In the summer of 2010, Google fired a 27-year-old site reliability engineer named David Barksdale after it discovered that Barksdale had been accessing the Google accounts of four teens he met through a local Seattle tech group.
The spying went on for months before it was reported, Gawker’s Adrian Chen wrote at the time. In one incident Chen described, a 15-year-old refused to tell Barksdale the name of his new girlfriend; Barksdale broke into the teen’s Google Voice account, listened to messages to get the name, then taunted him with it and threatened to call her.
Google was contrite, saying publicly that it “carefully control[s] the number of employees who have access to our systems” and monitors for abuses by rogue employees. The story was not picked up by mainstream media, the company did not bring criminal charges, and the world moved on surprisingly quickly.
Part of Google’s explanation was that it’s necessary to give some employees very high-level access. But Barksdale was a site reliability engineer, meaning he was responsible for things like uptime, performance, efficiency, and planning for high traffic times. Why would he need to have the ability to, as Gawker reported, access a user’s Gtalk buddy list and not only see what was on it, but unblock himself?
The rogue Twitter customer service employee who momentarily deactivated President Trump’s account on Thursday night brought this issue to mind. Silicon Valley companies often have insanely skewed ratios of employees to users. Twitter has 3,898 employees, according to Wikipedia, for 330 million monthly users, a ratio of one employee for every 84,658 users. Facebook has 23,165 employees and 2.07 billion monthly active users (1:89,358). When it was acquired by Facebook in 2014, WhatsApp had 55 employees for 420 million monthly users (1:7.6 million).
This means that a single employee may have a ton of power over loads of users, but the value of a single user is low. Their privacy may seem insignificant in light of the greater mob. Furthermore, building systems to simply and quickly access granular level data on hordes of people is the core competency of these user-facing Silicon Valley companies. At Uber, employees regularly abused its “God View” mode to spy on the movements of celebrities, politicians, and even ex-spouses. In 2015, the Finnish music producer and record label owner Paavo Siljamäki visited Facebook’s L.A. campus as part of the company’s efforts to teach celebrities and organizations how to use Facebook better. He watched as an engineer accessed his Facebook account without a password. “Just made me wonder how many of Facebook's staff have this kind of 'master' access to anyone's account?” Siljamäki wrote in a Facebook post afterward. “What are the rules on who and when they can access our private content and how would we know if someone did? (My facebook did not notify me that someone else accessed my private profile).” Facebook responded at the time to say that yes, it has a customer service tool that allowed employees to access anyone’s account, but “access is tiered and limited by job function” and abuse is taken very seriously.
The potential for employee abuse of high-level permissions seems to be much higher when a company is in its younger stages. According to an interview between The Rumpus and an anonymous Facebook employee in 2010, the company at one time had a master password that would work for any account. “I’m not going to give you the exact password, but with upper and lower case, symbols, numbers, all of the above, it spelled out ‘Chuck Norris,’ more or less,” this employee said. “It was pretty fantastic.” (Facebook said broadly that the interview contained “inaccuracies and misrepresentations” but did not deny that it had a Chuck Norris-themed password.)
These are just the incidents we know about. Presumably, there have been even more unreported cases of employees spying on or meddling with user accounts. These employees may have been fired, or they may have been allowed to return to work with a reprimand. The one thing we can assume is that they were not prosecuted, since it would be difficult to keep criminal charges filed in court from attracting public attention.
The case of Trump’s deactivation may be the first time an employee gets in legal trouble for abusing their privileges. There is already speculation that the employee, who Twitter says committed the prank on their last day, may have violated the Computer Fraud and Abuse Act, the wide-ranging and in many ways archaic law that prohibits accessing a computer “without authorization or exceeding authorized access” in various scenarios. Setting aside whether this was a national security crisis averted — anything a rogue employee could have done with Trump’s Twitter account seems no scarier than what the man himself could do at any moment — the fact that a customer service employee had this level of access is a reminder that anything you can see, some unknown number of employees can see as well.
