Amazon whistleblowers warn of lousy security at e-commerce giant

Three ex-Amazon employees are going public to draw attention to serious data protection problems. In their view, the e-commerce giant does not want to comply with applicable regulations at all.

These are very serious allegations that three formerly high-ranking Amazon employees are making to Politico. All three had been responsible for monitoring information security in different units, but too often failed to assert themselves with their notices, warnings and complaints of deficiencies. Ultimately, the employees who had apparently become too critical were removed from the workforce.

The whistleblowers' accusations focus on Amazon's retail business. They explicitly point out that Amazon Web Services, the cloud business of the manufacturer, is not affected by the allegations. Rather, the data security concepts used there are world-leading. But the AWS business is largely run apart from the main company anyway, they say, with only a few points of contact.

Amazon is said not to know what data is stored where and who has access to it

In its core area, on the other hand, there is said to be downright data chaos. For example, Amazon does not even know which data is stored where. The right to be forgotten, which is one of the central legal claims of the European Data Protection Regulation (GDPR), cannot be guaranteed by Amazon because the company does not know what needs to be deleted and where.

This lack of knowledge about storage types and locations puts the data of millions of customers at risk, because a small gap could have unexpected consequences in this way. If you don't know what data is stored where, you can't implement an effective protection strategy to prevent it from being hijacked.

Similarly, there is no control over which employees have access to which data. The whistleblowers claim to have found thousands of accounts of ex-employees who still had system rights and thus still had access to the Amazon data centers even after their employment contracts had ended.

Senior management allegedly not interested in problems

Information and warnings were regularly ignored or negated by superordinate bodies. In some cases, the same problem had to be pointed out for years before it could be eliminated. In some cases, superiors simply ignored the reports.

The whistleblowers paint a picture of a management system that views data security as an optional luxury and is willing to disregard internal existing rules at will. In doing so, executives are said to have displayed great creativity and in some cases deliberately misclassified data in order to circumvent certain auditing procedures.

EU whistleblower accuses Amazon of lacking GDPR compliance

One of the whistleblowers was assigned to the Luxembourg branch to ensure compliance with the GDPR and also complains about stumbling blocks that were put in his way. Amazon had only started to deal with the issue in April 2018, one month before the measures from the GDPR came into force. Prior to that, all attempts to prepare properly had been blocked.

This is said to have happened not only at the middle hierarchical levels. Reports about risks and deficiencies, which were addressed to Jeff Wilke, the CEO of Amazon and responsible for the global consumer business, are also said to have remained without feedback.

In the end, the ex-employee wants to have gained the impression that Amazon headquarters deliberately undermined the competencies of the Luxembourg branch and wanted to bleed the team dry. All three ex-employees state that they were forced out of the company. This was preceded by periods in which they were no longer informed about meetings, no longer received necessary information, and were all in all ignored. One of the ex-employees describes Amazon's actions as a "systematic erasure" of people who wanted to formulate and address compliance issues.

Amazon widely dismisses the allegations, implying that the employees acted outside their authority and therefore had to be hemmed in. The allegations are false, at least inaccurate or outdated, he said. On the contrary, Amazon has an excellent culture of data security, in which the protection of customer data enjoys the highest priority.