Slashdot Mirror
Tech Companies Have a History of Giving Low-Level Employees High-Level Access (theoutline.com)
A reader shares a report (condensed for space): In the summer of 2010, Google fired a 27-year-old site reliability engineer named David Barksdale after it discovered that Barksdale had been accessing the Google accounts of four teens he met through a local Seattle tech group. The spying went on for months before it was reported, Gawker's Adrian Chen wrote at the time. In one incident Chen described, a 15-year-old refused to tell Barksdale the name of his new girlfriend; Barksdale broke into the teen's Google Voice account, listened to messages to get the name, then taunted him with it and threatened to call her. Google was contrite, saying publicly that it "carefully control[s] the number of employees who have access to our systems" and monitors for abuses by rogue employees. [...] The rogue Twitter customer service employee who momentarily deactivated President Trump's account on Thursday night brought this issue to mind. Twitter has 3,898 employees, according to Wikipedia, for 330 million monthly users, a ratio of one employee for every 84,658 users. This means that a single employee may have a ton of power over loads of users, but the value of a single user is low. Their privacy may seem insignificant in light of the greater mob. [...] At Uber, employees regularly abused its "God View" mode to spy on the movements of celebrities, politicians, and even ex-spouses.
A 27 year old was stalking a 15 year old...
If you choose to give it to them, don't be shocked if/when they fuck you with it.
What does suck though is companies like Equifax. I never chose to give them my data. In that regard, we should have the choice to have them remove our data and be further blocked.
Where I work, the NOC staff, who are the lowest paid and least skilled, have complete administrative access over production systems. On the other hand application support have a ridged access profile of barely able to log onto systems and often cannot view application logs especially when there are issues.
You might as well be asking $10/hour rent a cops to guard Fort Knox while disabling all other security onsite.
All, really all, big organizations have this problem. Just ask Manning and Snowden; classic cases of too much access to too much information.
So governments, corporations, every organization needs to give power over information and access to the lowly peons or those peons can't do the lowly jobs they are supposed to do.
You can put in controls, access walls and shit, but if you do it, your administrative overhead will go through the roof. Someone like Google might sorta be able to pay for all of this, but it will hurt the bottom line to have a inhouse police. Someone like Twitter which is already leaking money like a faulty bucket leaks water: yeah right...
Even when you do this, all the security clearances, background checks and mandatory lie detector tests, etc. didn't prevent the whistleblowers.
In one incident Chen described, a 15-year-old refused to tell Barksdale the name of his new girlfriend; Barksdale broke into the teen's Google Voice account, listened to messages to get the name, then taunted him with it and threatened to call her.
First this guy and then James Damore, Google hires some real winners...
"When information is power, privacy is freedom" - Jah-Wren Ryel
This story stinks of hand waving. Just because someone realizes that "account access" means "account access", doesn't mean it's high level access. When you add finer grained controls, you get middle tech who's sole job is to vet access (now the lower level just performs a bit of social engineering and it's old status quo).
David Barksdale's story is a low level employee with low level access. If the application needs frequent adjustment at the account level, of course you hire a bunch of cheaper-than-average labor to perform the routine tasks. This generally includes broad access to the application, because customers expect that access to be available to the vendor of the service. The customer not recognizing how they are probably the common case that was farmed out, is not cause for alarm. It's a pragmatic approach, which is why it's always been this way.
Often wrong but never in doubt.
I am Jack9.
Everyone knows me.
Not that that means much but I was not much older and had access to plenty of stuff but no impulse to do anything bad.
Back in the old days, the local Bastard Operator From Hell could read all of your mail on the local system. Now, Google is the global bastard reading the mail of everyone in the world.
The people demand centralized monopolies. This is what the people get.
the CEO must review all code and deploy to machines... otherwise if you're writing code and deploying, you already have access to everything.
>Twitter has 3,898 employees, according to Wikipedia, for 330 million monthly users
Both Twitter and Facebook outsourced "user operations teams" in god forsaken places like Algiers, Albania, Tunis and so on.
They do dirty stuff like porn filtering, and banning
I've had lots of high level access over the years because I need it to do my job. I've also seen lots of overworked, overtired people in charge of massively important systems because in theory the work isn't that hard. The thing is, if you pay somebody minimum wage they live like somebody making minimum wage. Meaning their lives are a never ending parade of problems they can't solve. They're going to make mistakes, and you're going to pay for them. The only question is do you save more money by paying them like crap than you do cleaning up the mistakes. Depress wages far enough and the answer is 'yes'.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Maids clean rooms of VIP's.
I see many other posts making the same point, and I'll add my specific story from the 1980s.
In 1987, I was doing some work for a local chain of auto-body shops that had some software to do job pricing. In the process of understanding how the business worked, I got to know some of the guys who did sheet metal, welding, body repair, mechanical, etc. These were your typical blue-collar young males for the most part.
In the corner of the main shop area there was a dedicated terminal (VT100ish) and modem for connecting to the state DMV mainframe, where you could do basic queries. There were a couple legit uses for it, which is why the shop had it, but the only time I saw it used was by a couple of the guys who would enter the license plate number of cars they saw driven by pretty women, to pull up the registration info to find out the names and addresses of the car's owner. No checks or balances or access control; the logon info was taped on the side of the terminal. Any access logs would have been somewhere in Austin.
Totally creepy stuff then, still creepy 30 years later.
Level of employment does not equal trustworthiness of employees. In fact, often the higher you go the worse they get.
In engineering school, that major didn't exist - nor does it anywhere. Is it like a "Sanitation Engineer"?
Or "software engineer"? Or "domestic engineer"?
I get calls all the time form recruiters saying I'm an engineer. I say, "No. I'm a programmer."
"Oh, we're looking for engineers."
"My bad. I just read specs and develop software according to those specs."
"OHHHHHH! You are a software engineer!"
"I am?!"
"Yes!"
"OK. So, what's a programmer?"
"He's someone who takes specs and implements them in the programming language of choice."
"Ah. So, what's a software engineer?"
"He's someone who takes specs and implements in the programming language of choice using engineering principles."
"Ok. So, Thermo is involved?"
"What do you mean by 'Thermo'?"?
"Never mind. So, whatever - programmer, engineer, god, ....whatever the title is, I'll take the job."
"You have a problem with your attitude."
"....."
This is not surprising in the least. On a physical level, the person who likely has the most access is the janitor or cleaning staff.
Almost any access can be abused, if someone feels vindictive enough. An electrical worker can toss a dead rat in an opened panel, and the arc flash likely would take out a good amount of power in the building.
Having access controls to minimize things are critical, but even with those in place, there is a point where the problem changes from a technological issue to a HR issue, of why someone is that pissed and vindictive in the first place... and why they were cleared for access.
Hence they need "high level" access. This is well-known and unlikely to change.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Great Jeebus Almighty. People have insisted on giving all human communication to either Google or Facebook. Email for example used to be distributed - if your local BOFH was malicious, at least he didn't have access to the entire world's email, at once. But no, that wasn't good for the mouth breathing masses. Everyone insisted that a couple of advertising companies should get access to everything. All email, all instant messages, all voice chat.
Because, of course, advertising companies have our best interest in mind, I guess?
Stop centralizing what was designed to be a decentralized network already.
The ability to login to a customer's account and check basic information to verify identity, reset a password, or turn off an account is NOT high-level access.
Minimum wage customer service representatives REQUIRE this level of access to customers' accounts to answer basic support requests or investigate problems. When Xyzuser calls in or e-mails to request their account disabled or request a troubleshooting assist, some low-level user is going to answer this request.
There's no way around that, other than companies SHOULD be very tight with auditing, and make sure to challenge any action on a customer account that doesn't have an explanation and a support ticket opened by someone else.
Was asked to give a relatively low level employee administrative access to a system of ours facing customers. I thought it was a test, so I refused. Then got escalated to executives and had to relent. It didn't have any sensitive data on it, but the integrity of the data was important.
Of course prior to relenting, I took all legitimate content update channels offline, made a backup, and then blew the system away and restored from backup when that employee was done, to be extra paranoid.
This isn't high level access. High level access means telecom, email and backup files of senior execs, possibly access to the people in question to support them, proximity to their cubes, permission to listen in on board meetings, that sort of thing. These high level employees aren't usually very good with data (or any more discrete), you probably wouldn't necessarily want them managing it.
It's all necessarily low level access. But clearly they are not protecting customer data well, or putting a high value on privacy.
This is why every single snot nosed kid straight of school who think he's getting access to admin accounts and production environments is told in no uncertain terms they've done NOTHING to earn such access and won't be getting it any time soon.
There is nothing more pathetic than some 20 year old who thinks having a Linux box at home qualifies him to have the keys to a server which is mission critical. Son, you've yet to demonstrate anything which would cause me to entrust you with this, so we'll start small.
The reality is I've seen far too many people who have been in the industry for quite a while do stupid things against a prod environment or with admin access because they think they know it all or that everything will be fine -- because they've never fully appreciated the risks involved. The kids straight out of school? They haven't the slightest concept that these things aren't toys to go on joyrides with.
I work in regulated industries where outages cost tens of millions of dollars per hour and can lead to fines or possibly risk lives. One day, when you're all grown up and have proven you have the skills and the level of paranoia required to drive the big boy bus, we'll see ... but please don't ask me again why I'm not willing to let you take it out for a spin when the last simple task you tried to do you screwed up.
We once hired someone who claimed to be an admin, but couldn't do simple tasks on unimportant systems, and then whined incessantly when we refused to give him access to the important systems. He utterly failed to grasp that he hadn't earned the level of trust required. (In fact he never did because he was truly useless.)
It continues to amaze me how many people with no proven experience think it's their right to go in an tinker with mission critical things just because it's there, and it absolutely terrifies me how many companies actually hand over access to such people.
My managers expect me to be the grumpy old man when it comes to access, because the cost of fucking up can be huge. And on several occasions some higher level manager has overruled me, allowed someone access, and that person has broken something they never should have been touching.
There are places where "oops" should be limited to spilling coffee on your shirt, but not for anything to do with the running systems. Because the consequences can be mind boggling.
It takes time to understand that ze blinken' lights are nicht fer de fingerpoken by dumbkoffen.
I work for a well-known financial company. I guarantee you that if I accessed the information of any even marginally well known celebrity, public figure, even a notable individual, I would be asked why and expected to offer clear evidence of the need. I occasionally see personally identifiable information for any of our clients, and I do not pursue any I happen to come across that I recognize, and of course I would not.
I would also be asked if I accessed MY information - that usually results in one warning. Then dismissal.
But it's evident these Internet companies haven't worked out the confidentiality protections they should have in place, and so we read these reports. Kinda sad.
deleting the extra space after periods so i can stay relevant, yeah.
Every website or service I've ever supported allowed the tier one support to disable an account. That's not the same as deleting an account and in many cases it's essential.
Take Twitter: If an account is taken over and used for malicious purposes, you want the first level support to be able to freeze it without having to go through a bunch of checks. That's not really that high a level of power, it's what's required to do the job.
The Daddy casts sleep on the Baby. The Baby resists!
Think Bradley/Chelsea Manning an E-4 specialist who was entrusted with access to an astonishing breadth of sensitive information. Manning was, according to other soldiers, bullied to the point of a nervous breakdown during basic training, and yet even after that they moved him (as she was then) right into training as an intelligence analyst.
Assange cultivated Manning with methods anyone who'd read a LeCarré novel: pick out someone emotionally vulnerable and work to gain their trust.
Somebody's got to handle the grunt work of managing sensitive information, either in the military or private sector; but it's not going to be someone who spent four years at West Point or getting an engineering degree. But just because a job doesn't require *those* particular credentials doesn't mean anyone can or should do it.
The problem isn't that low level people have access to sensitive information; the problem is that organizations are sloppy about hiring people for those positions because they aren't high status jobs.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
I don't think the problem is "tech companies have a history of giving low level employees high level access".
I think the issue is "tech companies give many employees priviliges to do things because it works, and then those things have unexpectedly important consequences that weren't realized because it's a young company doing something no one else did before".
At Uber, employees regularly abused its "God View" mode to spy on the movements of celebrities, politicians, and even ex-spouses.
And, yea, on the Seventh day, God saw that the driver was at 5th and Elm and that it was Good. (... insert chanting in Latin ... )
It must have been something you assimilated. . . .
customer service can get to script driven and some cases all users must hit level 1 first. Also there can be a push to give all customer service the rights to do basic on/offs so they can do a quick fix.
Many years ago I was a entry level Data Tech that started at a very tender young age at a now very big tech company. Most of the time we were the ones doing the system level troubleshooting that required high level access, we did all the troubleshooting from oracle DB performance issues, to fixing the entire phone systems when it would crash on the weekends. We had global sudoers access, we had the master local passwords for all of the network gear, and we had a bunch more access. The only access we didn't have was to some web only tools, we got around that by just logging onto the systems that host the tools and putting together the data the hard way ourselves (fully encouraged by management, in their words "do what you need to, to get work done, but don't break it.") To be fair the company has always had a permissions system that prevented access to certain things, but you only needed to be a member of three different groups to get global sudoers access and with the pace of growth and no standardization at the company there was no way to grant us restricted access while also giving us access to do our jobs.
We had high level access for a number of years, until the company started securing everything. Then we started finding out, oh, hey we couldn't do half the jobs service owners came to expect of us when they started clamping down. Then they had to remove the restrictions. It was a constant pull. In full disclosure, after a couple year effort the company finally fully fixed their permissions issue for troubleshooting issues by lower level employees, but they had to take a lot of job duties away from these employees.
This isn't something easily fixed at growing tech companies. Often times you need this access to do work, because their is no standardization of access for support staff. As these companies grow fast it is very overwhelming to implement a lot of access restrictions for core low level employees.
For starters, let me state that it's my opinion that this Google person did something truly disgusting.
But what I find even more disgusting is that this person is mentioned with his full name in global, regular media. He is only 27 years old. He has to work for about 40 more years. Was it really neccessary to destroy his life over this? I don't think so.
Where I live it is common that even the heaviest criminals' identities are protected. More often than not only their first name and the first letter of the last name is mentioned in newspapers. Even though that can be quite enraging (imagine a serial rapist operating in your neighbourhood), it at least allows them to ever return to a normal life after they've done their sentence (nasty fine, jail time, etc.).
If we as a society don't think that (in general) they're allowed a normal life after having done something stupid (however disgusting), we might as well execute them immediately and get rid of jails altogether because that's a lot cheaper and at least we'd be sure they will never make the same mistake again.
I'll get off my soap box now :-)
There are many very boring and mundane things that require elevated privileges.
Creating accounts
Granting permissions
Patching servers
etc.
In fact, it's deadly dull and a complete pain in the ass.
Not stuff that would really keep some senior technical employee interested.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
It's more the rank and file IT guys that keep the servers running that they're talking about. Actually, the software engineers tend to have almost no access at all since 90% of what they do gets done in test environments and then pushed to production.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
You've got to pay people enough so that they can have a stable life. One where they're car doesn't break down all the time and they're not spending weekends and nights driving Uber to make rent. Even the most competent person is going to start making mistakes if they spend 50/hr week at their job and another 40/wk putting out fires in their personal life caused by a lack of resources.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I assume you mean front line or customer facing. So thank you for showing your contempt for these people msmash.
You have to give these people all these powers but ideally you audit them and have a way of backing out any changes they make. (The only thing I can think of that you really can't back out of a system is if someone reports you dead to the credit bureau. Sorry Jesus). The admins, programmers and anyone else who has access to the raw data generally are not audited.
Lets just hope he wasn't able to use his access to create a communications network for a drug gang that the police couldn't listen in without some sort of court approved measure.
So on this note, how much access do you all have at your company and where do you sit in the corporate food chain ?
Me, I'm just a faceless employee. One who has enable mode access to nearly every router and switch ( even the core systems ) in the entire company. Scary level of power if you think about it.
Someone has to do the work though and it certainly isn't going to be some executive type who wouldn't know what an enable mode prompt looked like if you threw it at them.
So, many tech companies ( especially the 500lb gorilla sized ones ) don't have a lot of choice.
We can't all be executives and the work still needs to get done.
Without volunteers, conscription would take its place. Ask the folks who fought in Vietnam how they felt about it.
Be happy there are volunteers.
You want an oncall person to be able to quickly stop a contraversy or even a legal liability to the company. So if a Twitter employer sees a lot of crap coming out a high profile account, you want to be able to quickly shut it off to limit damage.
Oh wait...
Having 2 low level employees needed to approve significant changes, instead of a lone actor would improve the situation. That way the person would have to convince one of their coworkers. If they are just doing their job, a coworker will quickly agree. If the action is obviously malicious, they won't agree and may report them cause they don't want to get in trouble too.