A) Rogue employee messages a bunch of internal email lists about having the right to organize
B) Rogue employee configures a security extension to issue a popup saying "Happy Birthday Sundar!" every time an employee visits google.com on June 10.
I am confident that A) wouldn't result in any formal adverse action (they'd mostly get a pile of nasty responses about spamming internal lists), and I am confident that B) would at the least earn the employee a reprimand and plausibly get them fired.
Yikes! That sounds like a dangerous place to work. If an employee with legitimate, assigned access to such a tool makes a change through normal procedures (not bypassing required code review or anything) and it's still a fireable mistake - well, I'm glad I don't work there.
Data is simultaneously Google's greatest strength and its biggest liability. If an employee uploads data to a not-known-to-be-secure third party, it can literally cost Google billions of dollars depending on the data locality. Or, it could plausibly cause a severe security breach (if e.g. an employee uploads a security token into a third party decoder).
And so the security team builds an extension in order to very loudly alert employees when they're on one of these known-to-be dangerous domains. And, as it happens, the implementation of the loud popups could make it a general browser notification platform whenever an employee visits a particular domain.
Is it a good idea for teams to start using it as a general notification platform?
No, not on any level. On top of being annoying for employees, it breaks the security UX. When someone sees one of these popups, they know they're important and that they should be very wary of whatever they're doing. But if it starts being a popup that can be triggered by anyone in the company who can convince themselves that they're providing value by sending out the popup, people start ignoring it. And there's no going back at that point, because employees have been trained to ignore the popup because of it staying stupid shit like "Happy Birthday Sundar!" and "Read these NLRB rights!" and "You can go grab a burger at the cafe today!" Everyone's been made worse off, and the original security problem has come back.
If you could concisely and cogently explain why this change is a bad idea in an HN comment, surely someone can do that in response to the change, revert it, and move on. If it's SOP for Google to fire people who make well-intentioned changes that have the side effect of alert fatigue, then one, I don't want to work there, and two, I would expect to see a lot more firings.
And surely they could explain the problem, revert it, and move on without calling her into a conference room and grilling her about who else she's organizing with. That makes it seem like it's about the content of the notification, not the alert fatigue.
Don't misunderstand, it's not that I'm really trying to defend google. This is to serve as a reality check and warning to those who don't understand the rules of employment. And I'm guessing the Engineer in question understood the risk full well.
I don't disagree with that either. I'm just saying that, if this is the company's choice of fireable offense if the company actually considers it normal to exercise the right to dismiss an employee (which they legally do have) for this sort of mistake, I'm glad I don't work there.
As I mentioned in another comment, I recently did something at work that you could spin in an equally sinister way, if you want. My company would be within its rights to fire me for it. My employer would be within its rights to fire me for sneezing at the wrong time, or even for no reason at all. I choose to continue working at this company because I trust that, despite their legal ability, they have no intention of actually doing so. If I ever lost that trust, I would leave.
(In fact, my employer and Google's also have very similar employment agreements about ownership of outside IP / personal open source, but I had reasons to trust my employer to act more reasonably than Google, which was part of why I chose my current employer when deciding about it and Google. In practice that trust has turned out to be well-placed, and there's now a thread on the front page about how Google loves to follow the letter of the employment agreement and arbitrarily deny IARC requests.)
"This kind of code change happens all the time. We frequently add things to make our jobs easier or even to just share hobbies or interests. For example, someone changed the default desktop wallpaper during the walkout last year so that the Linux penguin was holding a protest sign. The company has never reacted aggressively in response to a notification such as this in the past. It’s always been a celebrated part of the culture."
The fact that other employees have participated in pro-employee activism and not been disciplined speaks to that. Some things are fine, some things are not. Abusing security software is not.
Do you activism in your personal time. Don't use important company resources used to protect employees from harm to push your slogans. Regardless if those slogans are legally legitimate statements in a normal context, like handing out a leaflet on the edge of the property.
Correction: an internal message display tool.
> for your own pet activism
> push your slogans
Correction: a warning not to break federal labor law, which Google is actually required to provide.
https://miro.medium.com/max/2000/0*1BTVYLTvuHiJVvp_.jpg
> Do you activism in your personal time.
This is about Google. Apparently their company culture has been the opposite, and they have commonly had lots of political discussions on company time using company resources.
For the millionth time, it was not a general message display tool. It is a security tool to flag domains that run the risk of data leakage and malware. Trying to hijack a security extension to turn it into a general messaging platform is both stupid and bad for security.
Labor law requires that those notices be posted somewhere in a prominent place employees are likely to see. They definitely don't require them to be posted in arbitrary places at any employee's choice.
(Furthermore, the laws about protected concerted activity specifically permit you to do your activism at work, not just on your own time.)
Jeez, politics really does make people go funny in the head. As long as it's "their guy" everything is on the table to sidestep logic.
(I don't know enough of the history of Google's firings and this kind of violation to know either way.)
You can't fire a worker for organizing, or on the basis of sex, race, etc. But you CAN fire whoever you want for breaking even the most minor rules or even just poor performance. And the choice can be as politically motivated as google likes, doesn't change a thing.
Furthermore, google has a really easy time with "selective enforcement" They can show that people violating security rules and abusing administrative rights are always fired. Now, she can argue she didn't do this, but because of the nature of our legal system, it will be extremely hard to explain. I main, disgruntled employee abusing security? Whoever heard of such a thing. The civil judge will probably help google refer her to the FBI!
>They can show that people violating security rules and abusing administrative rights are always fired.
Yes, that agrees with what I was saying: if every message thusly inserted resulted in a firing, then it would not be fair to say she got fired "for notifying employees of their right to organize".
If you hijack the company's PR to inject your own personal opinion I'm pretty sure you'd be fired from any company.
True, but it seems kind of shady to come down harder on an employee based on the content of the interruption, and that content notifying of the right to organize.
Like, imagine there's a documentation page for http cookies. Consider two scenarios:
A) Rogue employee adds to the bottom of the page: "Cookies are also delicious treats given as a reward on the internet."
B) Rogue employee adds to the bottom of the page: "Employees reading this are reminded of their right to organize under NLRA."
Let's say that in scenario A, an employee would typically get a written warning, and in B, you always got fired. In that case, I think it would be fair for B to say -- at least in common speech -- "I got fired for notifying employees of their right to organize."
This is true, even though there is a general policy of not adding non-topical messages to doc pages, because the punishment never escalates to firing unless it's something like scenario B. (In a legal context rather than common speech I don't know enough to say whether it would be legal.)