Slashdot Mirror
Deleting Files is a Crime?
cemaco writes "A former employee of International Airport Centers, who is currently embroiled in a legal dispute with them, returned his company laptop as required. Hoping to find incriminating evidence, I.A.C. attempted to retrieve deleted information from the laptop in question with no success. This employee had beaten them to the punch. He had used 'secure delete' software, in order to make sure nothing could be recovered. He is now being charged with a violation of the Computer Fraud and Abuse Act."
If a smart lawyer would take the case.. it could be overturned on appeal.. How can you be charged when there is no evidence to hold you to that charge? The Judges are declaring a clean up of files as damage? Damage to what? the laptop was returned without the normal file associations that usually taints a origional install of the operating system. I tell you.. the more I see the law work.. the more i wonder....
Interestingly, it appears to me that the ex-employee did the right thing.
i ndofmatthew.com
1.)He is protecting the privacy of whoever's data was on the computer.
2.)He is ensuring that the computer is free from viruses, worms, spy ware, etc (assuming he performed a total wipe).
If the company wanted evidence against their employee then they should have attained it before accusing him. To do so in reverse order, as they did, only allows the employee to cover his tracks. If anything I am disappointed in the way that the company handled their business and at the very minimum reflects on the "quality of employees" that they hire.
One more note: doesn't this sort of thing fall under the category of "entrapment."
Argggg, I'm getting frustrated.... and I don't know if I should blame stupidity or the lawyers... oh wait... aren't they the same?
Matthew Wong
http://www.themindofmatthew.com/">http://www.them
If this "secure eraser" is so awesome, then what trace was there that this "secure eraser" had been used? If someone hauls me in for a crime and my computer has no evidence, does that mean I must have used a "secure eraser" on it?
So then if I have nothing to hide, am I now hiding something?
If I have been able to see further than others, it is because I bought a pair of binoculars.
And how will they prove that anything was erased?
I can't find it now, but a federal court judge once made the comment that people need the ability to delete files and have courts recognize them as "destroyed". Just because computer forensics has a much greater chance of success shouldn't mean that people can't deliberately disassociate themselves from material. This is core to the right against self incrimination.
Consider what might happen if I sent you a child porn image. You, offended, delete the image immediately and report me to the FBI. Now what if, unable to find me, the FBI came to your door, confiscated your laptop with a warrant (after all, you reported seeing the file, therefore you must have it) and used an undelete program to recover it. Are you now guilty of the crime of possession of child pornography? Yes, you are. At least, as far as the prosecutors are concerned.
It's never been tested legally to my knowledge, but the court MUST recognize that for someone to be charged over deleted evidence is akin to government agent pulling memories from your brain and using those memories to reconstitute matter in the same patter and then use it as evidence against you in a court of law.
This is Orwellian to the extreme, but it is quite possible that the raving "think of the children" lunatics out there will create just such a legal system. After all, they will argue, what stops kiddie porners from keeping their porn collections in the Recycle Bin? What about on a shadow drive with no FAT to link sectors to filenames? At what point does the work involved in recovery become high enough to consider something "gone"?
I'm glad to see this case, and I hope that the jurist in charge realizes that this is about a person's right to prevent their own thoughts and memories from being used against them in a court of law. After all, if the evidence went beyond the employee's person...there will be copies in e-mails, filed records, other computers. For someone to be able to go beyond the bounds of corporate communications into the person at the computer makes that employee's mind the company's property and not just his laptop.
-JoeShmoe
.
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
Apparently on that technical ground the court made, incredibly, a unanimous decision. I find that preposterous and worrying.
he's driving the speed limit, but he was probably speeding before he slowed down to it, let's write him a ticket
A feeling of having made the same mistake before: Deja Foobar
IANAL - But i used to work for a bunch... legally speaking you should install eraser and allow it to wipe nightly/weekly then this isn't an issue. If you do it on a regular schedule... your more likely to be legally covered. For example: You destroy a bunch of files before a warrant comes to you... you are busted, but if you destroy your files, one per night every night as normal upkeep you have the same nothing as before... but you arent in trouble cause its scheduled destruction. similar to insider trading: scheduled sale vs. impromptu trading. If you sell just to sell... and the stock takes a dive or jumps.... you could be liable for insider trading (assuming you have insider info). But if you sell a certain amount every month.... you cant be hurt in court no matter what jumps its doing. wipe that hard drive every night....OR do not store the contact info on their computer and you are fine just say you like paper records or a roledex.
Victory is gained, not in knowing your opponents next move, but in preempting them.
From the article:
That law says whoever "knowingly causes damage without authorization" to a networked computer can be held civilly and criminally liable.
The 7th Circuit made two remarkable leaps. First, the judges said that deleting files from a laptop counts as "damage." Second, they ruled that Citrin's implicit "authorization" evaporated when he (again, allegedly) chose to go into business for himself and violate his employment contract.
The court argued that the worst damage you can cause to someone's computer is erase their personal data. Seems he deleted his client list (or something similar, the article wasn't very clear on that point), and the company wanted it. Unethical way to leave a company, and he probably deserves to be nailed.
The main thing that bothers me is, what if I delete some JPGs that were stored on the computer? I may have a good reason for not wanting anyone to see them, and since they were mine, there should be nothing wrong with deleting them. Will this law allow them to come after me? Seems like it will, and that's what's scary.
Qxe4
Is it the company's policy that the notebook be returned in the condition that it recieved in? That would mean clean and ready for use. A lot of computer savy people would use a safe delete software as a matter of practise so there can't be any intent shown. Did they instruct the employee to not delete any files from the machine? If they didn't it's their fault for not telling them to return it in a condition with all files intact. If anyone has a concern about this keep a personal external hard drive that you store the information on so the machine will remain clean while you are using it. They'd need a court order to obtain your personal hard drive which you of coarse are now using on your home machine and you had to format it first. You should be required to provide back ups of business files when you leave a company but it seems like they are trolling for information. The law is pretty sketchy in this area and probably does need an update. Deleting the files might look suspicous but it also can just show an employee be responsible when they return a device.
They would have argued that they need it to search for evidence against him.
Then he could have been able to argue "You can't have it - returning it to you would be self-incrimination."
Or he could have just removed the hard disk and paid them $100 for a replacement hard disk, or better yet: "gee, it died a few days ago, and I replaced it. BTW, here's the invoice. Please reimburse me".
Lesson - posession is still 9/10 of the law.
..."if you have no evidence against guy, you simply can't get guy punished" they don't understand?
How they will prove that he cleaned up needed information in first place? Fingerprints? Electronic analystics? Give me a break, it is simply NOT possible. It is very possible that employee did something very wrong (and in fact, we don't know much about that). What we know that before getting a order from judge to get back hard drive, employee discarded any information from it. He maybe breached job contract, he maybe overstepped some laws, but clearly company will have a hard time to prove that this guy is gulty in first crime. And if laptop was only evidence then I think it smells more like "pushing around the small guy" theme all over again, not serious wish to discover the truth.
user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
Why cant these programs just fill the empty data with real useless data.
Like pictures of flowers, and exe code segments of windows dlls'.
Liberty freedom are no1, not dicks in suits.
Saying that a company owns everything on a laptop is like saying they own everything in your desk. So take a good long look around where you work and ask if you have anything personal inside company property. If you pick up the kids with the company car do they become an asset used on a balance sheet? No. It all comes down to common sense (something that is lacking more and more these days).
Personall I think this is nothing more then a case of them getting ticked off. They got pissed because he decided to go on his own as a real estate competitor and when he returned the laptop THEY tried to find incriminating evidence on him. No accusations of "You did this and we are looking for the proof" no, they went on a fishing trip through the hard drive. Seeing as they were looking for anything I think this guy was getting into sh*t no matter what.
There are only 10 kinds of people in the world. Those that understand binary and those that don't.
If he has the files, he's not a criminal because he has them, but because of what's in them. If he had gone into his employer's filing cabinets and destroyed documents that could have been used against him, he could have been charged for that, though under a different law. Deleting documents from an employer owned computer isn't any different, at least morally.
How about if I have a policy of deleting all files securely on all my computers all the time? Just as I shred my papers before throwing them away. Since I shred my papers, possibly I am destroying 'possible evidence' for any future law suit? If I do not delete files securely and someone steals my laptop and wrongly uses the information therein, who is responsible??
A few years back, I worked on a project that used ClearCase, and the management really wanted us to use it to record the full history of our projects. The group I was working with decided to take them literally.
.o and executable files, see ...
After about a week, we found that we were each able to fill our workstations' disks with the compiles we did. The ClearCase setup saved all our
If was fun watching them actually install a second disk on most workstations the first time this happened (and we all showed that the disks were 99% full of ClearCase files recording the week's work. Then, by the end of the next day, the new disks were full, and we announced that our progress was blocked until we could get more disks.
It actually took a couple weeks of meetings (and no progres on the project) before they faced the fact that "You can't delete your files" was not a tenable rule. They simply couldn't afford the petabytes of disk that the project was projected to require under their "save everything" rule.
So finally we were able to start deleting the 99% of our files that couldn't possibly be of any use to anyone, and only save the interesting source files. I don't think most of the management ever did understood what "source" and "binary" files referred to.
Anyway, yeah; if an employer wants to pay for the disk space, I'll happily save all my files for their later study. But somehow, I suspect that they're not gonna get much for their investment. They'll be much better off if they let me be the judge of which 99% of my files can be safely discarded.
If this court does go along with a "save all files" rule, it could be a very interesting precedent. It'll take more than a couple weeks of meetings to get such a court ruling overturned. In the meantime, some disk manufacturers might be doing a lot of business.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
"the files" is the evidence, not the crime. I think you are confusing the two. Making the evidence go away does not nullify the crime. If he commits a "crime" and there are files ("evidence") that he destroys, and you can prove there was a crime and the files were incriminating evidence, he can be charged not only with the crime, but also with destruction of evidence, which is illlegal.
Also the files on the laptop, were company property. While you are a company employee, you are caring for those files as a representative of the company, and you can arguably do with them as you please. After he was fired, those files were no longer under his care (he was no longer authorized to manage company property and resources) and remained property of the company. Wiping the hard drive at that point could very easily be proven to be Destruction of Private Property, again this is illegal.
The lessons learned:
(1) anything you put on a company computer IS THE COMPANY'S PROPERTY. Don't cry invasion of privacy or personal files, they are NOT yours anymore. You surrendered your right to privacy of your documents the moment you put them on company property. This actually is a double edged sword - many companies don't like you to use your own laptop specifically because they have less legal control over it and the information on it during extreme circumstances like termination. And don't forget, this includes email. Company has the right to monitor your email and anything else you do on the computer. It's astounding how many people believe that company email is private and that their employers are "not allowed" to look at personal employee emails.
(2) it's sometimes easier for a prossicutor to get a conviction if you destroy some (but not enough) evidence.
(3) it's not unheard of for a company to obtain a search warrant and send the police to ransack your house and take your computers/HDs/CDs to retrieve "sensitive company information". You don't even have to have the company's laptop for that one - they just have to convince a judge that you have "work in progress" you took home from work and loaded onto your computer, and you want it back. Sadly, most judges belly up on this issue and just sign off without due consideration for what they're allowing to happen.
With point 1, I get a chuckle when I walk by someone on a computer, typing up an email, and when they see someone approaching from behind they flip to another window or hit screensaver etc. I want to say to them "you DO realize that's not private in any way shape or form and I or any of your managers could easily read it?" but I usually just walk away smiling at their ignorance.
At some point in the future reality will hit them like a brick, and give them a good case of the cold sweats.
I work for the Department of Redundancy Department.
He was "not" in posession of the weapon. His fingerprints were "not" found on the weapon. He was "not" seen near the victim. In fact, witnesses have denied that the victim ever saw this person. Surely they must be hiding something!
I was joking of course. Just wanted to prove a point that if he deleted the files how could they prove that something incriminating was there?
Seven puppies were harmed during the making of this post.
Does the employee has rights to delete any files from the computer? If he does, there is ZERO reason to sue him. If you ask a non technical lay person who has no prior knowledge of how computers delete files, I think it is likely that he will think the act of deleting a file would remove a file completely from the computer and there will be no trace of it. However, it is the imperfection of use current technology that result in residue of files still residing in the computer after you delete them. There is ZERO requirement from anyone using a computer that the computer should contains copy of data in the computer after the data is deleted (if so, why should there be a delete in the first place?) So why should the act of "deleting" deleted data a crime, especially a serious crime? It is like you can throw away a piece of paper document but you can't shred a piece of paper document and throw it away.
We ask supervising managers what files/data are required and ask the users to send us those files. Provided that data is returned and the user left on good terms the drive on their machine/laptop is wiped. We have a lot of users who travel fulltime and to ask or even expect them not to use their laptop for personal reasons while on the road is ridiculous and management thankfully agress with that stance. So, for everyone's privacy... the drive just gets zapped and then reimaged.
It was argued that we may lose valuable information in doing so but I pointed out to our CMMI happy managers that this would indicate a failure in the document creation and control process and not an issue with our IT policy and they conceded the point.
Additionally we work on secure projects for the government and have NDA's in place with corporate clients. I can't allow my IT staff to dig through files that they're not authorized to see and because of that we have to treat the whole drive as if its classified material unless we can get someone who is authorized to see to come in and sort through the whole mess. And we're never going to be able to pull a billable consultant off a project to do that unless something is missing.
Long story short... *ZAP*
With point 1, I get a chuckle when I walk by someone on a computer, typing up an email, and when they see someone approaching from behind they flip to another window or hit screensaver etc. I want to say to them "you DO realize that's not private in any way shape or form and I or any of your managers could easily read it?" but I usually just walk away smiling at their ignorance.
It could also be that it is simply none of your business. I'm not comfortable with anyone reading over my shoulder or off of my screen while they stand there talking to me. I will nearly always minimize e-mail, query analyzer, web pages, regardless of their content. For all you know they could be writing a priviledged message to another employee (HR, management).
For me, I'm simply not comfortable with the situation, but with direct access to databases I could also be working with data that is confidential. Not only are work areas public, but it's not uncommon for people to have relatives or consultants visiting.
You make assumptions of wrong doing, but you're comfortable walking up and looking at someone's monitor where I doubt you would be comfortable picking up papers from their desk and reading them.
It is amazing what you can accomplish if you do not care who gets the credit. -- Harry Truman
Besides the poor choice of going into business that directly completes with his former employer, this guy allegedly made the other poor choice of using a 'wipe' utility to remove data.
... How about a group of graphics files that are public domain textures, traffic signs, fragments from websites (taken from browser cache), etc.. Another good group is music - record meetings and lectures then rename them to look like popular music titles. The final idea is to include some encrypted zip files with suggestive names - of course the files contained are renamed unix man docs. Just be sure to use the standard delete command to 'hide' the files from recovery.
What he should have done is used what I refer to as the general-use non-wipe routine. Basically, it involves simply deleting files you don't want/need, then filling the remaining drive space with 'wipe' files - various sized files filled with random or meaningless data and given random or misleading file names. Generate a group of base files, store on USB drives, then copy to the root directory of the target drive, renaming the files as you go. For extra fun, delete your 'wipe' files after you fill the drive. You could probably write a script to help, just make sure it is given an innocent name and stays on the USB drive.
It would be interesting to see the reaction of the managers and scavengers to finding a directory of hundreds of text files and then discovering that each file is a copy of unix man files, or five year old project documentation (that you had no part), or trek fan fiction, or
If you are brought into court like this poor guy your lawyer can argue that those files are there from the day-to-day use of the system. Nothing sinister or devious about those files.
Someone please tell me how the fuck they could prove that certain incriminating files even existed, if said files were wiped before they got the laptop?
What if they were never there to start with?
What a fucking idiot retard of a judge.
If only that were true. Unfortunately, companies, corporations anyway, do have the same rights as individuals in the United States. I tend to lean pretty hard to the right in most things political, but this fact has to change before companies do rule the world (even more than they do now).
Check out this interview
Companies do have the same rights as people
There is also the "transmission" thing, and only a highly philosophical engineer would consider typing into a laptop a "transmission."
The ______ Agenda
I kept the computer quite tidy due to a small hard drive. Most work was accouting, spread sheets and some word processing. Hard copies were printed and filed as permanent reports and as backups. Every month or two I would do a Norton Speed Disk which would wipe unused space.
When I left the company I left about two months of data on the hard drive and a 20 page status report which detailed where all the hard copy documents/files/data were physically located and info on the work in progress. The company sent the computer out for data recovery and when no erased files could be recovered I was sued. The company claimed the hard copies did not exist but were later found when I succeeded in obtaining a court ordered search of the company's office.
My lawyers filed a motion to dismiss claiming there was no triable evidence. The judge ruled that the lack of recoverable files was in itself evidence that "something" on the computer had been destroyed and thus fit the statute. The bopgus case settled a few year. No money changed hands but my legal fees ran about $150,000, my life savings.
Advice: 1. NEVER erase anything. Simply move the file out of the current workspace to an archive directory. When the drive gets full have the company buy a new drive -- give the old drive to the boss with a corresponding memo detailing in general what was on the drive. 2. Keep each file you create in a separate directory and maintain a printout of that directory. 3. Run your own backups and transfer the backups via memo when you leave. Leave another copy of the backup with a trusted co-worker who can put them where they can't easily be found and destroyed. The more people involved the better.
If you accidentially have personal info on the hard drive it might be a good idea to wipe the info before you leave. But you need to overwrite the directory and file space deleted since the empty space might be detected. Others here can suggest a procedure.
Well look at it this way, It matches the situation more closely.
The company gives you a company car to drive to locations were you need to either sell or fix something. You are allowed to take the car home and drive it to and from work. You have personal possesions in it like sun glasses, maps with the routes to your clients outline in markers, a jacket, change of clothes,your daughter's school book and homework because she left in the car when you droped her off on the way to your first apointment. Your company now decides to get rid of you for whatever reason, are you allowed to get you belonging out of the car now? Are you alowed to remove any trace of them? Did you violate any laws when removing them before returning the car? Even when the company fired you because you were driving your kid to school in the company car and they wer eplanning on ussing your daughter school books and home work as evidence to support thier decision?
This is more like what this is about. If the company gives me somethign to use, i use it for personal use as well as work, the personaly stuff doesn't automaticaly become the company's property. I'm not clear on exactly what was deleted but from the article it apears that it was evidence that could prove he was using the laptop to start his own buisiness wich should fall under personal use.
I am somewhat torn on the issue, so first my argument against him...
The data on the laptop belonged to IAC, not the employee. It wasn't personal emails to his wife or his personal credit card information. It was data gained during his employment and deleting those files was a malicious act taken after his employment ended. Would anyone here really say it is OK for someone to login to the server on their last day and wipe the company's customer database when they don't have a backup? What about a bank employee deleting financial records? Once you agree that those occurences of deleting data would be wrong, it's just a matter of scale to determine how wrong his actions were.
On the other hand, his contract specifically let him return or delete the data on his laptop. They probably didn't anticipate him leaving this way, and maybe he was supposed to backup those files to the company server or store them there in the first place. I don't think it matters though. When you have a contract (like his employment contract), you HAVE to take the plain meaning of it's words. The judge in the opinion tried several different ways to explain how IAC may have been thinking when they created the contract, but you can only argue that if the actual words of the contract are ambiguous. That is why lawyers make so much money, they are supposed to catch things like that. Saying that he can delete the data before returning the laptop is pretty plain to me. In either case, if the employement agreement was a standard employment contract for the company with minor modifications, any ambiguities must be decided against the drafter. If he has some say in the wording of the contract and had things changed from the first draft that wouldn't be the case though.
Also note that th
Of course, take this all with a grain of salt as I am not a lawyer...
Most companies' employee handbooks expressly dictate that anything created on their laptop is immediately owned by the company. They also make you sign legal agreements that you've read and accept the handbook.