Hacker News Reader

Comment by KirillPanov | Hacker News Reader

Or instead of answering my question people could just downvote me. I guess.

Legitimately curious here. "Download all my mail from the mail server" is something I do multiple times every day. I guess my workflow would be verboten in corporate environments? Is it really such an odd behavior that they have an automated check for this, and it isn't throwing false positives every hour? Or is this one of those things they tell you at the "onboarding" like "hey, you might download all your personal gmail via IMAP regularly, but don't do that with your corporate email account or you'll get a phone call from security".

Maybe I'm just out of touch with how corporate email works. It's been a decade since I was an employee of a publicly traded company.

View on HN

The Axios article says:

According to a source, Mitchell had been using automated scripts to look through her messages to find examples showing discriminatory treatment of Gebru before her account was locked.

Google's own statement, quoted by Axios, says:

Yesterday our systems detected that an account had exfiltrated thousands of files and shared them with multiple external accounts.

You're taking those as if they say the researcher was just using her mail client the way everybody does, but that's not what they say at all. The first one ("using automated scripts to look through her messages") says nothing about downloading at all; the second, official one, says that "thousands of files" were "shared with multiple external accounts." The allegation is clearly that the researcher wrote scripts to select (an apparently large number of) specific messages and forwarded those messages to people outside the company.

Nobody is saying "OMG SHE USED IMAP!". They're saying "She sent internal corporate emails to people outside the corporation."

Typically this is disallowed from non company devices. If you're allowed to sync your corporate email to your personal devices, that's probably an oversight.

So if IMAP-sync to corporate-owned laptops is a common and allowed use case how did an automated system notice this activity?

It's not like the IMAP protocol sends the host MAC address or /etc/machine-id as part of the command stream.

I'm really having a hard time imagining a plausible automated security system that would have led to this outcome.

I worked at Google and we used gmail, not IMAP, to view email. Corporate laptops allowed logging in to your corporate gmail, but I never saw anyone use IMAP and I have a feeling it wouldn’t be allowed. Once I left Google I had no access to my old corporate emails and I’m sure that’s the way they want it. I did thought experiments about data exfiltration and it would certainly be difficult. They control the OS on your system, they control the network, and they authenticate everything so no anonymous access is allowed. That’s why people get caught - they can see basically everything you’re doing on corporate machines or corporate networks and they know who you are.

Well, then, there are at least a few paths of reasoning you can follow:

* Google automatically flags this by the volume of data transferred and alerts human eyes

* Google's alert erroneously fired and they made a press release about it

* Google is lying

* Your premise that it is a common and allowed use case is false

Why stop when your conclusion is absurd. These paths don't appear to take great creativity to identify.

In general: if it’s on a corporate server, it’s not your email, it’s corporate IP.

I don't dispute that. I don't think you understood the question.

Reply on news.ycombinator.com