An Ugly Truth: Inside Facebook's Battle for Domination [calibre 4.99.5]

In most cases, the hackers had been there for years, and Stamos was appalled at how vulnerable companies remained to relatively simple attacks. “I wanted to point to the fact that the security industry had drifted away from what we all say our mission is, which is to keep people safe,” he said. Companies didn’t make security a priority, and they relied on overly complex systems that left them and their users vulnerable to attack. He used the analogy of a house: rather than create a solid, defensible structure and securely locking all the doors, he said, companies had done the equivalent of creating multistory residences with fragile windows. All a hacker needed to do was bide his time and wait, and eventually, a company would leave itself exposed.

Hundreds of people gathered for Stamos’s keynote address in the nondescript conference room. Stamos weaved nervously through the crowd, making small talk in his characteristic rapid-fire fashion. At the lectern, he tucked in his red plaid shirt, adjusted the hem of his gray suit jacket, and jammed his hands into his pockets. People were still standing and chatting when Stamos, too eager to wait any longer, launched into his talk.

“I’m not happy,” he began, “with where we are as an industry.”

Technology companies weren’t thinking of the privacy and security needs of the average person, he said. Cybersecurity companies were more interested in selling flashy and expensive technology than offering basic protections that small companies could afford. Each year, stories of hacks affecting millions of people were growing more common. People’s private information, including Social Security numbers and credit card details, were increasingly being sold and traded by hackers in online forums.

Many in the room nodded along as he spoke. Stamos didn’t disclose it in his speech, but he was growing concerned about the security practices of his own company. He had reason to be worried. Just weeks after the “unconference,” his team found a vulnerability that made it possible to enter Yahoo’s systems and search through a user’s emails. Stamos rushed to check if Russian or Chinese hackers were responsible for the breach. Instead, he discovered that the vulnerability had been placed there intentionally, with the approval of CEO Marissa Mayer, to allow the U.S. government to monitor Yahoo email users secretly.7 “It was a huge breach of trust,” he recalled. “I couldn’t stand by and watch it.” In less than a month, he would quit his job at Yahoo. When Mayer’s role in granting the government secret access was made public, it would cause a national scandal.

In cybersecurity circles, Stamos became known as a “warrant canary.” At the turn of the twentieth century, canaries had been sent into coal mines deep down below the earth’s surface. If the birds died, it was a silent signal that toxic gas had been released into the air and that the shaft wasn’t safe for miners. In the mid-2000s, the phrase was repurposed by internet companies. The companies had begun to receive secret government subpoenas for their data—the requests so secret that it was illegal even to reveal their existence. As a workaround to alert their users that their data was being accessed, internet companies began placing tiny images of yellow canaries or messages on their websites as a sign that all was well. If, one day, the canary disappeared, it meant the company had been served one of the secret subpoenas. Privacy experts and advocates knew to look for the canaries and to sound the alarm if one suddenly went missing.

When Stamos left Yahoo, it was a sign that something was deeply wrong there. His arrival at Facebook, however, indicated that he saw something at the company worth working for.

In the spring of 2015, Facebook executives were quietly looking around for a new head of security to replace Joe Sullivan, who was leaving for a similar post at the ride-hailing firm Uber. Zuckerberg and Sandberg asked Sullivan to help find his successor. Sandberg said she wanted a high-profile hire as a signal to their board of directors, and to regulators in Washington, of their commitment to security.