4 ms·

Question. What would a system capable of proving “this didn’t happen” look like?

actuator 6y ago
Audit trail of data source access? Though then, you would need to differentiate between legitimate access and using it for your own products.
- fennecfoxen 6y ago
  Suppose the data is accessed by one employee who routinely accesses data of this sort for legitimate purposes — but the employee takes a copy of the data (even just a summary) and sneakernets it over to the in-house brands. How can this attack vector be mitigated?
  - actuator 6y ago
    Yeah, this was what I was referring to. There is no way to control this and I am guessing this is why Jeff Bezos wasn't committing on this not being violated as well.
  - nerfhammer 6y ago
    Bureaucracy. A company that size, these people probably wouldn't know each other and at the scale needed would require significant organization to accomplish this. You would need a team of people doing this full time which requires bureaucracy.
  - deleted 6y ago
    [deleted]
rmrfstar 6y ago
A hard regulatory barrier between the product side and the sales platform side. This already exists in the financial sector. What you would call an "investment bank" is actually a holding company with a number of subsidiaries. The investment bank subsidiary does capital raising and M&A advisory, while the broker-dealer does market transactions. These are separated by a "Chinese wall" or a "firewall". There are criminal penalties for circumventing the wall.
- refurb 6y ago
  That's about the only way to do it, but it's still a relatively easy barrier to get over in my experience (I can't speak to finance). I work in a heavily regulated industry as well with clear "firewalls" between different groups. You're basically relying on the company's own good faith and fear of being punishment to actually enforce it. And the chance of it being discovered is very low as long as it's not a formal process within the company.
mc32 6y ago
"We have a policy against that" along with "I know of no such occurrences and if I did find out they'd get fired."
- tomp 6y ago
  I don’t think that’s exactly enough for serious things, like Anti-Money-Laundering or Bribery in finance. The company also needs to make be able to prove they (1) actually implemented reasonable policies to prevent it (e.g. having access controls, educating employees on relevant legislation, etc.) and (2) make sure that they’re not just avoiding the problem (e.g. by telling employees not to do it but then not investigating, or by hiring another local company to do the bribing).
throwaway5752 6y ago
My thought was that people reacting to the article are disappointed they didn't get an empty promise. Earlier this year, The Wall Street Journal reported that Amazon employees have accessed sales data from independent sellers on its marketplace to help the company develop competing products for its private-label. Amazon has a policy barring the practice, but lawmakers like Rep. Pramila Jayapal (D-WA) focused in on the company’s enforcement of that policy. “Let me ask you, Mr. Bezos, does Amazon ever access and use seller data when making business decisions?” Jayapal asked. Bezos highlighted the company’s policy banning the practice, but said, “I can’t guarantee you that that policy has never been violated.” He continued, “We continue to look into that very carefully. I’m not yet satisfied that we’ve gotten to the bottom of it, and we’re going to keep looking at it. It’s not as easy to do as you would think because some of the sources in the article are anonymous.” This seems reasonable. They have internal controls, but auditing of them is hard, and as he's under oath he can say they have the controls but ... proving a negative is hard. I understand why people predisposed to not trust Amazon, but in this case this is a reasonable answer being pulled out of context for a soundbite.
hrktb 6y ago
Spin off a separate/independant company thinking and producing the goods?

Audit trail of data source access? Though then, you would need to differentiate between legitimate access and using it for your own products.

fennecfoxen 6y ago
Suppose the data is accessed by one employee who routinely accesses data of this sort for legitimate purposes — but the employee takes a copy of the data (even just a summary) and sneakernets it over to the in-house brands. How can this attack vector be mitigated?
- actuator 6y ago
  Yeah, this was what I was referring to. There is no way to control this and I am guessing this is why Jeff Bezos wasn't committing on this not being violated as well.
- nerfhammer 6y ago
  Bureaucracy. A company that size, these people probably wouldn't know each other and at the scale needed would require significant organization to accomplish this. You would need a team of people doing this full time which requires bureaucracy.
- deleted 6y ago
  [deleted]

rmrfstar 6y ago

A hard regulatory barrier between the product side and the sales platform side. This already exists in the financial sector. What you would call an "investment bank" is actually a holding company with a number of subsidiaries. The investment bank subsidiary does capital raising and M&A advisory, while the broker-dealer does market transactions. These are separated by a "Chinese wall" or a "firewall". There are criminal penalties for circumventing the wall.

refurb 6y ago
That's about the only way to do it, but it's still a relatively easy barrier to get over in my experience (I can't speak to finance). I work in a heavily regulated industry as well with clear "firewalls" between different groups. You're basically relying on the company's own good faith and fear of being punishment to actually enforce it. And the chance of it being discovered is very low as long as it's not a formal process within the company.

mc32 6y ago

"We have a policy against that" along with "I know of no such occurrences and if I did find out they'd get fired."

tomp 6y ago
I don’t think that’s exactly enough for serious things, like Anti-Money-Laundering or Bribery in finance. The company also needs to make be able to prove they (1) actually implemented reasonable policies to prevent it (e.g. having access controls, educating employees on relevant legislation, etc.) and (2) make sure that they’re not just avoiding the problem (e.g. by telling employees not to do it but then not investigating, or by hiring another local company to do the bribing).

throwaway5752 6y ago

My thought was that people reacting to the article are disappointed they didn't get an empty promise. Earlier this year, The Wall Street Journal reported that Amazon employees have accessed sales data from independent sellers on its marketplace to help the company develop competing products for its private-label. Amazon has a policy barring the practice, but lawmakers like Rep. Pramila Jayapal (D-WA) focused in on the company’s enforcement of that policy. “Let me ask you, Mr. Bezos, does Amazon ever access and use seller data when making business decisions?” Jayapal asked. Bezos highlighted the company’s policy banning the practice, but said, “I can’t guarantee you that that policy has never been violated.” He continued, “We continue to look into that very carefully. I’m not yet satisfied that we’ve gotten to the bottom of it, and we’re going to keep looking at it. It’s not as easy to do as you would think because some of the sources in the article are anonymous.” This seems reasonable. They have internal controls, but auditing of them is hard, and as he's under oath he can say they have the controls but ... proving a negative is hard. I understand why people predisposed to not trust Amazon, but in this case this is a reasonable answer being pulled out of context for a soundbite.

hrktb 6y ago

Spin off a separate/independant company thinking and producing the goods?