7 ms·

I disagree. I interned twice at a telco, and while I had access to a bunch of information in databases as a developer, I had no access to call records, and in

I disagree. I interned twice at a telco, and while I had access to a bunch of information in databases as a developer, I had no access to call records, and in general you didn't have access to it unless you needed it for work. The problem is as I understand it, the NSA currently has the view that if a corporation has access to it, then it's not private and they get free reign. It's not that I don't expect Google to have my gmail records, or my phone to have call records and geolocation. Those companies can use that data to improve their services to me. It's when the NSA decides that they have access to all of this information from all these companies is when I have a problem.

Aloha 13y ago
Different companies, different policy, I worked in customer care, and later in a quasi-engineering role. In both cases, and two different companies I had full access to customer CDR's.
- modeless 13y ago
  Which two? I'd appreciate being able to avoid those companies.
  - ars 13y ago
    That's kinda silly unless you can confirm that the other companies are not doing exactly the same thing.
  - Aloha 13y ago
    It's really all of them - If your doing a job that involves either customer care, or resolving call based issues, you have the ability to: See call detail records, sometimes capture voice calls to and from that subscriber, capture signalling data in realtime, track a mobile user in call thru the system for the purposes of finding defective network elements. There is a good reason why we had these abilities, they were essential to resolve and troubleshoot user reported issues. For example, if a customer reported troubles or call quality issues calling 202-555-1212, I needed to be able to pull their CDR's so I could determine which outbound trunk group the call went out on, so I could report it to that carrier to see if they could resolve.
    - modeless 13y ago
      > There is a good reason why we had these abilities Bullshit. Systems can be designed to allow troubleshooting and problem resolution without giving broad access to user data. Telecoms are just too lazy to do it. They have local monopolies, so they just don't need to care.
      - MichaelGG 13y ago
        I've written tools for VoIP companies for diagnostics. The most helpful system is one that logs everything and has it available on-demand. The one I wrote literally recorded and indexed every call-related packet (except audio) and records were kept indefinitely. This is network-level traffic. It reduced time-to-resolution by at least an order of magnitude, since a ticket to the effect of "this weekend someone at the office called someone in Germany and it didnt work" could find out exactly what happened. Apart from that, call detail records (CDRs) are available to many people in a telecom. And it doesn't matter if you trust your telco, because they probably hand off traffic to others in many cases. Even large companies like AT&T deal with very scummy third-parties to get the cheapest prices to place calls. (I know that first hand, because sometimes people sell call capacity they don't have. Instead of completing the call, they answer and play a fake recording of someone saying "wait a sec". Once, when dialing from my AT&T cell, I got the same exact recording I had PCAP'd from some third-rate provider.) Unlike email, where you don't need to provide access to email records in most cases, CDRs are needed for all aspects of billing. While your complete profile may be relatively safe in a large company with internal controls, depending on your calling patterns, you may very well be leaking a lot of details to many third parties you've never heard of. Edit: You could theoretically add all sorts of controls and access-limitations. There's really zero benefit to doing so. Plenty of companies still rely on techs being able to run tcpdump on a mirror port or server in question.
        Aloha 13y ago
        Pretty much exactly my point of view. We had the problem with low cost carriers too - though it was usually a quality issue, some customers because of the nature of their business (e.g. lots of fax calling) we would push them on to generally high cost TDM trunks via the local LEC versus lower costs VoIP trunks with level3 or other carriers. I wish I could convey to people that they need to trust that their carrier is not just sharing their info beyond what is required to make the network work and what is legally required of them by the federal/state/local government. I wish I could also explain more about how the telephone network, works. Like, how its virtually impossible to record every single call made in the US in a blanket sort of way, and that every transiting carrier from here to there also has a slice of their information.
deleted 13y ago
[deleted]
drpancake 13y ago
I too interned at a telco and I was given free reign over this kind of data -- and more. As were some external, temporary contractors. I wrote a little about it here: https://news.ycombinator.com/item?id=5969957 https://news.ycombinator.com/item?id=5969957

Aloha 13y ago

Different companies, different policy, I worked in customer care, and later in a quasi-engineering role. In both cases, and two different companies I had full access to customer CDR's.

modeless 13y ago
Which two? I'd appreciate being able to avoid those companies.
- ars 13y ago
  That's kinda silly unless you can confirm that the other companies are not doing exactly the same thing.
- Aloha 13y ago
  It's really all of them - If your doing a job that involves either customer care, or resolving call based issues, you have the ability to: See call detail records, sometimes capture voice calls to and from that subscriber, capture signalling data in realtime, track a mobile user in call thru the system for the purposes of finding defective network elements. There is a good reason why we had these abilities, they were essential to resolve and troubleshoot user reported issues. For example, if a customer reported troubles or call quality issues calling 202-555-1212, I needed to be able to pull their CDR's so I could determine which outbound trunk group the call went out on, so I could report it to that carrier to see if they could resolve.
  - modeless 13y ago
    > There is a good reason why we had these abilities Bullshit. Systems can be designed to allow troubleshooting and problem resolution without giving broad access to user data. Telecoms are just too lazy to do it. They have local monopolies, so they just don't need to care.
    - MichaelGG 13y ago
      I've written tools for VoIP companies for diagnostics. The most helpful system is one that logs everything and has it available on-demand. The one I wrote literally recorded and indexed every call-related packet (except audio) and records were kept indefinitely. This is network-level traffic. It reduced time-to-resolution by at least an order of magnitude, since a ticket to the effect of "this weekend someone at the office called someone in Germany and it didnt work" could find out exactly what happened. Apart from that, call detail records (CDRs) are available to many people in a telecom. And it doesn't matter if you trust your telco, because they probably hand off traffic to others in many cases. Even large companies like AT&T deal with very scummy third-parties to get the cheapest prices to place calls. (I know that first hand, because sometimes people sell call capacity they don't have. Instead of completing the call, they answer and play a fake recording of someone saying "wait a sec". Once, when dialing from my AT&T cell, I got the same exact recording I had PCAP'd from some third-rate provider.) Unlike email, where you don't need to provide access to email records in most cases, CDRs are needed for all aspects of billing. While your complete profile may be relatively safe in a large company with internal controls, depending on your calling patterns, you may very well be leaking a lot of details to many third parties you've never heard of. Edit: You could theoretically add all sorts of controls and access-limitations. There's really zero benefit to doing so. Plenty of companies still rely on techs being able to run tcpdump on a mirror port or server in question.
      - Aloha 13y ago
        Pretty much exactly my point of view. We had the problem with low cost carriers too - though it was usually a quality issue, some customers because of the nature of their business (e.g. lots of fax calling) we would push them on to generally high cost TDM trunks via the local LEC versus lower costs VoIP trunks with level3 or other carriers. I wish I could convey to people that they need to trust that their carrier is not just sharing their info beyond what is required to make the network work and what is legally required of them by the federal/state/local government. I wish I could also explain more about how the telephone network, works. Like, how its virtually impossible to record every single call made in the US in a blanket sort of way, and that every transiting carrier from here to there also has a slice of their information.

deleted 13y ago

[deleted]

drpancake 13y ago

I too interned at a telco and I was given free reign over this kind of data -- and more. As were some external, temporary contractors. I wrote a little about it here: https://news.ycombinator.com/item?id=5969957 https://news.ycombinator.com/item?id=5969957