Snapchat employees abused company data access tools to spy on users
According to a report on Thursday, a number of Snap employees abused privileged data management tools to snoop on Snapchat users, in some cases potentially gaining access to location and contact information, as well as saved Snaps.
Citing past and current employees, along with internal Snap email correspondence, Motherboard reports the social media firm at one point fielded a number of tools that granted access to sensitive user data and profile content.
Similar to systems in use by other tech companies, Snap's tools were designed to fulfill legitimate data requests relating to customer issues, internal policy enforcement and other industry-standard purposes. For example, a tool called "SnapLion" was initially used to grant access to user information in the event that Snap was served a subpoena from law enforcement officials or data was demanded by court order.
While Snap policy prohibits perusal of user profiles, multiple employees illegitimately leveraged data access tools to spy on users, sources said. The illicit activity noted in the article took place several years ago and sources claim abuse occurred "a few times" by multiple people.
The exact nature of the intrusion is unknown, as are the tools used to accomplish the feat.
One former employee points directly to SnapLion, saying the tool lacked an adequate system for logging, or monitoring, users when it first debuted. Snap has since bolstered the system's security backbone. Further, the company notes internal data access tools are restricted to select employees.
"Protecting privacy is paramount at Snap. We keep very little user data, and we have robust policies and controls to limit internal access to the data we do have," a spokesperson said in a statement to the publication. "Unauthorized access of any kind is a clear violation of the company's standards of business conduct and, if detected, results in immediate termination."
A former employee familiar with SnapLion said the tool's scope has expanded beyond law enforcement requests and is now employed to reset passwords of hacked accounts and complete other user administration tasks, the report said.
Whether the abuse continues today is unknown, but both current and former employees lauded Snap's efforts toward user privacy.
Citing past and current employees, along with internal Snap email correspondence, Motherboard reports the social media firm at one point fielded a number of tools that granted access to sensitive user data and profile content.
Similar to systems in use by other tech companies, Snap's tools were designed to fulfill legitimate data requests relating to customer issues, internal policy enforcement and other industry-standard purposes. For example, a tool called "SnapLion" was initially used to grant access to user information in the event that Snap was served a subpoena from law enforcement officials or data was demanded by court order.
While Snap policy prohibits perusal of user profiles, multiple employees illegitimately leveraged data access tools to spy on users, sources said. The illicit activity noted in the article took place several years ago and sources claim abuse occurred "a few times" by multiple people.
The exact nature of the intrusion is unknown, as are the tools used to accomplish the feat.
One former employee points directly to SnapLion, saying the tool lacked an adequate system for logging, or monitoring, users when it first debuted. Snap has since bolstered the system's security backbone. Further, the company notes internal data access tools are restricted to select employees.
"Protecting privacy is paramount at Snap. We keep very little user data, and we have robust policies and controls to limit internal access to the data we do have," a spokesperson said in a statement to the publication. "Unauthorized access of any kind is a clear violation of the company's standards of business conduct and, if detected, results in immediate termination."
A former employee familiar with SnapLion said the tool's scope has expanded beyond law enforcement requests and is now employed to reset passwords of hacked accounts and complete other user administration tasks, the report said.
Whether the abuse continues today is unknown, but both current and former employees lauded Snap's efforts toward user privacy.
Comments
The statement from Snap is absolute "we got caught" boilerplate stuff about protecting user privacy. If there are still human beings working for Snap, you can rest assured these tools are still being abused (hopefully less often than before), not always by Snap employees. Bvwj has it exactly right: back doors will be abused or leaked if they exist, and so only THE most trusted employees should EVER have access, and even then every keystroke and click should be logged when they use it.
2. If no one is being harmed, and it’s all consensual, what should anyone care if people use the tool for sexual purposes? Give humans a tool and some of them will use it for sexual purposes. We are sexual beings. Its just what people do. Do you have a problem with human sexuality?
Exactly.
What a conundrum!