Slashdot Mirror
Are Background Checks Necessary For IT Workers?
4foot10 writes "UBS PaineWebber learned a hard lesson after hiring an IT systems admin without conducting a background check. Now its ex-employee is slated to be sentenced for launching a 'logic bomb' in UBS' computer systems that crashed 2,000 of the company's servers and left 17,000 brokers unable to make trades."
"What do you know about your own people?" asks Alan Paller, director of research at the SANS Institute, a security firm. ...nuff said.
Would you like your email to be read by someone you don't even know? Well that is what could happen if you hire a SysAdmin and do not conduct a background check. I know that I would actually prefer if my name was run through a background check so that management can actually trust me instead of always wondering.
"a 2006 study showed that 30% of insiders who are caught launching an attack against their employers have arrest records, and that those charges don't generally include computer crimes."
That means a background check won't catch 70% of the malicious insiders. This article is meaningless without info about the rates of attacks from insiders who would've passed or failed background checks. It's a reasonable hypothesis to say that IT workers with criminal records are more likely to launch insider attacks, but there's no scientific evidence of it in this article. It's all fluff based on one person's case.
No organization that large should technolgically empower a single person to be able to do that much damage without some sort of review process that would have caught the problem.
Did his changes get reviewed by his peers?
Did they go through some sort of QA process?
While it's a bit scary that they hired a criminal, that's hard to avoid in any large organization.
What's really *really* scary is that their internal processes let him do that much damage. I'd be worried if I were their customer.
Sure, he had a criminal record with offenses 20 to nearly 40 years prior to the time he was hired. I don't see that that's a real indication that he is likely to lauch a "logic bomb".
I've certainly heard plenty of stories about disgruntled IT workers in sensitive positions doing things like that—usually a criminal history isn't mentioned. Is there any evidence that there is a correlation between that and long-past criminal convictions that aren't closely related to the kind of damage they later do?
Or is this just a case of "Ooh, something bad happened, lets look for something about the person that might explain it, and then assume that this proves the general utility of background checks"?
The only thing a background check really proves is that a person has not been caught at anything yet. It's the ones that get away with nefarious actions that you really have to worry about (Note, I'm not one of those nefarious people, though I'm sure someone will bring that up).
If you look at where firms lose the most money, and the risk factors, it's the lack of realistic background checks and clawback contracts for CEOs and CFOs that puts a company at risk, then the accounting staff, then sales and shipping staff, and way down you have IT staff.
Let's get real.
-- Tigger warning: This post may contain tiggers! --
This is something that has affected me in the past year, while trying to get a job in the industry. I can completely understand background and credit checks, but at the same time, many perspective employers do not even give me a chance to explain myself, or the reason things came up. Granted, I'm only 24, and people see me as some damn kid who wants to show off to his friends, but that is completely opposite of what I'm there to do. I can understand that perspective employers see several arrests as a juvenile, and I'm instantaneously blacklisted. My credit has gone to shit too, especially after a messy divorce that has drug on for way too long. /end rant
Ok, so I know I'm going to get modded down on this, but it's something that is really never spoken about. True, it can affect the job search for many of us, but I support having background checks, on the condition that we the person being investigated be offered a chance to explain ourselves, and to not become prospective employee investigation # 54283.
It seems that the croud here decries criminal background checks as useless or even counter-productive. And yet this is the same croud that villifies Diebold for hiring criminals. Go figure...
___
If you think big enough, you'll never have to do it.
A company I worked for in the 90's discovered it's night-shift word processing supervisor was a convicted felon when conducting background checks on a couple dozen employees, after wallets and purses started disappearing from the office near Christmas time...
The WP supervisor had worked for another company and copied a database onto floppies and then erased the production database. He tried to hold the data for ransom, but the company just had him arrested. He did a couple of years in the klink and when he got out he went to work in the billing department of a local utility where he deposited customer payments into his own account. He did a couple years for that as well...He had worked for our company for 2 or 3 months, virtually unsupervised.
The wallet thief turned out to be a mailroom guy who had worked there for years...
Goofy, Geeky Gifts and More!
Companies should start by doing a background check of their CEOs and promptly fire them if any irregularities like a previous arrest or drug/alchohol violations are found. Once the people who could really do a lot of damage, like violate US/EU business laws, are investigated and dismissed, the company will be justified in asking rank and file to give up their privacy.
How many people are genuinely untrustworthy?
I don't know, either. And since you didn't say how many are, neither do you. But it only takes one to cost a company millions of dollars, or run them right out of business entirely. I have clients that rely utterly on their customers' sense that they handle their data securely and that the team of people who touch that data are trustworthy. One slip could ruin those customers, cost people their jobs, homes... that's a lot more expensive than a background check, or the salary you have to pay someone who can easily pass one.
Don't disappoint your bird dog. Go to the range.
How would burglary and assault (um... 47 YEARS AGO) lead to logic bombs? (From the OP) How would this have helped?
From the article:
Using only publicly available information, Hershman found three incidents, including drug-related charges from 1980 and a tax violation, within 24 hours. Within three or four days, he says investigators found information on a conviction and incarceration from the early 1960s related to aggravated assault and burglary charges. A presentencing[sic] report from the Probation Office in U.S. District Court also lists charges against Duronio from the 1960s, 1970s, 1980s, and 1990s.
So... basically, 27 years ago this guy had a drug case, and more than 40 years ago had an aggravated assault and burglary charge. From this they were supposed to deduce that this guy was going to logic bomb them?
Or, according to TFA and Hershman, this would've been enough for them not to hire him at all or just for computer work? He doesn't say. I've worked in firms that would refuse to hire you if you had anything on your record.
Please note here that Mr. Hershman sells this service and I am not so sure that he would be considered unbiased.
Here is some guy that would have been penalized for something he did 40 years ago?
Talk about 2nd class citizens. Do they understand that over 2% of the population is in prison and a considerable portion of people living today have been in prison or convicted of some offense at one point or another?
One of the engineers I hired had a drug conviction, but it was clear that she was recovering and this was a good opportunity for her. That was several years ago. Do I feel bad about that? Of course not.
I understand why companies feel the need to do criminal background checks to absolve themselves of a possible lawsuit. (They are culpable if they hire an ax-murderer just released from prison and he axifies some people.)
I believe that some of this is designed to find a chink to break down an employee so he/she will accept less in salary.
"Hmm... you have bad credit. Oh look, you also have some speeding tickets. Now, how much did you say you wanted for the privilege of working here?"
Criminal background checks should be used judiciously in sensitive positions. IT is probably one of those... but companies shouldn't just rubber-stamp anyone with a conviction a "no hire".
I have never been arrested for anything, what's to prevent me from doing something malicious? If I do, is my employer at fault for not checking me?
Background checks catch the stupid criminals.
I want to delete my account but Slashdot doesn't allow it.
And you have the right not to work for anyone who requires a background check. Just like someone who requires a background check has the right not to hire you for refusing to take one.
Welcome to the free market.
Cheers,
Dave
They that can give up essential liberty to obtain a little temporary safety deserve neither safety nor liberty.
Ben
The article is just fearmongering. Aside from the questionable use of statistics that others pointed out, many of the choice quotes are from sources that are hardly objective, such as "Howard Schmidt, a former White House security adviser and now president and CEO of R&H Security Consulting" or a a "Ken van Wyk, principal consultant with KRvW Associates," which, you guessed it, is a security consulting firm. It's like asking a telemarketer if he thinks you need a new long distance plan. Of course these people are going to tell you everyone's out to get you and they have the answer, all based on the strength of one horrific case study! Sure, you need to check up on people with, as they put it, the keys to your kingdom, but the analysis in TFA is hardly a basis for a level-headed, thoughtful discussion.
Even as you read this, your pants are strangling your loins! Aaa!
I think the label of criminal is kind of being tossed around like a kind of boogie man, some clearly designated type of human who is scientifically proven to be more prone (if not certain) to steal and destroy the property of anyone fooled into hiring them. I don't think this has any basis in reality, and background checks serve more as PR and a way to placate the public into a false sense of safety than anything else. In reality, every workplace I've ever seen, technical or otherwise, was full of "criminals" who had never been caught and for whom background checks would provide zero protection. Humans are quite often greedy and selfish and inclined towards breaking rules when they think they can get away with it. I've had bosses who used background checks to screen employees while they themselves would steal hardware from the office. I wonder how many (much less sensational stories) of IT workers without criminal histories stealing from their employers aren't being reported... I personally have a criminal record, dating back to my teenage years, and am now in my late twenties. I understand an employer's apprehension when considering me for a job, even after all these years of living a constructive life, but I believe the roots of that apprehension are manufactured by the media. In reality, it is a huge task for an ex-offender to go to school and even develop the qualifications for IT work, and in my personal experience and from volunteering to help employ other ex-offenders, I believe someone who has invested that amount of effort into pursuing that career is far less likely to throw it away by doing something stupid. Most active criminals/addicts can't hold it together enough to get through college and perform the duties expected of an IT worker. They don't invest huge amounts of effort and time playing it straight for years so they can infiltrate companies and ruin everything. This character seems like an aberration to me.
it used to be the background check was called "checking references", and was done by the manager or HR. Previous employers were contacted, and if there were bad vibes, the candidate was passed over. This would tell a company far more than background checks.
If anything, a psychological profile would be the proper approach.
And with a failure rate of about 20% (according to my headhunter) these personality tests keep a lot of good people out of jobs.
But I suppose we're all supposed to prostrate in front of the almighty corporation. God forbid companies take risks or put in place mitigation strategies so that rogue employees can't bring the whole place down.
Did they make Ken Lay take a personality test? What about Jeff Skilling? I suspect they would have been found ideal based on the types of questions on these tests - which tend to focus on attention to detail, attitude, and trust in coworkers. Yet these men ruined the livelihoods of thousands with their greed. But personality tests don't probe for greed or concern for others (at least not the ones I've taken). They're also pretty invasive, asking about a prospective employee's personal life.
The personality test I took was at a company in Baton Rouge, Louisiana. My friends back in Silicon Valley couldn't believe some of the questions that were on the test, and would "just have walked out". But I need a job, so I took the test. It said I wasn't gregarious enough and a something of a solitary worker. So despite a director-level assurance that they wanted to hire me, the personality test made the hiring decision for them.
Personality tests are measurements based on what companies think they want to know - and this isn't truly useful information. A "loner" might be able to accomplish more, faster, than folks who are sociable and who hang out at the coffee pot for several minutes a day, but according to the Caliper test, these people aren't good fits at most companies.
I think that based on these simple observations, personality tests (and by extension, background checks) are less useful than they're billed as being.
Viktor Cherkashin, a former KGB officer states in his book Spy Handler, people most often commit treason based on personal needs that need to be resolved, right now. Most commonly financial reasons, it is why Aldrich Ames and Robert Hanssen both defected to spy for Soviets.
....as long as people are involved, security threats can never be completely eliminated."
What's the ideal solution? Make your employees happy, pay them more, etc? It's difficult to stop good people from going rogue, and even worse doing pre-screening. Note even a single scope background investigation and polygraph works (see above)
And to quote Cherkashin, "The only way to be safe is to remove people from intelligence gathering,
The kind of background checks that were done 20 years ago wouldn't be a problem. A credit report (which by law you can obtain and correct), criminal convictions, that sort of thing. Pretty much everything comes out of public or quasi-public records.
These days, companies like ChoicePoint are offering data products mined from a wide array of sources. There are many problems with this approach, starting with the fact you did not consent for people to share your data for this purpose. In the US, the Fair Credit Reporting Act supposedly regulates some information products used for this kind purpose, but there are many ways around. The same kind of information that you have a right, under FCRA, to contest and correct in a credit report can appear in a background check... and lots more.
You have no right to know or contest what is in a background check. Particularly the cheap kind that are sold almost as shrink wrap products.
The information on the background check can be simply wrong. I had a modem line in my house for a short time, less than two years. Possibly because I had it for a short time, the number got recycled fairly quickly after I had it disconnected. Recently I ran a background check on myself, and found data that had nothing to do with me in it. Looking at it carefully, it turned out to apply to the people who got my old modem phone number.
What if those people had been criminals, or terrorists?
Here's another eample. A couple of years ago, a big box store in our area went out of business. A few months before the store went belly up, we had spent $15 there. Later, we got hundreds of dollars of charges on our credit card: somebody at the store ran our credit card number through dozens of times, apparently to bring enough cash to keep it afloat for another month. We told the credit card company to decline the charges. If the information that we had hundreds of dollars of unpaid debt ever appeared on our credit report, we could challenge it. But if it appeared in a background check, we wouldn't even know.
Even where information is correct, it might not be complete. For example, suppose the creditors in the store incident took us to court. That could appear on our background check. But if the judge dismissed the case, it might not appear in the report at all.
Wouldn't a more accurate background check be better? Yes, but it is more expensive. The background company can sell a much cheaper product if they tolerate a lot of mis-information that shows unlucky people in a false light. The employer can tolerate false positives too, unless it is unusally important to hire the best possible person. In those cases they could double check the background check if they aren't scared off; or they could purchase a better background check. Having a selection of price/quality in background checks benefits the employer and the data companies. It's bad for everyone else.
Background checks are a good thing. Inexpensive background checks are a good thing. Cheap (as in shoddy) background checks, which contain information you cannot see, much less contest or correct, are a very, very bad thing. At the very least, the information in the background check should be shown to you first, and you should be able to challenge it before it goes to the employer.
A better system would work like this: somebody ought to offer a "bonded worker" product. You, as the employee, would hire a trusted and respected company to do a background check on you. The bonding company would then produce a risk profile based on the information in that background check, and show it to you. You could query various findings and view and contest the data used to arrive at them. When the report is mutually acceptable, the report would be sent to your prospective employer. If that employer had any special concerns, they would submit them to the bonding company, who would draft a response which you could review and challenge. At any time you
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.