Former employees say Lyft staffers spied on passengers • Hacker News Board

Re: Former employees say Lyft staffers spied on passengers

#21

Post by oh_sigh » Thu, Jan 25, 2018, 10:34 PM UTC

joshuamorton wrote: post #6

cronjobma wrote: post #4

Whether it’s Uber or the NSA stories of staff spying on people for a variety of reasons... it always comes down to people who seem to have access to things that they probably shouldnt have gotten access to in the first place. Users should be protected by having their data encrypted and anonymized so no other human being (staffers, governments or hackers) can connect an ID to the data. This way they can still access t…

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

You should be able to look up how Google handles this if you want insight into how to do this well.

Re: Former employees say Lyft staffers spied on passengers

#22

Post by tzahola » Thu, Jan 25, 2018, 10:34 PM UTC

maybeiambatman wrote: post #3

I can completely see this happening. I have interned at small startups in the past where practice like this was rampant.

Yeah, and it’s usually called “data science” and “personalized targeting”.

Re: Former employees say Lyft staffers spied on passengers

#23

Post by toomuchtodo » Thu, Jan 25, 2018, 10:35 PM UTC

desireco42 wrote: post #12

toomuchtodo wrote: post #7

Earlier quoted context omitted.

I’m at a financial services firm, and we have an entire internal risk department to ensure employees aren’t exceeding their authority. Surfing the wrong websites? Badging in and out at abnormal hours? Accessing internal apps in ways you shouldn’t? Access immediately flagged for human intervention and you’re locked out. Our data scientist team improves on the heuristics constantly. At some point, organizations with da…

That sounds like fantastic place to work :), how come you are not locked out for posting on HN? (I am assuming you are doing this during work hours)

I’m on our cloud security team; our leadership chain gives us wide latitude (Hacker News A-OK) since our entire job is to be subject matter experts. Literally “Know All The Things” was how my job req was described to me.

Re: Former employees say Lyft staffers spied on passengers

#24

Post by ageitgey » Thu, Jan 25, 2018, 10:38 PM UTC

mattdodge wrote: post #18

None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver feedback isn't PII at all. I suppose it might be a bit questionable if Lyft was creating and providing tools to make it easy to look this stuff up and promoting it within the company but that doesn't sound like the case either.

> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this.

The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers."

I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?

Re: Former employees say Lyft staffers spied on passengers

#25

Post by musage » Thu, Jan 25, 2018, 10:38 PM UTC

joshuamorton wrote: post #6

cronjobma wrote: post #4

Whether it’s Uber or the NSA stories of staff spying on people for a variety of reasons... it always comes down to people who seem to have access to things that they probably shouldnt have gotten access to in the first place. Users should be protected by having their data encrypted and anonymized so no other human being (staffers, governments or hackers) can connect an ID to the data. This way they can still access t…

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options?

> You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver.

How did taxi drivers handle that for the last nearing 100 years? People before us managed sticky situations without destroying human civilization, so can we.

Re: Former employees say Lyft staffers spied on passengers

#26

Post by joshuamorton » Thu, Jan 25, 2018, 10:41 PM UTC

oh_sigh wrote: post #21

joshuamorton wrote: post #6

Earlier quoted context omitted.

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

You should be able to look up how Google handles this if you want insight into how to do this well.

I'm familiar :)

Re: Former employees say Lyft staffers spied on passengers

#27

Post by mattdodge » Thu, Jan 25, 2018, 10:41 PM UTC

ageitgey wrote: post #24

mattdodge wrote: post #18

None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver feedback isn't PII at all. I suppose it might be a bit questionable if Lyft was creating and providing tools to make it easy to look this stuff up and promoting it within the company but that doesn't sound like the case either.

> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?

Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.

Re: Former employees say Lyft staffers spied on passengers

#28

Post by marshray » Thu, Jan 25, 2018, 10:43 PM UTC

musage wrote: post #25

joshuamorton wrote: post #6

Earlier quoted context omitted.

(I work at Google, but these views are my own): This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up. You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver…

What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options? > You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver. How did taxi drivers handle that for the last nearing 100 years? People before us m…

> How did taxi drivers handle that for the last nearing 100 years?

They used specially-built cars with plexiglass barriers and uncomfortable thick vinyl covered seats that could be easily replaced.

Re: Former employees say Lyft staffers spied on passengers

#29

Post by morogop » Thu, Jan 25, 2018, 10:44 PM UTC

mattdodge wrote: post #27

ageitgey wrote: post #24

Earlier quoted context omitted.

> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?

Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.

Names and addresses are both personal data under almost all regulatory regimes.

A reasonable rule of thumb is that if you _could_ use the data to identify a person or a household, then it's personal data, whether or not you do so.

Re: Former employees say Lyft staffers spied on passengers

#30

Post by deferred » Thu, Jan 25, 2018, 10:44 PM UTC

mattdodge wrote: post #18

None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver feedback isn't PII at all. I suppose it might be a bit questionable if Lyft was creating and providing tools to make it easy to look this stuff up and promoting it within the company but that doesn't sound like the case either.

“This was said to be used to look up ex-lovers, check where their significant others were riding and to stalk people they found attractive who shared a Lyft Line with them... One staffer apparently bragged about obtaining Facebook CEO Mark Zuckerberg’s phone number.”

Right so nothing to see here...