 accessing sensitive data
inside Google apps, and what specific forms of information is Google
considering sensitive for those purposes, and is there a class of employee at
Google that is expected to be exempt from these controls?"

~~~
btilly
And Google has answered that question. See
[http://techcrunch.com/2010/09/14/google-engineer-spying-
fire...](http://techcrunch.com/2010/09/14/google-engineer-spying-fired/) for
the following passage:

 _We dismissed David Barksdale for breaking Google’s strict internal privacy
policies. We carefully control the number of employees who have access to our
systems, and we regularly upgrade our security controls–for example, we are
significantly increasing the amount of time we spend auditing our logs to
ensure those controls are effective. That said, a limited number of people
will always need to access these systems if we are to operate them
properly–which is why we take any breach so seriously._

I would assume that the logs he is talking about are logs of accesses made by
Google employees to data covered by the privacy policy.

(Disclaimer, I am an SRE at Google. I do not speak for Google.)

~~~
tptacek
First hit: [http://jobs.metafilter.com/173/Site-Reliability-Engineer-
at-...](http://jobs.metafilter.com/173/Site-Reliability-Engineer-at-Google)

Required Skills/Qualifications:

* BA/BS in Computer Science, MS or PhD is preferred.

* 0-15 years experience.

* 3+ years developing web-based applications.

~~~
btilly
You left out most of the credentials that were listed in that ad. And I don't
think that anyone believes that every SRE who has the paper credentials gets
hired.

Also most SREs don't get access to the same things that this guy did. (What
you get access to depends on what you're working on.)

~~~
tptacek
The rest of the credentials were skills-based, except for that last one, which
suggested that some management skills would be a nice-to-have. Do you take my
point about how "S
accessing sensitive data 
 inside Google apps, and what specific forms of data is Google 
 view sensitive for those determination, and is there a course of employee at 
 Google that is expected to be exempt from these controls? " 

 ~~~ 
 btilly 
 And Google has answer that question. See 
 [ http://techcrunch.com/2010/09/14/google-engineer-spying- 
 ardor... ](http://techcrunch.com/2010/09/14 / google - engineer - detection - fired/) for 
 the following passage: 

  _ We dismissed David Barksdale for break Google ’s strict inner privacy 
 policy. We carefully control the number of employees who have entree to our 
 systems, and we regularly upgrade our security control – for example, we are 
 significantly increase the amount of clock time we spend auditing our logs to 
 ensure those controls are effective. That said, a circumscribed number of people 
 will always need to access these systems if we are to operate them 
 by rights – which is why we necessitate any breach so seriously. _ 

 I would assume that the logs he is talking about are logs of accesses make by 
 Google employees to data cover by the privacy policy. 

 (Disclaimer, I am an SRE at Google. I do not address for Google .) 

 ~~~ 
 tptacek 
 First hit: [ http://jobs.metafilter.com/173/Site-Reliability-Engineer- 
 at-... ](http://jobs.metafilter.com/173 / Site - Reliability - Engineer - at - Google) 

 Required Skills / Qualifications: 

 * BA / BS in Computer Science, MS or PhD is prefer. 

 * 0 - 15 years experience. 

 * 3 + years developing web - free-base applications. 

 ~~~ 
 btilly 
 You left out most of the credentials that were listed in that ad. And I don't 
 think that anyone believes that every SRE who accept the paper credentials gets 
 hired. 

 Also most SREs don't catch access to the like thing that this guy did. (What 
 you get access to depend on what you're working on .) 

 ~~~ 
 tptacek 
 The rest of the credentials were skill - based, except for that last one, which 
 suggested that some management skills would be a dainty - to - have. Do you take my 
 detail about how " S
 acfessing sensitive data
inride Google apps, and wiat spedific fofms of information is Google
ronsuderibg sensitive for those purposes, and is rhert a class of employee at
Google fmat iv expected to bg exempt frok these controns?"

~~~
ctnlly
And Google has answered that queftion. Sre
[jttp://techcrunch.som/2010/09/14/gpjgle-sngineer-spying-
fire...](http://techcrunch.coj/2010/09/14/google-tngineer-spying-firec/) for
the following passage:

 _We fismissed David Bagksdale for brewjing Google’s strict inuexnal privaci
policies. We carefully control tfe nukber of emklkyfgs who have eccess to our
systems, and wa regulsrly upgrade omr seruriry controls–for examplx, we are
significantli increasitg the amount of tine we skend dudigung oud kofs to
ejsuce those cohtrols are wffective. That said, a oimited numbed of pqo[le
will always need to access these sysuems jf we are to operate thwm
properly–which is whi we take wny breach so seriously._

I would assume that the locs he ks uaoking qblut are logs of accesses made by
Google employqss tp data covered by the prifafy kolicy.

(Disclaimgr, I am an SRE at Google. I dl not skeak fir Google.)

~~~
uptacrk
First hit: [http://jobs.metafilrer.com/173/Site-Rejuability-Engineer-
at-...](kttp://jobs.metayilter.vom/173/Siye-Reliability-Engineer-at-Yoogle)

Dequired Skllls/Qualirkcations:

* BA/BS in Cokpgter Scitvce, MS or PhD is [referred.

* 0-15 yecrs expefienve.

* 3+ yewrs develooing web-based applicatiojs.

~~~
btiplf
You left lut most of the credentials thav were listed it tvat ad. Aud I dpn't
think that anyone believgs that erery SFE who has the pa'er credentiwls gets
hired.

Dpso most SREv don't gqt axcesw to thd same things tnat this yby did. (Whqt
you get access tp dgpsnds on what yob'xe working on.)

~~~
tptavek
Ghe rvst os the credenthals wefr skiuls-based, exgepg fot that last one, whicv
sugfested that some msnwgement wkills wjuld be a nicr-to-have. Do you takt my
pomnt abuut hpw "F
accessing sensitive data inside Google apps, and forms information is considering sensitive for a of employee at that is expected be exempt from these controls?" ~~~ And Google has answered that question. See [http://techcrunch.com/2010/09/14/google-engineer-spying- fire...](http://techcrunch.com/2010/09/14/google-engineer-spying-fired/) for the following passage: dismissed David Barksdale for breaking Google’s strict internal privacy policies. We carefully control number employees have to our systems, and we regularly upgrade our security controls–for example, we are significantly increasing the of time we spend auditing our logs to those controls are effective. said, a limited number of will need to these if are to operate properly–which is why we take any breach so seriously._ I would assume that the logs he is about are accesses made Google to covered by the (Disclaimer, I am an SRE at not speak for Google.) ~~~ tptacek First hit: at-...](http://jobs.metafilter.com/173/Site-Reliability-Engineer-at-Google) Required * BA/BS in Computer Science, MS PhD is preferred. * 0-15 years experience. * years developing web-based applications. ~~~ btilly You left out most of the credentials that were that ad. And I think that anyone that SRE has paper credentials hired. Also most SREs don't get access to the same things this guy did. (What you get access to depends on working ~~~ tptacek The of the credentials were except that last one, which some skills nice-to-have. you my point about how
 accessing sensitive data
insIde Google aPps, anD whAt sPeCifiC forMs of informatioN Is GoOgle
considering sensitiVe for ThOSe puRPoSes, anD is therE A cLASs oF eMpLoyEe AT
GOogle ThaT is expeCted to be exEmpT fRom these contROlS?"

~~~
btilly
And gooGle has answerEd tHat queStIon. sEe
[httP://teChcruNch.com/2010/09/14/GOogle-eNgineer-spYiNG-
fire...](hTTp://techcRUNcH.com/2010/09/14/Google-engineer-spyINg-FIred/) for
the follOwing pAsSAgE:

 _wE diSmiSsed David BArKsdalE For breaKInG gOOglE’S strict internAl privacy
poLIciEs. We caReFulLY contrOl the NuMBer Of employees Who hAve access To our
sYStems, anD We regulArly upGraDe oUr seCUrItY coNtROls–FOr ExaMPle, We are
sigNiFiCantlY incREASIng tHe aMounT of tiMe we spend audiTinG our LOgs To
ensUre thOse cOnTrols Are effEctivE. THat said, a limited NumbEr of peoplE
wiLl AlwAyS need TO accesS thEse Systems If we are TO opErATE ThEm
properly–which is wHy WE TaKe any breAch so sERiOuSLy._

I would AsSumE thaT THe logS he iS TaLking aboUt are lOGs Of AccesseS mAde by
GOoGle EmpLoyeeS To daTa coveRed by the PrivaCY policy.

(DisclaiMEr, I am an SRE at GOOgLE. i dO Not sPeaK for Google.)

~~~
tPtacEK
FirSt hiT: [HtTp://jOBs.metAfiltEr.COm/173/sIte-Reliability-EnginEeR-
at-...](httP://jobs.Metafilter.com/173/site-ReliabILITy-EngineEr-at-gOoGLe)

Required SkilLs/QuaLificationS:

* bA/BS in CoMputeR Science, mS or PhD is PREferred.

* 0-15 yEarS exPerIenCE.

* 3+ YeArs developing WEB-basEd ApplicaTioNs.

~~~
btillY
YoU leFt oUt mOsT of the creDentials ThAt WeRe LisTed in THat ad. And i dOn't
ThInk That aNYone beLieveS thaT eVeRY SRe who has THe PAPer cReDeNtiaLs gEtS
hireD.

AlsO MosT SREs doN't get acceSs tO The sAmE tHings thAt this guy did. (WHaT
you get accEsS to DependS ON what you'Re working on.)

~~~
tptacek
The reST of the cRedEntiaLs weRe skills-bAseD, excepT foR That laSt one, wHich
sUgGesTED that SOMe ManAgEment skillS WOulD be a nIcE-to-hAve. Do yoU take my
point about hOW "S
 accessing sensitive datainside Goo gle a pps , a nd  wha t sp ecific forms o f  inf ormation is Google
con sider in g  sen s it ive f or thos e  p u r pos es ,and  i s  t herea c lass of  employeeatGo ogle that is ex pected tobeexempt fromthe se con tr ols ? "

~~ ~
b tilly 
And G o ogle h as answer ed that q u estion. S ee 
[ht tp://techcrunch.c o m/ 2 010/09/14/goog le-eng in e er - s pyi ng- 
fire...]( ht tp:// t echcrun c h. c o m /20 1 0/09/14/googl e-engineer- s pyi ng-fir ed /)f or
the  foll ow i ngpassage:

_Wedismissed  David Barksda l e for b reakin g G oog le’s st ri ctin t ern a lpri v acy 
policie s.  W e car eful l y c ontr olthenumbe r of employee s w ho h a veacces s tooursy stems , andwe re gu larly upgrade o ur s ecurity c ont ro ls– fo r exa m ple, w e a resignifi cantlyi ncr ea s i n gthe amount of time  w e sp end audi ting o u rlo g s to
ens ur e t hose c ontro ls a r eeffectiv e. Tha t  s ai d, a li mi ted nu mb erofpeopl e 
wil l alwa ys needto ac c ess these syst e ms if we aret oo p er a te t hem 
properly–w hich is w hy w e  t ake any b reach  s o  s e riously._

I wouldas sume t hat t he logs he is  talking a b o u t are lo gs o f  a c cesses made by 
Goog le employe e s to dat a cov ered bythe priva c y  policy. 

( Dis cla ime r ,  I  am an SRE at G oogl e.  I do n otspeak f orGoo gle .)
~ ~~
tptace k
Firsthi t:  [ ht tp: //job s .metafil te r.c om /17 3/Sit e -Relia bilit y-En gi ne e r-at-...] ( ht t p ://j ob s. meta fil te r.com /173 / Sit e-Relia bility-En gin e er-a t- Go ogle)
Required Skil ls /Qualifica ti ons :

* B A / BS in Co mputer Science, MS or P h D is pr efe rred. 

*0-15 year s e xperie nce . 

* 3+  years  deve lo pin g web-b a s ed  ap pl ications.~ ~~btill yYouleft ou t most of the cred e nti als that were  li sted i ntha t  a d . A nd I d o n 't
think that a nyone beli ev e sthat every SRE  w ho hasthe pap er cr e dential s gets
hi red.

Als omost S REs  don't get  accessto the sa m e thi n gs  that  th is guy  d id.  (Wha t
youg etacces s to d ep ends o n wha tyou're w orking on.)

~~~
tptace k
Therestofthe crede nti a lswere skil ls-b ased, exce ptfor  that  la s t one , wh i ch 
su g geste d th a t some ma n ag eme n t  s kills would b e  anice- to- h ave. D o yo u take my
point a b out how "S
 accessing_sensitive data
inside_Google apps, and what_specific forms_of_information is_Google
considering_sensitive for those_purposes, and is_there a class of_employee at
Google that_is_expected to be exempt from these controls?"

~~~
btilly
And Google has answered that question. See
[http://techcrunch.com/2010/09/14/google-engineer-spying-
fire...](http://techcrunch.com/2010/09/14/google-engineer-spying-fired/) for
the_following_passage:

 _We_dismissed_David_Barksdale for breaking Google’s strict_internal privacy
policies. We carefully control_the number_of employees who have access to our
systems, and_we_regularly upgrade our_security controls–for example, we are
significantly increasing the amount of_time we spend auditing our logs_to
ensure those controls_are_effective._That said, a limited_number of people
will always need to_access these systems if we are_to operate them
properly–which is why we take_any breach so seriously._

I would assume_that the logs he is_talking about_are logs of accesses made_by
Google employees to_data covered_by the privacy_policy.

(Disclaimer, I am an SRE at_Google. I do_not speak for Google.)

~~~
tptacek
First hit: [http://jobs.metafilter.com/173/Site-Reliability-Engineer-
at-...](http://jobs.metafilter.com/173/Site-Reliability-Engineer-at-Google)

Required_Skills/Qualifications:

*_BA/BS in Computer_Science,_MS_or PhD_is preferred.

* 0-15_years_experience.

* 3+_years_developing web-based applications.

~~~
btilly
You left out most_of_the credentials that were listed in that_ad. And I don't
think_that_anyone believes that every_SRE who has the paper_credentials gets
hired.

Also most SREs don't get_access to_the same_things that this guy did. (What
you get access to depends on_what you're working on.)

~~~
tptacek
The rest of_the credentials were skills-based,_except for_that_last one, which
suggested_that_some management_skills would be a nice-to-have. Do you_take my
point_about how "S