Slashdot Mirror
Deleting Files is a Crime?
cemaco writes "A former employee of International Airport Centers, who is currently embroiled in a legal dispute with them, returned his company laptop as required. Hoping to find incriminating evidence, I.A.C. attempted to retrieve deleted information from the laptop in question with no success. This employee had beaten them to the punch. He had used 'secure delete' software, in order to make sure nothing could be recovered. He is now being charged with a violation of the Computer Fraud and Abuse Act."
So if he has the files, he's a criminal. But if he doesn't have the files, he's also a criminal? How is deliberate obstruction determined in a case like this?
Adolf Hitler, when challenged by some people, said "I don't need you, I have your children."
Effectively one could say the same thing about those in government who have usurped the rights of the people since the ink dried on the Constitution and Bill of Rights. "I don't need you, I have the laws." Worst of all, they have a lot of the children too, because the children don't care or will vigorously defend the right of the government to deny them their very own rights.
Ideally, a judge would, like the article's author, take one look at the charges and say, "whaaaaat?" just before throwing the whole silly thing out. Now three loops have decided returning the drive clean is a crime, unanimously.
Ok, there's the thought that work on the laptop would be of value (a project of some sort or list of contacts and estimates valueable to the next to occupy the position) to the employer and the employee violated some work ethic, by destroying company property, but that's now how it reads. More likely the computer would only contain things meaningful to the employee in the context of producting the actual end work.
Next there will probably be some poor person sued for throwing out old yellowed paper-work, which had been in the bottom drawer of a desk for 30 years, when retiring.
Does this mean each person must approach the company gestapo for approval to destroy or discard anything?
A laughable concept. IAC are a bully and the U.S. Court of Appeals for the 7th Circuit are out of their league regarding workplaces and technology.
oy, he erased 'is name from the company directory! someone could get seriously lost looking for a former employee's cubicle and come to great harm! put 'im in irons!
A feeling of having made the same mistake before: Deja Foobar
If the laptop was classified as evidence in the case, chances are it wouldn't be in his possession. If it wasn't, then he didn't commit a crime.
On the other hand, if a document was issued classifying the harddrive as evidence before he deleted the contents of the drive, he did commit a crime.
Ideally, it should be as simple as that.
When you work somewhere what you obtain from that employer belongs to the employer until the employer relinquishes ownership to you.
/. if the guy had set fire to the corporate tower as he walked out the door. I think not. But, what he did was equally malicious.
Would this have even been posted on
Caution: Contents under pressure
Possibly. But if he used it as a personal laptop it might have credit card info from online purchases, porn in the internet history, or some music he ripped off a cd to listen to while he was working or traveling. None of that is illegal but all of it is stuff you wouldnt want an employer / ex employer to find.
Yes and no.
If the company had a set of policies in place, and had informed the employees about them, that ALL data that was put onto the system became the property of the company. Or if there was a clause on there about not putting personal data or programs on there.
In this case, they would pretty much need to PROVE that anything he deleted was possibly incriminating. Which, at this point, would be damn near impossible.
Chas - The one, the only.
THANK GOD!!!
We are required to wipe the drives when we leave with something like a hardware 3 pass low level uniquely random sequencer based on radioactive decay.
I got a little overboard there. I do not work in a secure environment. I believe this is for our privacy when we leave, or maybe it has to do with security for financial information, or maybe it has no reason, but it is a policy.
This guy got raped by the system before the real deal. Gotta love our freedoms!
Unless the company's written policy was "you cannot delete files from this laptop we've given you" then I can't see where there is a problem. If they really needed those files, they should have taken possession of the laptop BEFORE the fit hit the shan rather than cry foul after the fact.
Depends. It's certainly the company's laptop, but the NON-work-related data may not be theirs. Every company I've worked in that allowed the use of a laptop had allowances for "limited personal use" in their acceptible use policies. That meant that it was cool for me to use the laptop to check my webmail accounts during lunch, etc. That information was mine, not theirs. It was also assumed reasonable for me to delete my personal data that was left on the system.
Operative word being "Reasonable."
It would all depend on whether his company's acceptible use policy had an allowance for limited personal use or not. If they did say it was OK to use it for personal use, they had no legal grounds upon which to try and recover HIS personal (not work related) data since it was HIS.
Your analogy implies that EVERYTHING in a workspace is company property, when in most cases it's not. Having personal effects in my office, and removing them when I leave the employer, is no different form having some personal data on a computer.
Never attribute to malice what can as easily be the result of incompetence...
If you allow the employee to use the laptop for personal use (online banking eg.) then you have to expect them to take steps to protect themselves.
This is a bizarre ruling -- I expect some interesting repercussions.
And who classifies it as "evidence" it could also be so home made movie's of him doing his wife that he didn't want to get out at his ex-office
What would you do without a monitor? Sit and look stupid behind a keyboard and a mouse
Deleting files can have legal consequences: if it's prohibited by your contract, if it's data shared with others, or if the evidence has already been subpoenaed.
This decision seems wrong, however: preventing people from deleting files on laptops under their control was not what the Computer Fraud and Abuse Act was intended for (note, in particular, that it makes reference to a networked computer). Whether the employee was allowed to files should be a matter purely of their employment contract and the stated corporate policies.
Ideally, a judge would, like the article's author, take one look at the charges and say, "whaaaaat?" just before throwing the whole silly thing out. Now three loops have decided returning the drive clean is a crime, unanimously.
RTFA. That's exactly what the judge did. The company appealled the decision, and the appeals court sent it back to the judge saying: no, you can't throw this out. The company might be right. You need to hold a trial to figure it out.
Having read the article, I agree. The issue is not so clear-cut that it should be dismissed out of hand: it deserves its day in court. The guy may have deleted incriminating information (which is a crime, see Enron paper shredders). He may also have been propping up his business at company's expense (i.e. using whatever data he acquired while making sure the company doesn't get a hold of it). That's for the judge to decide, and that's exactly what the appeals court said should happen.
Oh and, btw:
Adolf Hitler
you lose.
___
If you think big enough, you'll never have to do it.
Or the third possibility is he does not delete the files, and there are no files which shows he violated his work contract. The crime was in deleting the files. There could not be a crime in leaving the files there.
What most likely happened was he used his employers laptop in starting his own buisness. Who knows how he did this, maybe he used trade secrets or something else. When he decided to quit, he wanted to remove the evidence of his actions, so he removed everything from the laptop.
The company has a right to issue the laptop and require it is returned in the same condition, and that would include the software and data on the laptop.
Is the laptop's data the property of the employer? That is the question. If the laptop is the property of the employer, and the employer has a right to the data on the laptop, then what this guy did is the same thing as if he deleted records from a PC in his cubicle. Or is it different because he can take a laptop out of the office?
My gut reaction is to want more privacy. But maybe that is not possible anymore. Heck, the government demanded search records from Yahoo, MSN, and Google a few months ago so they could see who was searching for prohibited porn and terrorism. Google was the only one who did not provide the data, but not because they wanted to protect their users privacy, but because they did not want other companies to see their data.
It's important to point out that this decision was not made in a criminal case, but in a civil case. As such Critin wasn't found guilty of anything and therefore I believe this ruling does not count as a binding precedent for criminal cases merely a persuasive one. Nevertheless, it is disconcerting that the seventh circuit court of appeals made this ruling. However there are lots of caveats in the ruling that mean the question of what you can and can't delete from a computer when leaving a company is still relatively open. In the end, Citrin didn't just delete love letters and e-mails to personal friends from his computer - he deleted files concerning clients - files he knew his company would be interested in and didn't have a copy of. Personally, I think that it should be the responsibility of the company to make sure a copy of such files exist on their servers but that's just my opinion.
Sadly, once again Slashdot has chosen to report news with the most sensationalist slant possible. Despite the fact interest in the story would have probably been the same (or more) if it had reported a few extra details of the case. In the end, sensationalism diminishes, not increases, the value of a news service.
Some law in the UK makes it illegal to possess encrypted data and not provide a key to decrypt it. it even allowed for the situation where i could email u an encrypted archive and your inability to open it would put u in breach of the law.
hehe, the rebel i am.. i just emptied my recycle bin..
--AlexC
Just because I dont agree with climate change doesnt make me a troll
If they can prove he did this in order to hide evidence, they may have a case.
However, for instance, I run "eraser" on a daily basis which scrubs all free space on all drives, plus slack space at the ends of files. I consider this simply standard operating procedure, because my computer does have sensitive data on it. In addition, I lock my machine when I leave, and all my data is held in an encrypted volume, so if someone reboots the machine to a boot CD or something, or steals the machine, they still get nothing.
If I undertake these actions as a general course of business because I consider them to be simply part of trying to do my job and take security seriously, I think that's a lot harder to prosecute against.
Destruction of evidence is a crime .. so he is a criminal. Well first off if you were actually reading and paying attention you'd grasp the difference between personal data and evidence.
Just cuz the company owns the laptop does not make every piece of data on it theirs.
As a reader already pointed out if the company wanted to keep tabs on what their employee was doing then they should have spied on him via the company network or taken his laptop without first warning him.
Just because you use a pencil from work to write a note to your wife doesn't mean the company intrinsically owns the data simply because you produced it using their pencil or paper. So any claim that all the data on his laptop could be considered company property is a joke and is more then pushing the envelope of personal privacy.
Cases like this are great because they strengthen our rights by pointing out the continued erosion of personal privacy and getting people interested. If Americans are freaking out because they could be wiretapped imagine what they would do if we told them every note they have written and every word they have said at work or using company paper, pencils, cell phones or computers magically belongs to that company.
If there is evidence on the computer then it has to be addresses as evidence, and they must provide the burdeon of that proof and good reasons for why they waited to long to review the potential evidence to see if it was even there.
Obviously if they had ANY case what-so-ever they would have siezed the laptop from him like the police do with no questions asked. This will be a stupid move on the companies part as they have gone and gotten their private happenings into the public eye.
If the guy dropped his laptop in the pool or something are they gonna claim that as a computer crime for destroying company data.
It's not as if they don't have backups of the vast majority of work he did or else they DESERVE to lose their data as they had no reasonable plan for data backup in place.
It's also ridiculous to suggest that if a person stores personal data on their laptop they have no right to remove.
Any data worth not losing should have been backed up as company procedure. They only have their selves to blame.
Basically the whole issue ended up being about timing.
When he decided to leave employ of the IAC to start his own venture, his authorization at that point to use the computer did not belong to him. Though he may have physically retained the computer, and had all access to it, he did not have legal rights to its contents.
At that point, he was a competitor to IAC, possibly with information on his person about IAC that a competitor should not.
IAC wondered what he had, and whether he was misusing this laptop for his own benefit, which would break all kinds of laws. They wanted to take a look at said laptop, and see if he'd used it or seen anything he shouldn't have recently.
This employee then accessed the laptop and deleted all kinds of stuff, akin to shredding documents Enron or Watergate style. He then returns the laptop to IAC, his former employer and now competitor.
Unsurprisingly, former employee is now sued, though his conviction is by a tenuous interpretation of a law.
Citrin pointed out that his employment contract permitted him to "destroy" data in the laptop when he left the company.
His right to do this was in his contract. Can anyone tell me why a contract can no longer protect an individual from a company?
Prominent computer employers usually require basic scrubbing, like deleting and formatting harddrives, but generally encourage any technique that renders the previous data inaccessible such as zeroing and random writing programs when returning a workstation. Even if the machine isn't sold to the general public at that point, it can be given to another employee who has no business looking at data you might have been privy to. You would think that given the recent data exposures from companies who sold old equipment without properly 'scrubbing' the machines that something like this would be encouraged. FTFA, Sounds like the guy is no saint, but the employer should store any data they deem critical on central servers where they control retention and backup regiments. What do they want his browser bookmarks? history? Really sounds like the employer is misuing law because they were duped. Without any data, proving his breach of contract is more difficult regardless of how nefarious his activities appear. Gotta love the great cases that get to establish precedent...yeehaw...
I understand the reasoning that Judges can only pass judgements based on the arguments presented by lawyers on behalf of their clients, and this was fine for hundreds of years, but the computing universe that a lot people spend a considerable amount of time living in is far too different to the physical domain we live in.
A Judge who is not computer literate should not be prevailing over a case based on IT. Even us geeks have trouble coming up with analogies that are accurate enough to explain things properly to ordinary people when we're fixing their computers.
Judges shouldn't need analogies or "translators" when they hear a case centred around IT, they should know what CPU, GPU, NTFS, EXT2, HFS, etc, all mean, otherwise they cannot seriously be expected to form an accurate picture of what is being argued, and therefore cannot be expected to come up with a ruling based on any sort of accuracy.
Judging, he he, from this bit in the article,
This Judge doesn't really know how a computer works.
Deleting files is certainly not the worst thing you can do to a computer. Hell, go ahead and delete critical operating system files. A restore disk, OS installation disk, or re-image later and the computer is back up and running.
It may seem like I'm arguing semantics, but it's just the way that phrase leapt out at me that leads me to think that the Judge seriously misunderstands the connection between the functions of a computer, and the way that data is stored within the computer.
Could he also misunderstand that the computer was probably going back to the company almost exactly as it had been issued, and therefore undamaged other than normal wear and tear?
His name is Robert Paulsen...
He never mentioned Godwin's Law. Who cares about Godwin, bringing up Hitler in a completely unrelated discussion is a stupid thing to do to. Period.
"people need the ability to delete files and have courts recognize them as "destroyed""
... then yes, I totally agree.
... let's say pictures or videos he was "using for work", deleting incriminating evidence "to free up space" and replacing those video files multiple times?
When they're *your* files on *your* computer
But I don't think that logic applies to this case. Evenso, what would have prevented this guy from filling his hard drive with
If he did that often enough it would probably be very difficult to recover any data. Would he still be liable then?
I think his mistake was in arguing about his authority to delete files at all. His argument should have been that all the files alleged to have been deleted were personal files, personal use of the laptop was authorized by his employment agreement (quote the relevant paragraph from the agreement, and the company has no right to demand that those files be turned over in the first place. You can't be charged under the law he was if the only things you "damaged" belonged to you.
Of course, this only works if he was scrupulous to avoid mixing his personal stuff with company data and can clearly show that all the files the company can prove were theirs are untouched. If he did delete files from an area normally or provably containing company data, he's pretty much SOL.
Except what is his employer's data and what are his own personal thoughts? Taking their leads on properties and going "hey, I should call my friend and have him buy land near XYZ" is a lot different than "hey, I should send my friend a copy of confidential employer report".
The company is alleging that the only proof that the guy violated his contract was on their laptop. Well what if the guy had put the data on his own computer? Would the company then be entitled to it? If he destroyed the data on his own personal computer, would that also be a crime?
This whole idiotic ruling creates a legal catch-22. You are an employee given access to confidential information. Suddenly you are no longer an employee. So, if you keep that information, you could be found to "gaining access to information that you do not have permission to access" and be guilty of computer fraud under the statues. NOW, if you destroy the information so that you cannot be found guilty of having access, you can be charged with "hacking or tampering with information you did not have permission to access" and be guilty of computer fraud under the statues. Damned if you do, damned if you don't.
-JoeShmoe
.
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
This should be a civil matter.
It is a testament to the broken state of our laws (and especially our computer crime laws) that his former employer was able to (convince a DA to) drag him into criminal court for this.
If the guy had hacked into company computers and destroyed data, then sure, he should be prosecuted under criminal laws. But wiping files from a hard drive? If the guy really did do damage to his former employer, or violated a contract with them, then it shouldn't be a criminal case. It should be a civil case.
If you had super powers, would you use them for good, or for awesome?
Of course it's BS. But so is the whole case.
The REAL case is that the guy was setting up his competing business, and they wanted the laptop data to prove it.
They shouldn't be going after him for "destruction of data on a networked device" but for violating his non-compete. Especially since, if they can't prove he violated the non-compete, then it IS his data to do as he pleases, even if it was sitting on their laptop.
Look at it this way: If they can't first show he violated his non-compete, then they have no claim to the data he erased, as it may have been "his" data just as much, or more, than theirs.
On the other hand, prove first that he violated his non-compete, and you can THEN also get him on the data destruction.
What you CAN'T do is the reverse - prove the destruction of your data if you can't first prove that it is uncontestedly your data.
The employer can demand anything he wants. And the employee can say "sue me."
In this case, though, the employer is putting the cart before the horse - attempting to claim vandalism to their property (destruction of files on a networked computer) without first proving the files in question were their property. They wanted the files to show he broke his non-compete and, as such, was no longer an employee, and thus not authorized to delete the files. Seems to me, if they can't first show he broke his non-compete, they can't claim uncontested ownership to the files.
They're in a catch-22.
but if i was going to quit my job... and start a new company in the same business .... I woudln't use my old companies laptop for planning my new venture. When i look for new jobs, I don't search monster from my work computer... i go home and weep like a woman... consider killing myself and then decide to look for a new job instead =)
... it is always sales or real estate?? why is that...?
had this guy bought a laptop (which he is likely going to need for his new company anyway) and used it for dealings w/ his new venture... his problems would be gone.
that said.... it is some bullshite to claim that deleting the files securely was a violation.
seems like most of the time when i hear about employement problems like this
actually I am happy to see you, however that is in fact a banana in my pocket.
From the article: But it is unlikely, to say the least, that the provision was intended to authorize him to destroy data that he knew the company had no duplicates of and would have wanted to have
So why the hell was this critical data on a laptop and not backed up or stored somewhere more secure? Their IT guys should be fired...
IANAL, but I think there's his defense right there. If the data was critical, any company worth it's salt has a policy that it needs to be stored (or at least copied) somewhere secure.
Real programmers use "copy con program.exe"
Deleting data isn't necessarily a crime, but destroying evidence which is subject to discovery in a civil or criminal process is, even if you're Arthur Anderson.
-fb Everything not expressly forbidden is now mandatory.
That is bullshit. If that were true: a company could argue that the government can't look at their financial records because it would incriminate them; a murderer could deny police access to their premises because they would find a body in her freezer that would incriminate her.
A murderer CAN deny access to their property even having a dead body in the freezer, enless the police have a warrant. A company CAN refuse to turn over documents enless the police have a warrant. Police can't walk in anywhere they want and/or just take things because they may or may not be incriminating, it's called probable cause. They must have enough viable reason to further their investigation, you can't just bother every citizen because you may or may not know a partial bit of information about a crime.
When I return a PC or laptop to a client site, they are entitle to:
That's it. Everything else on the machine is my personal property, and removing it is my right the same as cleaning out my desk when I finish a contract.
I do not fail; I succeed at finding out what does not work.
I'll go out on a limb here and say that if this company is sophisticated enough to have a non-compete agreement in place, there's probably an agreement in place that covers what you should and should not have on a company laptop. You say that if they can't prove violation of the non-compete then hte data is his to do with what he pleases. This is almost certainly not so. I'd be willing to bet that ANYTHING on that company computer is company property. The company has a right to look at any of it at any time, and the individual's use of the computer is tactit agreement to that policy. Therefore, if he has deleted ANYTHING the company wants to see he is likely in violation of the company's data policy. If any data recovered was unrelated to his work, he's again violated the company's data policy. If any data recovered was related to a private business he was running using company property, then he's in violation of the company's data policy AND his non-compete agreement. If it's company hardware then everything on it is uncontestedly their data. They don't need to prove it.
Perhaps a little off topic, but just today I was reading how my former mayor left office and 4000 emails magically "disappeared". It is interesting because lately San Diego has had a great deal of scandals. I suppose stuff like this is becomming common practice. I can't help but wonder, why is the IT system so lacking? I know that if the FDA were to audit a life critical system, such a thing wouldn't pass (of course, the auditors might not realize the flaw). Granted lives aren't on the line in this case... but still.