Item — HN Reader

Not really. The problem is unauthorised access by users with sufficient privileges to do what ever they want. That would include turning off audit logs.

Do you think that when Google serves your data up to the secret police that shows up in audit logs?

3 comments

It depends on your threat profile. Are the secret police more likely to target you than a vengeful ex who happens to work at Google?

Obviously Google doesn't provide any real defense against court ordered snooping, but everyone (should) know that at this point. No sufficiently large company will provide any real defense, and going with no name companies doesn't help either.

Do you imagine that engineers at Google just wander around with unaudited ability to disable audit logs?

Do you imagine this to be an impossibility? It would only take one.

I imagine that nobody has ever been deliberately given this power (why would it need to exist?), and that the auditing implementation is robust against most combinations of credentials that most engineers could put together. The number of people that could pull it off in theory is probably very small, the number that could do it in practice without leaving any trace is probably 0.

If they have legitimate access to the underlying infrastructure, they can just run cat on the physical files.

Even if you manage to end up as root in a shell on the host OS, the data you're interested in is going to be encrypted at rest, probably with keys that aren't on the same machine, and your access to the machine is going to have been logged somewhere. Access to the underlying infrastructure for the data persistence layer is also presumably granted to a tiny fraction of engineers. Only the relevant teams would need it, and even then not all of them.

I think the problem has more to do with human nature. I've read statistics that 1 in 25 people have strong sociopathic tendencies; the percentage could arguably be higher for high-ranking jobs in media companies.

There will always be people who want to make use of the power they hold for personal gain. I'd imagine this is especially true if they're unable to empathise / audit their own behavior due to their personality type.

No amount of process improvement can stop this type of exploitation as far as I can imagine. If the platform is built, we should probably accept that it either has—or will—be exploited .. or put measures in place to stop that kind of power existing in the first place.