Apple Fires Engineer Who Kept Customer Device IDs Private
Ryan Merket (Hacker News, PDF):
The company said his performance was the reason, according to a lawsuit Boardman filed in San Francisco Superior Court. Boardman says that explanation was a pretext. His version of the story begins three years earlier, inside Apple’s technical relationship with the largest wireless carriers in the United States, with a category of data capable of identifying nearly every phone on the network.
[…]
Apple considered serial numbers and IMEIs personally identifiable information under its internal policies, Boardman alleges. Representatives working with carriers other than AT&T required the carrier to obtain a customer release before Apple supplied the data. The Apple representative assigned to AT&T did not enforce that requirement, according to the complaint. Boardman says the identifiers were then transmitted through “unsecured email communications.”
He reported the practice to his manager and sought guidance from Apple’s legal department. He alleges that the company never gave him a written response.
I don’t think he has much of a legal case. Apple was probably within its rights to fire him if what he refused to do was against company policy but not illegal. It doesn’t sound like Apple is disputing that, at least not yet.
However, I think this is interesting because:
This seems to be another case, like yesterday’s story, where the interests of the customer and the carrier are at odds, and Apple leans towards the latter.
It shows that a policy is no guarantee, because it depends on humans choosing to follow it. There are other cases where Apple has been able to engineer privacy into the system. But some data is not end-to-end encrypted, so consent is a formal but a not technical requirement.
Previously:
- Apple Upgrade
- Advertising Cognitive Dissonance
- App Store Personalized Recommendations and Keylogging
- UK Again Wants iCloud Backdoor
4 Comments RSS · Twitter · Mastodon
"Apple was probably within its rights to fire him if what he refused to do was against company policy but not illegal." To me, the article reads like it actually could have been against company policy, as the article does say that serial numbers and IMEIs are PII under an internal policy. Although Apple is a terrible company, it almost certainly also has some sort of internal policy around the use and disclosure of PII. The article just doesn't make that explicit. It could be that IMEI and serial numbers are exempt for this purpose for some reason, but who knows.
Though, Apple can basically fire anyone at anytime and make up a pretext, so I don't think it changes anything about the merits or the outcome of the case.
(Similarly, individual people on juries should know their rights, too. If it's a terrible corporation that has plenty of money, you are always welcome to vote guilty and you don't have to explain why. Keep that in mind.)
LOL re-reading my comment right after I hit submit, I think I read this sentence wrong: "Apple was probably within its rights to fire him if what he refused to do was against company policy but not illegal." You're saying the disclosure of PII without consent probably WAS against company policy, but refusing to do something against company policy that isn't illegal can still result in a firing. So I think we agree, sorry for the misunderstanding. :)
@Simone Yes, sorry for not being clear. I mean that, despite it being against company policy, they can fire him because the request was not illegal. If they were asking him to violate the law, he would have some legal protection. Otherwise, as you say, both the company and the jury can pretty much do whatever they want.
Highly unlikely it would ever see a jury. Apple would want to opt for a judge making the decision for the explicit reason of avoiding amoral emotional jurors willing to twist the law just because they hate Apple and/or large companies. Since Apple is being sued, they have a say on if it is bench or jury.
Once he contacted Apple's legal department and they didn't tell him not to do it, he didn't have a leg to stand on. Unless some action is illegal, Apple's legal department/upper management is the final word on what employees have to do or not do, not the employee manual.
