Professionalism/David Barksdale and Digital Privacy

Google provides users with free services and in return gathers personal data from users for revenue and product purposes. Companies largely retain control over the collected data, and to maintain operations grant select engineers access. The selection criteria for said engineers prioritize technical skill over ethical needs. Together with market forces that pressure Google to increase profits, Google is incentivized to act in ways that value data collection over data privacy. Ultimately, this results in a company environment where engineers may easily abuse their power. Such was the case for David Barksdale, an ex-Google employee.

Case Background

Google is an expansive company that has many applications used daily and widely throughout our lives. Google collects all inputted data and categorizes by account information. The data is crucial for product research, selling data used towards advertising, and for customer service. Google's Site Reliability Engineers (SREs) use this data to help resolve any issues with an account.

David Barksdale, a former SRE, violated Google's internal privacy. Using his data privilege, he spied on four minors’ accounts by viewing their call logs, contact lists, and chat transcripts. He used their data to threaten the minors and to chat with them over Google's Buddy List. Google made the following statement upon discovery:

“We dismissed David Barksdale for breaking Google’s strict internal privacy policies. We carefully control the number of employees who have access to our systems, and we regularly upgrade our security controls -- for example, we are significantly increasing the amount of time we spend auditing our logs to ensure those controls are effective. That said, a limited number of people will always need to access these systems if we are to operate them property - which is why we have any breach so seriously.” - Bill Coughran, Senior Vice President, Engineering, Google

However, despite Google's security protocol and limited access to customer data, Barksdale was not the first perpetrator.

Data Privacy & Google's Site Reliability Engineers

The SRE position requires access to Google databases and customer data. According to a former Google SRE who left the company in 2007, “since site reliability engineers are responsible for troubleshooting issues on a constant basis, they access Google’s servers remotely many times a day, often at odd hours,” whenever an issue needs to be fixed .

Troubleshooting problems quickly is important to maintain happy Google users. Google users expect their Google services to operate at all times, quickly, and to never lose their information. Google’s many services are linked so that users may maintain a single user account across all of the Google platforms. The databases behind these services are linked in order to support this framework. The former Google SRE suggests that “SREs are given unfettered access to user’s accounts for the services they oversee,” allowing them to troubleshoot problems promptly when they happen . In other words, SREs have access to an array of databases to troubleshoot problems that may span across multiple Google service platforms. For example, “if you’re an SRE…on Gmail, you will have access to mailboxes because you may have to look into the databases. You’ll need access to the storage mechanisms,” according to the former SRE. In this case, “in order to determine the cause of a technical issue with Gmail, an SRE might have to access emails stored on Google’s servers to see if data is corrupted” .

Google’s internal structure may insufficiently prevent deviant abuse of sensitive customer data. When SRE’s access Google’s databases, their activities and other information such as the type of maintenance performed and date and time of access are stored in activity server logs. Activity server logs are generally comprised of extensive data fields for details about maintenance activities. Reading and interpreting logs is no small task, thus they may not be monitored in real time. However, activity server logs are very helpful to prove things after-the-fact. In the case of Mr. Barksdale, the threat of his activities being recorded in maintenance logs did not stop him from intrusively accessing customer data. Google has since stated that the company will be "significantly increasing the amount of time [they] spend auditing [their] logs". Server logs do not prevent deviant behavior; at best they discourage it and certainly did not prevent Mr. Barksdale from abusing his access to customer data.

Google trusts its employees with access to customer data based primarily on their technical expertise. Google’s trust in its' SREs may be more justified with additional behavioral interviewing as a criterion for the position.

Google’s interviewing process for the SRE position is focused almost solely on technical material. Below is a description of the interview process for the SRE position written by an interviewee at Glassdoor.com .

“On-site interview #1: System Administration. We spent most of the time working on the design of a hypothetical web service.”

“On-site interview #2: Troubleshooting. We made it through two problems, one dealing with networking and the other to figure out why a service was failing.”

“On-site interview #3: Large System Design. The problem dealt with analyzing large volumes of data.”

“On-site interview #4: Perl Coding. Consisted of a regular expression question and then a data analysis question with several iterations that made it progressively harder.”

“On-site Interview #5: Networking. The interviewer wasn’t particularly helpful and this was a definite fail” .

The interviewee offers a concise description of each interview and does not mention any behavioral interviewing or any nontechnical conversation during the interviews. As highlighted, the entire interview process is a knowledge test. In the words of a former Google employee, “the company does not closely monitor SREs to detect improper access to customers’ accounts because SREs are generally considered highly-experienced engineers who can be trusted” .

Market Forces & The Right To Be Forgotten

Understanding why Google does not react more strongly to these ethical violations requires placing Google in the context of public markets. Google is a public company, and consequently under pressure from investors to generate returns. This pressure causes a company to pit certain values against one another, in this case data privacy and data collection. To understand why, it is useful to see how Google generates revenue.

To appease investors, Google must either improve existing revenue streams or create new ones. Today, advertisements remain Google's primary source of revenue, accounting for nearly 90% of 2014 revenue [pic]. As such, the company spends a lot of energy improving advertisements. Using personal data collected earlier, advertisements are tailored to users' tastes, improving click-through rates (i.e., if I know you like shoes, then you are more likely to click on an ad about shoes). Fundamentally, this is how Google improves revenue - by improving the ad experience. Furthermore, the data acts as a barrier to entry to new competitors, giving Google a strong competitive advantage. Basically, data fuels Google's bottom line. It is therefore important for Google to retain control over its data, so that it may remain competitive. This is why Google fought so hard when the European Union challenged Google over data ownership.

In May 2014 , the European Union ruled that search engines must remove customers' data from their servers at their customer's request. The ruling became famous for its idea that citizens have a right to be forgotten (though that term also dates back to an earlier ruling ). The ruling made waves and proved popular: nearly 70,000 requests poured in within the first eight weeks. As the largest search engine in the world, Google was hit the hardest, and valuable data had to be removed. The data, however, pales in comparison to what Google is more frightful of: that the ruling fundamentally challenges who is in control over the data. It effectively changed power over users' data from Google to the citizens. Furthermore, the ruling sets precedent for more comprehensive laws to further erode Google's dominance over their data. Google retaliated by upping lobbying efforts to the point where EU commissioner Viviane Reding responded by acknowledging the "unprecedented lobbying" effort . This is a battle that continues today, as Google fights to retain control over their data.

Market pressures, then, pit data collection against data privacy. The European Union's ruling favored citizens' data privacy, but Google responded by fighting to repeal the law.

Summary

David Barksdale is a technical expert, but in this case, his actions were clearly not those of a professional. Google is a transformative company that creates many popular products for its' customers, but has competing interests in mind. In this case, neither Mr. Barksdale nor Google fulfilled their professional obligations. A key element to achieve professionalism is ethics. Mr. Barksdale lacked ethics, and Google's pressure to improve profits requires them to value technical expertise and data collection over ethical values like data privacy.