6 ms·

I hope the HN crowd doesn't write this off because it's Russia - employee abuse of customer data is all too common in tech: - Google Engineer Stalked Teens, Sp

I hope the HN crowd doesn't write this off because it's Russia - employee abuse of customer data is all too common in tech: - Google Engineer Stalked Teens, Spied on Chats: https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te... - Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-allegation-that-employees-abused-customer-data https://www.theinformation.com/articles/lyft-investigates-al... - Uber Employees Allegedly Use Data to Stalk Exes, Celebs: https://www.newser.com/story/235409/lawsuit-uber-employees-use-data-to-stalk-celebs-exes.html https://www.newser.com/story/235409/lawsuit-uber-employees-u... - Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employee-used-privile-1825666305 https://gizmodo.com/facebook-investigating-claim-that-employ... - Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees-abused-data-access-spy-on-users-snaplion https://www.vice.com/en_us/article/xwnva7/snapchat-employees... - Yahoo Engineer Used Insider Access to Get Private Photos of Women: https://www.vice.com/en_asia/article/59nwyk/yahoo-engineer-used-insider-access-to-get-private-photos-of-women https://www.vice.com/en_asia/article/59nwyk/yahoo-engineer-u... Most occurrences likely never even make it into the news.

cryptochromium 6y ago
It's a real big problem. Employees from our version of the cdc (ggd) were caught selling peoples data who were tested positive for covid. including social security numbers. https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/handel-gegevens-nederlanders-ggd-systemen-database-coronit-hpzone https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/ha...
- brnt 6y ago
  Who would be buying this info? Are Dutch insurers allowed to procure such information?
  - Boltgolt 6y ago
    If you have a name, phone number and BSN (Dutch SSN) you can easily do lage-scale identity fraud
    - brnt 6y ago
      Can you? I don't have any Dutch examples of that, but seeing the high prices the information sells for, I guess I'm missing something.
sn_master 6y ago
Also, plenty of employees in car dealerships and finance companies in the US sell access to credit reports (i.e. they make a new credit report search on demand, not a previously stolen one). Just go to any of the darkweb markets and you'll find them there, with a lot of glowing "reviews". If the money is there, and it can be done anonymously, people will keep doing it.
- Person5478 6y ago
  Which should be __SCORCHINGLY__ illegal because too many credit report requests can actually affect your credit score.
jhayward 6y ago
There are more: https://www.reuters.com/article/us-usa-surveillance-watchdog/nsa-staff-used-spy-tools-on-spouses-ex-lovers-watchdog-idUSBRE98Q14G20130927 https://www.reuters.com/article/us-usa-surveillance-watchdog...
lindsay7 6y ago
Yandex is not russian. It is developed by a company in switzerland and primarily targets the russian market.
- justusthane 6y ago
  I don't see anything that backs that up on the Wikipedia page. Their headquarters is in Moscow and it was founded by two Russians. They have a sales office in Lucerne. https://en.wikipedia.org/wiki/Yandex https://en.wikipedia.org/wiki/Yandex
- bobuk 6y ago
  Yandex is a company registered at the Netherlands, 99% of the company's developers are located in Russia. So, technically Yandex is Russian.
- diggan 6y ago
  What, you're joking surely? Yandex was founded by three Russians and the HQ is in Moscow, and they obviously target the Russian market. If Yandex is not Russian, what is? Like saying Google is Irish because they have some center there for the EU business. Google is surely a US-based company.
  - fire7000 6y ago
    Sergey Brin is from Russia. He only co-founded Google...
- filoleg 6y ago
  From their wikipedia page [0]: >Yandex is a Russian Dutch-domiciled multinational corporation providing Internet-related products and services, including transportation, search and information services, eCommerce, navigation, mobile applications, and online advertising. >The firm is registered in Schiphol, the Netherlands as a naamloze vennootschap (Dutch public limited company), but the company founders and most of the team members are located in Russia. So yes, technically the company is registered outside of Russia (Netherlands, not Switzerland like you claimed), but their HQ and heavy majority of their workforce and the founders are located in Moscow. I would definitely count it as a Russian company. 0. https://en.wikipedia.org/wiki/Yandex https://en.wikipedia.org/wiki/Yandex
ransom1538 6y ago
"I hope the HN crowd doesn't write this off because it's Russia" Sorta. I worked next to them in Burlingame, CA.
ericcholis 6y ago
- eBay employees stalk and harass bloggers https://www.nytimes.com/2020/09/26/technology/ebay-cockroaches-stalking-scandal.html https://www.nytimes.com/2020/09/26/technology/ebay-cockroach...
shim2k 6y ago
Not saying it does not occur in tech in general, but there is a difference in scale between selling the data and abusing it for personal reasons. The examples you provided are exclusively the latter. The mentioned employee sold access to 4,887 email accounts.
bserge 6y ago
Not sure if this would make anyone feel better or worse, but you can find these kinds of examples everywhere. Abuse of position, often with results way, way worse than a hacked account, is extremely common in every single industry. We're all human, after all.
polote 6y ago
Not mentioning that to get the blue mark on Instagram, you can pay a facebook employee that will give you the badge. This is surreal https://mashable.com/2017/09/01/instagram-verification-paid-black-market-facebook/?europe=true https://mashable.com/2017/09/01/instagram-verification-paid-...
bpodgursky 6y ago
I don't want to speak to the other companies, but that Google link is over a decade old. They absolutely have very strict access control now — it would be 100% impossible for a Google employee to do this nowdays.
throwawayboise 6y ago
Your employer is very possibly doing it to you and other employees as well, and it's perfectly legal for them to do it. I keep any work-issued equipment I have at home powered off if I'm not actually working.
- sam_lowry_ 6y ago
  In many places in the world, they can't. In Europe, the matter of employers monitoring employees is highly regulated.
- foolinaround 6y ago
  never thought of this level of paranoia! you think they would record audio/video, or just log the keystrokes?
  - SirSourdough 6y ago
    I’m aware of at least one case of a school installing software that allowed them to remotely access the webcams of students, and they admitted to using the software on 40+ occasions. I wouldn’t be surprised if this practice existed in the corporate world as well.
    - razakel 6y ago
      There was the Robbins v. Lower Merion School District case, where a student sued after being disciplined for "taking drugs" in his bedroom (it was actually candy). They'd remotely activated the webcam on his school-issued laptop. And, frankly, spying on a teenage boy in his bedroom, they're lucky they didn't face felony charges.
  - heavyset_go 6y ago
    I know of a fairly large employer in the pharmaceutical space that installs spyware on company computers that employees take home, and uses that spyware to keep tabs on what websites were visited on the machines. They made decisions to fire certain employees based on it, too.
  - 6y ago
selykg 6y ago
Best approach to data is that if it can't be seen or read (through any means) then that data can't be abused or misused. This is why end-to-end encryption should be a first choice for pretty much everything.
smsm42 6y ago
I'm pretty sure unless the system is based on minimum-privilege strict audit (with audit logs regularly reviewed by a dedicated inspector team) - which I never ever seen happening anywhere - somebody out of lots of people that have access will be tempted. And the reason why most of "unicorns" likely do not have strict audit system for PI is because it costs many $$$$ but brings exactly $0 in revenue. And until it becomes many $$$$ in potential lawsuit liability exposure, it will continue so, because nobody would invest serious effort in something that is only hurting the bottom line.
netsharc 6y ago
Interestingly Navalny and Bellingcat used the leaky Russian data systems (leaky because corrupt employees/police offer access to data for money) to trace his poisoners and who they communicated with. A fascinating case of exploiting a corrupt system against itself.. https://www.bellingcat.com/resources/2020/12/14/navalny-fsb-methodology/ https://www.bellingcat.com/resources/2020/12/14/navalny-fsb-...
fingerlocks 6y ago
The Facebook allegation looks incredibly weak. I’m not trying to defend anyone here, but it sounds like the employee was canned over a cringey bad joke text to a tinder date. Was there any actual evidence of wrongdoing? All I’m seeing is a screenshot of a text message circulating on the Twitter outrage circuit.

cryptochromium 6y ago

It's a real big problem. Employees from our version of the cdc (ggd) were caught selling peoples data who were tested positive for covid. including social security numbers. https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/handel-gegevens-nederlanders-ggd-systemen-database-coronit-hpzone https://www.rtlnieuws.nl/nieuws/nederland/artikel/5210644/ha...

brnt 6y ago
Who would be buying this info? Are Dutch insurers allowed to procure such information?
- Boltgolt 6y ago
  If you have a name, phone number and BSN (Dutch SSN) you can easily do lage-scale identity fraud
  - brnt 6y ago
    Can you? I don't have any Dutch examples of that, but seeing the high prices the information sells for, I guess I'm missing something.

sn_master 6y ago

Also, plenty of employees in car dealerships and finance companies in the US sell access to credit reports (i.e. they make a new credit report search on demand, not a previously stolen one). Just go to any of the darkweb markets and you'll find them there, with a lot of glowing "reviews". If the money is there, and it can be done anonymously, people will keep doing it.

Person5478 6y ago
Which should be __SCORCHINGLY__ illegal because too many credit report requests can actually affect your credit score.

jhayward 6y ago

There are more: https://www.reuters.com/article/us-usa-surveillance-watchdog/nsa-staff-used-spy-tools-on-spouses-ex-lovers-watchdog-idUSBRE98Q14G20130927 https://www.reuters.com/article/us-usa-surveillance-watchdog...

lindsay7 6y ago

Yandex is not russian. It is developed by a company in switzerland and primarily targets the russian market.

justusthane 6y ago
I don't see anything that backs that up on the Wikipedia page. Their headquarters is in Moscow and it was founded by two Russians. They have a sales office in Lucerne. https://en.wikipedia.org/wiki/Yandex https://en.wikipedia.org/wiki/Yandex
bobuk 6y ago
Yandex is a company registered at the Netherlands, 99% of the company's developers are located in Russia. So, technically Yandex is Russian.
diggan 6y ago
What, you're joking surely? Yandex was founded by three Russians and the HQ is in Moscow, and they obviously target the Russian market. If Yandex is not Russian, what is? Like saying Google is Irish because they have some center there for the EU business. Google is surely a US-based company.
- fire7000 6y ago
  Sergey Brin is from Russia. He only co-founded Google...
filoleg 6y ago
From their wikipedia page [0]: >Yandex is a Russian Dutch-domiciled multinational corporation providing Internet-related products and services, including transportation, search and information services, eCommerce, navigation, mobile applications, and online advertising. >The firm is registered in Schiphol, the Netherlands as a naamloze vennootschap (Dutch public limited company), but the company founders and most of the team members are located in Russia. So yes, technically the company is registered outside of Russia (Netherlands, not Switzerland like you claimed), but their HQ and heavy majority of their workforce and the founders are located in Moscow. I would definitely count it as a Russian company. 0. https://en.wikipedia.org/wiki/Yandex https://en.wikipedia.org/wiki/Yandex

ransom1538 6y ago

"I hope the HN crowd doesn't write this off because it's Russia" Sorta. I worked next to them in Burlingame, CA.

ericcholis 6y ago

- eBay employees stalk and harass bloggers https://www.nytimes.com/2020/09/26/technology/ebay-cockroaches-stalking-scandal.html https://www.nytimes.com/2020/09/26/technology/ebay-cockroach...

shim2k 6y ago

Not saying it does not occur in tech in general, but there is a difference in scale between selling the data and abusing it for personal reasons. The examples you provided are exclusively the latter. The mentioned employee sold access to 4,887 email accounts.

bserge 6y ago

Not sure if this would make anyone feel better or worse, but you can find these kinds of examples everywhere. Abuse of position, often with results way, way worse than a hacked account, is extremely common in every single industry. We're all human, after all.

polote 6y ago

Not mentioning that to get the blue mark on Instagram, you can pay a facebook employee that will give you the badge. This is surreal https://mashable.com/2017/09/01/instagram-verification-paid-black-market-facebook/?europe=true https://mashable.com/2017/09/01/instagram-verification-paid-...

bpodgursky 6y ago

I don't want to speak to the other companies, but that Google link is over a decade old. They absolutely have very strict access control now — it would be 100% impossible for a Google employee to do this nowdays.

throwawayboise 6y ago

Your employer is very possibly doing it to you and other employees as well, and it's perfectly legal for them to do it. I keep any work-issued equipment I have at home powered off if I'm not actually working.

sam_lowry_ 6y ago
In many places in the world, they can't. In Europe, the matter of employers monitoring employees is highly regulated.
foolinaround 6y ago
never thought of this level of paranoia! you think they would record audio/video, or just log the keystrokes?
- SirSourdough 6y ago
  I’m aware of at least one case of a school installing software that allowed them to remotely access the webcams of students, and they admitted to using the software on 40+ occasions. I wouldn’t be surprised if this practice existed in the corporate world as well.
  - razakel 6y ago
    There was the Robbins v. Lower Merion School District case, where a student sued after being disciplined for "taking drugs" in his bedroom (it was actually candy). They'd remotely activated the webcam on his school-issued laptop. And, frankly, spying on a teenage boy in his bedroom, they're lucky they didn't face felony charges.
- heavyset_go 6y ago
  I know of a fairly large employer in the pharmaceutical space that installs spyware on company computers that employees take home, and uses that spyware to keep tabs on what websites were visited on the machines. They made decisions to fire certain employees based on it, too.
- 6y ago

selykg 6y ago

Best approach to data is that if it can't be seen or read (through any means) then that data can't be abused or misused. This is why end-to-end encryption should be a first choice for pretty much everything.

smsm42 6y ago

I'm pretty sure unless the system is based on minimum-privilege strict audit (with audit logs regularly reviewed by a dedicated inspector team) - which I never ever seen happening anywhere - somebody out of lots of people that have access will be tempted. And the reason why most of "unicorns" likely do not have strict audit system for PI is because it costs many $$$$ but brings exactly $0 in revenue. And until it becomes many $$$$ in potential lawsuit liability exposure, it will continue so, because nobody would invest serious effort in something that is only hurting the bottom line.

netsharc 6y ago

Interestingly Navalny and Bellingcat used the leaky Russian data systems (leaky because corrupt employees/police offer access to data for money) to trace his poisoners and who they communicated with. A fascinating case of exploiting a corrupt system against itself.. https://www.bellingcat.com/resources/2020/12/14/navalny-fsb-methodology/ https://www.bellingcat.com/resources/2020/12/14/navalny-fsb-...

fingerlocks 6y ago

The Facebook allegation looks incredibly weak. I’m not trying to defend anyone here, but it sounds like the employee was canned over a cringey bad joke text to a tinder date. Was there any actual evidence of wrongdoing? All I’m seeing is a screenshot of a text message circulating on the Twitter outrage circuit.