Doesn't AT&T have any privacy safeguards?
(I just started working at Google, and getting at any user data, eg for debugging of a complicated problem, is the single biggest pile of paperwork they make you do. Even anonymized logs.)
(I just started working at Google, and getting at any user data, eg for debugging of a complicated problem, is the single biggest pile of paperwork they make you do. Even anonymized logs.)
My contract agency requested that I provide them with a company directory. I found the least helpful way to comply with that I could, with minimal information. Though thinking back on this, I 1) probably shouldn't even have done that, 2) should have refused the request, and 3) should have reported the request to the client.
And that's one of the, generally, more upstanding contract shops I've dealt with (still have occasional relations though no further gigs to date).
Dealing with ethics in the heat of it, especially where an engineering mindset tends to "this is a problem I should figure out how to solve" can be ... interesting.
People would go through users telephone logs, listen to their voicemails and read their SMS messages. If you had the right access, it was a wide open system with little or no safeguards on it. I think back on it now and am appalled, but at the time it was a kind of running joke to the guys in tech support.
More story time.
I worked for a firm providing services to a large revolving consumer credit organization. These companies are essentially two things: a really impressive transactions processing network (the volume of traffic they handle is immense), and branding.
Think of all the credit card commercials you've seen. That's the branding side at work.
As a contractor of theirs, there was a requirement to go through their data security training.
And while, yes, PII (personally identifiable information) was a concern, the vast bulk of the message, and emphatically highest concern, was with the brand, business plans, and similar information. That is, a company with vast holdings of personal information (described by a military acquaintance with intelligence ties in the late 1990s as "more than we've got" from the perspective of the TLAs, though that status may have since changed), was more concerned with how its trademarks and marketing campaigns were protected was ... revealing.
I would expect better controls against wiretapping, reading texts, accessing smartphone location data, etc. but identifying which physical circuit is serving a customer (and, consequently, where that customer lives) would seem to be a pretty basic bread-and-butter operation for AT&T. Not really a place where you could afford to go through a bunch of paperwork or an approval process.
The data's already there to run that sort of analysis. Unless they for some ... very difficult to imagine... reason don't log the actions of their own staff.