Google Site Reliability Engineer (SRE) David Barksdale was recently fired for stalking and spying on teenagers through various Google services, according to Gawker. Although the stalking was not sexual in nature, it was still a massive breach of privacy since the employee regularly accessed private user information from Google's systems. Barksdale met the teens at a Seattle technology group in his area, of which he is no longer a part of. Google has confirmed that the 27-year-old was dismissed in July for "breaking internal privacy policies" and that this isn't the first time the search giant has had to fire an employee for breaching user privacy.
Google would not elaborate, of course, on how widespread Barksdale's abuses were, but we do know of at least four cases where Barksdale spied on children's Google accounts without their consent. Furthermore, Barksdale allegedly befriended a 15-year-old boy at one point, who wouldn't reveal his girlfriend's name. Barksdale responded by tapping into call logs from Google Voice to retrieve her name and phone number, and then taunted the boy and threatened to call her. He continued to use his SRE position to tap into Google Voice phone logs, accessed Google contact lists and chat transcripts, and unblocked himself from a Google Talk buddy list after being blocked, up until parents of the minors complained about the intrusions. Google was apparently unaware of Barksdale's activities until receiving the complaints.
Barksdale had access to such a large amount of private information because Google SREs are responsible for troubleshooting user problems, meaning that they often have to view and interact with accounts at all levels. Google assumes SREs will not abuse their power, and we're sure most do not, but clearly the company doesn't have enough checks or controls in place to see if SREs are really following the rules. This is a quite serious reminder about how much of our data Google has access to and how we should remember what we are doing when we trust a company like Google with our personal information.