Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"GCreep: Google Engineer Stalked Teens, Spied on Chats (Updated)" http://gawker.com/5637234/

Not wholly sure what the outcome of the above was, but you could also fear google's employees if you were so inclined. Or anyone that had undue/inappropriate access to/sway with google's employees. They are only many thousands of humans after all.



"Not wholly sure what the outcome of the above was"

Did you actually read the complete article?

"We dismissed David Barksdale for breaking Google's strict internal privacy policies. We carefully control the number of employees who have access to our systems, and we regularly upgrade our security controls–for example, we are significantly increasing the amount of time we spend auditing our logs to ensure those controls are effective. That said, a limited number of people will always need to access these systems if we are to operate them properly–which is why we take any breach so seriously."

I can tell you that privacy is taken very seriously within the company and that access to PII (Personally Identifiable Information) is quite restricted and access to it is logged and monitored.


I read it some time ago. In the case above, it had to be brought to google's attention and so I would say the logging and monitoring is not invincible. Who polices your log access monitors? I understand that gmail is somewhat distributed and policing remote sites in poorer areas is problematic - especially if one were to consider how much easier it would be to persuade google employees in those areas, should gmail/g+ be offshored in the future.

Should have elaborated: I'm not sure if a civil/criminal proceeding arose out of the case above.


"In the case above, it had to be brought to google's attention and so I would say the logging and monitoring is not invincible."

The answer is right in the blurb that I posted: "...for example, we are significantly increasing the amount of time we spend auditing our logs to ensure those controls are effective..."

In other words, this incident pointed out a weakness in the system and it is being addressed. From personal experience I can tell you that it is - in fact - being addressed and more controls and monitoring have been rolled out and more are being rolled out. I don't feel comfortable going into details, but from the perspective of a working engineer I have both had conversations about this with senior VPs and have had to do work to comply with the new controls (and have more work planned in the upcoming quarter to be compatible with upcoming controls that are even stronger).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: