Did you not read the part where she did, where she followed the process by the book and it was approved? Or did you just have your mind made up to decide to side with Google instead?

This was the process: "the standard approval process, which requires two co-workers to greenlight changes"

In my company, I could put in travel orders to let me go to and from Hawaii on the company dime, have a vacation, and have my supervisor approve (which is following the standard process), but doing that should get me in a lot of trouble and/or fired.

Sorry, but could you clarify what you would be fired for in your hypothetical situation? Presumably, it's not automatically against company policy to expense a trip to Hawaii.

I was implying I took the trip to vacation, not to do work. Sorry if that wasn't clear.

And your supervisor knew of your intent to deceive the company when they made the approval? And if so, why would they make the approval unless they too wanted to be fired?

Sorry to be pedantic about a hypothetical, but I think it's necessary to consider the specifics of the actual case. Assuming this process involves something akin to a codebase commit, where the contents of the approved change can be clearly seen by the approvers, it raises the question of what sanctions her colleagues faced if Spiers' violation was so severe as to result in near immediate termination.

(because obviously, in your hypothetical situation, your supervisor would be fired if they knowingly approved a deceptive work expense)

If your supervisor knew that you were taking the trip to vacation, why would they approve it?

If the supervisor did not know, then your analogy is flawed. There was no information asymmetry between Spiers and her reviewers - they knew what the change did and they approved it.

No, to follow the analogy: The supervisor trusted that person to only put in requests that are actually work-related. Just because the process says "supervisor approves" doesn't mean that it absolves the subordinate of responsibility.

So in this case process was followed, yeah. But trust was broken, and it only stands to reason that Google would fire this employee because of it. All other stuff is secondary and pollutes the discussion.

So forming a union (which is absolutely legally protected) is like going on a vacation?

Because adding harmless code and stealing plane tickets, hotel fare, and maybe a rental car are the same thing.

How do you think old-school labor organizing went down? Do you think the bosses stood there smiling as employees handed out flyers at lunch? Google shouldn't have a say in how employees unionize. They have every reason, literally EVERY SINGLE REASON to sabotage it at every stage to make it as ineffective as possible.

They are merely pointing out that despite the action following one standard procedure, it is still possible to be against the rules.

And a fox has every reason to make a "rule" that dogs can't go in the henhouse. That's why we don't let foxes guard henhouses.

no it shouldn't, your supervisor thinks that you should go to hawaii for company's benefit.

I think in that case your supervisor should be fired.

You followed company policy, but your supervisor didn't.

They got a code review. That doesn't mean the message they inserted was approved, it just means they got two engineers to sign off on the code.

Obviously, inserting pro-unionization messaging into a security tool isn't "by the book", or we wouldn't be having this discussion.

If it was a code review, it would judge code quality and similar things. Not whether that change is in Google's interest. I guess if she was a product owner and added this feature, she would have been fired as well, despite following the process. She just acted against the company's interest.

Do you only know copy and paste the same comment?

I'm honestly a little surprised (and worried) about all the commenters who argue Google is in the right here.

This isn't a cut-and-dry issue. The internal tool was purportedly used to alert about privacy and security issues on external websites. But the message sent to users was not privacy or security related.

Of course Google is right. She happened to get two coworkers to approve what she was doing.

If I got a manager who I was friends with to approve my purchase of a fully decked out $53K Mac Pro so I could finally use Slack at a decent speed when I am working from home, wouldn’t you think there was something fishy?

I think then the responsibility is on the manager?

Or maybe all of them. These are highly paid employees. They bear a personal responsibility and can’t shove all consequences onto a manager.

Since you can’t spend 53000 dollars on a Mac laptop last I checked, yes! However the whole purpose of a managerial hierarchy is to establish a responsibility chain so at very least I would expect the manager to also get fired.

Google doesn’t care about these antics. They, like all employers, don’t want their employees to have meaningful bargaining power.

They did say Mac Pro:

https://www.hardwarezone.com.sg/tech-news-fully-spec-apple-m...

Taking into account the exchange rate that works out to about 55K USD.

Whoops you're right. I misread.

Well, there have been plenty of stories about toxic managers in tech companies. If your manager said it was okay to hit on your coworker does that absolve your responsibility to have good judgement?

And as far as having “bargaining power” they are tech workers at Google. If they have even a modicum of skills they have the ultimate power - they can walk away and get another job.

Heck, I’ve worked at a bunch of no name companies over 20 years and even I can walk out of the office and have another job in two weeks and this is nowhere near the west coast.

A single employee walking away has no power to change the status quo at google. A lot of them, however, do. That's what google and all employers wants to crush before it has a chance to coalesce.

Or maybe they just don’t want to give up their salary and RSUs.....

People love to make excuses for their bosses because they believe their interests are aligned :(

I agree. There's a scene from Futurama that is useful here :) https://i.redd.it/gy1a8j3rqhx21.jpg

Also for a less tongue-in-cheek response this is related to the notion of "false consciousness" first written about by Friedrich Engels in the 1800s: https://en.wikipedia.org/wiki/False_consciousness

> I'm honestly a little surprised (and worried) about all the commenters who argue Google is in the right here.

i, honestly, want to know why you think otherwise. what she did is wrong.

but assuming she didn't know and that's what the "by the book" process at Google truly is... that's even more concerning

Why is that? You can't just get code review / deployment approval. You need to have approval that a certain feature or process is wanted / needed for the system. My guess is the sec engineer in this story did not get approval for this feature in the first place, she just went ahead and changed the code.

What if this change allowed passwords to be captured in plain text? Browsing history? Surely those are fire-able offenses? So how is this situation any different?

So if she escalated her privileges and bypassed the approval process, yes, of course that should merit severe punishment. But that's not what happened, according to Spiers.

Giving her the benefit of the doubt for the sake of argument, you'd agree there's a huge difference between adding malicious phishing code to a company tool, versus displaying a text notification that doesn't fit the tool's original intent?

The text in question read, “Googlers have the right to participate in protected concerted activities.”, which is arguably different than the usual privacy/security warnings that the tool was intended for. But is it a fireable offense, versus an offense that warrants reprimand?

To put it another way, I think very few people would be bothered by Spiers being fired if the text notification she added were "Heil Hitler!". But that kind of content is fireable for a number of reasons. Whereas Spiers note about union rights, while inappropriate for the given plugin, is not patently against Google policy, and (again, assuming it's just a text notification) did not endanger the company.

If an employee tries to set fire to company equipment, they should be fired. If they draw a swastika on a bathroom stall, they should be fired. If they post up a pro-labor pamphlet in a bathroom stall, where it's against company policy to post any materials (regardless of content), should they be fired or reprimanded?

All these 10x developers terrified they'd have to make a reasonable wage like the rest of us serfs.

*By the way, that's very much sarcasm since a well organized union doesn't need to cap wages at any level. It's just the argument that keeps getting put forward and I get sick of it.

People can disagree with you in good faith without being shills.

I am totally against people pushing their political messages on me while at work, and dislike working with the sort of person depicted in this article. I think they're bad for morale and a distraction from the business.

You can quite easily convince yourself by reading through my comment history that I'm not part of any PR firm, just a guy who wastes too much time commenting on HN.

From the article, it doesn’t appear to be the case. She said she was allowed to inject JS code as a “digital extension” to putting a poster up.

In this case, the people who approved it should be fired as co-conspirators. The sanctity of the software that runs on employee's hardware should never be violated.

Even if she followed the rules that doesn't mean she should be absolved of guilt. You can follow the rules and submit a PR, have 2 code reviews and plenty of tests, if you brake production then you can still be fired for incompentency.

The fact that 2 reviewers approved her change doesn't mean that she has the right to send notifications like this through a browser extension.

The spyware was designed to pop up notifications on visiting URLs to users, she just added another message for a url.

"Part of my job was to write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the web. "

I'd be curious to know what URLs employees get alerts about? Perhaps services which do not take kindly to seeing IPs from Google offices?

The notice was added to a relevant page (a work organisation consultant webpage), from what it looks: https://medium.com/@ksspiers/google-fires-another-worker-for...

"Spiers, 21, said she went through the standard approval process, which requires two co-workers to greenlight changes, before updating the Chrome browser extension. Another source at Google familiar with the update approval process confirmed to NBC news that those two approvals are standard practice for a browser extension update."

She alleges it was done by the book.

I'm pretty sure that if I stood up in my office, I could find one or two people who would rubber stamp a change for me, assuming it was in good faith/approved, and would discuss implementation details/issues with the code, rather than question the reason for the changes. Particularly if the changes were tagged with a Jira. If your only defence is "well, what I did wasn _technically_ allowed", you lose the benefit of the doubt.

Incidents like this are the reason why red tape ends up introduced on small teams, and are what turn projects into a nightmare to work on.

That sounds suspiciously like a continuous delivery approval process (like needing two approvers for a PR).

Does what she did even pass the sniff test? What if she got permission from her supervisor to inject $political_message_you_dont_agree_with in your browser. Would you be okay with that?

A pro-union statement may be a "political message", but it is also content that has special protections in labor law. As the article says, as part of a legal settlement over alleged labor violations, Google is required to print out and post a statement of employee rights [0] that begins, "FEDERAL LAW GIVES YOU THE RIGHT TO: Form, join, or assist a union;...Act together with other employees for your benefit and protection;"

[0] https://www.cnbc.com/2019/09/13/googles-settlement-on-speech...

Print out and post is not the same thing as injecting JS in the browser. Was she part of the legal or compliance team?

FTA: "The tool is managed by the platform security team, for which Spiers worked for almost two years as a security engineer."

Is it part of the security teams mission to insure legal compliance to workplace laws?

I’m part of my company’s “architecture team” but that doesn’t mean I have the right (even though I do have the access) to spin up an X1 AWS instance at work with 2TB of RAM. If my immediate manager said it was okay, I would have sense enough to get it confirmed by my CTO.

Company management does not typically go out of its way to disseminate right-to-unionize speech. They are legally prevented from stifling such speech. And apparently, their alleged labor violations were serious enough that the NLRB mandated as part of their settlement that Google must post more material informing workers of their right to unionize [0].

But my overall point is not that I think her alteration was appropriate (given the context of the tool). But that her mistake could reasonably be seen as one made in good faith, especially because the content itself does not outright violate company policy or labor law. In other words: approved content, unapproved venue. The question is: that's a fireable offense?

So why do you keep likening it to hypotheticals that would reasonably violate standard policy and procedure, such as conspiring with your manager to spend $53K on a Mac Pro that you use at home? Or injecting via browser notification a "political_message_you_dont_agree_with"?

[0] https://www.cnbc.com/2019/09/13/googles-settlement-on-speech...

A former company I worked for was under a consent decree. Their legal team had to come up with remedies that were acceptable by the government to address them - not their security team.

I was the dev lead responsible for writing software that would be used by the department that was most impacted by the decree. Should I have taken it upon myself to create pop ups informing them to be careful about compliance? Legally, I probably couldn’t have been fired but would that have displayed good judgement?

When you are part of certain departments or positions, you have more access and therefore are expected to have better judgement.

Many startups have a culture where you could spin up an X1 AWS instance with 2TB of RAM if you need it, without having to go and get approval. Similarly, Google has a culture where engineers make various changes to internal tools without needing approval from higher ups.

Well, according to the post, obviously not....

No, the post states that it is obviously the case:

>This kind of code change happens all the time. We frequently add things to make our jobs easier or even to just share hobbies or interests. For example, someone changed the default desktop wallpaper during the walkout last year so that the Linux penguin was holding a protest sign. The company has never reacted aggressively in response to a notification such as this in the past. It’s always been a celebrated part of the culture.

It’s amazing that you think that anecdote is okay or even welcomed....

Well no, but considering that she seems to have followed the correct processes if she had done that I'd have expected the response to be rolling back the commit and a follow up postmortem to document what was missing from the process that allowed it to happen and changes made to the process to prevent it from happening in the future. Not firing the employee. You shouldn't blame workers for system failures.

What if your manager told you it was okay to post “Make America Great Again” or “Hope” (Obama’s slogan) slogans on everyone’s desk because he was staunch Republican/Democrat - would you just shrug and say “my manager said it was okay”?

Again, labor/union messaging has protections that political campaigning does not. If you were a manager and you told your employee to throw away the pro-union pamphlet that you taped to your cubicle wall, your manager would be putting the company in legal trouble.

Taping it to your wall is acceptable. Posting it to my computer screen isn’t.

why, and more importantly, why is this an "immediately fire" level of offense, would this have been the result if the popup reminded you that its earth day?

Its naive to think her firing had nothing to do with the fact Google doesn't like unions.

Why? It’s just like religion. If your religion tells you not to drink, I will respect that. If your religion tells you that I’m not allowed to drink I will tell you to f’ off.

The irony being of course, Google's entire business is shoving ads into people's faces that approximately nobody wants to see.

And guess what? I don’t need government intervention for that either. I can install an ad blocker, not use software that is ad based with no way to get rid of the ads and not buy Android phones. Free will is great isn’t it?

But the owners of websites want to show these google ads to you. Who is in control of content: the viewers or creators/hosters?

Agreed, but the engineer's claim is that she followed the standard approval process "which requires two co-workers to greenlight changes". The article says another Googler confirmed that this is the process. But the article doesn't say that Spiers' assertion (that she went through the process, and had two colleagues sign off) has been specifically confirmed.

Presumably, audit logs would make this an easy thing to set straight.

You can follow the rules and submit a PR, have 2 code reviews and plenty of tests, if you brake production then you can still be fired for incompentency.

The fact that 2 reviewers approved her change doesn't mean that she has the right to send notifications like this through a browser extension.

According to Spiers[1], modifying software that runs on every employee's computer was her -job-.

[1] https://medium.com/@ksspiers/google-fires-another-worker-for...

As noted later in the article, she got two thumbs up; doesn't this justify her actions </s>.

The article says that she went through the standard approval process.

We've banned this account for repeatedly breaking the HN guidelines and ignoring our requests to stop.

https://news.ycombinator.com/newsguidelines.html