I think they make the mistake of presuming this has to go up to 11 on day 1.
Tell the employees you're going to be proactively auditing. Choose a threshold. Interview and potentially fire those employees going over the threshold. Do this until you're done firing people, then increase the threshold and repeat. You will have to fire people, or threaten to, but employees will get the message that the PII-party is over.
To be honest tho - this is the contract that both the company and union agreed to, so bad on the company for being okay and not making this a more serious infraction. I've talked to some of the union stewards about this and they basically said they wanted this data locked down harder. They said it's too easy to access and super temping and wished the company would put more protection around it. Go figure.
Should you have been fired? Depends on how much you abused your privilege and what you did with that information. Your comparison to 1 strike laws and greater crime is pretty rich given the information you improperly accessed could be used to blackmail others, or whatever. It's important to treat such information with the utmost respect. Your cavalier attitude and inability to accept responsibility in this regard may be very common within the tech industry, but such attitudes are also why there is a growing movement to; take data out of the hands of companies, and to harshly punish companies who fail to protect the data on one hand while vacuuming up as much as possible with the other.
Yes.
I'd be very concerned if there still aren't processes and technical barriers to prevent the majority employees from accessing user data. IP address, phone number, etc. should require top-level authorization to access - not something an engineer or even marketing/sales person can just look up.
Twitter was hacked via social engineering of an employee just last month: https://news.ycombinator.com/item?id=23851275
Wouldn't that just expose user data to an even wider group of people while doing this reporting?
"employee id 1234 accessed "email, password hash, location, birthday" about customer id 6789 on 2020-09-01"
nothing particularly sensitive in there, but makes it easy to audit and check for abnormalities.
Obviously some things like SMS or sending of email need to manipulate this data, but rx/tx of eg sms given a placeholder token could also be similarly siloed, so most technical staff would never have or need access to raw PII like IP, phone, or email.
Unfortunately geolocation for ad targeting and other customization features is still probably going to make a “what country is this user in right now?” possible for most devs/SREs, which is itself a bit of a physical location change traffic leak, but making it near-impossible for most devs or SREs to view untokenized user PII would probably be a huge step in the right direction.
This kind of system are already used to both optimize business processes and conformance check then by organizations like banks and hospitals.
Through tools are currently focused mainly on the use case for process optimization and regulation conformance checking less so for irregularity detection but tools like that exists to. I think to remember SAP has some form of self learning/calibrating irregularity detection "service"/tool.
So it's less about creating it then about spending Mony on it and from scratch up analysing your internal thread model.
It's quite expensive, some of this software is sold for higher 5 digit numbers even for "small" use-cases.
"Your margin is my opportunity" - Jeff Bezos
A simple version of this could be done cheaply, and not cost much. API to push events, website to host reports, pay-for-use add-ons for alerts, etc.
Here are some of the reasons why this niche isn't a good fit for a low margin business:
These products are complex and require extensive customization to be useful. It's common to require consulting when installing or upgrading them.
Third-party integrations are common; the product that I support integrates with at least 3 third-party services.
The service is valuable to these organizations and they are willing to pay fairly high fees for using it. Why leave money on the table?
Support costs are high due to the complexity of the customer's environment.
But go ahead and find a random group of 3 ex-googlers with no domain experience to raise ~$2MM and chase it anyways. Then when you burn through the money you can go back to your FANNG job with a nice raise.
Seems like something one could build a SaaS business around- send them reports that <user> accessed <fields> about <customer ID> on <date>, along with a copy of attributes and roles about each user. Service could offer deep dives, querying, reporting, along with ML or rule-based flagging to say "That seems odd".
If Twitter can't build the infrastructure needed to do that, I can't imagine how few small companies can do it themselves either.