Snapchat Employees Abused Data Access To Spy on Users

Several departments inside social media giant Snap have dedicated tools for accessing user data, and multiple employees have abused their privileged access to spy on Snapchat users, Motherboard reported on Thursday. From the report: Two former employees said multiple Snap employees abused their access to Snapchat user data several years ago. Those sources, as well as an additional two former employees, a current employee, and a cache of internal company emails obtained by Motherboard, described internal tools that allowed Snap employees at the time to access user data, including in some cases location information, their own saved Snaps and personal information such as phone numbers and email addresses. Snaps are photos or videos that, if not saved, typically disappear after being received (or after 24 hours if posted to a user's Story). [...] Although Snap has introduced strict access controls to user data and takes abuse and user privacy very seriously according to several sources, the news highlights something that many users may forget: behind the products we use everyday there are people with access to highly sensitive customer data, who need it to perform essential work on the service. But, without proper protections in place, those same people may abuse it to spy on user's private information or profiles.

Wow...

[Lab Rat Jason]

I'm shocked... SHOCKED... that this would happen.

Hm...

[argStyopa]

...yeah, "we promise we won't keep those often-intimate snaps at all" cross our heart!

And now people are surprised that wasn't true?

The next time you laugh sadly because Grandma was 'taken in' by some shyster pretending to be a Nigerian prince, well, you might want to think of how many snapchats you might regret out there.

Re:

[whoever57]

you might want to think of how many snapchats you might regret out there.

The number for me is zero, simply because I have never used it.

I also suspect that, given it's typical use, the number is zero for many people posting on /.

Re:

[Myrdrahl]

That number is exactly zero, simply because I do not take pictures of things that I might regret and if I did, the last place I would do so is in Snapchat. Neither will I ever send photos, video or anything else to anybody if there is any chance of it being incriminating in some shape or form, not even to myself. I simply keep shit like that to myself. If there is a video or a picture of me out there, there is nothing in it, that I'm capable of standing behind 100%. It's a pretty simple rule to live by actu

Uh huh ... sure ...

[Anonymous Coward]

behind the products we use everyday there are people with access to highly sensitive customer data, who need it to perform essential work on the service

See, their need to access highly sensitive customer data is trumped by the fact that I assume all forms of social media and apps are ran by greedy assholes and morons, and I have no intention of sharing highly sensitive data with them in the first place.

If you're not my bank, and you're not my health provider (and therefore covered by applicable laws) ... t

Well, of course

[hduff]

No amount of "we won't ever look at your data" will keep it from curious eyes.

Re:

[bill_mcgonigle]

A simple amount of e2e cryptography will. But the users are the product, not the customers so privacy will never be a feature .

Of course they've got access.

[marcle]

As an IT guy, you've got to have administrative access to the systems you're working on in order to do your job. If you're a professional, you don't abuse that access. If you've got more than one IT guy doing it, you've definitely got a management problem. But there ain't no way you're gonna wall off the data from the techies.

Re:Of course they've got access.

[Solandri]

It's easy to wall off data from the techies. The "data" isn't the bits. It's the information those bits represent. So you just implement client-side encryption. The data still gets stored on your servers, but it's encrypted by the client before it ever gets to you. Your techies can access it, but it'll be gibberish ciphertext to them. Only the user (using a client with the correct decryption key) will be able to see the plaintext version. Communications between two people (like SnapChat) just need to be encrypted using public/private key pairs.

The main reasons cloud service companies don't do this is (1) they don't want to deal with tech support calls from users who have forgotten their password or whose clients have lost their encryption key, and (2) so they can spy on their users by reading their data and sell the information to marketers.

Re:

[ceoyoyo]

There's no reason at all why anybody but the two endpoints need to have access to the data.

Re:

[Myrdrahl]

I think it's mostly a crime of opportunity. I've been working in IT for 15+ years and have usually always had the means to access personal files for anyone in the companies that I have worked for in those years. I have never snooped around and I don't think I ever will - it's hard to say that it will never, under no circumstance, ever happen, but it haven't yet. To me it's about integrity. I have a security clearance that gives me access to all data on our servers, including personal information. I'm entru

This is common sense

[nehumanuscrede]

This is also why I don't do Cloud unless my data is encrypted ( my encryption, not theirs ) before transmission to said Cloud.

It's human nature to be nosy. If you put ANY data out there, SOMEONE is going to go through it regardless if you want them to or not.

Think Positive!

[v1s10nary]

Well it sure is a good thing that nobody ever sends anything "sensitive" in nature over Snapchat... Damn.... Nevermind....

It Happens All the Time

[dcw3]

Seriously, if your company/agency is keeping private data on people, you can just about guarantee that it's gonna be abused by the employees. It's happened at the IRS, it's happened with multiple police, it's happened at FBI, NSA, and virtually every social media place. People look up their friends and enemies. The question is, WTF can we do about it?

Re:

[Myrdrahl]

For agencies like those you mention it's a question about restricting access to a small number of people and restrict the scope of their access. Sure, you will always have that police chief or higher-ups that will misuse their credentials, but I think that's the best we can do. Encrypt everything and log every access to anything of importance. If someone looks up an address in the system, log that search. If someone pulls up files from a backup, log that shit. There will still be people who can't keep their

Safeguarding Data

[Only Time Will Tell]

One of my first 'real' jobs was as an e-commerce programmer. One day I was doing some testing and looked in the database to make sure the data read through. I was shocked to find whoever set up the site had left all customer data in plain data fields, open to see/download by anyone who had access. If I was evil, I could have dumped tens of thousands of rows of customer addresses, credit cards, etc. and done who knows with it (we were running SQL Server 2000, which meant it could have been real real easy