It's happened before: https://techcrunch.com/2010/09/14/google-engineer-spying-fir... If a person has enough access, and they have to, given that someone has to have admin access.

Around 100 people have root @ Google. They get a tshirt with it on.

With months of effort researching tripwires and auditing systems, any of them could read your mail.

There's a pretty good chance they'd get caught by some auditing or alerting system they were unaware of though. Many of those systems are kept secret from employees for obvious reasons.

Any two employees collude to much more easily read your mail. There's probably ~1000 people in that position (not only the gmail team, but anyone who writes any kind of library code used by any of the databases, datastores, or application servers). They would leave audit records though, although they might go unnoticed.

That's cool in that it's such a small number. Netflix shared how they do ephemeral access by publishing bless *[1]. It would be cool to see how Google does it as well. Googling for the usual terms doesn't return anything.

[1]https://github.com/Netflix/bless

>100 people have root @ Google. They get a tshirt with it on.

A convenient way to put a target on your back. What benefit does this have to their security? Accountability?

The t-shirts are a bit of jokey swag, not an access control mechanism. ;)

Yes, it’s a “hey everyone this person has the keys to the kingdom, target them” indicator.

It's likely that reading Gmail data and other sensitive actions require significantly less privilege than some Google-wide "root".

Access controls are actually fairly locked down. I would guess the access control list for Gmail data is only ~10 people. If any of them were to make use of their access permissions, it would automatically trigger a review of their actions.

Worth noting that this occurred in 2009 (ie when gmail looked like this: https://1.bp.blogspot.com/_ZaGO7GjCqAI/SYD3g8LflXI/AAAAAAAAO...).

I don't know anything about Google's internals, but, like, there's some data. It gets to your screen. There's code written by Google employees that makes that happen. That code gets modified on a regular basis by Google employees. If enough Google employees get together, they can modify that code to do whatever they want.

I expect that any single Google employee does not have access, in the sense that they've locked themselves out of making changes to their systems without a computer seeing multiple human approvals. But there is a point at which someone can fix that computer.

But yes, my point was that the threat model here isn't "one Google employee goes rogue," it's "multiple Google employees with extremely privileged access to Gmail and/or their code deployment servers all decide that they want to read your email without telling you, and nobody blows any whistles," which seems much more far-fetched.

If there is a will, there is a way. It's all about trust, but I'm sure st least publicly they have stated employees do not have that access.