The problem was much bigger than just AMZReview, which was just one of many players that could extract data from the information Amazon gave to sellers. Merchants accessed billions of customer orders through the Amazon interface with little oversight. The largest third-party provider had access to a billion orders. Of course, there were rules on how sellers and developers should use the system. But it emerged, according to the memo, that more than half of the third-party providers the company investigated violated Amazon`s terms of service. A former employee familiar with the details says most were likely legitimate businesses. Yet, the former employee adds, “there was a huge hole. It was really unrestricted. It wasn`t that executives like Wilke didn`t care about protecting customer data, Gagnon says. “They did what they thought was enough,” he says. “They make a lot of money.
Their stock is increasing. They had no indication that cyberattacks would affect their business. Or at least not yet. Security also learned that someone logged into 6,581 customer accounts in Amazon`s system and deleted the reviews they wrote. The two incidents appeared to be linked. Someone was playing in one of the biggest markets in the world, and they got help from within. Less affected was Amazon`s security team, which had repeatedly warned of the risks of constantly devouring new subsidiaries and integrating them into the company`s network. Less than a week after the shotgun wedding ended, an analyst at credit card processing company First Data called an Amazon employee with a disturbing tip. A Ukrainian broker had just posted credit card data on the dark web that could indicate a breach at Whole Foods. Other lawyers tried to argue, but it didn`t go well. “It`s a very uncomfortable situation to be present at IAPP events as a backbencher,” wrote a Germany-based Amazon lawyer, “when it`s clear that I work for a company that is perceived to be uninterested in privacy issues.” Some of those involved couldn`t help but think of the Cambridge Analytica scandal that is still brewing.
But while Facebook was publicly toasted, Amazon was quiet with AMZReview. Some privacy advocates say the company should have cleaned up the mess. “You should have said, `Here`s what`s going on, here`s what we did to fix it, and here`s what we know about who got their hands on your data,`” says Bennett Cyphers, a human resources technologist at the Electronic Frontier Foundation. –A non-refundable delay of 7.62 per full month of©© delay.© On this last point, DeVore probably made a sure assumption. This year, a Georgetown University study found that Amazon is the second most trusted institution in the United States after the military. But as companies like Facebook have learned in recent years, public trust can be fragile. And in hindsight, the most interesting thing about Amazon`s 2018 statement is what DeVore didn`t say. Remarkably, someone was missing from Facebook or Equifax, which had been interviewed separately by Congress.
For the assembled leaders, the hearing was an opportunity to make the case for friendly policies — and to reassure Congress that, of course, their companies were in complete control of the issue. The 2022 Resource Survey brings together the SLS and OPS surveys. “The biggest concern was just the optics,” says a former Amazon employee who was aware of the situation. “What if it turned out that this was happening? All that embarrassing you ordered on Amazon, is there a Chinese company that could set the date you bought it? Obviously, they wouldn`t want anyone to know. In January 2020, after just over a year and a half in that role, Carter stepped down as head of Amazon`s information security division. His departure sent the division in more months without a leader. In the name of fast customer service, breakneck growth, and rapid “invention on behalf of customers” – in the name of your pleasure – Amazon had given much of its global workforce exceptional leeway to unlock customer data at will. It was, as Amazon`s former chief information security officer, Gary Gagnon, called it, “free access for all” to customer information.
And as information security officials warned, it left the company wide open to “insider threat actors” while making it too difficult to track all of Amazon`s data. Eventually, Amazon placed another leader at the top of information security — someone who had a proven track record, at least within the company. The new head of the division was Jeff Carter, the man who orchestrated Amazon`s monumental data migration from Oracle to Amazon Web Services. But there was a catch: Carter had no experience in data security. As he himself later joked in a presentation seen on YouTube, his reaction to the job posting was to say, “Uh, this doesn`t seem like an entry-level job for a security manager.” Amazon says it has always had privacy employees spread across the company, that it “started planning for GDPR years in advance,” and simply chose to centralize its efforts before the deadline. But months later, before the Senate Commerce Committee, DeVore still seemed upset that European law had distracted Amazon from its customer-centric priorities. “Our longstanding commitment to privacy has aligned us well with the principles of the European Union`s General Data Protection Regulation,” said DeVore. “In order to meet the specific requirements for processing, retaining and deleting personal data, we had to devote significant resources to administrative tasks – and away from inventions on behalf of customers.” From that moment on, things deteriorated. In a hand-to-hand meeting in early 2017, Wilke introduced Gagnon as the new head of the security department and shocked some employees who expected the interim boss, a longtime insider, to get the job. When Gagnon gave his first speech to his team, his frequent use of the prefix “cyber-” immediately excited some members of the division, who saw it as the tic of an East Coast government. “It became a joke from day one,” says one former manager. Gagnon says an employee then took him aside and advised him to drop the term “cybersecurity.” When Lam finally managed to recover her account, months later, her own Amazon ad seemed to backfire, as if she was obsessed: customers ordered a GingerChi jade roller, but sometimes they received a Krasr roll by mail instead, and their credit card payments went to Lam`s rivals.
The Krasr rollers resembled Lam`s product, down to the cloth bag and information insert, but they were sometimes defective. So Krasr got the sale, customers got a deterrent bait, and Lam received the bad reviews. (“Everything is suspicious,” wrote one GingerChi critic after receiving a Krasr roll that didn`t roll.) This spring, mysterious sellers on Amazon began filing a copyright infringement lawsuit against Lam, prompting Amazon to suspend his account. She tried to email her accusers but never heard a response, so she suspected Krasr was behind the complaints. Krasr had also reissued his own jade roller with a marketing push. For two decades of its history, Amazon, like many companies, has outsourced the storage of its data to a third-party provider, Oracle. But by the mid-2010s, Amazon`s data warehouse had become the world`s largest Oracle database — up to 1,000 times larger than any other, according to an Amazon estimate. It contained 50,000 terabytes of information. The committee`s chairman, John Thune of South Dakota, took the order of the hearing and then began listing events over the past year that had shown how a data-driven economy can go wrong.
It had been 12 months since it was reported that a highly preventable breach by the credit agency Equifax had claimed the names, social security numbers and other sensitive identifying information of more than 145 million Americans. And it had been six months since Facebook was embroiled in a scandal involving Cambridge Analytica, a political intelligence firm that had managed to gather private information on up to 87 million Facebook users for a seemingly rogue psychographic ploy by Bond to get Donald Trump into the White House. This rapid and furious spread was in part what made it nearly impossible for the information security department to master Amazon`s data. “The growing number of copies of documents, combined with Amazon`s model of responsibility and decentralized ownership,” the memo says, tasked the security department with a Sisyphean task.
