How many insider threat programs at various firms are really being used to implement systemic discrimination?

I thought it was becoming common knowledge many Silicon Valley campuses and other corporations use an IMSI catcher/Stringray to capture personal cellular communications of its employees...

https://www.businessinsider.com/ex-tesla-employee-claims-the...

https://www.theverge.com/2017/10/3/16408724/waymo-uber-lewan...

https://www.reuters.com/article/us-apple-nuvia-lawsuit/apple...

I am pretty sure none of these people used their corporate issued cell phones...

I would not be surprised if ebay hired a firm to park an IMSI catcher machine close enough to the home of these people.

The reason they felt secure enough to deny these accusations implies they have all done this before.

Now instead suppose my employer gives me an iPhone with a cell plan they are paying for. Now there are more questions - is this a vanilla iPhone or is some kind of tracking software installed on it? Perhaps the phone company will freely give up my browsing history to my employer? I’m a lot less comfortable with this. It feels like my employer has legal authority and technical capability to see a lot of what I’m doing on the phone.

Edit:

> Also don't do activities on them that are... criminal.

I’d not worried that employer would get me in trouble with the government for criminal activity. My behavior is a little more constrained by worries that somebody at company could be analyzing my browsing history for violations of company policy, which in a worst-case scenario could get me terminated or cause me to face civil litigation, especially if I were to do a startup.

I am not saying anything criminal was discussed on these phones...

If you look for higher paying jobs and discuss the matter on your personal phone with a recruiter during lunch time... Insider Threat programs will report you to your boss and HR.

If you are socially active in your private time and receive a text about a meeting, these activities will be reported to your Insider Threat program and hinder your career.

If you are having an affair (not with any coworkers) and receive a text... This will be tracked by Insider Threat program.

If you get called on your personal phone by a VC firm or competitor for a new position, this will be tracked by Insider Threat program...

If there is a full disclosure upfront, then I don't think it's that bad... But if disclosure is only given to favorites allowing some to modify their behavior... That's horrible

I can believe some companies would use a stringray, but I don’t think the average line manager would be brought into the loop on this. It would be reserved to intelligence operations that never see the light of day, and therefore couldn’t inform low level operations like performance management of the average employee.

Uhh...

One thing I was curious about was how the feds got the data from Apple. I'm guessing because they were eBay-owned phones and eBay gave permission but I don't think it actually says anywhere.

[To say nothing of the fact that, for supposed security people, their operational security was... not good. Just more arrogance I guess.]

How did they get past the lockscreen? Corp phone has some MDM policy that let's them bypass/reset the lock screen?

I wonder how many times similar things like this have happened (maybe even by the same people) but they covered their tracks successfully.

One final note - I'm very impressed with the professionalism and skill of the NPD(the local police department of the victims).

Hitchhiker: Hell no.

Raoul Duke: I didn't think so. Because in spite of his race, this man is very valuable to me. Oh, shit. I forgot about the beer. You want one?

Hitchhiker: No.

Raoul Duke: How 'bout some ether?

Hitchhiker: What?

Raoul Duke: Never mind.

-- Fear & Loathing In Las Vegas

I'm reminded of that 1993 cartoon by Peter Steiner in The New Yorker: https://upload.wikimedia.org/wikipedia/en/f/f8/Internet_dog....

If nothing else, it's probably safe to assume that someone like Mark Zuckerberg or Larry Page regularly get emails or other messages saying things like "im gunna go to ur house nd kill ur dog and ur hot wife"

Law enforcement doesn't have the resources to investigate every one of these, absent a credible threat of it actually happening, so corporate security / executive protection exists to, well, investigate.

Considering the necessary exposure the president has, he might be even more secure.

Personal security for CEOs (never mind billionaire CEOs) is hardly anything new. If I were Mark, received the amount of hate/threat messages he does, and had a young daughter, I'd do everything short of hiring the 82nd Airborne to follow me around.

https://www.businessinsider.com/how-much-silicon-valley-ceos...

Taylor Swift once said "I don't have security to look cool. I have security because people want to take me home and chain me to a pipe in their basement."

TSwift isn't even a billionaire.

https://en.wikipedia.org/wiki/Law_Enforcement_Officers_Safet...

For some positions, the ability to carry concealed was mandatory (e.g. the CEO's driver/bodyguard). Related aside: the CEO I'm thinking of wasn't allowed to drive himself in order to avoid any stock hits if they whapped into a kid running into the street after a ball (or what have you).

And typically it was just to gather information to provide to law enforcement, when necessary, and to provide information to our physical security team when we thought there may be some increased risk of a belligerent person trying to come to our premises. Very definitely not to take matters into our own hands and act like a dystopian quasi-paramilitary cabal terrorizing random people with obsessive psychological warfare campaigns. It was the total opposite; we were constantly walking on eggshells to do as little as possible and to defer as much as possible to law enforcement, as we should've been.

Never once did I see the slightest inkling of a desire to go after critics of the company from anyone on our team or from management. We would get some visibility into that from dashboards showing mentions of the company on social media and stuff like that, but we'd just ignore or occasionally chuckle at (or agree with...) any criticism we saw.

I'd like to think this hyper-paranoid, authoritarian, power-tripping attitude (let alone the abject psychopathy and psychosis) isn't too common in corporate security teams, but I have no clue and only have my n = 1 sample to go off of. And maybe the distribution is different for tech companies dedicated to rapid growth/monopolization, compared to more traditional, "boring" companies.