"In fact, the general manager of Uber NYC accessed the profile of a BuzzFeed News reporter, Johana Bhuiyan, to make points in the course of a discussion of Uber policies. At no point in the email exchanges did she give him permission to do so."

Or does "rifling" mean something else to you?

I guess it's talking about the travel logs from 2 paragraphs above?

But at the same time, the point isn't that "the Uber GM found some hideously private information about the journalist," the point is that regardless of what their "information policy" is, the GM could access the account of the journalist, and was apparently comfortable doing so based on his own discretion and sense of propriety rather than explicit permission. If his sense of propriety was fine, and the information was innocuous, then that particular event wasn't a big deal. But it kind of makes lie of the idea that another high-level individual at Uber who may have, shall we say, different ideas about propiety could not abuse the information that Uber is entrusted with.

To access detailed customer information required getting a one-time-use key, which is generated from a request that references other documentation (bug reports, customer support requests, etc) as well as a justification.

This key would only work against a single customer, and expires after some time.

The requests themselves are regularly audited internally to prevent abuse.

This is the level of internal privacy guarantees a company like Uber needs. No employee should have unmonitored, carte blanche access to customer data.

The fact that the CEO can access data at whim should be very troubling. That means they don't have even the most basic infosec guidelines in place.

All of those things are in his statements. He doesn't have to spell it out for you to know what he means.

There was no need. It's kind of like when someone says "we know where you live", "watch your back", etc -- the implication is clear.