Engineer Says Google Fired Her For Browser Pop-Up About Worker Rights

An anonymous reader quotes a report from Ars Technica: Another former employee has accused Google of violating federal labor law by firing her for activities related to labor organizing. In a Tuesday blog post, Kathryn Spiers says Google terminated her after she created a browser tool to notify employees of their organizing rights. Spiers says she worked on a Google security team that was focused on how Google employees used Chrome within the company. Part of her job was to "write browser notifications so that my coworkers can be automatically notified of employee guidelines and company policies while they surf the Web."

So when Google hired a consulting company known for its anti-union work, Spiers wrote a notification that would appear whenever Google employees visited the firm's website. The notification stated that "Googlers have the right to participate in protected concerted activities." That's a legal term of art for worker organizing efforts. It also included a link to the worker rights notification mandated by the NLRB settlement. Google responded swiftly and harshly, according to Spiers. She was suspended from her job pending an investigation. Spiers writes that Google officials "dragged me into three separate interrogations with very little warning each time. I was interrogated about separate other organizing activities, and asked (eight times) if I had an intention to disrupt the workplace." She says she wasn't allowed to consult with a lawyer. Two weeks later, on December 13, Spiers was fired. She was told that she had violated Google's policies but couldn't get more details about which policies she had violated. In an email shared with several media outlets, Google executive Royal Hansen said: "[Spiers] misused a security and privacy tool to create a pop-up that was neither about security nor privacy. She did that without authorization from her team or the Security and Privacy Policy Notifier team, and without a business justification. And she used an emergency rapid push to do it."

Hansen argued that the firing had nothing to do with the content of the message. "The decision would have been the same had the pop-up message been on any other subject," he argued.

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Engineer Says Google Fired Her For Browser Pop-Up About Worker Rights
id: ef1bc248-3a75-4800-8c55-73ed64145d18
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Engineer Says Google Fired Her" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Engineer Says Google Fired Her For Brows")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Engineer Says Google Fired Her For Brows*"

CommonSecurityLog
| where Message has "Engineer Says Google Fired Her For Brows"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc