Do Google corporate email accounts allow IMAP sync, like gmail accounts? I mean fully-replicated BODY.RFC822 sync, not just headers.
I have to assume not, otherwise everybody using this feature would trigger the same exfiltration-lockout.
I have to assume not, otherwise everybody using this feature would trigger the same exfiltration-lockout.
Legitimately curious here. "Download all my mail from the mail server" is something I do multiple times every day. I guess my workflow would be verboten in corporate environments? Is it really such an odd behavior that they have an automated check for this, and it isn't throwing false positives every hour? Or is this one of those things they tell you at the "onboarding" like "hey, you might download all your personal gmail via IMAP regularly, but don't do that with your corporate email account or you'll get a phone call from security".
Maybe I'm just out of touch with how corporate email works. It's been a decade since I was an employee of a publicly traded company.
According to a source, Mitchell had been using automated scripts to look through her messages to find examples showing discriminatory treatment of Gebru before her account was locked.
Google's own statement, quoted by Axios, says:
Yesterday our systems detected that an account had exfiltrated thousands of files and shared them with multiple external accounts.
You're taking those as if they say the researcher was just using her mail client the way everybody does, but that's not what they say at all. The first one ("using automated scripts to look through her messages") says nothing about downloading at all; the second, official one, says that "thousands of files" were "shared with multiple external accounts." The allegation is clearly that the researcher wrote scripts to select (an apparently large number of) specific messages and forwarded those messages to people outside the company.
Nobody is saying "OMG SHE USED IMAP!". They're saying "She sent internal corporate emails to people outside the corporation."
It's not like the IMAP protocol sends the host MAC address or /etc/machine-id as part of the command stream.
I'm really having a hard time imagining a plausible automated security system that would have led to this outcome.
* Google automatically flags this by the volume of data transferred and alerts human eyes
* Google's alert erroneously fired and they made a press release about it
* Google is lying
* Your premise that it is a common and allowed use case is false
Why stop when your conclusion is absurd. These paths don't appear to take great creativity to identify.