Slashdot Mirror
Google Engineer Spied On Teen Users
bonch writes "Former Google employee David Barksdale accessed user accounts to spy on call logs, chat transcripts, contact lists. As a Site Reliability Engineer, Barksdale had access to the company's most sensitive information and even unblocked himself from a teen's buddy list. He met the minors through a Seattle technology group. Angry parents cut off contact with him and complained to Google, who quietly fired him."
And not only call logs, chat transcripts and contact lists. The article notes:
he pulled up the person's email account, contact list, chat transcripts, Google Voice call logs—even a list of other Gmail addresses that the friend had registered but didn't think were linked to their main account—within seconds.
So even if you think logging out and making a new separate account is enough, it's all linked
And what about Google Analytics and everything else? They can see everywhere you've been on the internet, and obviously abuse it.
Google's policy may be "Do No Evil" but each individual's policy may differ...
You never know who is watching or listening in. People don't realize that every single thing they do online can, at some point along the pipe, be potentially seen by someone.
Living With a Nerd
Someone always has access to the data, and they're going to look at it at some point. The expectation that no one will be nosey when they're bored one day is just naivety (or stupidity). In this case the motivation is a bit creepier but on other websites people will be looking through "private" data when they're bored - be it Facebook messages, Twitter DMs, GMail emails, or Slashdot private journals.
If you want it to remain secure and unread by other people, don't put it where other people might access it.
http://twitter.com/onion2k
But I found anotherFA.
Free Martian Whores!
Then they couldn't index it for advertisement, which is Google's business
Blah blah sig blah blah blah irony blah blah
"Is it 1984 already?" Daria
Young single male admins at companies like Google and Yahoo are golden contacts. If you are looking to research something, they can help. For a price.
Not just line men. We used to do that all the time as kids, just cause we figured out we could.
...the question is: what's his
Trolling is a art,
Individual person does nefarious actions -- name of company he works for used in title of news article for salacious reasons. More at 11.
It is by my will alone my thoughts acquire motion; it is by the juice of the coffee bean that the thoughts acquire speed
More than enough reason for no business to store any business e-mail on their servers and no one with any e-mail which has real world value.
You are basically suggesting that no one uses the Internet anymore. End-to-end encryption aside, there will always be a system administrator with the technical ability to snoop data stored or in transfer. The only reason you can slam Google here is because they actually caught the guy.
Google has no grounds to prosecute the guy. The kids/parents may have some grounds based on harassment or something but the guy legitimately had access to that data, he just abused it. It happens, he was fired. I love these posts which act as if "my company" could never hire anyone who would abuse their access to data. It happens regularly at every company I've ever worked at to some degree or another. When it happens, you deal with it. *shrug*
Check out my lame java blog at www.javachopshop.com
As anybody with real system administration experience knows, what protects user privacy is that you do not look at their data without explicit permission. That means people with this level of access have to have certain personality traits, and a high level of personal integrity is the most important one. I guess this is just another failed Google hiring process result.
What now needs to follow is criminal proceedings resulting in a a rather unpleasant punishment. Oh, wait, the US does not have working privacy laws...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Exactly... any admin worth their position could extract similar information from their corporate network. This was an inside job like any other inside job. It's only news because it is Google.
If this has been an admin of Facebook or MySpace it would have had similar impact. It should be no surprise that any information you give to a company is available to their admins to use or abuse.
Remember to maintain your supply of
He - David Barksdale, notorious harasser of vulnerable teens, I mean - shares a name with a more famous chap, who will remain at the top of Google searches. Unless enough people start referring to David Barksdale primarily in the context of the famous freaky violator of childrens' privacy. You know, David Barksdale. The freaky creepy weird fucked up emotionally stunted probably-not-a-pederast basket case fired by Google for stalking children. That guy.
If you were blocking sigs, you wouldn't have to read this.
The problem with this guy power-tripping on some kids, was not that he didn't give importance to people's privacy - which is apparently along the lines of the company's general mindset - but that he got caught for being stupid.
Google, who quietly fired him
Not as quietly as they might have hoped...
...the fucking Cloud.
It was not Google who caught the guy which is what is worrying in this case, it was the parents of the kids involved.
I would have expected a shop of their size to have proper security and use at least some of their precious IPR on log analysis.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
Hell, I'm not even an admin worthy of the position - and I can do as you say. Crap - some ditzy female was playing one of the kids for a fool - I knew she was a worthless tramp, but you don't just tell your kids that, because they will HATE YOU FOREVER for interfering in their personal love lives. Well - she used a computer at my house to read some personal emails and such stuff. Dad just forwarded all the dirt, complete with account passwords, to the son via a "proxy". The female disappeared from the son's life faster than pizza on football night. No, I don't condone spying on people - but bitches don't count, LOL
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
After RTA it appears that David Barksdale violated Google internal policies so that means some Federal ECPA laws were violated, specifically 18 USC 2701(a).
The exceptions outlined in voluntary 18 USC 2702 and mandatory 18 USC 2703 don't apply either.
If Google doesn't have a policy of handing privacy violations over to AUSA/Federal or local law enforcement then I would urge a review of Google's policies.
They might. A lot of companies have huge disclaimers on all their systems. Something about people unauthorized to use a system or using it in excess of their authority will be prosecuted. They also typically include a blurp about information being intended for you as well....Also typically some type of consent to being monitored.
I would think that it is similar to an EULA and maybe could be enforced. Also most companies have an acceptable use policy and people who violate it can be subject to civil penalties as well as disciplinary action.
Also a lot of companies sue you if you say something the slightest bit bad about them. This guy just shit on Google's reputation, that probably will cause some economic damage (no matter how small....since most people won't care, but I would bet at least one person might be put off from trying Google for that violation). I would think a civil suit could proceed on that merit....
But now the guy is popular in the news and has probably just lost any chance of being hired by any big company in this day of web searching potential employees... Unless Google changes their ranking algorithm to bury this case....
Isn't there some ISO 9000 rule (or other standard) that says that admins cannot look at user data? And why isn't google adhering to this standard?
If Pandora's box is destined to be opened, *I* want to be the one to open it.
The only reason you can slam Google here is because they actually caught the guy.
No, Google didn't catch the guy. The kids' parents caught the guy and told Google about it, and only *then* did Google take action.
Evidently, Google does not have a process controlling the access of user accounts by employees of the company. Google needs to stop ignoring the fact that it is dealing with increasingly more private information on individuals and that like other organizations with such information (think banks) it needs to develop a full fledged process (with well defined protocols, auditing, etc.) to ensure that any access to a user's private information is authorized and accounted for.
Google wants to think of itself as a technology company where process is a hindrance. Google is too big to continue thinking and acting like that.
I'm guessing Google will not deal with this particular problem until it gets sued.
So you'd be willing to try to ruin some guy you don't even know over 'evidence' in a three-line Slashdot blurb? You want to at least wait and see if actual charges are filed, let alone a guilty verdict? Talk about jumping to conclusions...
I dunno, at places I've been the low-level sysadmin access is not very closely monitored. "Official" access through the normal APIs is logged and monitored, but when the Unix sysadmin has root on the database machine, he could be grepping through the database for all anybody knows.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
In other words he is acting like a teenager.
Once you grow up, the term becomes "sociopath."
I was not defending Google, I was only stating that SOMEONE on the inside of every company has access to things that could be dangerous in the wrong hands, even your bank of choice. That being said, the problem isn't that someone has access, the problem is that they need to better screen their employees and their behavior to discourage this sort of thing.
This kind of idiotic move happens all the time and people get fired over it. I read recently about a school principal viewing porn on his computer at work (in the school) and getting canned for it. Idiots are everywhere and people with access or power are not except from being idiots. Again, this is not news.
Remember to maintain your supply of
What happened around here? Slashdot used to be so pro-privacy as a matter of principle. We're supposed to ignore a huge breach of trust at Google because it happens elsewhere? Nobody else has the enormous amount of data that Google has on you. Think about it.
We're on different pages. This isn't a breach of privacy by Google the company, it is by this individual. Google has policies already in place against this behavior and does not condone or promote it. What else could you possibly expect them to do as a company?
Additionally, you (or whomever) gave your information to Google by using their services. People inside Google have access to that information you willingly gave them (duh). Someone within that inner circle violated Google's policies for people within that inner circle. That person was fired. There is no way for Google to completely prevent this sort of thing from happening, they can only monitor and react.
If you do not want this to happen to you then do not use Google's services. But don't go on the Internet and use publicly available (and free) services and then expect anything other than your "privacy" being violated.
Remember to maintain your supply of
good, gave him the tools/;info to handle it himself and it worked out better.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
And yet here I see you on Slashdot. As an unsubscribed plain old user, I can find:
- Your last few comments
- The last few stories you've submitted
- Your Slashdot friends / fans / foes
- Their comments / stories / etc
I'm not trying very hard, and I'm certainly not a data miner, but I'd guess even that amount of data would be enough to put something together about you -- at least a vague sense of your interests and disinterests. And how much more information would the Slashdot admins have about you? All they have to do is miss a single creep in their hiring process and all of that information is free reign. It might not be as sensitive as your emails, but its still an invasion of your privacy. And the chances for creeps to slip through the cracks grows with the size of your company (I'd imagine sub-linearly as screening procedures typically would get better as the company grows, but its still not a DECREASING chance).