Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former employees say Lyft staffers spied on passengers

techcrunch.com

Post reply on HN
Print view View original

191–200 of 253 posts

Re: Former employees say Lyft staffers spied on passengers

#191

Post by CodeWriter23 »

nkkollaw wrote: post #56

I was talking about this with my girlfriend at dinner tonight. While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time.…

Chances are, the field of view is so wide there isn’t much of your GF to be seen in the recording, even in HD.

Re: Former employees say Lyft staffers spied on passengers

#192

Post by ryanfreeborn »

mattmanser wrote: post #10

Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information See, that's a complete lie and that's the attitude that needs to sop. No-one needed access. Analytics definitely didn't. Engineers never did. Customer services should have to request permission from the customer before accessing sensitive data, with a valid reason.…

This is a pretty absolutist approach.

>What's the need?

How about plain old abuse? People using services to break the law, particularly crimes with victims? Safety risks?

- An uber passenger sees their driver has a gun in the cup holder; they report it to uber.

- A Square merchant is using Square to launder serious money and Square catches it.

- A Dropbox user is uploading child pornography that indicates active child abuse.

In these situations, you think the company should consult the user first before they take a look at PII? Or ask a senior manager? The former is laughable, and the latter is not scalable. Senior manager clearance might work at a small or even midsize company, but for a large tech company abuse happens thousands of times a day. Review must be operationalized.

I would love to see a law that could strike the right balance, but I don't see how it's possible. Accommodating both small and large companies would be very challenging If you mandate the kind of structure that big companies would need, it could cripple smaller companies operational budgets. If you mandate the rules suited for small companies, it fetters large companies at scale. And then how would you enforce it? Another regulatory agency with audit authority?

This kind of regulation is better served by the market, imo, and we've seen that with Uber. In regions where Lyft is a viable option, it has seen significant business increase in the wake of Uber's many scandals. The key is sunlight, which is usually cast by 1. journalists 2. whistleblowers 3. EFF and other watchdogs.

Re: Former employees say Lyft staffers spied on passengers

#193

Post by tallanvor »

anigbrowl wrote: post #141
ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

Technical solutions are great, but ultimately this is a human problem. Not every firm has the resources or know-how to do all that, but any firm can have a clear policy of termination and lawsuits for anyone found abusing access to customer data.

But it is both a technical and human problem.

Obviously a company should have policies against the abuse of data - and I'm sure almost all of them do. But you need a technical solution to be able to determine when people have accessed information they shouldn't have, otherwise the policy is worthless because you won't know that the abuse has happened until it blows up in your face.

So, since you already need a solution to be able to audit activities, adding controls to help cut down on the number of people who are able to abuse the data reduces your potential liability immensely.

Re: Former employees say Lyft staffers spied on passengers

#194

Post by nkkollaw »

averagewall wrote: post #115
nkkollaw wrote: post #65

Earlier quoted context omitted.

Perhaps not actively, but I bet in case of a hot woman or something weird going on they'll know where the monitors are. I also have two separate family members that have businesses with cameras, and they both look at what's going from an app on their iPads while they watch TV in the evening (actually, having seen them do it is probably why I know videos at businesses are not handled properly).

Don't public places like shops have to have a sign saying there's CCTV? So customers know they're watched just like in the street.

Not in Italy nor Poland.

Also, what difference would that make? I already know I'm being filmed, the problem is that there is no control over how that video is used.

Re: Former employees say Lyft staffers spied on passengers

#195

Post by nkkollaw »

djsumdog wrote: post #153
nkkollaw wrote: post #56

I was talking about this with my girlfriend at dinner tonight. While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time.…

They are public cameras taking pubic photos. That's the whole deal with the "creepshots" deal on Reddit/Tumbler/etc. The subjects are in a public place. If someone does candid shots of lots of different types of people in a city and puts them in an art gallery, they're often considered art (even if 10% ~ 15% of the photos are of really pretty men or women that might be taken as being sexual). However, if you have a s…

Is a restaurant considered a public place, though?

Re: Former employees say Lyft staffers spied on passengers

#196

Post by maze-le »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

This list should be made a 'Best Practices' document. Good Work!

Re: Former employees say Lyft staffers spied on passengers

#197

Post by cornholio »

ryan_j_naughton wrote: post #122

Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz: - all inbound API requests first go to our API proxy in the secure layer. - the API proxy encrypts all PII using the encryption service in the secure layer - then API proxy sends the request on to the appropriate service, having swapped all PII for tokens. - all services in the general layer are not able to…

The key problem with both Lyft and Uber is that employees who had the right to view the data abused the privileges.

While encryption can help to enforce the privileges against technically capable employees, the main problem is the privilege system itself, or lack thereof. 95% of the abuse would be eliminated with no encryption, just proper design of the internal interfaces and queries talking to the plain text database.

And many employees really do need elevated access for their work. It's then imperative to create a privacy focused internal culture where it's clear that abuses result in termination and civil/criminal actions, and put in place strict access logging and enforce these policies.

Re: Former employees say Lyft staffers spied on passengers

#198

Post by mys_throwaway »

0xB31B1B wrote: post #189
mys_throwaway wrote: post #187

I happen to know that the former country manager of Uber in Malaysia used driver personal information to bully and then swindle a gig worker at another (but not competing) gig-economy startup. Long story short, he pressured the worker into doing a gig for free if he could guess his birthday. Not quite a fair gamble considering he knew the guy's birthday from when he'd signed up as a driver for Uber. This would still…

What does this have to do with lyft?

- The linked article alleges employees at Lyft abused information.

- Lyft is a direct competitor of Uber.

I think my account of an employee at Uber, and not just any employee, but a country manager, committing a worse abuse is fairly relevant to the topic.

Re: Former employees say Lyft staffers spied on passengers

#199

Post by tallanvor »

mynameisvlad wrote: post #69
jtmcmc wrote: post #36

Earlier quoted context omitted.

What's the need for anything? Your argument seems to be predicated on a very specific definition of what need is which is somewhat at odds with most of the rest of the world.

Can you actually refute the parent comment's argument? Because it seems more than reasonable to me. Analytics and Engineering definitely don't need this level of data access for any sort of day-to-day work. I work on analytics tools, and at best, anonymized and generalized data is needed, but never specific customer data. We specifically strip out any PII on data that might reach developers and need to request permis…

A balance has to be made. The parent remark does not show an understanding of the realities of working on a service on all levels. There are many times when developers need access to specific customer data. Pretty much every company has in their TOS verbiage to note that employees may have to access customer data without their specific consent. That said, companies can and should have multiple layers to help prevent abuse of customer information:

1. Access levels: Different employees need access to different types of information. Access at a specific level should be approved by at least one individual, often the employee's manager, but may require multiple layers of approval, depending on the sensitivity of the data. In some cases, background checks may be required. Access should need to be reviewed any time your job duties change.

2. Separation of networks: Customer data should not be on your normal company network except for specific approved instances (such as when a customer sends a file to support that they can use for testing and pass to developers if needed). It should not be possible to pull information from the network containing customer data to your company network, but it might be necessary to be able to push data over.

3. JIT access: Access to the network and systems containing customer data should require elevation. Access to systems and data on this network should still be subject to your access level (an example would be being able to access unscrubbed logs that may include some private information, but not be able to otherwise access data a customer has entered or uploaded.

4. Auditing: There should be an audit trail of who approved an employee's access levels and when. Access to customer data should always be audited, as should access to unscrubbed log files. Other access may need to be audited based on legal requirements or a company's stated commitments to their customers. --That part isn't an absolute, and while more audit logs are generally better, in some cases it may be too much noise.

5. Encryption at rest: Customer data should be encrypted when it is not in use. This might be file level encryption, database encryption, something else, or some combination.

6. Encryption in transit: Customer data should be encrypted while it is being transported to or from the customer, between networks, and preferably within networks.

This stuff can be difficult to do, but by the time you're as large as Facebook, Uber, Lyft, etc., there's no excuse not to be doing it. You can bet that while the implementation differs, Amazon, Google and Microsoft are also doing this.

Post reply on HN