Slashdot Mirror
Deleting Files is a Crime?
cemaco writes "A former employee of International Airport Centers, who is currently embroiled in a legal dispute with them, returned his company laptop as required. Hoping to find incriminating evidence, I.A.C. attempted to retrieve deleted information from the laptop in question with no success. This employee had beaten them to the punch. He had used 'secure delete' software, in order to make sure nothing could be recovered. He is now being charged with a violation of the Computer Fraud and Abuse Act."
If a smart lawyer would take the case.. it could be overturned on appeal.. How can you be charged when there is no evidence to hold you to that charge? The Judges are declaring a clean up of files as damage? Damage to what? the laptop was returned without the normal file associations that usually taints a origional install of the operating system. I tell you.. the more I see the law work.. the more i wonder....
Interestingly, it appears to me that the ex-employee did the right thing.
i ndofmatthew.com
1.)He is protecting the privacy of whoever's data was on the computer.
2.)He is ensuring that the computer is free from viruses, worms, spy ware, etc (assuming he performed a total wipe).
If the company wanted evidence against their employee then they should have attained it before accusing him. To do so in reverse order, as they did, only allows the employee to cover his tracks. If anything I am disappointed in the way that the company handled their business and at the very minimum reflects on the "quality of employees" that they hire.
One more note: doesn't this sort of thing fall under the category of "entrapment."
Argggg, I'm getting frustrated.... and I don't know if I should blame stupidity or the lawyers... oh wait... aren't they the same?
Matthew Wong
http://www.themindofmatthew.com/">http://www.them
If this "secure eraser" is so awesome, then what trace was there that this "secure eraser" had been used? If someone hauls me in for a crime and my computer has no evidence, does that mean I must have used a "secure eraser" on it?
So then if I have nothing to hide, am I now hiding something?
If I have been able to see further than others, it is because I bought a pair of binoculars.
I can't find it now, but a federal court judge once made the comment that people need the ability to delete files and have courts recognize them as "destroyed". Just because computer forensics has a much greater chance of success shouldn't mean that people can't deliberately disassociate themselves from material. This is core to the right against self incrimination.
Consider what might happen if I sent you a child porn image. You, offended, delete the image immediately and report me to the FBI. Now what if, unable to find me, the FBI came to your door, confiscated your laptop with a warrant (after all, you reported seeing the file, therefore you must have it) and used an undelete program to recover it. Are you now guilty of the crime of possession of child pornography? Yes, you are. At least, as far as the prosecutors are concerned.
It's never been tested legally to my knowledge, but the court MUST recognize that for someone to be charged over deleted evidence is akin to government agent pulling memories from your brain and using those memories to reconstitute matter in the same patter and then use it as evidence against you in a court of law.
This is Orwellian to the extreme, but it is quite possible that the raving "think of the children" lunatics out there will create just such a legal system. After all, they will argue, what stops kiddie porners from keeping their porn collections in the Recycle Bin? What about on a shadow drive with no FAT to link sectors to filenames? At what point does the work involved in recovery become high enough to consider something "gone"?
I'm glad to see this case, and I hope that the jurist in charge realizes that this is about a person's right to prevent their own thoughts and memories from being used against them in a court of law. After all, if the evidence went beyond the employee's person...there will be copies in e-mails, filed records, other computers. For someone to be able to go beyond the bounds of corporate communications into the person at the computer makes that employee's mind the company's property and not just his laptop.
-JoeShmoe
.
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
From the article:
That law says whoever "knowingly causes damage without authorization" to a networked computer can be held civilly and criminally liable.
The 7th Circuit made two remarkable leaps. First, the judges said that deleting files from a laptop counts as "damage." Second, they ruled that Citrin's implicit "authorization" evaporated when he (again, allegedly) chose to go into business for himself and violate his employment contract.
The court argued that the worst damage you can cause to someone's computer is erase their personal data. Seems he deleted his client list (or something similar, the article wasn't very clear on that point), and the company wanted it. Unethical way to leave a company, and he probably deserves to be nailed.
The main thing that bothers me is, what if I delete some JPGs that were stored on the computer? I may have a good reason for not wanting anyone to see them, and since they were mine, there should be nothing wrong with deleting them. Will this law allow them to come after me? Seems like it will, and that's what's scary.
Qxe4
They would have argued that they need it to search for evidence against him.
Then he could have been able to argue "You can't have it - returning it to you would be self-incrimination."
Or he could have just removed the hard disk and paid them $100 for a replacement hard disk, or better yet: "gee, it died a few days ago, and I replaced it. BTW, here's the invoice. Please reimburse me".
Lesson - posession is still 9/10 of the law.
Saying that a company owns everything on a laptop is like saying they own everything in your desk. So take a good long look around where you work and ask if you have anything personal inside company property. If you pick up the kids with the company car do they become an asset used on a balance sheet? No. It all comes down to common sense (something that is lacking more and more these days).
Personall I think this is nothing more then a case of them getting ticked off. They got pissed because he decided to go on his own as a real estate competitor and when he returned the laptop THEY tried to find incriminating evidence on him. No accusations of "You did this and we are looking for the proof" no, they went on a fishing trip through the hard drive. Seeing as they were looking for anything I think this guy was getting into sh*t no matter what.
There are only 10 kinds of people in the world. Those that understand binary and those that don't.
If he has the files, he's not a criminal because he has them, but because of what's in them. If he had gone into his employer's filing cabinets and destroyed documents that could have been used against him, he could have been charged for that, though under a different law. Deleting documents from an employer owned computer isn't any different, at least morally.
A few years back, I worked on a project that used ClearCase, and the management really wanted us to use it to record the full history of our projects. The group I was working with decided to take them literally.
.o and executable files, see ...
After about a week, we found that we were each able to fill our workstations' disks with the compiles we did. The ClearCase setup saved all our
If was fun watching them actually install a second disk on most workstations the first time this happened (and we all showed that the disks were 99% full of ClearCase files recording the week's work. Then, by the end of the next day, the new disks were full, and we announced that our progress was blocked until we could get more disks.
It actually took a couple weeks of meetings (and no progres on the project) before they faced the fact that "You can't delete your files" was not a tenable rule. They simply couldn't afford the petabytes of disk that the project was projected to require under their "save everything" rule.
So finally we were able to start deleting the 99% of our files that couldn't possibly be of any use to anyone, and only save the interesting source files. I don't think most of the management ever did understood what "source" and "binary" files referred to.
Anyway, yeah; if an employer wants to pay for the disk space, I'll happily save all my files for their later study. But somehow, I suspect that they're not gonna get much for their investment. They'll be much better off if they let me be the judge of which 99% of my files can be safely discarded.
If this court does go along with a "save all files" rule, it could be a very interesting precedent. It'll take more than a couple weeks of meetings to get such a court ruling overturned. In the meantime, some disk manufacturers might be doing a lot of business.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
We ask supervising managers what files/data are required and ask the users to send us those files. Provided that data is returned and the user left on good terms the drive on their machine/laptop is wiped. We have a lot of users who travel fulltime and to ask or even expect them not to use their laptop for personal reasons while on the road is ridiculous and management thankfully agress with that stance. So, for everyone's privacy... the drive just gets zapped and then reimaged.
It was argued that we may lose valuable information in doing so but I pointed out to our CMMI happy managers that this would indicate a failure in the document creation and control process and not an issue with our IT policy and they conceded the point.
Additionally we work on secure projects for the government and have NDA's in place with corporate clients. I can't allow my IT staff to dig through files that they're not authorized to see and because of that we have to treat the whole drive as if its classified material unless we can get someone who is authorized to see to come in and sort through the whole mess. And we're never going to be able to pull a billable consultant off a project to do that unless something is missing.
Long story short... *ZAP*
Besides the poor choice of going into business that directly completes with his former employer, this guy allegedly made the other poor choice of using a 'wipe' utility to remove data.
... How about a group of graphics files that are public domain textures, traffic signs, fragments from websites (taken from browser cache), etc.. Another good group is music - record meetings and lectures then rename them to look like popular music titles. The final idea is to include some encrypted zip files with suggestive names - of course the files contained are renamed unix man docs. Just be sure to use the standard delete command to 'hide' the files from recovery.
What he should have done is used what I refer to as the general-use non-wipe routine. Basically, it involves simply deleting files you don't want/need, then filling the remaining drive space with 'wipe' files - various sized files filled with random or meaningless data and given random or misleading file names. Generate a group of base files, store on USB drives, then copy to the root directory of the target drive, renaming the files as you go. For extra fun, delete your 'wipe' files after you fill the drive. You could probably write a script to help, just make sure it is given an innocent name and stays on the USB drive.
It would be interesting to see the reaction of the managers and scavengers to finding a directory of hundreds of text files and then discovering that each file is a copy of unix man files, or five year old project documentation (that you had no part), or trek fan fiction, or
If you are brought into court like this poor guy your lawyer can argue that those files are there from the day-to-day use of the system. Nothing sinister or devious about those files.
Someone please tell me how the fuck they could prove that certain incriminating files even existed, if said files were wiped before they got the laptop?
What if they were never there to start with?
What a fucking idiot retard of a judge.
If only that were true. Unfortunately, companies, corporations anyway, do have the same rights as individuals in the United States. I tend to lean pretty hard to the right in most things political, but this fact has to change before companies do rule the world (even more than they do now).
Check out this interview
Companies do have the same rights as people
I kept the computer quite tidy due to a small hard drive. Most work was accouting, spread sheets and some word processing. Hard copies were printed and filed as permanent reports and as backups. Every month or two I would do a Norton Speed Disk which would wipe unused space.
When I left the company I left about two months of data on the hard drive and a 20 page status report which detailed where all the hard copy documents/files/data were physically located and info on the work in progress. The company sent the computer out for data recovery and when no erased files could be recovered I was sued. The company claimed the hard copies did not exist but were later found when I succeeded in obtaining a court ordered search of the company's office.
My lawyers filed a motion to dismiss claiming there was no triable evidence. The judge ruled that the lack of recoverable files was in itself evidence that "something" on the computer had been destroyed and thus fit the statute. The bopgus case settled a few year. No money changed hands but my legal fees ran about $150,000, my life savings.
Advice: 1. NEVER erase anything. Simply move the file out of the current workspace to an archive directory. When the drive gets full have the company buy a new drive -- give the old drive to the boss with a corresponding memo detailing in general what was on the drive. 2. Keep each file you create in a separate directory and maintain a printout of that directory. 3. Run your own backups and transfer the backups via memo when you leave. Leave another copy of the backup with a trusted co-worker who can put them where they can't easily be found and destroyed. The more people involved the better.
If you accidentially have personal info on the hard drive it might be a good idea to wipe the info before you leave. But you need to overwrite the directory and file space deleted since the empty space might be detected. Others here can suggest a procedure.
Well look at it this way, It matches the situation more closely.
The company gives you a company car to drive to locations were you need to either sell or fix something. You are allowed to take the car home and drive it to and from work. You have personal possesions in it like sun glasses, maps with the routes to your clients outline in markers, a jacket, change of clothes,your daughter's school book and homework because she left in the car when you droped her off on the way to your first apointment. Your company now decides to get rid of you for whatever reason, are you allowed to get you belonging out of the car now? Are you alowed to remove any trace of them? Did you violate any laws when removing them before returning the car? Even when the company fired you because you were driving your kid to school in the company car and they wer eplanning on ussing your daughter school books and home work as evidence to support thier decision?
This is more like what this is about. If the company gives me somethign to use, i use it for personal use as well as work, the personaly stuff doesn't automaticaly become the company's property. I'm not clear on exactly what was deleted but from the article it apears that it was evidence that could prove he was using the laptop to start his own buisiness wich should fall under personal use.