker-for-exercising-her-rights-and-protecting-coworkers-from-illegal-b86c41ef91b9 https://medium.com/@ksspiers/google-fires-another-worker-for...
kllrnohj 7y ago
> So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website. No, the "so basically" is the employee added another URL & a string to a map of URLs & strings in an existing extension. The extension already existed. It already showed notifications on various URLs. She didn't create that part.
deleted 7y ago
[deleted]
ColonelSanders 7y ago
The management is giving each other high fives now. As they no doubt strategize their plan from the comfort of their boardroom, they know this activist's personality will become the face of effort to collectively bargain. Despite news articles mentioning walkouts themed on identity politics and out of court sexual assault allegations - those are narrow and not representative of the collective: a small, but vocal clique demanding VIP treatment at the expense of everything else. As for the feelings of those not fitting those characteristics? Do they not have their own personal and professional struggles, ambitions to cooperate and rise in the organization and live a happy life with a family? It's a perfect distraction from the worker's struggle for union representation. In order to form a union, you need votes. Google's management knows enduring the most radical and loud is a small price compared to having a union to ensure everyone is treated fair. Cater to the whims of radicals rather than focusing on common ground == no plurality. Union busted, mission accomplished. https://www.nlrb.gov/rights-we-protect/whats-law/employees/i-am-not-represented-union/your-right-form-union https://www.nlrb.gov/rights-we-protect/whats-law/employees/i...
nooglersanon 7y ago
> So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website. This is actually false (it's not listed in the article, so I wouldn't expect you to know). It was a config file containing URL patterns and plain text messages. Most messages were things like: "please don't upload random company files to dropbox.com/upload". So my take is that this employee's job responsibilities probably involved notifying sending these types of notifications. However I'd actually agree that there was some "abuse" because letting someone know they are about to upload a file to dropbox is pretty different than using it as a forum to remind people that organizing is a protected activity. I wouldn't fire someone over that because despite them being in the wrong, it doesn't seem malicious.
geofft 7y ago
> So basically, the Google employee added arbitrary javascript This is a little disingenuous. She's a software engineer who works on this extension. "Injecting arbitrary JavaScript" is her job. If she bypassed code review, introduced a vulnerability, abused a known weakness to violate policy (e.g. logged into an account with signing keys to deploy manually when it's usually automated), etc. then you'd have a case. If she did her job and followed all policies about review and the only question is the content of the notification, then the way she sent it is an unfair criticism. It reeks of CFAA-style stretching of the truth about authorized access, and we as hackers shouldn't stand for it. I wrote a command-line tool at work to automatically add a bunch of party parrots to a Slack message. This tool runs with your personal credentials, and web-scrapes your Slack access token in order to run. As a normal UNIX tool it also has access to your homedir etc. The credentials it uses can also read your private Slack DMs, access data that you can get to but I am legally forbidden from seeing, etc. - but it does none of those things. I installed it to a bin directory in everyone's path, without code review, because we have a system that explicitly allows this and it is often useful. Our security team raised a general ticket to the effect of, hm, maybe code review should be required before you stick code in everyone's PATH. Nobody is thinking of firing me for "injecting arbitrary Python" or "stealing credentials" or anything because nothing I did was against either policy or convention, even though you can make it sound horrid if you choose.
manicdee 7y ago
What would be the cheapest-approved mechanism of presenting this legally mandated notice to employees? Remembering this isn’t just a generic legal requirement but a specific demand imposed on Google at this point in time.
sundayedition 7y ago
I think there's a piece that some people are overlooking. There are very specific statutory protections about when, where, and how you have a right to organize. Things that would likely require legal review and Google has the budget to test the waters of at this point. The last clause in the link below pertains to this scenario, I think, which may bite Google. Or it may not because it all depends on case law and what union leadership is willing to push back on (which could take years to sort out via legal proceedings) Really, at the end of the day all Google has to risk via this kind of behavior is some lawyer time, setting precedent, and potentially being required to post a notice if they end up losing. Source: https://www.nlrb.gov/rights-we-protect/whats-law/employees/i-am-not-represented-union/your-rights-during-union-organizing https://www.nlrb.gov/rights-we-protect/whats-law/employees/i... > Working time is for work, so your employer may maintain and enforce non-discriminatory rules limiting solicitation and distribution, except that your employer cannot prohibit you from talking about or soliciting for a union during non-work time, such as before or after work or during break times; or from distributing union literature during non-work time, in non-work areas, such as parking lots or break rooms. Also, restrictions on your efforts to communicate with co-workers cannot be discriminatory. For example, your employer cannot prohibit you from talking about the union during working time if it permits you to talk about other non-work-related matters during working time.

by cj 7y ago

gbronner 7y ago

Almost irrespective of the website that it was triggered on, it represents a huge waste of her time, as well as that of the hapless employees forced to click through her automatically-created popups. It also weaponizes the internal browser to advocate for political causes. It shows such stunningly bad judgement that they are entirely justified in firing her.

givinguflac 7y ago
IMHO its absurd to think stating a law/fact is advocating a political cause, unless you consider the law a political cause? In which case, wow.
- noirbot 7y ago
  I mean, I know I'd be highly annoyed if I got a "Don't post copyrighted material" popup every time I visited Stack Overflow. It's the law, but it doesn't mean I want an addon nagging me about my legal obligations. In the same way, I know I have a right to vote, but I definitely felt it was annoying when I had a coworker who would regularly spam us to remind us to vote. It's not necessarily Political, but it's advocacy. I only have so much mental bandwidth - hijacking it to have my read a message of your choosing is cause advocacy whether I agree with it or not. Advocating a certain level of involvement/mindfulness of specific issues is political - Most of the difference between folks in the same party/ideology is just in if they think about or prioritize certain issues over others. Do you care more about Union Rights or the Environment? International Wars or domestic policing? Pushing people towards one over the other is political even if they already agree with you on the underlying issue.
  - givinguflac 7y ago
    Perhaps I'm misunderstanding you, but it sounds like you're saying telling people facts about reality they should know is advocacy, and advocacy is somehow inherently political? By extension of this logic teaching children math is a political act.
    - jesuschristy 7y ago
      Would you be ok with her putting the 2nd amendment on there? Or perhaps a message on how to legally immigrate?
    - noirbot 7y ago
      So, teaching anything is certainly advocacy in the literal sense. Your math teacher is an advocate for you learning math, and the importance of math. I wouldn't say that's political advocacy, because most people would agree that the rules and facts around of algebra generally aren't something that's commonly debated by governments. That said, if I was taking a world history class, and my teacher spent the whole class for a year exclusively going over US war atrocities and rights abuses, I think you could argue that would be political, even if it was all factual and correct. They chose to present a set of facts that leads people towards a specific ideology and worldview that influences how they observe politics and the government. Telling people truths can still be political. Having a popup at work, or a chat message, that informed me of a political candidate's policy positions would be "telling people facts about reality they should know", but is definitely political advocacy. Just because that candidate happens to be in favor of workers rights, or union power, or parental leave, doesn't mean that it's now a relevant work topic. In a perfect world, everyone would know all their rights and all the laws that are relevant to them, but most people don't. Trying to impose that I take time at work to inform myself about them is thus innately political advocacy. That's not to say that it's a bad thing - I appreciate folks who remind people to vote/registration deadlines, or post informative information about relevant local laws, but it doesn't mean it's not political advocacy to do so when you're doing it in a targeted manner. It's possible to both think that what this person did was political activism, and to believe that it probably shouldn't have been punished this hard.
- jesuschristy 7y ago
  What if the browser extension showed a quote of the 2nd amendment. Would your opinion change? Edit: I’m not expecting a response here but hopefully it’ll give some of y’all some self awareness.

Maxion 7y ago

If you further read the article, she went through the standard approval process for changes. She did it by the book. That's hardly "injecting code".

mytailorisrich 7y ago
> Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension That sounds like code review approvals, not actual project/management approval of the 'feature'. We have the same: Cannot commit any code change unless 2 other team members have reviewed it. That has nothing to do with having actual project/management approval for the change.
- CodeMage 7y ago
  Did you read what the extension is for?
  - Maxion 7y ago
    It feels like a lot of astro-turfing going on here. Why would any sane person be against unions?
    - JumpCrisscross 7y ago
      > Why would any sane person be against unions? I have no horse in this race. But as a counterpoint, pretty much everything in New York is more expensive due to heavy unionisation, particularly around construction and public services.
      - take_a_breath 7y ago
        Could also be because of its density and GDP. Are there “cheap” alpha cities? https://financesonline.com/10-wealthiest-cities-in-the-world-its-not-new-york-or-london-at-the-top https://financesonline.com/10-wealthiest-cities-in-the-world...

Touche 7y ago

It's still worth discussing if their reaction warranted the offense. Would they have fired her had she added a pop-up on Earth Day encouraging employees to recycle? Or would she have received a slap on the wrist for that. In other words, how much of what she was advocating was part of the decision to fire?

ninly 7y ago
> Or would she have received a slap on the wrist for that. Or would she have received a pat on the back, given that she went through the Standard Procedure for adding a feature to the browser plug-in?
- ddalex 7y ago
  Sounds like she went through standard procedure to add code, but the feature was not sanctioned by management.... i.e. if you work on a payment system, add you add code to siphon sub-cent rounding "errors" to a "settlement" account, said code may pass review (because it looks legit to code reviewers), but I bet management would be pissed at the change if not prior approved.
  - JoeAltmaier 7y ago
    Not cool to equate a notification of rights, to a crime (theft).
  - loopz 7y ago
    So do nothing until management orders it, is that how they want it now? This is what they'll get!
TravHatesMe 7y ago
That is a good question. Is this a fireable offense regardless of the content? If not, what kind of content is fireable, subject matter that is political, religious, vulgar, or offensive? Putting this into an internal tool does seem unprofessional in my opinion. Why bite the hand that feeds you?

ocdtrekkie 7y ago

This is a mischaracterization, if you read what the extension is used for: Showing popups when people visit certain sites. For example, popping up a notice to remind users not to upload Google data to Dropbox when they visit Dropbox. So no, she wouldn't have "added arbitrary JavaScript". She would've added an additional message and triggering website to an existing script.

skywhopper 7y ago

Sure, but the question is, would they react this way if the injected content was something else?

mc32 7y ago
So.... this is interesting. The answer is if they are strict authoritarians and go by the book, yes. There is no leeway. If they are flexible and are open to interpretation and intent then no... but then that leaves them open to risk. Because of that most companies over time become very strict and unforgiving.
- CPLX 7y ago
  The trope that says "asking for rules to be enforced in a sane and human manner leads to authoritarianism" is a pretty recognizable form of bullshit.
orangecat 7y ago
That's the most important question, and there's a pretty good case to be made for "yes". It's a severe error in judgment for a security engineer to co-opt an security notification system in order to spread personal messages. Not only is it spam, it desensitizes users to real warnings. (Imagine an email from Google where the subject is "SECURITY ISSUE WITH YOUR ACCOUNT" and the content is an ad for a Pixel). I probably would have given a strong warning rather than firing, but it's not unreasonable to be especially strict when dealing with security matters.
- loopz 7y ago
  So Security isn't a career move and this wasn't to stifle unionization at all?

ninly 7y ago

Certainly bold and perhaps ill-advised, but I would hardly characterize this as "injection" > Spiers told NBC News that she was inspired to create a digital notification because “a poster in the cafeteria is not the best way of reaching the majority of Googlers.” > The message included a link to a statement that the NLRB required the company to post for employees following the settlement of a complaint that was filed against Google in 2016. > Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension. Another source at Google familiar with the update approval process confirmed to NBC news that those two approvals are standard practice for a browser extension update.

Touche 7y ago
Prefixing this by saying I am not siding with Google (since people make assumptions). The standard approval process sounds like most merge review processes on any engineering team. There's a sort of assumed good-faith for this process. The fact that 2 coworkers were fine with your change doesn't mean it was made in good-faith and was within the bounds of normal types of changes. Any engineer with the freedom to make changes without manager approval knows that adding features or making major changes isn't not the sort of thing you just do on your own. You'd go through another process for that. So I don't buy this argument at all. This was a knowing violation. That does not, however, mean that they punishment was warranted, I don't think that it was.
- impalallama 7y ago
  Yeah let's be real, if she programmed a popup to appear over twitter with a message like "Don't slack off dummy UwU" and or something equally ill informed she would have been rebuked at worst. To say that it wasn't the union overtones that got her fired is naive.
  - qaq 7y ago
    I know 0 large companies who would tolerate what you just described from a security team member.

SkyBelow 7y ago

When a cop pulls speeders but strongly focuses on one demographic group, even though each pull is justified in that the one pulled was violating the law, the pattern that emerges shows a greater level of injustice and the actual reasoning used is quite different than the stated reasoning because the stated reasoning is not consistently being applied. In this particular case, does Google consistently apply the stated reasoning? Google says it does, the engineer says they don't. Do we just trust Google despite a very long history of corporations taking illegal or unacceptable actions against employees engaging in similar actions, or do we let it go before a court to be decided?

bad_user 7y ago
That justice isn't equally applied doesn't excuse the perpetrator. If you're speeding over the limit and the cops pull you over, you still deserve the fine, simply because that's the law. This doesn't mean that the cops themselves are innocent of any wrongdoing, but the two issues are separate. And of course civil disobedience can be justified if the law or its application are unjust, but using it as an excuse after the fact is lame.
- SkyBelow 7y ago
  >That justice isn't equally applied doesn't excuse the perpetrator. If you can prove it isn't being applied fairly it can result in rewards that more than cancel out any such penalty. Such discrimination cases can be hard to prove but can result in significant rewards magnitudes greater than the ticket fine.

sidcool 7y ago

Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension.

raiyu 7y ago
Spiers wasn't fired for adding code, Spiers was fired for using a pop-up and that simply isn't the Google way.
- JohnJamesRambo 7y ago
  Should have been an AMP page.

JumpCrisscross 7y ago

> injecting javascript into an employer's internal chrome extension The purpose of the extension is to serve site-specific pop-ups. Spiers added a pop-up to an existing pop-up tool using existing, precedented processes. The analogy to a poster in a cafeteria, which is explicitly protected by federal law, passes a first-order smell test.

c0achmcguirk 7y ago
Is this a precedent that Google or any company wants to have, though? Engineers with access to company-wide tools or extensions can put political or divisive content into them? This is more than just a "poster in the cafe" because of the reach and invasiveness of the approach. Disclaimer: I work for Google, speaking for myself only.
- JumpCrisscross 7y ago
  > Is this a precedent that Google or any company wants to have, though? Google is free to pull the tool or change the documented process. (I admit, the process seems lax.) Instead, they fired the employee. That’s an aggressive response. > the reach and invasiveness of the approach It’s a pop-up generated when one visits the site of the “firm that Google hired this year amid a groundswell of labor activism at the company”. That sounds like a reasonable scope. Again, using a tool whose entire purpose is to serve site-specific pop-ups. [1] https://www.nbcnews.com/news/all/security-engineer-says-google-fired-her-trying-notify-co-workers-n1103031 https://www.nbcnews.com/news/all/security-engineer-says-goog...
extropy 7y ago
These popups are security popups, the ones you would get from your antivirus/firewall and carry a certain Management endorsement weight. It's not a free for all space to put random messages into.
- JumpCrisscross 7y ago
  > random messages into Federally-protected content isn’t random speech. There are reasonable arguments on both sides. Looking forward to seeing them play out at the NLRB and in the courts. The only solid takeaway at this time is, if you think this is black-and-white, you’re missing salient detail.

iandanforth 7y ago

This isn't how extension development works? The APIs for calling the notify methods already exist. Depending on how their tools work the diff could have been 1. A list of one website on which to notify 2. The static content to display on that website in a predefined (provided by the browser) popup context. While I grant what you're saying is possible given the dev's access rights, it's not required for the functionality described in the article.

minimuffins 7y ago

What do so many of you get out of taking authority's side at every possible turn? She added a message. "Injecting arbitrary javascript." Please.

debt 7y ago

The concerning thing is she seems to call out that employees have the right to “concerted activities” which means Google sung only opposed to unionization efforts but to any “concerted action” by their employees. Even so much as organizing could be viewed as a threat by Google’s management.

crazygringo 7y ago

Indeed. And there are a ton of comments here saying it's OK because "she went through the standard approval process, which requires two co-workers to greenlight changes." But that doesn't mean it was OK. It just means the co-workers might have greenlit it without taking a close look, or were misled as to what they were approving, or that they were approving it because the code was correct technically, and approval isn't about judging the code's product purpose. If this tool was NOT meant to be used as the equivalent of "posters on the wall" and she modified it, regardless of co-worker code approval, it DOES seem to be an abuse of privileges. If her manager had given her the OK, then she's in the right. Otherwise, I have a hard time seeing how this isn't abuse of one's position.

loopz 7y ago
Unless managers are authorizing all changes, employees must assume their own judgement. Thus not firing offence.

helen___keller 7y ago

I agreed with this at first, but according to her medium post ( https://medium.com/@ksspiers/google-fires-another-worker-for-exercising-her-rights-and-protecting-coworkers-from-illegal-b86c41ef91b9 https://medium.com/@ksspiers/google-fires-another-worker-for... ) "Part of my job was to write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web" If this is true and her job is literally to create javascript notifications of company policy, then I think it's entirely reasonable what she did considering it IS company policy (well, law really) that you have a right to organize. Link to the popup: https://miro.medium.com/max/2000/0*1BTVYLTvuHiJVvp_.jpg https://miro.medium.com/max/2000/0*1BTVYLTvuHiJVvp_.jpg

dqv 7y ago
You're right. It literally links to (what appears to be) an internal company document. go/nlrbnotice
- deleted 7y ago
  [deleted]
- kettro 7y ago
  Yeah, the go/ is a shortener for goto.google.com/, and is the main way of sharing links internally.
- wetmore 7y ago
  Just because it's a go link doesn't make it an internal document. A go link is just a shortened url. You can make a go link point to a non-internal web page.
  - dqv 7y ago
    >It also included a link to a list of employee rights and protections that Google agreed to post as part of a settlement with the National Labor Relations Board this year.[0] But in this case it appears to be a link to an internal notice. [0]: https://www.bloomberg.com/news/articles/2019-12-17/another-google-worker-says-she-was-fired-for-labor-advocacy https://www.bloomberg.com/news/articles/2019-12-17/another-g...

justinmchase 7y ago

Wouldn't she have had to make a pull request? Since when can't a developer make a controlled change to code?

ummonk 7y ago
Yes, and needed the approval of two reviewers, which she got.

paggle 7y ago

Yikes. That is straight up black hat shit. What ever happened to posters and bullhorns?

sequoia 7y ago

> But injecting javascript Come now. It's a browser extension, it's written in JavaScript, and knowingly installed by employees. No "injecting" went on here, let's not try to make this sound more nefarious than it was (not very). Fireable? Perhaps. But not because of a security concern. (edit: reading more, it's clear that the only thing that makes this "fireable" in google's view is that it promotes union organizing that they oppose. Any other such message would probably not cause firing unless it caused a PR problem, and perhaps not even then.)

quotemstr 7y ago

This isn't the first time either. Just before the walkout, a group of employees force-changed everyone's desktop background to an advertisement for the walkout. That particular change, while obnoxious, was harmless --- but that change could have been anything, including very difficult to detect spyware. It's essential that company-wide code and configuration changes occur only with official approval and process. Emotional and activism do not constute reasons to bypass this process.

neonate 7y ago
Is that true? Amazing if so. I had not heard this before.
- kalleboo 7y ago
  She mentioned it herself in the Medium post > This kind of code change happens all the time. We frequently add things to make our jobs easier or even to just share hobbies or interests. For example, someone changed the default desktop wallpaper during the walkout last year so that the Linux penguin was holding a protest sign. The company has never reacted aggressively in response to a notification such as this in the past. It’s always been a celebrated part of the culture https://medium.com/@ksspiers/google-fires-another-worker-for-exercising-her-rights-and-protecting-coworkers-from-illegal-b86c41ef91b9 https://medium.com/@ksspiers/google-fires-another-worker-for...

kllrnohj 7y ago

> So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website. No, the "so basically" is the employee added another URL & a string to a map of URLs & strings in an existing extension. The extension already existed. It already showed notifications on various URLs. She didn't create that part.

deleted 7y ago

[deleted]

ColonelSanders 7y ago

The management is giving each other high fives now. As they no doubt strategize their plan from the comfort of their boardroom, they know this activist's personality will become the face of effort to collectively bargain. Despite news articles mentioning walkouts themed on identity politics and out of court sexual assault allegations - those are narrow and not representative of the collective: a small, but vocal clique demanding VIP treatment at the expense of everything else. As for the feelings of those not fitting those characteristics? Do they not have their own personal and professional struggles, ambitions to cooperate and rise in the organization and live a happy life with a family? It's a perfect distraction from the worker's struggle for union representation. In order to form a union, you need votes. Google's management knows enduring the most radical and loud is a small price compared to having a union to ensure everyone is treated fair. Cater to the whims of radicals rather than focusing on common ground == no plurality. Union busted, mission accomplished. https://www.nlrb.gov/rights-we-protect/whats-law/employees/i-am-not-represented-union/your-right-form-union https://www.nlrb.gov/rights-we-protect/whats-law/employees/i...

nooglersanon 7y ago

> So basically, the Google employee added arbitrary javascript to an internal chrome extension used by Google employees that triggered a popup when employees visited a specific website. This is actually false (it's not listed in the article, so I wouldn't expect you to know). It was a config file containing URL patterns and plain text messages. Most messages were things like: "please don't upload random company files to dropbox.com/upload". So my take is that this employee's job responsibilities probably involved notifying sending these types of notifications. However I'd actually agree that there was some "abuse" because letting someone know they are about to upload a file to dropbox is pretty different than using it as a forum to remind people that organizing is a protected activity. I wouldn't fire someone over that because despite them being in the wrong, it doesn't seem malicious.

geofft 7y ago

> So basically, the Google employee added arbitrary javascript This is a little disingenuous. She's a software engineer who works on this extension. "Injecting arbitrary JavaScript" is her job. If she bypassed code review, introduced a vulnerability, abused a known weakness to violate policy (e.g. logged into an account with signing keys to deploy manually when it's usually automated), etc. then you'd have a case. If she did her job and followed all policies about review and the only question is the content of the notification, then the way she sent it is an unfair criticism. It reeks of CFAA-style stretching of the truth about authorized access, and we as hackers shouldn't stand for it. I wrote a command-line tool at work to automatically add a bunch of party parrots to a Slack message. This tool runs with your personal credentials, and web-scrapes your Slack access token in order to run. As a normal UNIX tool it also has access to your homedir etc. The credentials it uses can also read your private Slack DMs, access data that you can get to but I am legally forbidden from seeing, etc. - but it does none of those things. I installed it to a bin directory in everyone's path, without code review, because we have a system that explicitly allows this and it is often useful. Our security team raised a general ticket to the effect of, hm, maybe code review should be required before you stick code in everyone's PATH. Nobody is thinking of firing me for "injecting arbitrary Python" or "stealing credentials" or anything because nothing I did was against either policy or convention, even though you can make it sound horrid if you choose.

manicdee 7y ago

What would be the cheapest-approved mechanism of presenting this legally mandated notice to employees? Remembering this isn’t just a generic legal requirement but a specific demand imposed on Google at this point in time.

sundayedition 7y ago

I think there's a piece that some people are overlooking. There are very specific statutory protections about when, where, and how you have a right to organize. Things that would likely require legal review and Google has the budget to test the waters of at this point. The last clause in the link below pertains to this scenario, I think, which may bite Google. Or it may not because it all depends on case law and what union leadership is willing to push back on (which could take years to sort out via legal proceedings) Really, at the end of the day all Google has to risk via this kind of behavior is some lawyer time, setting precedent, and potentially being required to post a notice if they end up losing. Source: https://www.nlrb.gov/rights-we-protect/whats-law/employees/i-am-not-represented-union/your-rights-during-union-organizing https://www.nlrb.gov/rights-we-protect/whats-law/employees/i... > Working time is for work, so your employer may maintain and enforce non-discriminatory rules limiting solicitation and distribution, except that your employer cannot prohibit you from talking about or soliciting for a union during non-work time, such as before or after work or during break times; or from distributing union literature during non-work time, in non-work areas, such as parking lots or break rooms. Also, restrictions on your efforts to communicate with co-workers cannot be discriminatory. For example, your employer cannot prohibit you from talking about the union during working time if it permits you to talk about other non-work-related matters during working time.