I don't think it's so black and white: the "security tool" is a chrome extension for sending notices to employees about the site they are visiting.

An analogous situation seems like if the company had a big cork board for safety/security messages and someone posted a paper with that sentence on it next to something the company posted that was perceived as anti-union.

It's unclear to me if that other scenario is protected or not: I understand that you're legally protected when posting notices informing your peers of certain rights on company property, but presumably you couldn't stick such notices just anywhere.

I don't think the cork board analogy really works here. This sounds like a person (ab)used their position and access to the backend of a security tool (Chrome extension or not) to broadcast a non-security related message.

I think we can generally agree that if they were on a team maintaining protocol buffers and they baked an unnecessary ignored message into the encoded stream (about whatever) there should be repercussions for lack of good judgement.

Generally speaking, I am for workers self-organizing if they feel it is appropriate. It's not clear to me that Spiers should have been fired for this seemingly minor offense.

> broadcast a non-security related message.

I don't think it was broadcast, it was displayed if one particular website was visited. That seems very analogous to permitted organizing activities such as using your employers email system to organize or posting on a cork board.

> they baked an unnecessary ignored message into the encoded stream (about whatever) there should be repercussions for lack of good judgement.

Would you be fired? I'm not so sure. It is pretty obvious that this firing was not unrelated to the messaging.

I'm glad that the very conservative interpretation of labor law that most on HN seem to believe is not the reality of labor law in the US, although more should still be done.

"...presumably you couldn't stick such notices just anywhere."

Nor use company resources/infrastructure to distribute it.

Actually, when she was fired, this was not the case. The NLRB ruled a day or two after she went public about being fired that company communications couldn't be used for this type of thing. Before that companies had to allow it.

https://www.post-gazette.com/business/career-workplace/2019/...

Ah, so this was before they amended the rule allowing communication to be restricted.

I wonder what the restrictions were before. It specifically says emails were allowed. But I wonder if a person maintaining an intranet site could post a banner on it with the same message. I'm guessing not since it isn't designed for that type of communication. I'm not sure where the plugin would fall. Seems like the message didn't fit the intended plugin scope.

Yeah, hard to say, one could certainly make an argument that it did fall under that though. It would need to be decided in court.

How could that message, on that site, fall into the scope of the plugin? I could maybe see if it was a site that employees were actually using it to perform concerted activities. If the firm was hired by the company, then they can't also represent the workers. Thus, what could employees do on that site for concerted activities?

I would also guess the plugin only covers prohibited use and does not cover allowed uses (ie does the plugin say you have 1st ammendment rights when visiting Facebook?). I doubt the documentation states that the plugin shall provide users with their rights. It probably says something like the purpose is to provide users with policy or law information related to the site they are visiting so they don't break the law/policy.

Is it even the case that you are legally protected when you inform you coworkers that they have constitutional rights? I would have assumed only informing them of workplace rights specifically would be protected.

Only if it's a concerted effort to improve the workplace and even then it depends on how it is accomplished.

The message merely stated that employees have the right to organize. Without additional context, I don't see how that is a concerted effort to improve the workplace. There would have to be a "unionize to improve health coverage, or wages, etc" type message. Otherwise, I could just stand at my desk all day and tell people as they walk by that they have the right to free speech, to own a gun, and protections from unreasonable searches, etc. It's not a concerted effort to make the workplace better, so it doesn't matter if I'm telling people about their rights (not to mention I would not be doing my job while on the clock).

Using a plugin to communicate that message is likely a subversion of it's intended purpose and would be inappropriate - similar to if she were maintaining the company intranet site and posted a banner with that information. They aren't mediums for individual communication (such as email or chat apps) but rather for company-to-employee messaging and for the sole use of the company. In this case, she misused company-to-employee infrastructure outside of its scope for her own communication purposes.

I really hope you're not making an infrastructure cost argument here. Would be kind of laughable.

Cost wouldn't matter. The idea is that you can't use the company's resources for your personal projects, especially if that project is being used against them. So let's say you want to put up a single flyer about unionizing. You can do that in the appropriate area, such as off the company property or potentially on a bulletin board in the break room. What you can't do is type it up while on the clock and print it on the company's printer.

The other way (and it seems the NLRB sees it this way too) is that she didn't materially hurt google by doing so, and on the flipside used this system to make sure that laws are known and can be followed.

This is (a bit) like google buying property around polling stations and then preventing anyone from passing through to vote. They're not hurting google by passing through, but they keep shouting "get off my land!" Why would we let them weaponize property law to prevent others from enforcing their rights vis-a-vis google?

Did she make the change on company time? If so, her wages would be material damage. Even if made off the clock, it could still be considered material because Google needs to pay someone to fix it.

Your voting/property analogy is completely off-base. It completely ignores right of ways and public property. And if you have people actually trespassing on private property on the way to a polling place then they are in violation of the law and can be cited. I see no legal way that you can "weaponize" property law to prevent access to a polling location. Also, there's nothing stopping employees from exercising their right to concerted efforts off company time and property.

I think the far more substantial damage is from Google customers wondering what else the employee or some malicious insider could have done. You can bet that this came up in internal audits and customers' security assessments.

Presumably in this scenario the employee was one of a small group of people that was responsible for maintaining the cork board, and used it for their political beliefs

I find it funny how people assert that she used it for her political "beliefs" (when the message was simply informing people of their rights) but seem to take at face value Google's assertion that they acted on this because she (ab)used the infrastructure, as opposed to what she used it for.

I'm going to go ahead and assume that a similar circumvention of company policy for non-labor union purposes would not have been met with immediate termination. Unless Google can say that this was normal punishment or was part of a pattern of behavior, it's kinda hard for it not to look like retaliation.

> political beliefs

Informing employees of their legal right to organize isn't a political belief.

Would you feel the same way if she added a banner that suggested her fellow employees exercise their 2nd amendment rights?

Bad faith argument aside, informing people of the rights they do have is not really having a political stance. Those rights exist regardless of what one personally supports. Obviously, this holds true for USA's 2nd amendment rights as well as any other provisions granted by the law.

Companies have active interests in suppressing this sort of information, and put forth efforts to try and convince people that literally stating the laws of the country that one resides in is somehow pushing a political agenda.

It was the parent comment's language. I was more taking issue with the "cork board" metaphor

> I remember that case. Yeah - she deserved to be fired. She used an internal security tool to push her personal political views. How could that not be a fire-able offense?

If you read the next sentence in the linked article, the NLRB disagrees:

  Spiers was fired after she created a pop-up for Google employees visiting the IRI Consultants website. “Googlers have the right to participate in protected concerted activities,” the notification read, according to The Guardian. The company said Spiers had violated security policies, a statement that hurt her reputation in the tech community. Now, the NLRB has found the firing was unlawful.

The trick is that there's an auditable trail of things that she did. Notably, she bypassed restriction in our code change system which would've required review. The policy around bypassing that is explicitly to only be used in emergencies.

Again, reasonable for her to be fired.

> Again, reasonable for her to be fired.

The NLRB is where decisions like this are argued. They weighed the evidence, with a much fuller view than any of us here, and came to the conclusion that the firing was illegal.

Is there anyone else that has every bypassed this step, but wasn't fired? What's the definition of an emergency?

Also it seems reasonable to me her complaint that this hurt her reputation, after all you're a Google employee and here you are smearing her in a public board. I know you're gonna say "I don't speak for my company", to which I will reply: It seems you're a Google employee, and you're speaking as a Google employee. It's distasteful that a Google employee find the need to accuse her in public like this. Is that a view shared by your co-workers? Do you all usually go in public boards to speak ill of past employees? To reveal why they were fired?

People bypass this step all the time. The difference is they all have a good faith belief their managers would approve the change if they were available. Spiers 100% knew her changes wouldn't be approved by project leadership, and she used an emergency push to bypass their review.

Honestly, the fact that she has the gall to complain to the NLRB about this firing is pretty despicable. Google should be suing her for defamation.

> Honestly, the fact that she has the gall to complain to the NLRB about this firing is pretty despicable. Google should be suing her for defamation.

This is such an ill-informed understanding of how labor law works I'm not sure where to even start. You have a legal right to assert your legal rights, as was done here. The NLRB is akin to a trial court that makes the determination and issues judgements.

Winning a legal case is not "defamation".

NRLB cases are not "legal cases", they are administrative proceedings from which one has pretty much no actual legal recourse.

The have redress through the U.S. Court of Appeals for noncompliance with their decisions, so this really isn’t true at all.

The other side have no real recourse, though.

I work at Google, but have no inside knowledge of these events.

I doubt that Google spontaneously published the reason for the firing. AFAICT, the former employees went to the press following their firing, and the "violation of security policies" explanation was the response to articles initiated by the former employees. It's not clear to me how the parent's comments are a smear, unless the statement that "she bypassed restriction in our code change system" is not factual (which I don't know, but I have no reason to doubt it).

Not a Googler, but probably "to fix the json in case someone leaves out a comma causing the notification system to no longer work".

> Notably, she bypassed restriction in our code change system which would've required review.

[Googler, opinions my own]

This is not true. The code changes in question were done normally. The policy "exemptions" were in regard to the rollout of the resulting binary, which are well described here[0].

[0]: https://news.ycombinator.com/item?id=25280028

She got approval from her manager and passed a code review.

What more was she meant to do?

She didn't bypass anything.

"Googlers have the right to participate in protected concerted activities" is not a personal political opinion, it is the law.

Yes, you have a right to participate in unionization and politics. But you don't have a right to alter company software to spread your political message. There's a big difference between holding a "Vote X" sign on a street corner on your own time, and using your position as a developer to put up "Vote X" signs on your company's website.

But developers at Uber and Lyft can spam drivers and riders with "Tap to support Prop 22" every time they want to use their apps with no consequence? I don't see how anyone can get upset with employees notifying fellow employees of their legal rights when the same tech companies will abuse their platforms to literally broadcast their political beliefs.

https://www.theverge.com/2020/11/4/21549760/uber-lyft-prop-2...

> same tech companies will abuse their platforms to literally broadcast their political beliefs.

if the owners of the company feels the desire to, they can instruct their employees to perform work to broadcast/promote their (owner's) political beliefs. This is just a case of a company using its resources for a purpose designated by the owner.

An employee co-opting company resources without owner approval to broadcast their (employee's) political message is not allowed, unless explicitly given permission by the owners.

Why people cannot tell the difference between the two situations above is beyond me - it's not like they are similar or confusing.

But the NLRB ruled that what Spiers did was perfectly within their rights, so you’re completely wrong in this specific case. However correct you may believe yourself in the abstract, entirely relies on the lawfulness of the specifics.

> Spiers did was perfectly within their rights

no that's not what the article says.

The article claims: > NLRB has found Google’s policy against employees looking at certain coworkers’ calendars is unlawful.

Google claimed that she abused security notification system for websites to show a non-security related message (see https://www.theguardian.com/us-news/2019/dec/17/fifth-google...). She could, within her rights, send emails to organize a company wide meeting, or write up a public document to talk about unionization. If google had banned this, then they would fall afoul of the law.

May be google is really using the excuse that she abused security notification systems to fire her. That's something I'm not privy to, and only litigation will reveal this (if it even does).

You’re incorrectly conflating the two cases described in the article. Berland was fired for viewing other’s calendars, Spiers for the notifications.

The NLRB ruled both firings were illegitimate and their actions protected under labor law. So no, she was within her rights and the NLRB said she’s to be reinstated.

The NLRB has no direct enforcement power, so how it resolves itself will be dependent on if the NLRB pursues Google in the U.S. Court of Appeals, they settle out of court, or otherwise. My guess is that they settle because an NLRB ruling against you isn’t likely to work in your favor in the event of an employment lawsuit. But regardless, what Spiers did stands as a favorable precedent for workers in the event of other disputes with similar circumstances.

Do you believe those messages were done by developers, on their own initiative? Or by company PR people whose profession is to manage public messaging? The point is, somebody used checked in code to further personal political aims. I highly doubt that is what occurred at Lyft and Uber.

The developers in your example are doing it with the express approval of the company and management. The ones at Google were not.

So yes, there is a big difference.

> using your position as a developer to put up "Vote X" signs on your company's website.

To state the law* for internal users who visit one specific website

There is also a big difference in saying "Vote for X" vs. "You are allowed to vote."

Ok. So it's OK if your webhost provider replaces your homepage with the phrase "you are allowed to vote"?

I think apt comparison is - if some Apple or Google engineer would push a non-authorized OTA update to all Apple/Google phones which would add a permanent political banner to homescreen - would you consider this to be a firing offense or not?

And to people who are trying to justify this by process being "technically possible" - there is a non empty set of Apple and Google employees who can technically push any code to your phone remotely. Is it still acceptable for them to use that to push their political agenda?

Because it comes down to trust. You trust people who can push code to your devices to not abuse it.

Pushing a banner to all phones with a political message would be a brazen abuse of one's engineering position.

This developer's change was much more narrow, it modified an internal tool that only Google employees see. But it's still breaching professionalism. If the message instead was, "Unions are corrupt and deprive people of individual agency" would that be acceptable? Especially with the unique position Google is in as our gateway to information, it's prudent to avoid employees that cannot refrain from making changes to production software to further personal politics.

So if she instead put "Nobody has the right to enter this country illegally" it would be fine because she's just restating the law?

"Entering the country illegally is illegal" is restating the law. Such a statement would likely take on more meaning given the context in which it was said.

"Nobody has the right to ..." is your opinion.

Well, "nobody has the legal right to..." is restating. And to me, the "legal" is rather obviously implied.

INAL but it is your right to illegally cross the border of a Geneva convention signatory country and seek an asylum. So no, not the same.

I don't agree the implication is obvious at all. Interpreting it that way make it a total truism - nonsensical unless interpreted within a greater context.

And it looks to me that's just what the GP poster was trying to do - challenge others to argue with a truism while pretending that the context in which it was stated isn't relevant.

That would be appropriate (in this analogy) if the website was advising employees on how to jump over border walls.

What about a website for lawyers who defend illegally-entered immigrants?

ICI consultants isn't a criminal organization as far as I know, and without really knowing anything about them, I would assume the consulting services they provide don't tell companies to perform illegal acts.

Substituting your equivalence:

> She used an internal security tool to push the law

Even for messages I agreed with, I would still find this a questionable activity and disruptive as an employee.

You find it questionable and disruptive that someone would encourage people to know and enforce the law? How very peculiar.

Seems like if that's the status quo, it should be disrupted.

So someone with technical access (if actively bypassing review) should be allowed to replace the www.google.com homepage with a copy of the US constitution and that's just fine and dandy?

"Oh, I'm just informing people of their constitutional rights? What's the problem? I thought this was 'merica"

If she had used a company printer to print pro-union fliers and then shared them I'm 90% she could be fired for misuse of company resources. At to my intuition this feels like using the company printer without permission.

> If she had used a company printer to print pro-union fliers and then shared them I'm 90% she could be fired for misuse of company resources. At to my intuition this feels like using the company printer without permission.

Until Trump's NLRB overturned the precedent late last year, workers had stronger protections than getting fired for a minor slip-up in the course of organizing. But today, your intuition would be correct.

So I am not going to update my opinion, this was legal but morally dubious on Google's part. On her part it sucks but she easily could have avoided the situation.

No, changes cannot be retroactive (in general) meaning the prior law applied at that time.

I think the point here is "...used internal security tools...", Not the particulars of the message she was pushing.

That is the stated reason but we all know that is not the real reason. If they added an ascii art of a dinosaur or a message on another topic to that internal security tool, they wouldn't have been fired, probably not even a slap on the wrist, at most an annoyed "take that off" request.

> we all know that is not the real reason

No, that is not true. Some of us take security seriously.

Can you contextualize who you are, so that I can better understand “us”? You mention seriousness as an absolute virtue, but if it fires people for a harmless, easily correctable mistake in an internal tool, it is just misguided and an excuse especially if it “happens” to serve some ulterior motive.

It's not harmless. Google is very concerned about internal security, and putting irrelevant messages in security notifications makes them more likely to be ignored in the future. Your ASCII dinosaur hypothetical is a good way to think about it, and I wouldn't be surprised or outraged if that also resulted in the offender being fired.

If that was the point, then why was the other bit included in such obvious service to the "point"?

Security is a broad topic and can include avoiding legal liabilities.

Yep, and case law dictates what is acceptable participation. Generally, using company time and infrastructure to perform concerted activities is prohibited. That's why union voting and meetings are done off the clock and off-site. Once protected by union membership, the protections tend to increase since you're not acting alone.

If you want to play that game, you could spam people with the text of all sorts of interesting laws. It's still an abuse of authority.

But I wonder if anyone would be have been fired if it were an April fools prank?

Where's the evidence of "spamming?" Is Google "spamming" its employees on a regular basis with their "approved" messages?

When a Googler visits particular domains, she gets a message from the internal security tool like "Do not upload user data to third-party services. Use secure alternatives instead." This is to prevent employees from inadvertently causing a PII incident or violating contractual obligations to external customers.

And?

Laws are political.

Faulty analogy because it references a specific set of religions (those with churches) in the context of a workplace. If in some insane reality, Google was trying to prevent their employees from joining religions (as they were, in this case, with unions), than the first half would be fine and fully protected by law.

By your logic, an employee should be protected if they decided to add a political statement to the homepage of google.com? No?

Companies had to allow communication tools to be used for collective action when she was fired for this. The NLRB overturned that 5 year precedent a day or two after she went public about being fired.

https://www.post-gazette.com/business/career-workplace/2019/...

A little more than that even. They have the right to participate in concerted activities. But those activities must usually be performed in a way that would not impact the business during working hours. Unionization and voting etc must usually be performed off-site.

> Unionization and voting etc must usually be performed off-site.

Sounds like a non profit startup opportunity, to provide tools to empower workers to unionize and vote remotely. With remote normalizing, as long as you stay off corp gear (stay off corp gear for any activities not directly related to your employment!), your employer isn't going to know you're working towards organizing, preventing them from interfering with your organizing activities (which does them a favor, considering that's illegal under US labor law).

Unit [ https://unitworkers.com/about ] is interested in helping establish small, locally-run unions.

They claim Google spied on Spiers and did something illegal. This might be the case, but they don't disclose what they exactly did. Maybe we'll know later on.

Original link + comments: https://news.ycombinator.com/item?id=21813619

This was an internal tool. How will a regression in that be "highly embarrassing ... to the company"?

Wait, how was this literal incident not highly embarrassing to the company? "Our internal security team has been known to put up unapproved messages in popups that only apply to specific partners/vendors". Doesn't even matter what the content was in that context.

When you do consider the content/context, then we need to consider that this vendor/partner (IRI) was likely offended by the implications and the relationship between Google and the vendor/partner was likely damaged.

IRI did the right thing in not publicly commenting on the issue, though, so we'll never know for sure what actual affect this incident had on that relationship.

The argument was "At my job (and most jobs, I would think), if you check in any superfluous code, you’re going to be seen as a bad coder. Regressions are real and are highly embarrassing to both the company and you."

That is a bad argument in this case, because a regression in an internal tool is not going to be "highly embarrassing to both the company and you."

This was not a "regression" in any sense.

I welcome any other argument on this topic. But the argument presented had a flaw that I was pointing out.

You mean a change that passed code review and for which she was given an ok by her manager?

Tool becomes external because a customer needed the functionality. Regression was silent until the customer found it. “Whoops, we couldn’t possibly have seen that coming”.

It happens.

If you turn internal tools into external tools without thoroughly reviewing them, that's a far bigger problem.