That struck me as odd do not US phone companies secure their sensitive customers information. When I worked at BT they took this very seriously and say looking up the queens unlisted telephone number you would get into serious trouble.

For some systems team leaders who needed wide access to data had to pass security clearing at the TS / DV level I was told.

Hah, the queen has an unlisted phone? Well I guess she has a private landline...

Reading your comment makes me imagine HM The Queen in the royal carriage, being bored at the slow pace, staring at her smartphone, scrolling through Instagram.

Yep there was a big scandal in Scotland when a some what sketchy journalist got a job in a call centre and did that.

The irony was the press office was on the floor above and didn't notice.

Lol, how did that go? I am thinking... something along these lines:

Telemarketer: When you sign up with ShitWare, our Platinum partner, you get a free BigMac (tm) with a crumpet and a small drink! This exciting promotion is only available to our subscribers! Limited time offer. Quantities are limited. Only in participating restaurants. Some conditions apply. Taxes (incl. VAT) not included.

Queen: Goodness gracious, did you just say free BigMac (tm) and crumpets? That is, like, fucking amazing! OK I clicked on that link, it says "Your Windows is infected! Click here to clean!" Is that OK? Btw where is my food.

Telemarketer: It is, indeed, perfectly OK! Just click on where it says "I Agree". BTW it is one crumpet (not "crumpets") or a hashbrown, subject to availability. This exciting, time-limited offer is ---

Queen: Yeah whatever dude, just send the food in.

Queen: This is good. Most good.

Politicians of a number of nations have been caught messing around with mobile games and such during debates...

So if your waiting to be called to speak

Interesting. I wonder, what was the procedure when some random telemarketer dialed one of those Queen's unlisted numbers? Or, whatever unlisted numbers.

Is that something that BT would intercept?

But surely since I'm head of the CIA, Liz and Phil won't mind if I phone for a catch up?

> I would never let my manager into my Linux systems, just to make an analogy. I give my manager a report on what's going on but I'd never let them in.

I'm not sure about the chain of command in your company but in most companies, managers don't need permission from their charges for access. Managers are the ones who give their underlings access.

Granted, in most tech infrastructure, only a handful of people might have direct access to production/sensitive assets like databases, file, web, etc servers. And managers wouldn't want to muck around on production servers. But the idea that you wouldn't let your manager access or that they couldn't get access if require seems very odd. What happens if you quit or get fired? If your manager wanted access and you refused, he has the power to fire you.

> Yet these top directors are able to get access to essentially any database or system just because of their title.

Depending on their role, directors of any company can get access to anything because they act as the ultimate arbiters on behalf of the shareholders. The chairman of the board is who the CEO of companies report to.

Sure, you wouldn't want people who don't know the systems to gain access. But I'd be interested to know how a low level employee can prevent their manager or even directors from access if they wanted it.

> top secret databases

The info was surely sensitive, but I don't see this article indicating that any of the information was classified (let alone TS). That would be a major vulnerability, normally guarded against by using completely separate systems to access such information.

The thing is that your manager does not need your permission. He comes in, states he wants to have all the accesses and you give them to him.

If you do not, he rightly fires you.

There are of course many legal cases where administrative access is limited.

What you are describing is scary : you hold the company in hostage, and the company is apparently happy with this since it allows such a posture from their admin team.

Beside the legal aspects I mentioned, I always had complete access to all the thousands machines and services I was ultimately in charge of. I would have test scenarios to ensure access is granted, but did not log into them because there was no reason to do so (and I may break something).

Note: the way how the acces is provided in another story. It should be documented, traceable, etc.

It isn't because of their title. It's because of their authority. You can argue against access but ultimately do not have the authority to prevent it. They can fire you.

I once had an IT guy who was making up his own passwords for workstations and servers. When he refused to provide them to me I had our attorney meet with him so he could clearly understand the implications. He was holding the company hostage and violating policy. He provided the passwords at the end of that meeting and was fired on the spot.