Google Engineer Spied On Teen Users 338
bonch writes "Former Google employee David Barksdale accessed user accounts to spy on call logs, chat transcripts, contact lists. As a Site Reliability Engineer, Barksdale had access to the company's most sensitive information and even unblocked himself from a teen's buddy list. He met the minors through a Seattle technology group. Angry parents cut off contact with him and complained to Google, who quietly fired him."
All the data on Google (Score:3, Insightful)
And not only call logs, chat transcripts and contact lists. The article notes:
he pulled up the person's email account, contact list, chat transcripts, Google Voice call logs—even a list of other Gmail addresses that the friend had registered but didn't think were linked to their main account—within seconds.
So even if you think logging out and making a new separate account is enough, it's all linked
And what about Google Analytics and everything else? They can see everywhere you've been on the internet, and obviously abuse it.
More than enough reason for no business (Score:2)
to store any business e-mail on their servers and no one with any e-mail which has real world value.
Sorry, but if they can read my e-mail account on GMail without my permission, as in my password, then there is zero security regardless of what all their policies and procedures declare. They should just step up and encrypt all of it using the user's password as part of the key, if not that then automated systems which send e-mail to an audit team, the user, and anyone the user designates, when access by SQL
Re:More than enough reason for no business (Score:4, Insightful)
Then they couldn't index it for advertisement, which is Google's business
Re:More than enough reason for no business (Score:4, Informative)
More than enough reason for no business to store any business e-mail on their servers and no one with any e-mail which has real world value.
You are basically suggesting that no one uses the Internet anymore. End-to-end encryption aside, there will always be a system administrator with the technical ability to snoop data stored or in transfer. The only reason you can slam Google here is because they actually caught the guy.
Re:More than enough reason for no business (Score:5, Insightful)
Exactly... any admin worth their position could extract similar information from their corporate network. This was an inside job like any other inside job. It's only news because it is Google.
If this has been an admin of Facebook or MySpace it would have had similar impact. It should be no surprise that any information you give to a company is available to their admins to use or abuse.
Re: (Score:2)
No, if it had been Facebook or MySpace, it wouldn't be a surprise. Dumb-ass kids willfully give up information which could be used to harm them in some way, including "cyber stalking" (its new cause its on the innernets!), and you don't even have to be an employee of the company to perform it. Chances are there are enough holes in the Facebook API that someone could find a way to force an unblock action for themselves.
Of course, no, this doesn't really surprise me either. But, I deleted my Google account
Re: (Score:3, Interesting)
And yet here I see you on Slashdot. As an unsubscribed plain old user, I can find:
- Your last few comments
- The last few stories you've submitted
- Your Slashdot friends / fans / foes
- Their comments / stories / etc
I'm not trying very hard, and I'm certainly not a data miner, but I'd guess even that amount of data would be enough to put something together about you -- at least a vague sense of your interests and disinterests. And how much more information would the Slashdot admins have about you? All they
Re:More than enough reason for no business (Score:5, Interesting)
Re: (Score:3, Insightful)
good, gave him the tools/;info to handle it himself and it worked out better.
Re:Youth culture run amok. (Score:4, Insightful)
In other words he is acting like a teenager.
Once you grow up, the term becomes "sociopath."
Re: (Score:3, Insightful)
I was not defending Google, I was only stating that SOMEONE on the inside of every company has access to things that could be dangerous in the wrong hands, even your bank of choice. That being said, the problem isn't that someone has access, the problem is that they need to better screen their employees and their behavior to discourage this sort of thing.
This kind of idiotic move happens all the time and people get fired over it. I read recently about a school principal viewing porn on his computer at wor
Re:And let the defense of Google begin (Score:4, Insightful)
What happened around here? Slashdot used to be so pro-privacy as a matter of principle. We're supposed to ignore a huge breach of trust at Google because it happens elsewhere? Nobody else has the enormous amount of data that Google has on you. Think about it.
We're on different pages. This isn't a breach of privacy by Google the company, it is by this individual. Google has policies already in place against this behavior and does not condone or promote it. What else could you possibly expect them to do as a company?
Additionally, you (or whomever) gave your information to Google by using their services. People inside Google have access to that information you willingly gave them (duh). Someone within that inner circle violated Google's policies for people within that inner circle. That person was fired. There is no way for Google to completely prevent this sort of thing from happening, they can only monitor and react.
If you do not want this to happen to you then do not use Google's services. But don't go on the Internet and use publicly available (and free) services and then expect anything other than your "privacy" being violated.
Re:More than enough reason for no business (Score:5, Insightful)
It was not Google who caught the guy which is what is worrying in this case, it was the parents of the kids involved.
I would have expected a shop of their size to have proper security and use at least some of their precious IPR on log analysis.
Re:More than enough reason for no business (Score:5, Insightful)
I dunno, at places I've been the low-level sysadmin access is not very closely monitored. "Official" access through the normal APIs is logged and monitored, but when the Unix sysadmin has root on the database machine, he could be grepping through the database for all anybody knows.
Re: (Score:2)
If your email is cleartext, then there's always someone that can read it, no matter what the environment is. You can chose GPG/PGP, SSL, and various other things to solve this problem, but if *you choose* to cleartext, the problem will always exist.
I can read my bosses emails... doesn't seem at all right to me, but I need to have that access to maintain the mailserver. I'd suggest encryption, but nobody can be bothered to bother with it. Even when they do, it's only for that one email in a year, so
Their IMAP is slow though (Score:2)
Re: (Score:2)
Exactly. Unencrypted email is just shouting something into a crowded party and hoping only the person you're addressing listens.
Re: (Score:2, Informative)
"...So even if you think logging out and making a new separate account is enough, it's all linked"
That's relatively easy to get around. Create your initial gmail account on 1 machine using a particular ISP, and create your second acct by using a different computing device(like a droid) on another ISP. Of course, you must remember to never use one machine to check both accounts. It takes dicipline, but it an be done.
I have a gmail account that I created on Comcast with my home desktop, and a completely diffe
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Even better, DON'T USE GMAIL for your private and sensitive info....
Even better, don't store your private and sensitive info in plain text on the Internet.
If your email is more sensitive than a postcard use PGP/GPG to provide reasonable security. And if it's too sensitive to have a copy stored on someone else's servers either host it yourself or keep a physical copy in a safe instead.
Do No Evil (Score:5, Insightful)
Re:Do No Evil (Score:5, Insightful)
Re:Do No Evil (Score:5, Insightful)
Unless he is charged and convicted, let's not hang a man in the realm of public opinion. He was fired, and hopefully he learned something.
Re: (Score:3, Funny)
...let's not hang a man in the realm of public opinion...
You're new here, aren't you?
Re:Do No Evil (Score:5, Funny)
So new that Slashdot hasn't had time to assign them a user ID.
Re: (Score:2)
So new that Slashdot hasn't had time to assign them a user ID.
Anonymous Coward's UID is 666 [slashdot.org], you can't go much lower.
Re: (Score:2)
>>>Unless he is charged and convicted, let's not hang a man in the realm of public opinion
Me too:
If this is my competition, I have nothing to worry about.
Re: (Score:3, Interesting)
And the quietly letting him go rather than warning others about this persons actions is ... whose policy?
I expect that quietly means "no media coverage". I guess that, internally, word spread pretty quickly why he was being let go.
Re: (Score:2)
Despite "no media coverage", it landed on /.
Re: (Score:2)
The shareholders'.
Re:Do No Evil (Score:4, Funny)
Re:Do No Evil (Score:5, Informative)
Holy shit, Pope Benedict must be a majority shareholder at Google!
It said quietly fired, not quietly transferred to a different regional office.
Re: (Score:3, Interesting)
Not to mention, the people he spied on weren't threatened with Hell if they ever spoke of it.
Re:Do No Evil (Score:4, Insightful)
Re: (Score:2)
He no longer has access to Google. He's no longer in the program where he first met the teens. What else would you want them to do? Reading the article it does not seem that he did anything illegal that the police can charge. His position allowed him to access the information but he violated the company policies.
That's the thing isn't it ... besides, good luck finding another job administering anything more than the computers in a dentist's office. Some people want to jump on the "Do No Evil" bandwagon here but I don't think that's the case. Stupid or bad people sometimes get into positions of responsibility. Google got rid of the man promptly, which I think was the right thing to do here. Besides, given all the laws we now have on the books regarding this kind of thing, my guess is this guy will get charged with s
Re: (Score:3, Interesting)
Speaking of which, Newt recently cleared the bar at 18 feet, elevating "Luo tribesman" into the neo-conservative N-word lexicon in a single bound.
These people hate Michael Moore with a passion, so why do they expend so much energy making him sound like an intelligent man? As Mr Moore pointed out, it is obvious to anyone who has ever cracked open an American history book, American was founded on the sentiment of anti-colonialism (only when
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Re:Do No Evil (Score:4, Insightful)
People seem to be taking my point about quietly letting him go to mean that Google should have issued a press release or made a public announcement - no, that's not what I am suggesting, but its quite apt since reporting this matter to the authorities would have been akin to making a public announcement.
Re:Do No Evil (Score:4, Insightful)
Are those crimes, though? "Lock him up!" "But he didn't commit a crime." "Would you make the same excuse if he HAD committed a crime?" "Huh?"
Re: (Score:2)
Your little dialog between two anonymous people assumes that he didn't commit a crime and uses that supposition to suggest that saying his actions should be referred to the authorities is wrong - my stance is that his actions are definitely morally and ethically wrong, and could indeed
I'm pretty sure Google has lawyers (Score:2)
I'm pretty sure Google has lawyers. Furthermore, I'm pretty sure they were involved in the firing of this guy.
I think it's pretty silly and disingenuous to suggest that anyone, especially a company, should report unethical behavior to the authorities and let them sort it out whether or not it's illegal, especially when it's pretty likely that it's not. Again, we're not talking about someone stealing credit card numbers, which is clearly a crime. (And which, if I'm not mistaken, would require them to repo
Report him for what? (Score:2)
Referred for what? As far as I can tell, the guy didn't do anything illegal. Creepy? Oh, hell, yeah, but illegal?
Fact is, I know that when I send and receive e-mail via Google, there are people in the company that has access to that stuff. I run a few web sites myself, and I hope that people understand that with root access to the server, I have access to everything they do, also. I even go so far as to point that out now and then. But I'm a pretty
Re: (Score:2)
mod +1 insightful
Always a concern (Score:5, Interesting)
You never know who is watching or listening in. People don't realize that every single thing they do online can, at some point along the pipe, be potentially seen by someone.
Not just online (Score:2)
Re: (Score:2, Interesting)
Re: (Score:2)
What's so hard about hooking a speaker up to the phone line? ;)
Re:Always a concern (Score:4, Insightful)
People don't realize that every single thing they do online can, at some point along the pipe, be potentially seen by someone.
Not if you're using end-to-end encryption without a public CA. Computer scientists have known this since 1977 and end-users have had tools since at least 1991. Key distribution is still hard, so it's not quite popular. We could really use some apps that securely exchange keys via phone "bumps".
Re: (Score:2)
And I don't think you read what he wrote:
Re:Always a concern (Score:5, Interesting)
An old friend of mine used to work for a high clearance group out in Colorado someplace. This is going back to 1995'sh... He has since gone silent (No contacts) , but I remember one conversation that we had had where he warned:
"If you want it to be a secret you better keep it in your head. Don't write it down, don't email it, don't call on the phone... Because if they want, they can know." (Paraphrased from so long ago...) But you get the point.
It was true then and even more so now. Who are "They"? Well, that's the problem... in 1995 I presumed it was the Federal Government that could disseminate the information to state/local. And under Homeland Security we do have "FUSION CENTERS" so you know that happens. But also it seems corporations of large magnitude can fall into it. If it is for "research, Statistics & Administration" then big whoop, but obviously it is a big temptation for people to abuse it once they are on the "inside."
Case in point would be Crystal Bowersox. She had her privacy violated multiple times in Ohio. Probably by people paid to dig up dirt for tabloids or something, but just like Google, Creepy.
http://www.dispatchpolitics.com/live/content/local_news/stories/2010/09/09/copy/ohio-apologized-to-idol-star-for-illegal-snooping.html?adsec=politics&sid=101 [dispatchpolitics.com]
http://content.usatoday.com/communities/idolchatter/post/2010/09/crystal-bowersoxs-privacy-breached-by-ohio-officials/1 [usatoday.com]
http://marquee.blogs.cnn.com/2010/09/09/ohio-apologizes-to-crystal-bowersox-for-security-breach/ [cnn.com]
http://www.google.com/hostednews/ap/article/ALeqM5i_29YKZdSnooBzedGCwrNGaqfyDgD9I4IR7G1 [google.com]
http://au.eonline.com/uberblog/b199540_why_were_cops_snooping_on_idols_crystal.html [eonline.com]
Happens on every website. (Score:3, Insightful)
Someone always has access to the data, and they're going to look at it at some point. The expectation that no one will be nosey when they're bored one day is just naivety (or stupidity). In this case the motivation is a bit creepier but on other websites people will be looking through "private" data when they're bored - be it Facebook messages, Twitter DMs, GMail emails, or Slashdot private journals.
If you want it to remain secure and unread by other people, don't put it where other people might access it.
Re: (Score:2)
If you want it to remain secure and unread by other people, don't put it where other people might access it.
This is Google. They drive up and take pictures of your house.
Re:Happens on every website. (Score:5, Insightful)
OMG! Pictures of my house, on a public street, where thousands of people can drive by and see it? MY PRIVACY IS RUINED! I might as well post my SSN on the Internet now!
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
Many people have gotten fines from evidence collected on google earth. Specifically swimming pools that don't meet zoning, that would not be visible from public view (only satellite or airplane).
http://www.switched.com/2010/08/02/long-island-town-uses-google-earth-to-find-rogue-swimming-pools/ [switched.com]
Re: (Score:2)
I think it's a matter of how many people have access to that information. While it's not "private", now people are shocked that that information can be stored and kept literally forever and searched by many.
Walking down the street talking on a cell phone is fairly private even though you are in a public place because people will tone you out, forget about what you said, or only catch parts of your conversation. However, if someone followed you around with a microphone you might get pissed off.
Re: (Score:2)
People will be looking through "private" data when they're bored - be it Facebook messages, Twitter DMs, GMail emails, or Slashdot private journals.
In the latter case they usually run out screaming "aaaaaghhhh...." never to be seen again. Access logs show they have been reading a file named "CowboyNeal's sexual fantasies".
Re: (Score:3, Informative)
In this case the motivation is a bit creepier...
Well, if the linked article has its guesses and quotes correct then it seems this guy was just trying to show off with his neat GEP (Google Employee Powers) and overstepped privacy boundaries doing so. Now, IMHO this is generally worse than just being curious or "nosey[sic]" but probably not creepier (I worked tech support just after college and I saw more than one "curious" co-worker search the customer database for members of the opposite sex who happened to live in the same city as we were in and who had
TFA firewalled off here (Score:3, Informative)
But I found anotherFA. [computerworld.com]
Re: (Score:2, Informative)
according to this FA, it wasn't some creepy stalker type deal.
He found a techie group and wanted to impress them with his 'haxor' skills. It probably didn't come out until later that he worked for Google. It was a stupid move and an abuse of power, but it wasn't something as creepy as the original post here makes it sound.
"Barksdale's harassment did not appear to be sexual in nature, although ... [he] demonstrated extraordinarily questionable judgment. ... It seems part of the reason ... was to show off the
Big Google is watching (Score:3, Insightful)
Duh (Score:5, Interesting)
Young single male admins at companies like Google and Yahoo are golden contacts. If you are looking to research something, they can help. For a price.
Re: (Score:3, Funny)
"Research something" or "Research something"?
Come on... (Score:5, Funny)
...the question is: what's his
This just in! (Score:4, Insightful)
Individual person does nefarious actions -- name of company he works for used in title of news article for salacious reasons. More at 11.
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
Barring not letting any employee see protected user data (a completely unreasonable practice), I don't see how this could have been prevented.
If simple forms and NDA's are good enough for HIPPA, it's good enough for Google.
Re: (Score:3, Insightful)
Re:This just in! (Score:4, Insightful)
Re: (Score:3, Interesting)
And what company do you think exists where nobody has access to this sort of information?
If your logic is "anything than[sic] can happen, will happen" then it is happening everywhere. You're out of luck.
Google knew something was wrong... (Score:2)
wonder if he did it for the lullz (Score:2)
Cannot really be prevented (Score:5, Insightful)
As anybody with real system administration experience knows, what protects user privacy is that you do not look at their data without explicit permission. That means people with this level of access have to have certain personality traits, and a high level of personal integrity is the most important one. I guess this is just another failed Google hiring process result.
What now needs to follow is criminal proceedings resulting in a a rather unpleasant punishment. Oh, wait, the US does not have working privacy laws...
Re: (Score:2)
"What now needs to follow is criminal proceedings "
Criminal proceedings for what? Reading some private stuff he legally had access to anyway and for wounding up some teens. Whats your verdict then judge? 30 years in max security?
Jeez, get a sense of perspective.
Re: (Score:2)
I'm sure a DA could get him on a variety of wiretapping, invasion of privacy, unauthorised access to a computer system, etc. charges.
Luckily for David Barksdale, creepy kiddy stalker (Score:4, Funny)
Re:Luckily for David Barksdale, creepy kiddy stalk (Score:4, Insightful)
So you'd be willing to try to ruin some guy you don't even know over 'evidence' in a three-line Slashdot blurb? You want to at least wait and see if actual charges are filed, let alone a guilty verdict? Talk about jumping to conclusions...
Surprise! (Score:4, Interesting)
The problem with this guy power-tripping on some kids, was not that he didn't give importance to people's privacy - which is apparently along the lines of the company's general mindset - but that he got caught for being stupid.
Re: (Score:3, Informative)
“If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”
"And it’s important, for example, that we’re all subject in the United States to the Patriot Act... "
The "Patriot Act" was given as just one example, not as the main reason. The old "security versus privacy."
define 'quiet' (Score:2, Insightful)
Google, who quietly fired him
Not as quietly as they might have hoped...
Anybody still up for The Cloud ? (Score:2)
This is a taste of things to come. Companies will do it. Subcontractors will do it. Employees will do it. Trainees will do it.
When you put your data out there... well, it's out there. Your choice. THis was Google's responsibility.. what was their punishment ? nothing.
Parents at Google lecture about child safety (Score:2)
Oops: Parents at Google in the US talking about child safety online [youtube.com], from the just-announced Google Family Safety Center [blogspot.com], apparently still in Beta.
Think of the children! (Score:2)
Well , it had to be said :)
Federal laws were violated (Score:3, Informative)
The exceptions outlined in voluntary 18 USC 2702 [cornell.edu] and mandatory 18 USC 2703 [cornell.edu] don't apply either.
If Google doesn't have a policy of handing privacy violations over to AUSA/Federal or local law enforcement then I would urge a review of Google's policies.
iso certification (Score:3, Interesting)
Isn't there some ISO 9000 rule (or other standard) that says that admins cannot look at user data? And why isn't google adhering to this standard?
Google screwed up (Score:3, Interesting)
Evidently, Google does not have a process controlling the access of user accounts by employees of the company. Google needs to stop ignoring the fact that it is dealing with increasingly more private information on individuals and that like other organizations with such information (think banks) it needs to develop a full fledged process (with well defined protocols, auditing, etc.) to ensure that any access to a user's private information is authorized and accounted for.
Google wants to think of itself as a technology company where process is a hindrance. Google is too big to continue thinking and acting like that.
I'm guessing Google will not deal with this particular problem until it gets sued.
Re: (Score:2)
You can't prevent access to the info without stopping them from doing their jobs. All you can do is severely limit the access, and strike whenever someone abuses the right.
Re: (Score:2)
Re:Did Google do enough? (Score:5, Insightful)
Re: (Score:3, Interesting)
I would think that it is similar to an EULA and maybe could be enforced. Also most companies have an acceptable use policy and people who violate it can be subject to civil pe
Re: (Score:2)
There's little you can do.
Administrators of IT systems almost always require - or can trivially gain - access to personal data at some point in order to do their jobs and while sometimes there are signs that point to it, you often have no idea who's going to flip and start abusing their power until they've already started doing it.
The best you can do it put detection and auditing mechanisms in place and ensure that you deal with an violators swiftly, but you're never going to entirely prevent it from happen
Re: (Score:2)
Google should of stepped it up a bit and sent this guy off to jail to set an example.
Uh ... what? You do realize that a publicly-held corporation is not a law enforcement agency or a court of law, and can't actually send anyone to jail? The guy was fired, the company reported the incident, and if the cops think they have anything on the guy that will stick they'll charge him with something. That's how it works. The best an employer can do is to co-operate with law enforcement.
Besides, if you're that concerned about people reading your emails, run your own server, it's not hard, and the s
Re: (Score:2)
who watches the watchers?
meta-voyeurs?
Re: (Score:2)
Smart and clever, sure. But immature and lacking self-esteem as well? That is a recipe for disaster, especially if you put them in a position of informational power.
A mature person, no matter how strange their thought processes, does not spy on the conversations of others (work purposes excepted), or brag about their hacking abilities. He may have had the smarts, but he didn't have the maturity for his position.
Google would do well to employ more older staff to help in this regard. This may not have hap
ah (Score:5, Funny)
...the fucking Cloud.