Slashdot Mirror
Getting Rid of Staff With High Access?
HikingStick writes "I've been in the tech field for over 15 years. After more than nine years with the same company, I've been asked to step in and establish an IT department for a regional manufacturing firm. I approached my company early, providing four weeks notice (including a week of pre-scheduled [and pre-approved] vacation time). I have a number of projects to complete, and had planned to document some of the obscure bits of knowledge I've gleaned over the past nine years for the benefit of my peers, so I figured that would give me plenty of time. That was on a Friday. The following Monday, word came down from above that all of my privileged access was to be removed — immediately. So, here I sit, stripped of power with weeks ahead of me. From discussions with my peers in other companies, I know that cutting off high-privilege users is common, but usually in conjunction with a severance offer (to keep their hands off the network during those final weeks, especially if there is any ill-will). Should I argue for restored access, highlight the fact that I am currently a human paperweight, request a severance package, or simply become the most prolific Slashdot poster over the next few weeks? Does your company have a policy/process for dealing with high-privilege users who give notice? What is it, and do you make exceptions?"
It's in the company's interest for you to do nothing. They actually will prefer if you do absolutely nothing because of their own liability. As a regular employee, if you mess something up it's just negligence (oops). On the other hand if the company terminates you and still gives you access, and then you mess something up, they're criminally liable because they should have restricted your access.
For example, I worked on banking software and had god-rights. If I as a regular employee steal all of the customer data and sell it, then I am the criminal. If I have been terminated and do the same, then they are at fault. Now yes, I realize that it's a pedantic difference, but the banks which run the software see a world of difference and will sue the my employer accordingly.
Believe me, it's cheaper to pay me 6 months severance than it is to be sued for my actions.
It really depends on level of access and what they can access. In many cases however they have been escorted out the door with in minutes of giving notice. Typically they get the two weeks notice they gave as paid time (Two weeks is standard).
Power Corrupts,Absolute Power Corrupts Absolutely, leaving one person(group)in charge is absolutely corrupt.
There's just so much to learn on the Internet. You could take foreign language courses, read geeky stuff from MIT OpenCourseware, or follow world affairs more deeply on Google News. If someone got bored with that, they might just some simple job they could do at a distance and draw two salaries at the same time.
I remember when I was 18 and knew everything. Every seasoned interviewer knows that the reference it check is not the immediate past or current employer but 2 or more back. The current employer has an incentive to lie if they are getting rid of a bad employee. To the original poster - do your job as best you can and live with the decision. Try and pass along any undocumented knowledge to good employees that will use it correctly.
In the so called "right to work" states, http://en.wikipedia.org/wiki/Right-to-work then you can be terminated without cause at any time. It s not uncommon for an IT worker (especially a high level one) to give his notice and be immediately escorted from the building under armed guard and his personal kit shipped to him.
Bad Panda! No Bamboo for you! In matters of importance ACs will not be responded to. Want to say something critical,OK
"Completely unaware of the fact that I was about to be laid off," - He didn't know, seems it was an honest mistake...
You should really read comments before flaming. Especially bits that you quote. Especially bits that completely invalidate whatever it is you think you want to say, AND that you quote. Especially bits like this: "Completely unaware of the fact that I was about to be laid off..."
GP was not being childish; he was not throwing a tantrum; he didn't even know he was about to be laid off. He started a long-running script, presumably a perfectly normal part of his job, but one which would need some shepherding. Then his permission to do that shepherding was revoked, so he was unable to do it. So he didn't do it. So the company reaped the benefits of their own folly. There was nothing the GP could have done to affect the situation, and no blame can reasonably adhere to him.
So get off your high horse, buddy. Somebody with as low a UID as you ought to know better.
SIGSEGV caught, terminating
wait... not that kind of sig.
Your example is exactly why giving notice is not something you really do anymore. I got further screwed. I was nice like you and did all that, then HR came back with a letter, "All vacation is canceled" you cant take vacation after you give notice, you also forfeit all vacation and sick time accrued.
I thought by law they had to pay you for any vacation time earned. At the very least, if that's what they put in their manual, it IS illegal. Whatever you put in your employee manual becomes legally binding.
Is that by convention or by law? In the US employment is voluntary. You don't HAVE to give any notice at all, but it's considered professional to do so.
I thought by law they had to pay you for any vacation time earned.
I think that's on a state by state basis, but it certainly true in many states.
As for cancelling planned vacation time after the employee gives notice, I say, take the time off anyway. What are they going to do? Fire you?
Are you going to a competitor?
If not, I'd approach my boss, say "I understand that you want to protect all the data that I have access to. But, I hope to be able to serve this company in the time that I have left and without at least some of that access, I can't do that. Here are the things that I still have in progress: X, Y and Z. If you give me permission to do A, B and C, then I can complete these projects before I leave.
"Others might have given you much less notice, But out of loyalty, I wanted to give you ample time to find my replacement and handle the transition. Would you please consider reinstating the access I need to finish these projects? If you cannot, please tell me how I can serve this company until my departure."
They probably won't give you the access. But, this at least creates a positive impression in their minds. Pulling some of the other stunts suggested here doesn't.
The problem with references is that they've been rendered pretty much useless by the threat of lawsuits.
If you're asked for a reference for someone and you trash them (however well deserved), it opens your company up to a lawsuit from the person who you were asked about.
If you're asked for a reference for someone and you sing their praises, the other company can sue your company should the employee do poorly in the new job.
That's why many places have policies about the kind of references their employees are allowed to give. I know of one bank that limits the allowable references to "yes, person x worked here from date y to date z." Beyond that, it is corporate policy to say nothing.
Your play is to do whatever is in your own personal interest (which would include the interest of your family and friends, and perhaps innocent bystanders).
"Not an actor, but he plays one on TV."
Don't know in this case, but I wouldn't be surprised if it were law.
Europe in general has much more law around that governs employee-employer relation than the U.S.
Take a look at French Labor Law for example http://en.wikipedia.org/wiki/New_Employment_Contract or German Labor Law http://www.germanlawjournal.com/article.php?id=594
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
OK, I guess I'll de-cloak and jump in. First background, I'm a CTO with a small software company. By small I'm talking about 30 bodies total. I mention this only to provide some data on my experience/viewpoint (CTO, not developer) and my environment (dev shop, small company) and even with all that said, remember YMMV.
OK, our policy falls in to two categories/buckets:
1 - your privs are removed and you are sent home with pay for the notice period, goodbye don't come in to work.
2- you keep all your privs and you continue to work, thanks for staying during the notice period.
Nothing else makes sense to us. Removing your privs and having you come in just creates a distraction while you talk to other staff, not useful to us.
As to whether you fall into bucket 1 or 2 is the result of conversations among management. Any doubt that you will play nice - goto bucket 1 immediately. Any doubt that you are really needed to complete work - goto bucket 1 immediately. If you both can and will contribute to the project and we do not expect any issues with you working during your notice (poaching employees, causing trouble, etc.) then go to bucket 2.
We have had people we assigned to bucket 1 that were great employees and I'd like to keep. They were not really needed for the project and we sent them home as sort of a last 'paid vacation' from us. No ill will, I'd hire them again. We've also sent people home and taken a hit on the project as the distraction, productivity, or trust factor outweighed the usefulness factor.
Removing your privileges and still having you come in makes absolutely no sense to me. Seems to be the worst of both worlds, you can't really be productive and the low work load can cause you to create distractions for other staff. I just do not get why they want to do that.
Hope that helps.
It's certainly taught to me than once (not as a manager) that it is good security policy to do this for terminated IT employees. I suspect some companies just don't make a distinction between terminated employees and employees leaving voluntarily.
At one of my old jobs, I remember them doing this specifically in the case where they found out the employee was going to a competitor.
Always have all your personal effects removed from your workplace before ever handing in your letter of resignation. Be prepared to leave immediately... well in advance of the date you give them formal notification. Try not to be too conspicuous while you "sterilize" your office before that day either.
And most of all... turn in your letter the very last thing at the end of the business day, and make it a Friday. Never, ever turn it in first thing in the morning, especially on a Monday or early in the week.
I think there is/was a difference between DoD work with classified+ information and private companies.
Until recently, it was assumed that even if it was known that a person was quitting in a job that required a security clearance, they would not be divulging any of the stuff they worked with for any reasons whatsoever, as there are stiff criminal penalties for this.
In private companies, they have an NDA with relatively minor civil consequences, and information in a company, though considered secret to the corporate officers is not truly secret in the classified sense, but "merely" considered a trade secret. So companies are swift to react to someone who they just find who is bailing on them, but still has access to the crown jewels, regardless of job function or whatnot. Its a pure knee-jerk reaction. Even with an NDA, companies go into panic mode when one of their high security employees leaves because they are afraid of stuff being learned by "osmosis" about their secret chocolate chip recipes by the competition.
In any big project, there's always more documentation that can be written, and more details to pass on.
If you've got an employee that can turn over all their knowledge in two or three days, you've been hiring the wrong people.
One answer to your earlier question about "why weren't you passing/sharing knowledge the whole time you were there before?" It's not always about hoarding knowledge - often, there's simply nobody to turn it over to. In a busy environment, it's difficult to find time to sit down and train someone in a system they're unlikely to use. Those other employees all have their own projects to get done, too. Documentation and cross-training, while good to have, often slip in priority compared to getting the newest patch out.
As a contractor, I tend not to have this problem as much. Since I know from the beginning that I won't be there long, I can be meticulous in my documentation and training, planning from the beginning to get my work ready to turn over to someone else. Most regular employees, though, usually don't have that luxury.
If the masses can keep you down, you're not the Ubermensch.
It depends on where you work. For many jobs you will be polygraphed. For some jobs you will go through a lifestyle poly in addition to a counterintelligence/espionage one. Whether the poly works or not is an open question--at the very least it's a psychological tool used to interview people in a stressful situation.
Pretty much all security clearance jobs will run a credit check, background check, etc.
Many jobs will send send investigators to past acquaintances, friends, neighbors, colleges, etc.
The point being, there is a HUGE degree of variation, even to get the same ultimate security clearance. You can immediately get an interim secret clearance just by filling out a form. top secret, etc takes longer and is more rigorous.
"Right to work" and "at-will employment" are two entirely different things.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.