Slashdot Mirror
Punishing Security Breaches
Schneier has a story on his blog this morning about
punishing security breaches. This one is in response to the tale of Gray Powell, the Apple engineer who left an important bit of technology in a bar recently. You might have heard of it. You also might have been on either the breacher or the corporate side. I'd hate to be in either position myself.
California law prohibits the sale of stolen goods and states that a person who uses someone else’s lost property without permission may be guilty of theft.
And since it's over $950, it's a felony. Even if they didn't know it was stolen, they could face a lesser charge of "misappropriation of lost property" which is a crime but not theft. Charges haven't been pressed yet but the police say they're investigating the options.
My work here is dung.
No I have not! What is this "Apple" you speak of?
If someone wants to take something classified out of a top secret military compound, he might have to secrete it on his person and deliberately sneak it past a guard who searches briefcases and purses. He might be committing a crime by doing so ...
Are you joking? Try losing their security clearance, being court marshaled and a probable investigation into 1) what motive you had removing classified material 2) where it was going and 3) how many other violations you knowingly committed.
I've gotten a corporate laptop with semi-sensitive material on it about the company I work for. I was given it when I traveled to various states. The guidelines were very clear. From locking it in the safe when I left the hotel room to not leaving it in my car. While it's less likely that someone would show up at a bar with a laptop, this is outright out of the question. Regardless of how lax their security measures are you might misplace a phone while drinking so don't bring it drinking! If you want to or accidentally take it drinking, you're accepting the risks.
It'd be hard for me to imagine that Apple -- the pseudosecretive company that it is -- wouldn't have stringent policies in place. Still, firing Powell would look less than heartless. I'd be shocked if any company as big as Apple didn't have such policies explicitly spelled out.
My work here is dung.
A PR agent finally does what he is supposed to (for once in his life with great succes) and they punish him for it. Apple's 1997 slogan goes to waste here Think different? Yeah right!
Be yourself and aim high!
I wonder if this was a way to let people know another one is on the way. The way the "Blogosphere" is intentionaly manipulated by corporation is obvious to me. This whole scenario seems unlikely to me.
Please stop these stupid articles about someone fucking up or planting a phone.
Stop it.
Stop advertising for them.
There's only one way to take care of someone who leaks mission critical information.
First you fire them. No sense in keeping them around if they are going to fuck up like that.
Next you sue them for major damages. Make an example out of them.
Since a corporation has no way to punish someone with actual jail time, the next best thing is to make sure people think twice before making big mistakes again.
Then you wonder where all the job applicants went.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
As much as everyone had been beating up on gizmodo for leaking this guy's name, I would not be surprised if the only reason he kept his job was because of the publicity.
Firing, I can understand, but suing? No one was publicly humiliated or libeled. No one was physically harmed or killed. No one else suddenly lost their job. No one was discriminated against or denied rights or equal protection under the law. No one cheated or stole anything. No one was placed in potential harms way.
IANAL so I won't comment on if someone could be legally sued for this right now in the US. But I will say that I don't think anyone should be sued for this nor do I think the law should allow it. The guy goofed by leaving a phone in a bar, this isn't like falling asleep while monitoring a nuclear power plant. Being fired is enough punishment.
"All great wisdom is contained in .signature files"
In this case, what are the damages exactly?
Apple's got no trouble attracting applicants.
They might do, if they continue to grow a reputation for Stasi style tactics and policies that make Orwell look like an optimist. Which firing and suing this guy would certainly do.
How far Apple is from the tipping point of going from "a cool place to work" to "last chance saloon for those desperate enough and unable to get work elsewhere" is an open question, particularly in today's economy. But one thing is certain...they are closer to that point now than they were two years ago, and will be a whole lot closer still if they act in a vindictive manner toward a guy who simply made a mistake any of us could have made.
After all, who hasn't lost a cell phone at least once in their life? (A good reason to never volunteer to test prototypes, especially if your lifestyle includes the occasional pub visit)
The Future of Human Evolution: Autonomy
of a security breach ever. A viral marketing campaign where someone "loses" a prototype phone at a bar does not count as a "security breach".
Don't take life so seriously. No one makes it out alive.
Because a world where that happens is a world I'm sure we'd all fucking love to live in.
I know Apple is famous for "accidentally" leaking hints of upcoming technologies out to generate buzz, but this is strange. If I were in a highly-competitive market and wanted to not give the Chinese knockoff makers a head start on my design, the last thing I'd do is let it out of the building.
I could see Apple anonmyously leaving photos or spec sheets around. Maybe they might even take a -mock-up- out in the wild like car companies do when they are track-testing a new model. (iPhone in a Samsung case? :-) ) But there's no real reason for them to "field-test" a device like that. Apple has a large corporate campus, and I guarantee they have the strongest ATT signal in the entire country. Plus, if you're testing stuff like GPS, you don't have to go across town, you just have to go across the building. Nah, this guy just had to show his buddies, and he lost it. That really sucks for him, because no matter what actually happened, he's never going to be trusted to work on secret products again. Even if Steve Jobs himself said, "Go take this phone for a spin." and he can prove it, there's always going to be the doubt that he has the self-control to keep quiet about what he's doing.
I know people who work in high-security environments, where they design products in a race to be the first to the Patent Office. Most are absolutely forbidden from even talking about what they're working on. I highly doubt that Pfizer or Bristol-Myers allows their researchers to take their lab notebooks anywhere outside their labs. People desiging the next netbook or mobile phone are in a similar situation -- 10 seconds after a prototype gets out, it will be glommed up, reverse-engineered, and a cheaper faster version will be out a week before yours.
Given all the draconian stuff I've heard about Apple being a wierd place to work, I'm sure they have an incredibly strict policy about secrecy...that is, they control the message, not the employee working on it.
We could pursue the DRM issue forever, but there's a completely unrelated lesson Apple could learn from this debacle if they cared to. If the offending phone was indeed left on a barstool, a question arises (in my mind at least): If Apple are so damned clever, why can't they make their phones small enough to fit in a pocket of your jeans?
Then nobody would have to leave the device out in plain view for anyone to pinch.
Long ago we decided that if anyone in our company breaches security by losing an access card, or sharing a password, we would not punish the person responsible if they came forward immediately.
This policy encourages a quick resolution to the security breach. A lost security card or password can be disabled or reset thereby limiting the damage the mistake caused.
Persecuting people that make mistakes only delays the notification process, and then delays the fix - putting more people/things at risk.
People make mistakes, they happen, and there is nothing you can do to prevent them.
-ted