Comment by jijijijij | Hacker News Reader

Comment by jijijijij | Hacker News Reader

Parent Full thread

> Incidentally, if someone gets mad about you running this sort of thing, you probably don't want to work there anyway.

If you do want to work there, though, maybe check the legal situation first...

I am almost certain, this counts as unauthorized processing of personal information. Just because you have access doesn't mean it's fair game to do whatever you like with it. Especially archiving, keeping a history or linking (external) data is not the intended use for such an interface. If you take the information home with you, e.g. on your work laptop, that may be a whole nother can of worms. May even count as business secrets you're exfiltrating.

At least in Europe, abusing such an interface likely would be illegal, certainly if you keep a copy/diff. Your employer may have to act against you, or become liable. Or they may use this misconduct later to conveniently terminate your contract (lol, especially, if you use your insights as leverage).

I presume the larger the network, the more likely this will get you in trouble. Conversely, collecting the data has little use otherwise.

How about you organize with your colleagues to voluntarily share employment information to gain collective leverage?

A diff of the directory is abuse? That seems overly aggressive and I don’t see what that prevents.

Are you trying to be pedantic? A diff by itself does not necessarily contain any information at all. However, it should be fairly obvious a complete diff in relation to a reference contains all the information of a prior state. So it's functionally similar to a copy.

[LIVE]->[DIFF_N]->[DIFF_N-1]->...->[DIFF_1]=[LIVE_1]

You know, that's kinda how Git works.

> A diff of the directory is abuse?

Yes, if it contains employment information. A bunch of diffs can cross the threshold into event sourcing and if you have enough of them you might end up with a copy of the directory.

I already have a copy of the entire source code for this application, including all of the secret database logins. Why would having a copy of the employee directory be a bigger problem? (To be clear: I'm trying to understand the issue, not dismiss it)

> Why would having a copy of the employee directory be a bigger problem?

In jurisdictions where people have the right to be forgotten, they could ask for all their information to be erased. How would that work if you keep a copy of the employee directory? That is one example.

Another example would be a proposed bill in my jurisdiction which will force employers to disclose all information it stores about employees at the request of any employee. This will make you (someone who has a copy of the employee directory) some sort of data processor, which comes with new requirements about how you store that data and for how long.

As someone else said somewhere in this thread, if you can see information, this does not automatically mean that you can store it.

First off, the article is about processing and metadata analysis, not just a mere "copy". Then, let's clarify: You legally stream a movie, you are also "copying" files to your computer, yet keeping "a copy" of the entirety would be considered illegal. Pedantic, naive technicalities are a ill-advised legal defense, and so is the expectation of object-oriented jurisprudence. Not everything is categorically same, because of a shared attribute. Intent matters.

With your argument you are conflating intellectual property and business assets of your company, with privacy and informational self-determination of your colleagues. The latter isn't necessarily in the direct interest of your employer, but rather a right given by ethics, or governmental entities. Never mind metadata, a simple copy could mean transferring sensible information to a context where access control for unauthorized parties isn't implemented. Eg. you could have your take-home work laptop stolen, or compromised while watching porn. Legislative example: Under the GDPR, a doctor or therapist is not allowed to handle any patient data on private devices, which extends to contact information stored on their private phone. Context matters.

Not everything is about money, or monetary damage. Privacy rights are about freedom and self-determination of the individual.

Although, the organizational structure and history of a corporation certainly has implications for operational security as well. Try mapping and exfiltrating employment graphs and collected personal metadata at a defense contractor and see where that gets you. Mind you, OP's respective metadata analysis has little informational value in a ten peopled start-up, where you talk to everyone anyway. We're here considering corporations large enough for the individual employee to miss operational oversight by direct means. Corporations large enough, that meta-data would be valuable for third parties, too. Trust matters.

Reply on news.ycombinator.com