Twitter is being sued over the Saudi spies they hired in customer service and SRE roles, the ones who used their access to collect information on Saudi dissidents. protocol.com/bulletins/saud…
A bunch of people have been telling me that it’s ok to relax end-to-end encryption to fight crime, as long as there are protections and data never leaves the company. Stuff like shows why it’s not. 
“But this was an isolated incident!” Or alternatively, maybe being caught was the isolated incident. How many companies (startups, particularly) have internal controls sufficient to withstand even devops folks with admin credentials?
Someone who once worked at Facebook a few years back told me that during orientation they told new employees what to do if someone threatened them (or their families) for access to customer data. The advice was to hand it over.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
