Google fired a software engineer because he allegedly took advantage of his position as a member of an elite technical group at the company to access user accounts in violation of the company policy. Accounts accessed included those of four minors whom he had encountered through a technology group, according to reports by CNN and Gawker.
While there is no allegation of sexual predatory behavior, the engineer appears to have spied on minors’ accounts, accessed their contact lists and chats transcripts.
Given Google’s size it is almost predictable that an incident such as this would happen. When a company has thousands of employees, it is just a matter of statistics and probability. If X% of the country’s population is immature, emotionally unstable or has other personal problems, it is likely that these same characteristics will appear in the workforce of companies, despite the employers’ attempts at identifying the problem employee and prevent the occurrence of any mishap.
Events similar to the Google firing have occurred in hospitals where employees have taken advantage of their access privileges to snoop into celebrities’ health records. In this case patients records were copies or stolen for the purpose of selling them to the press. As a result, California enacted a law – California Health & Safety Code Section 1280.15 that requires hospitals and clinics to prevent the unlawful or unauthorized access to patient’s medical information and to report these incidents. The law provides for significant fines for hospitals and clinics who fail to provide adequate protection for patients’ records. Since the enactment of the law, several hospitals have been fined.
It is very difficult to predict and anticipate incidents such as the one that occurred at Google. Human behavior is too unpredictable. There are, however, a few things that a company can do to attempt to prevent this type of situation, or reduce the probability of their occurrence.
Reference checks
Before hiring or promoting an employee, adequate reference and background checks should be conducted. While most companies conduct a reference check when hiring a new employee, in many cases, the investigation is informal, and is limited to acquiring a better understanding of the person’s skills. These reference checks should be adapted to the nature of the position and the rights and responsibilities that the new hire will have.
Background checks
When an applicant’s responsibilities will give him access to sensitive information, such as personal data or company trade secrets, his background should be checked extensively. An in-depth evaluation might include conducting a criminal record investigation and interviewing character witnesses. This type of investigation is highly regulated, and requires significant precautions. While the administrative burden and financial cost of conducting these in-depth investigations are substantial, the cost is negligible when compared to the potential effect on the company’s reputation and market capitalization that a security or privacy incident might have.
Training
It is also crucial to train the employee (or contractor) appropriately. Initial and ongoing training, periodic reminders, and other education regarding privacy and awareness are essential to help reduce the probability of these occurrences. Young or immature employees, in particular, need appropriate, focused, education and awareness sessions for them to acquire the right reflexes when confronted with the temptation to “play God” with a database.
Monitoring
In addition to education and awareness, it is important to ensure that the lessons learned during the training sessions are actually applied in practice. In other words, the company should regularly monitor the employees’ activities. Companies have a responsibility to their clients and the other employees to ensure that the workforce abides by its rules of ethics and behaviors. They also have an obligation to their shareholders to ensure that the company’s assets (including its intellectual property assets and its reputation) or market value are not jeopardized through the negligence, immaturity or other behavior of their employees. To this end, employee supervision and periodic monitoring of their activities are crucial for identifying derailments while they are still manageable. Many technologies are available for this purpose.
Hotlines
Companies can also supplement their monitoring through the use of whistle blowing hotlines and customer hotlines that allow employees and customers to report problems that they identify. These hotlines must be administered in such a way as to ensure anonymity, when needed. The information collected must be reviewed and the matter investigated promptly and with appropriate discretion to protect the individuals concerned.
A company or a group is only as good as its weakest link. It is a daunting task – but a necessary one – to ensure at all times that all employees understand and abide by the rules.
- GDPR and Blockchain: Can they Coexist?
- The EU General Data Protection Regulation and Its Implications for US Insurance Companies
- All you wanted to know about the GDPR