Are Background Checks Necessary For IT Workers?

4foot10 writes "UBS PaineWebber learned a hard lesson after hiring an IT systems admin without conducting a background check. Now its ex-employee is slated to be sentenced for launching a 'logic bomb' in UBS' computer systems that crashed 2,000 of the company's servers and left 17,000 brokers unable to make trades."

Comments

Just another advertisement

[Anonymous Coward]

"What do you know about your own people?" asks Alan Paller, director of research at the SANS Institute, a security firm. ...nuff said.

Ask yourself this question

[Bryansix]

Would you like your email to be read by someone you don't even know? Well that is what could happen if you hire a SysAdmin and do not conduct a background check. I know that I would actually prefer if my name was run through a background check so that management can actually trust me instead of always wondering.

Re:Ask yourself this question

[paeanblack]

Employer-run background checks are not the way to go here. Just get your workers bonded for some amount of money commensurate with the damage they can cause. Bonding agencies have been around for centuries and have experience in this field that the typical firm's HR department does not.

Basically, you pay $smallnum, and if $guywithaccess does $badthing, you get paid $bignum to cover your expenses. Let someone guess the odds.

Re:Ask yourself this question

[grcumb]

Would you like your email to be read by someone you don't even know? Well that is what could happen if you hire a SysAdmin and do not conduct a background check.

You're not making the argument for background checks; you're making the argument for secure systems that don't allow untrustworthy cowboys to peek at others' mail without supervision.

If someone could prove to me that background checks actually serve any other purpose than to cow potential employees, I'd be willing to consider that there might be some use for them. As things stand, I think they're a silly and - here's the important part - ineffective means of establishing security in business.

Invest some trust in your employees. Verify that the trust is deserved. Punish breaches of trust.

Re:Ask yourself this question

[AnotherBlackHat]

Would you like your email to be read by someone you don't even know? Well that is what could happen if you hire a SysAdmin and do not conduct a background check.

So if I run a background check, my email will be read by someone I do know?

-- Should you trust authority without question?

Re:Ask yourself this question

[couchslug]

A background check could filter out a lot of bad people.

From TFA:

"According to Dawn Cappelli, a senior member at Carnegie Mellon University's Computer Emergency Response Team, a 2006 study showed that 30% of insiders who are caught launching an attack against their employers have arrest records, and that those charges don't generally include computer crimes. Some 18% were for violent offenses such as rape and manslaughter, 11% were for alcohol- and drug-related offenses, and another 11% were for theft."

Coupling background checks with secure systems gets the benefits of both.

Re:Ask yourself this question

[jwarnick]

I'm consulting for a 17,000 person multi-national firm. Most of the the internal infrastructure, including email, is outsourced to HP India. It is my experience that HP India is staffed by diploma mill graduates. These are the people reading your email.

Re:Ask yourself this question

[dave562]

I can't speak for HP India, but as an IT consultant who keeps Exchange running for a lot of large firms I can tell you that Exchange isn't as insecure as some of the FUD here would have you believe. By default, Domain Admins are EXPLICITLY DENIED rights to users mailboxes. If you grant yourself those rights, it will be logged. For that matter, even the Exchange Administrator account is set default deny when it comes to reading other people's emails.

Re: Ask yourself this question

[gidds]

Those figures mean absolutely nothing without corresponding figures from good employees.

If exactly 0% of good employees have arrest records, then an arrest record would be a pretty good indicator of malicious intent; while it wouldn't allow you to catch the other 70% of baddies, it would give you pretty conclusive evidence against that 30%.

If, on the other hand, the records for good employees were the same (which I suspect is closer to the truth), then an arrest record (or lack of one) would tell you absolutely nothing about an employee's trustworthiness.

And if the records for good employees were generally higher than for bad ones, then an arrest record would be an indicator in FAVOUR of hiring, not against!

So, worrying as those numbers might sound, they're utterly meaningless here without some context and background!

Re:Ask yourself this question

[paeanblack]

Hang on. You're a bad person if you've been arrested? Doesn't matter whether you were actually guilty of anything?

OmniMedia's shares dropped 50% when Martha Stewart was arrested. Nothing changed when she was convicted. This is typical market behavior. Even if she were acquitted, the damage was already done.

The arrest is worse than the conviction. Guilty or not, you are still a risk to the company. That's reality.

Re:Ask yourself this question

[daeg]

The amounts of money required to cover some disasters are astronomical, and even then, money alone cannot solve the damage.

If one of your system admins, say, sells a database of 2 million social security numbers, how much is that worth?

Ideally, it would a be a mix of the two systems. Some positions do require security and background checks. Bond them, too -- the security check should lower the cost to bond them (and in a high-bond instance, the bonding company would likely do their own background check anyway).

Re:Ask yourself this question

[glrotate]

Hang on. You're a bad person if you've been arrested? Doesn't matter whether you were actually guilty of anything? Probably. There's enough crime out there that cops generally don't waste their time arresting innocent people.

Re:Ask yourself this question

[MaxQuordlepleen]

Don't fish around like that on the production system. Do it in your test lab with the backups...

Re:Ask yourself this question

[toadlife]

What the last poster said.

To expand a bit, it's about privilege separation and auditing. Windows, and every other network OS supports it in some form or another.

With Windows and Exchange, the reset of a password or the change of an ACL on a users mailbox can be set up to trigger an audit event in the security portion of the event log. The exchange administrator can be denied the right to clear (or even view) the security event logs and/or the event logs can be piped out to an external server that only a third party can access. The clearing of the security even log on a system adds an event that says "so and so cleared the event log".

In the past I've enable auditing on policy changes on our Windows DCs - not because someone was hacking - but because someone in the department was changing GPOs without first discussing it with others and causing problems.

Of course, with enough access, someone who is sufficiently bright could probably get around such measures with kernel hacking/root kitting, but if someone has enough access to do those things then, proper privilege separation isn't being practiced in the first place.

Re:Ask yourself this question

[Sj0]

How many people, at what cost per hour, for how many hours, will you use to do the background check? What agencies or companies will require what fees for information? How long will you have to wait for the check to be completed, and how will the vacancy you're trying to fill affect your bottom line during the duration of the check?

That's your cost for option A.

How much is the bonding service?

That's your cost for option B.

Whether you like it or not, you're paying for insurance either way. The question is which cost is greater, and which provides the greater effective insurance.

Re: Ask yourself this question

[arivanov]

Yes I have been denied jobs because my credit score wasn't high enough.

Ha-ha. You are also as likely to be denied a job if it is too good.

Happened to me the one of the few times when I was stupid enough to apply for a bank job. I run a very tight household - no debts besides mortgage (and even that on an accelerated repayment), no credit taken for anything else (my cars are always bought with a money transfer, same for furniture and everything else), no late payments ever, no missed payments ever. And guess what - I failed the credit portion of background check. It looked to non-standard for them and they decided that I probably have some clandestine hidden income to be able to do this (I learned that from an insider much later).

So at least some US banks actually like to see their employees comfortably deep in debt. Just in case so that they do not develop too much independence. Anyway, I have learned the lesson and stick to telecoms now where the background check is mostly limited to references.

Re:Ask yourself this question

[Jesus_666]

Although I would be interested to see the coding-equivalent of engrish :)

// Saying it is great, together.
// Warned: Danger when fifty more than size is present!
int great_operation_of_high_addition_talk(int incrementor_number, int adder_number)
{
// Memorizer of the chestnut is great reservation
char * holder = malloc(sizeof(char) * 50); int addition_chestnut = 1;

// Let's increment by the great opportunity of addition!
do
{
adder_number += addition_chestnut;
incrementor_number -= addition_chestnut;
} until(!(addition_chestnut - 1 !=
incrementor_number)) // it is done

// Adding we are finish, it is enjoyed to write the figure
sprintf(holder "%50d", adder_number);

// The saying, it is
printf("%50s\n\l", holder);

free(holder); // given freedom for holding entity, it lessens the space taken
}

Re: Ask yourself this question

[mutterc]

My employer, a routing software company, just got bought by a chip company.

The forms I currently have to fill out (as a "new employee") require authorizing a credit check. You never know what a kernel developer with bad credit will do, I guess.

Credit checks bother me even more than the more-invasive checks (arrest (not conviction) records, medical history, etc.) because of the downward-spiral potential. When substantially all employers are using them (which of course will happen soon enough), if you get bad credit, you won't be able to get a job.

With bad credit, things cost more, and now your job prospects are limited. Good luck climbing out of the debt.

It's just one of those things that seems to make good sense for every individual employer (like another pet peeve of mine, not training people but expecting them to arrive fully-experienced), but when everyone does it, has significant negative societal impact.

Of course not!

[susano_otter]

Background checks are a blatant violation of our right to privacy!

Our entire civilization will be replaced by a fascist tyranny the moment we allow background checks to happen!

No guarantee

[homer_ca]

"a 2006 study showed that 30% of insiders who are caught launching an attack against their employers have arrest records, and that those charges don't generally include computer crimes."

That means a background check won't catch 70% of the malicious insiders. This article is meaningless without info about the rates of attacks from insiders who would've passed or failed background checks. It's a reasonable hypothesis to say that IT workers with criminal records are more likely to launch insider attacks, but there's no scientific evidence of it in this article. It's all fluff based on one person's case.

Re:No guarantee

[DragonWriter]

More importantly, it doesn't tell you if the 30% of "insiders" who launch attacks that have arrest records is greater or less than the proportion of people in similar positions that have arrest records to start with, and therefore if people with arrest records in are even more dangerous than others.

Re:No guarantee

[GigsVT]

That logic is flawed.

Same logic: Per capita, more black people commit crimes than white people, therefore, black people are more dangerous to hire.

Re:No guarantee

[Anonymous Coward]

Where's the flaw part?

Re:No guarantee

[ObsessiveMathsFreak]

Where's the flaw part?

An obvious troll,(modded up why...?) but I'll bite. Let's look at the GPs statement again.

That logic is flawed.

Same logic: Per capita, more black people commit crimes than white people, therefore, black people are more dangerous to hire.

Where's the flaw part?

This is an obvious fallacy based on what I like to call "The Tyranny of the Random Mean". Like most statistics, the GPs statement is valid, when based on a certain "population". In this case, the entire population of black people, in I presume the USA. And certainly it would be true that, on average, on average, if you selected at random 100 black people from the entire black population in the US, and the same for 100 white people, then the total sum of criminal convictions would probably be higher for the former group. Please note the italised and emboldened words in the above. They are very, very important.

Now, you're conducting a job interview, where the interviewees' skin colours vary. You are concerned about security and you have the above statistic in front of you. The sad fact of life is, most people will read the above and conclude that security-wise, a white person is a safer bet. They weren't. Or that is to say, the above statistic is of no use in telling you whether they are or not. Here's why.

Firstly, statistics is based largely on the fact that when the number of samples from the population is large, say ~100, then general population statistics are applicable. If the sample is, say, one or two, population statistics is of little to no use.

Secondly, and more importantly, your sample is no longer random. N.B. N.B. N.B. !!!!

I'll say that again, in case you missed it.

Your sample is no longer random .

The entire premise of statistics is that you randomly select individuals from the population. Statisticians stay up at night worrying themselves over how to do this, and are even more obsessive about their random number quality that a /dev/urandom geek. If your selection from the population is not random, then the statistics will be totally misleading.

You're at a job interview for a specific IT position, yet you want to use a population wide statistic for the entire population in this situation. You're basically assumming that all; qualified, black, geeks, applying for a job at your company, in your town, at this time, is a valid random selection from the entire black population of the United States. Congradulations. You just failed Data Analysis 101.

If you want to actually apply a statistic validly, again, you need to have a random sample, from the right population. In a job interview, you're never going to have a random sample. It may or may not be quasi random, but even it if was, you'd need a statistic for all contemporary, qualified, black, geeks, probably in your region. If you had that, then you might be justified in applying a statistic, but in reality, with such a small sample size (likely just one guy), the noise would be so high you're just wsting your time.

Instead of trolling for pretty useless statistics and data, companies should just hire based on merit. Take candidates, look them up and down, decide if they personally are the best person for the job. "Normal" is a statistic. Human beings are not homogeneous, they are all different, they all have strengths and weaknesses. If you base your hiring practicies on the averages, then you'll end up with average employees. Mediocre, jacks of all trades who are neither excellent or terrible at anything. And your company too will be as average as they come.

Backgroud checks are needed for some IT workers

[Anonymous Coward]

But for this case, they had bigger problems.

No organization that large should technolgically empower a single person to be able to do that much damage without some sort of review process that would have caught the problem.

Did his changes get reviewed by his peers?

Did they go through some sort of QA process?

While it's a bit scary that they hired a criminal, that's hard to avoid in any large organization.

What's really *really* scary is that their internal processes let him do that much damage. I'd be worried if I were their customer.

Re:Backgroud checks are needed for some IT workers

[teal_]

While it's a bit scary that they hired a criminal

That's not fair. This person has presumably been punished for their crime(s) and paid their debt to society, it's unfair to blacklist him for the rest of his life.

Don't see the point...

[DragonWriter]

Sure, he had a criminal record with offenses 20 to nearly 40 years prior to the time he was hired. I don't see that that's a real indication that he is likely to lauch a "logic bomb".

I've certainly heard plenty of stories about disgruntled IT workers in sensitive positions doing things like that—usually a criminal history isn't mentioned. Is there any evidence that there is a correlation between that and long-past criminal convictions that aren't closely related to the kind of damage they later do?

Or is this just a case of "Ooh, something bad happened, lets look for something about the person that might explain it, and then assume that this proves the general utility of background checks"?

Re:Don't see the point...

[JimBobJoe]

Is there any evidence that there is a correlation between that and long-past criminal convictions that aren't closely related to the kind of damage they later do?

I do background checks for a living.

I wouldn't go as far to say that it's snake oil, but I definitely think it's oversold by so-called security types.

I think they are most useful in predicting some types of violent behavior. In my experience, an individual who gets charged and convicted with domestic violence in their 50s almost always has a dozen speeding tickets, a criminal trespass conviction and maybe a disorderly conduct charge for good measure. Background checks might be useful to predict this type of potential behavior.

On the other hand, people who commit murder or sexual offenses (whether it's in their 20s, 30s, 40s or 50s) won't even have a parking ticket in their name. I feel like they just snap one day. So in this regard, background checks are worthless.

Theft and burglury and related charges are 95% of the time committed by those under 25. It just doesn't come up later in life. Background checks can be misleading in this regard.

Background checks that go back 30 or 40 years are pretty expensive (as noted in the article) and unusual. If you did your crime in the 70s I'm guaranteed not to find it.

My biggest issue is that background checks are hugely dependent on our judicial system, which doesn't operate as "cleanly" as the credit rating system, but for some reason, is treated as if it did.

Money used in defense plays a huge role in things. An extra grand or two on a lawyer might very well be the difference between being offered a plea bargain to misdemeanor 1 Theft, and being offered a plea bargain to misdemeanor 4 unauthorized use of property with the prosecutor agreeing to expunge the case in a year. (Whereas the credit rating system keeps all the records out there, what keeps criminal records around in the judicial system might have very little to do with the crime perpetrated.

How the state legislature enacted laws plays a huge role, though one the security companies like to dismiss. For instance, my state of Ohio has probably the nation's most liberal marijuana possession laws--anything under 100g is a minor misdemeanor, maximum fine $100--and no public record.. In quite a lot of states the same posession is a high level misdemeanor with jail time and obviously, a public record.

Does that mean that two people who've been cited for marijuana possession (same quantity), one in a state like Ohio with no public record, and another in a state with a public record will be treated very differently by companies because of their records? Absolutely. But that neither strikes me as fair or particularly logical--after all, the companies nor the security firms really ever sit down and realize that they are dependent on the state for the information--and that different laws in different states cause different information outcomes. They just use whatever information they have against the job candidate.

What was the cause?

[AK Marc]

Prosecutors charged that Duronio, angry over not receiving as large a bonus as he had expected, sought revenge against his employer [... who] spent about $3.1 million to assess the damages and restore the computer systems, [... and] haven't reported how much was lost in business downtime.

In retrospect, it appears that the entire event, as well as the financial damages and the hit to the company's reputation, could've been avoided if UBS PaineWebber, a giant in the financial community, had done a background check on Duronio when he had been hired.

And I see the problem as being caused by a lack of bonuses in IT. Prevent logic bombs, give your IT workers large bonuses!

(I'm talking to you, boss)

CEOs and CFOs far more of a risk

[WillAffleckUW]

If you look at where firms lose the most money, and the risk factors, it's the lack of realistic background checks and clawback contracts for CEOs and CFOs that puts a company at risk, then the accounting staff, then sales and shipping staff, and way down you have IT staff.

Let's get real.

Been there, done that

[k4]

Yes, of course admins with the ability to wreak major havoc at an organization should have to undergo background checks. Several years ago I worked at a Fortune 500 company, and there were no background checks done at all for IT staff. Turns out we hired a guy who used a fake name and someone else's social security number, and he worked as one of our main sysadmins for over a year, with privileges on probably 100 servers and full privileges on the email servers, before he was caught. I thought background checks were a waste of time until that...scared me half to death because no one had any idea what he'd done in all that time, and worse, no idea who he actually was.

Re:Been there, done that

[hackstraw]

Turns out we hired a guy who used a fake name and someone else's social security number, and he worked as one of our main sysadmins for over a year...

Hmm, so I would assume he picked a clean SSN and name, so a background check would have revealed???

There is a place that has 441 employees, and here is the breakdown of their past:

* 29 members have been accused of spousal abuse.
* 7 have been arrested for fraud.
* 19 have been accused of writing bad checks.
* 117 have bankrupted at least two businesses.
* 3 have been arrested for assault.
* 71 have credit reports so bad they can't qualify for a credit card.
* 14 have been arrested on drug-related charges.
* 8 have been arrested for shoplifting.
* 21 are current defendants in lawsuits.

* And in 1998 alone, 84 were stopped for drunk driving, but released after they claimed Congressional immunity.

Yes, thats congress.

Background Checks and Credit Checks for IT

[michael.j.jarvis]

This is something that has affected me in the past year, while trying to get a job in the industry. I can completely understand background and credit checks, but at the same time, many perspective employers do not even give me a chance to explain myself, or the reason things came up. Granted, I'm only 24, and people see me as some damn kid who wants to show off to his friends, but that is completely opposite of what I'm there to do. I can understand that perspective employers see several arrests as a juvenile, and I'm instantaneously blacklisted. My credit has gone to shit too, especially after a messy divorce that has drug on for way too long.
Ok, so I know I'm going to get modded down on this, but it's something that is really never spoken about. True, it can affect the job search for many of us, but I support having background checks, on the condition that we the person being investigated be offered a chance to explain ourselves, and to not become prospective employee investigation # 54283. /end rant

Re:Background Checks and Credit Checks for IT

[mythosaz]

I hate to burst your bubble, but here's the reality. You, at 24, probably have a similar knowledgebase and skillset as other applicants for my positions. Since I run a background and credit check against my future employees, I get to pick between someone with the same skills as you and a "clean" record, or you with bad credit, a divorce and and a criminal record. Guess who I'm hiring.

Unfair? No. You're not the sort of person I want working for me. You don't have a stable family life. As such you're more likely to quit/move and give shorter notice when you do. You have bad credit. You haven't demonstrated (regardless of good or bad reasons) to large financial institutions that you're worth loaning money to. I'm less likely to want to give you access to mine. Finally, you're a criminal. Sure, you were a criminal when you were a kid, but, on paper, you're more likely to be a criminal in the future, and that's nothing my company wants anything to do with.

On the other hand, if you've got a great resume, and you stand out, and it's not a tiebreak, we might overlook SOME of those problems.

I sympathize. I have a divorce. Until recently I had bad credit. I got in trouble as a young adult and have a misdemeanor record (reduced felony). I know if I didn't have the skills I do in my special niche of the IT world, I'd be passed over in favor of others. Thems the breaks. It's the price I pay for the mistakes in my youth.

This is funny

[RelliK]

It seems that the croud here decries criminal background checks as useless or even counter-productive. And yet this is the same croud that villifies Diebold for hiring criminals. Go figure...

Re:This is funny

[Sj0]

Make up your mind, Anonymous Coward, is Bush the heroic liberator who brought us into our mighty victory of morality and justice and law in Iraq and in so doing struck a blow against terrorism, or is Bush the cowardly army deserter who brought us an illegal, immoral war against a red herring of a irrelevant despot in the middle of the war on terror?

God, you're so hypocritical sometimes! It's like you're arguing with yourself!

Re:What for?

[Bryansix]

Obviously you have never worked in the Mortgage Business. It seems like the majority of the people in this business are in it to commit some kind of fraud. Whether that fraud will cost the company money is up another story. Still you have the Loan Originators lying on applications and changing data to push loans through, you have Branch Managers accepting first payments and cashing the checks in their offshore accounts, you have people "referring" loans to get around licensing requirements. So what risk does an IT person pose in this industry? Ever heard of Identity Theft? I personally have access to the social security numbers, bank account numbers, last know addresses etc of all of the borrowers on any loans passing through here. Now I'm not stealing this information but the Secret Service actually arrested some former employees here for an ID Theft Scheme. So yes, background checks plus a process of following up and actually being aware of what your employees is up to is very important.

True Story...

[MadMorf]

A company I worked for in the 90's discovered it's night-shift word processing supervisor was a convicted felon when conducting background checks on a couple dozen employees, after wallets and purses started disappearing from the office near Christmas time...

The WP supervisor had worked for another company and copied a database onto floppies and then erased the production database. He tried to hold the data for ransom, but the company just had him arrested. He did a couple of years in the klink and when he got out he went to work in the billing department of a local utility where he deposited customer payments into his own account. He did a couple years for that as well...He had worked for our company for 2 or 3 months, virtually unsupervised.

The wallet thief turned out to be a mailroom guy who had worked there for years...

Absolutely

[iamacat]

Companies should start by doing a background check of their CEOs and promptly fire them if any irregularities like a previous arrest or drug/alchohol violations are found. Once the people who could really do a lot of damage, like violate US/EU business laws, are investigated and dismissed, the company will be justified in asking rank and file to give up their privacy.

Re:Are you serious?

[$RANDOMLUSER]

> Are background checks necessary for Sys Admins at a financial institution?

For sysadmins it should be called a wallpaper check.

How would it have helped?

[Christopher_Edwardz]

How would burglary and assault (um... 47 YEARS AGO) lead to logic bombs? (From the OP) How would this have helped?

From the article:

Using only publicly available information, Hershman found three incidents, including drug-related charges from 1980 and a tax violation, within 24 hours. Within three or four days, he says investigators found information on a conviction and incarceration from the early 1960s related to aggravated assault and burglary charges. A presentencing[sic] report from the Probation Office in U.S. District Court also lists charges against Duronio from the 1960s, 1970s, 1980s, and 1990s.

So... basically, 27 years ago this guy had a drug case, and more than 40 years ago had an aggravated assault and burglary charge. From this they were supposed to deduce that this guy was going to logic bomb them?

Or, according to TFA and Hershman, this would've been enough for them not to hire him at all or just for computer work? He doesn't say. I've worked in firms that would refuse to hire you if you had anything on your record.

Please note here that Mr. Hershman sells this service and I am not so sure that he would be considered unbiased.

Here is some guy that would have been penalized for something he did 40 years ago?

Talk about 2nd class citizens. Do they understand that over 2% of the population is in prison and a considerable portion of people living today have been in prison or convicted of some offense at one point or another?

One of the engineers I hired had a drug conviction, but it was clear that she was recovering and this was a good opportunity for her. That was several years ago. Do I feel bad about that? Of course not.

I understand why companies feel the need to do criminal background checks to absolve themselves of a possible lawsuit. (They are culpable if they hire an ax-murderer just released from prison and he axifies some people.)

I believe that some of this is designed to find a chink to break down an employee so he/she will accept less in salary.

"Hmm... you have bad credit. Oh look, you also have some speeding tickets. Now, how much did you say you wanted for the privilege of working here?"

Criminal background checks should be used judiciously in sensitive positions. IT is probably one of those... but companies shouldn't just rubber-stamp anyone with a conviction a "no hire".

How would a background check stop this?

[Gothmolly]

I have never been arrested for anything, what's to prevent me from doing something malicious? If I do, is my employer at fault for not checking me?

Background checks catch the stupid criminals.

Little/no reward

[mungtor]

The way that I look at it is this:

Your IS/IT people are less likely to do Bad Things(tm) since there is little or no reward in it for them. Upper levels of managment can embezzel funds, so can lowly finance interns. For them, there is the possibility of stealing millons of dollars over time.

For IS/IT people, what have you really done? It's a larger scale equivalent of breaking a window. You've caused trouble for other people, but there is no benefit to you.

Besides, IS/IT people are easy to keep happy for the most part. Let them have ownership of the network, don't micro-manage them, and buy them the occasional cool gadget. Want a 20" LCD? If the $300 is costs keeps you happy for 6 months, you can have 4. Want the most kick-ass computer in the company? For the $1000 difference it would take, no problem.

IS/IT people are important. They are the ones who know where your data is, how it's organized, and where it's backed up. Their needs are simple too. They mostly do IS/IT work because they like new stuff and gadgets. Throw them a new piece of tech every other month and keep their salaries at least comparable and you won't have to worry.

Disclaimer: I say these things about IS/IT people because I was one, then I managed them, and now I'm happy to just be one again.

Re:Little/no reward

[Lehk228]

they could take the rounding errors from millions of transactions each day and deposit those errors into their own account, then the crazy guy you just fired will burn the building down

You are free to refuse

[DaveAtFraud]

And you have the right not to work for anyone who requires a background check. Just like someone who requires a background check has the right not to hire you for refusing to take one.

Welcome to the free market.

Cheers,
Dave

Fearmongering for fun and profit.

[bigmaddog]

The article is just fearmongering. Aside from the questionable use of statistics that others pointed out, many of the choice quotes are from sources that are hardly objective, such as "Howard Schmidt, a former White House security adviser and now president and CEO of R&H Security Consulting" or a a "Ken van Wyk, principal consultant with KRvW Associates," which, you guessed it, is a security consulting firm. It's like asking a telemarketer if he thinks you need a new long distance plan. Of course these people are going to tell you everyone's out to get you and they have the answer, all based on the strength of one horrific case study! Sure, you need to check up on people with, as they put it, the keys to your kingdom, but the analysis in TFA is hardly a basis for a level-headed, thoughtful discussion.

Criminals are people (for better or for worse)

[xjmrufinix]

I think the label of criminal is kind of being tossed around like a kind of boogie man, some clearly designated type of human who is scientifically proven to be more prone (if not certain) to steal and destroy the property of anyone fooled into hiring them. I don't think this has any basis in reality, and background checks serve more as PR and a way to placate the public into a false sense of safety than anything else. In reality, every workplace I've ever seen, technical or otherwise, was full of "criminals" who had never been caught and for whom background checks would provide zero protection. Humans are quite often greedy and selfish and inclined towards breaking rules when they think they can get away with it. I've had bosses who used background checks to screen employees while they themselves would steal hardware from the office. I wonder how many (much less sensational stories) of IT workers without criminal histories stealing from their employers aren't being reported... I personally have a criminal record, dating back to my teenage years, and am now in my late twenties. I understand an employer's apprehension when considering me for a job, even after all these years of living a constructive life, but I believe the roots of that apprehension are manufactured by the media. In reality, it is a huge task for an ex-offender to go to school and even develop the qualifications for IT work, and in my personal experience and from volunteering to help employ other ex-offenders, I believe someone who has invested that amount of effort into pursuing that career is far less likely to throw it away by doing something stupid. Most active criminals/addicts can't hold it together enough to get through college and perform the duties expected of an IT worker. They don't invest huge amounts of effort and time playing it straight for years so they can infiltrate companies and ruin everything. This character seems like an aberration to me.

Re:background checks are worthless

[vought]

If anything, a psychological profile would be the proper approach.

And with a failure rate of about 20% (according to my headhunter) these personality tests keep a lot of good people out of jobs.

But I suppose we're all supposed to prostrate in front of the almighty corporation. God forbid companies take risks or put in place mitigation strategies so that rogue employees can't bring the whole place down.

Did they make Ken Lay take a personality test? What about Jeff Skilling? I suspect they would have been found ideal based on the types of questions on these tests - which tend to focus on attention to detail, attitude, and trust in coworkers. Yet these men ruined the livelihoods of thousands with their greed. But personality tests don't probe for greed or concern for others (at least not the ones I've taken). They're also pretty invasive, asking about a prospective employee's personal life.

The personality test I took was at a company in Baton Rouge, Louisiana. My friends back in Silicon Valley couldn't believe some of the questions that were on the test, and would "just have walked out". But I need a job, so I took the test. It said I wasn't gregarious enough and a something of a solitary worker. So despite a director-level assurance that they wanted to hire me, the personality test made the hiring decision for them.

Personality tests are measurements based on what companies think they want to know - and this isn't truly useful information. A "loner" might be able to accomplish more, faster, than folks who are sociable and who hang out at the coffee pot for several minutes a day, but according to the Caliper test, these people aren't good fits at most companies.

I think that based on these simple observations, personality tests (and by extension, background checks) are less useful than they're billed as being.