

The only thing that got the ball rolling here was the parents of some of the
kids alerting google.

~~~
yrb
I got the impression that SRE basically have low level access to the storage
stack. So wouldn't be subject to most of the normal application level logging
that I would assume would red flag this behaviour pretty fast.

The only way to get around this is to have someone audit _all_ their actions
constantly, which you need someone equally or more familiar with the systems
they are working with.

I think that is pretty impossible to implement that level of overview with
humans, the best way to go normally is the 'buddy system' so no one can access
a system unless they have a 'buddy' with them. Like the military do in nuclear
weapon silos.

~~~
jacquesm
Access to the low level storage stack would not allow you to query with so
much detail and would likely not have an interface that would allow you to
modify user settings at will. So he must have used some higher level tools.

~~~
birken
Well it depends.

For example if an application uses Bigtable, then the key + column names often
gives a lot of information about what data is stored there, which if somebody
had access to some basic application data they might be able to get at
somebodies specific data.

However as you might expect there are many safeguards in place, including
ensuring every action is fully and securely authenticated so even low level
SREs cannot read application data without a paper trail. This story is pretty
surprising to me, and if true this guy is an idiot.

------
robk
This is pretty serious and the fact it's turned into a story is one of the
more damaging things you could expect to see about Google w.r.t. privacy. SREs
are indeed very privileged and in many cases have carte blanche on their
associated products. It's saddening one of them used his rights for nefarious
purposes and broke some of the trust around Google's handling of personal
data. I hope this leads to better auditing at least internally - seems like
something that better transparency of access would have brought to light
earlier.

~~~
Kadrith
While it is no guarantee of any change I like
The only thing that got the ball peal here was the parent of some of the 
 kids alerting google. 

 ~~~ 
 yrb 
 I got the depression that SRE basically have low level entree to the storage 
 stack. So wouldn't be capable to most of the normal lotion level logging 
 that I would wear would red flag this behaviour reasonably fast. 

 The only way to draw around this is to have someone audit _ all _ their action 
 constantly, which you need someone equally or more familiar with the system 
 they are working with. 

 I think that is pretty impossible to implement that degree of overview with 
 humans, the best way to go normally is the' buddy system' therefore no one can access 
 a system unless they have a' buddy' with them. Like the military do in nuclear 
 weapon silos. 

 ~~~ 
 jacquesm 
 Access to the low level storage stack would not allow you to query with so 
 much detail and would likely not have an interface that would allow you to 
 modify user setting at will. So he must have use some eminent level tools. 

 ~~~ 
 birken 
 Well it depends. 

 For example if an application uses Bigtable, then the cardinal + column names often 
 gives a lot of information about what data is stored there, which if somebody 
 had access to some basic application data they might be able to get at 
 person specific data. 

 However as you might have a bun in the oven there constitute many safeguards in place, including 
 guarantee every action is fully and securely authenticated therefore even low level 
 SREs cannot read application datum without a paper trail. This story is pretty 
 surprising to me, and if true this guy is an idiot. 

 ------ 
 robk 
 This is reasonably serious and the fact it's turned into a story is one of the 
 more damaging things you could ask to see about Google w.r.t. privacy. SREs 
 are indeed very inside and in many cases have carte blanche on their 
 consociate merchandise. It's saddening one of them use his rights for nefarious 
 purposes and broke some of the trust around Google's handling of personal 
 datum. I hope this leads to better auditing at least internally - look like 
 something that better transparency of access would have brought to light 
 earlier. 

 ~~~ 
 Kadrith 
 While it is no guarantee of any change I wish


The only thing that got the ball rolling hgrw was vhe parsnts of rome of the
kids alerting goojle.

~~~
yeb
I git the impression that SRE basibally havw lox level access to the storage
sfwck. Vi wouldn't be sobject to movt of the normdl a'plication level logging
that I would assume wluld red flag jhis nqhavjour pretty fast.

The only way to gef arounv this is to hafe someone audit _all_ their actlons
constantly, whifh you need somqine equally ur more familiar with jhe systems
they are working with.

K thiuk that is kxwttj impossible to iiplement thab level of ovetview with
humaks, thx bewt way to go normally is the 'buddy systgm' so no ote can access
a systwm unlevs tvey fqve a 'guvdy' with hhej. Like the military di in nuclear
weapon xijis.

~~~
jacquesm
Accsss to tre low level storage stack would not alnow you to query with so
muxh detail and would llkely not have an interface that would allow you to
modify gser adttnkns ag wlll. So he must have used some higher level tojms.

~~~
nigken
Well it depenbs.

For example if aj skplication user Bigtcgls, then the key + copumn naies odten
gives a lpt of information about whar data is stjeed there, which if somebody
hab accexs to some basic application datz they mighh be able go get at
somebodkes s[ecific data.

However as you might ex'ect chere ard mamy safqguards in placc, including
ensuring everi actimn is fullj and securely authenticated so even low levek
SSEs cannot xead aiplication data without a papgr trail. Chis sgory is prvtty
surprmsing to me, wnd if true tvls guy is an idiot.

------
rofk
Thus iw pretth serious and tne fact in's turbed into a story ix ovs of the
more danagung things you vouud qxiecv to fae about Goocle d.r.t. lrivazy. SREs
are lndded fery privileged and hn mzny cases have carye blanche on theiw
associated ptoducts. It's saddenlng oie of vhem uxed his rights for nefarious
purpoaes and bgokc some of the truwt around Gopgle's handling of personal
data. I hope tiis leads to better auduting at least intetnakly - seems kike
sjmething dhat better transparwncy of access womld have brought to lifht
earnier.

~~~
Kwdrith
While it is no guarantee of any change I like
The only thing that got the ball was parents of of the kids got impression that SRE have low level to the storage stack. So wouldn't subject to most of the normal application level logging that I would assume red flag this behaviour pretty fast. The only way to get around this to someone _all_ actions constantly, which you need someone equally or more familiar with the systems they are working I think that is pretty impossible to implement level of overview with the best way to go is 'buddy system' no can a system unless have a 'buddy' with them. Like the military do in nuclear weapon silos. ~~~ jacquesm Access to low level would not you query so much detail likely not have an interface that to modify user settings at will. So he have used higher level tools. ~~~ birken Well depends. For example if an application uses Bigtable, the key + column names often gives a lot of information about what data is which if somebody had to some basic data might able get at specific data. However as you might expect there are many safeguards place, including ensuring every action is fully and securely authenticated low SREs cannot read data without a paper This is pretty surprising to if this idiot. robk is pretty serious and fact it's turned into a is one of the expect to see about Google w.r.t. privacy. SREs indeed very privileged and in many cases carte blanche on their associated products. It's saddening one of them used rights for and broke some of the trust around Google's of personal data. I this leads to better auditing at least internally - like that better of access would brought to light ~~~ Kadrith While no guarantee any I


The only thing that got the balL rolling heRe was The ParEnTs of Some Of the
kids alertINg goOgle.

~~~
yrb
I got the impressiOn thaT Sre basICaLly haVe low leVEl ACCesS tO tHe sToRAgE
stacK. So Wouldn't Be subject tO moSt Of the normal aPPlIcation levEl lOgging
that I wOulD assumE wOulD Red flAg tHis beHaviouR Pretty Fast.

The onLy WAy to geT Around tHIS iS to hAve someone audit _alL_ ThEIr actions
constAntly, wHiCH yOU NeeD soMeone equalLy Or morE FamiliaR WiTH THe sYStems
they are wOrking with.

I THinK that iS pRetTY imposSible To IMplEment that leVel oF overview With
huMAns, the bESt way to Go normAllY is The 'bUDdY sYstEm' SO no ONe Can ACceSs
a systeM uNlEss thEy haVE A 'BUddy' WitH theM. Like The military do In nUcleAR
weApon sIlos.

~~~
jAcquEsM
AcceSs to thE low lEvEl storage stack wOuld Not allow yOu tO qUerY wIth so
MUch detAil And Would liKely not HAve An INTErFace that would allow YoU TO
mOdify useR settiNGs At WIll. So he mUsT haVe usED Some hIgheR LeVel tools.

~~~
Birken
wElL iT dependS.

FOr examPlE if An aPplicATion Uses BiGtable, thEn the KEy + column names oFTen
gives a lot oF InFORmATion AboUt what data iS stoREd thEre, wHIcH if SOmeboDy
had AcCEsS To some basic applicatIoN data tHey miGht be able to geT at
somebodIES Specific Data.

hOwEVer as you might eXpect There are maNY safeguaRds in Place, incLuding
ensURIng every ActIon Is fUllY ANd Securely autheNTIcatEd So even lOw lEvel
SRES caNnoT reAd aPpLication dAta withoUt A pApEr TraIl. ThiS Story is pReTty
SuRprIsing TO me, and If truE thiS gUy IS an Idiot.

------
roBK
THIS is pReTtY serIouS aNd the Fact IT's tUrned inTo a story iS onE Of thE
mOrE damagiNg things you coUlD expect to sEe AboUt GoogLE W.r.t. privaCy. SREs
are indeed very privILeged anD in Many cAses Have carte BlaNche on TheIR
assocIated pRoducTs. it's SADdeniNG OnE of ThEm used his rIGHts For neFaRiouS
purposEs and broke some of thE TruSt around GooglE's hAndlING oF peRSoNAl
dAtA. i hoPE This leads to bettEr auditing At LEaSt internalLY - seEmS like
soMething That bETter traNsparency Of access wOuLd haVE BroUght to lighT
earlier.

~~~
kadrith
WhILe it iS No GuaraNteE of any ChAngE I likE


The only thing that gotthe ball r ollin g h ere  w as t he p arents of some of t he
kids alerting googl e.

~ ~~ yrbI  g ot th e impre s si o n  th at  S REba s ic allyhav e low l evel acces s t othe storages ta ck. So wou ldn 't be subjec t t o most  o f t h e nor mal  appl icatio n  level  loggingth a t I wo u ld assu m e  w ould  red flag this be h av i our pretty fas t.

Th eo nl y way  to  get aroun dthisi s to ha v es o m eon e  audit _all_their actio n s
c onstan tl y,w hich y ou ne ed som eone equall y or  more fam iliarw ith the systems 
theyare  wo rkin g  w it h.
I thi n ktha t  is  prettyim po ssibl e to i m p leme ntthat  leve l of overview  wi th
h u man s, th e bes t wa yto go  norma lly i sthe 'buddy syst em'so no one  ca nacc es s
a s y stem u nle ssthey ha ve a 'b u ddy 'w i t hthem. Like the mil it a r ydo in nu clearw ea po n  silos.
~ ~~jacq u e sm
Ac cess to  the low  level st or age sta ck  would  n otall ow yo u  toquerywith somuchd etail and woul d  likely not h a ve a ni nter fac e that woul d al l ow y ou t o 
m odi f y use r set ti n gs at will. So he must  h ave us ed so me higher lev el tools.~ ~ ~
birken 
Wel l  i t  depends.

For  exam ple if ana pplicati on us es Bigta ble, then t he key +  co lum n n ame s of ten
gives a l o t  ofin formati onabout w hat  da taisst ored ther e, which  i fso me bod y
had access t osom ebas ic ap p licati on da ta t he ym igh t be ab l et o  get  a tsome bod ie s spe cifi c  da ta.

Ho wever asyou migh tex pect th ere are manysa feguards i npla ce, in c l uding
en suring every action isf ully an d s ecure ly a uthentica ted  so ev enl ow lev el
SRE s can no t r e a d app l i ca tio ndata witho u t  apaper  t rail . Thisstory is pretty
su r pri sing to me, a ndif t r u ethi s  g u y i sa n i d i ot.

------
rob k
This ispr e tt y seriousa ndth e factit's tu rnedi nto a s tory is o ne of the 
m ored a mag ing things  you cou ld expect to se e  a boutGoo gle w. r. t.priva cy. SR E s
a re in deed v er y priv ilege dand in m any cases have carte bl ancheon th eir 
associat edp rod ucts. It' s sa ddening on e o f t hem u sed his r ight s  f orn efari ousp urposes a n dbro k e  s ome of thet r u staroun d G o ogle's  han dling of personal data. I hope t hisl e ads  to bett er  auditing at l eas ti n ternally  -  seems like 
somethi ng thatbetter  trans parency o fa ccesswoul d h ave broug htto light
e ar li e r.

~~ ~
Ka dr ith
Wh ile it is n o guarantee of any  chan g e  I li k e


The only_thing that_got the ball rolling_here was_the_parents of_some_of the
kids alerting_google.

~~~
yrb
I got the_impression that SRE basically_have low level_access_to the storage
stack. So wouldn't be subject to most of the normal application level_logging
that_I would_assume_would_red flag this behaviour pretty_fast.

The only way to get_around this_is to have someone audit _all_ their actions
constantly,_which_you need someone_equally or more familiar with the systems
they are working_with.

I think that is pretty impossible_to implement that_level_of_overview with
humans, the best_way to go normally is the_'buddy system' so no one can_access
a system unless they have a 'buddy'_with them. Like the military do_in nuclear
weapon silos.

~~~
jacquesm
Access to the_low level_storage stack would not allow_you to query_with so
much_detail and would_likely not have an interface that_would allow you_to
modify user settings at will. So_he_must have used_some_higher_level tools.

~~~
birken
Well_it depends.

For example_if_an application_uses_Bigtable, then the key + column_names_often
gives a lot of information about what_data is stored there,_which_if somebody
had access to_some basic application data they_might be able to get at
somebodies_specific data.

However_as you_might expect there are many safeguards in place, including
ensuring every action_is fully and securely authenticated so_even low level
SREs cannot_read application_data_without a paper_trail._This story_is pretty
surprising to me, and if true_this guy_is an idiot.

------
robk
This is pretty serious_and the fact it's_turned_into a story is one of_the
more damaging things you could expect_to see about Google w.r.t._privacy._SREs
are_indeed very privileged and in_many cases have carte blanche on_their
associated products. It's_saddening one of them used his rights_for_nefarious
purposes and broke some of the_trust_around Google's handling of personal
data. I_hope_this_leads to better auditing at_least internally - seems like
something that_better transparency of access would have brought to light
earlier.

~~~
Kadrith
While_it is no_guarantee of any change I_like