How IT Pros Can Avoid Legal Trouble

snydeq writes "InfoWorld's Peter S. Vogel reports on the kinds of inadvertent transgressions that could land IT pros into legal trouble without realizing it. From confidentiality and privacy negligence, to copyright and source code violations, IT staff are legally liable for a lot more than they might think — in some cases because the law will not stop at your employer, instead holding individual IT employees responsible for violations even if the individuals are just 'doing their job.' Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do. 'That lack of understanding can lead them to conclude you're at fault or should have known better,' Vogel writes. 'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'" What legally questionable scenarios have cropped up at your job?

Comments

Liability

[nhaines]

I'm liable for first posts.

Re:Liability

[Anonymous Coward]

I regularly kill processes.

Re:Liability

[skids]

As long as you caught them forking children, I don't think anyone will mind.

Re:Liability

[Maarx]

And me without mod points.

Re:Liability

[Anonymous Coward]

Think of the children! dont fork them

Re:Liability

[Type44Q]

As long as you caught them forking children...

At first I was trying to figure out what this was referring to and then I figured it out: the Vatican must hires developers, too! :P

Re:Liability

[diabloskh]

I work in the medical field and I have found that every day there is more and more liability for those of us in an over crowded profession with no licensing to keep the morons out. It's very hard to explain that a 5 year engineering degree is not the same as a 2 year night rotation at ITT Tech

Re:Liability

[realityimpaired]

It's much harder to explain that a 5 year engineering degree is not worth as much as 1 year of actual work experience... degrees/certifications are pieces of paper that don't actually prove you know what you're doing. Actually working within the technology is what proves whether or not you know what you're doing, and I've seen recent university grads manage to seriously fuck things up because they'd been taught the wrong way to do things.

Terry Childs was NOT an IT pro

[Anonymous Coward]

He was a petulant child.

This narrative that this ruling could affect non-sociopaths is FUD.

Re:Terry Childs was NOT an IT pro

[ushering05401]

I don't like that site, but I clicked through long enough to see if this was a Childs centric article... and it isn't.

Anyone currently putting utility boxes in the wild that allow passive bridging for diagnostic captures could be affected by what is being described in the article (just the first common example that comes to mind). Any entry-level Linux hacker doesn't need to veer out of the repos to install their way to diagnostic tools that could violate federal wiretapping charges if set up with the wrong cat5 off the rack at work.

Re:Terry Childs was NOT an IT pro

[Toonol]

Terry Childs is a terrible poster child for IT professionals. He did all sorts of things professionally and ethically wrong, and probably legally wrong, as well. I certainly would have pressed charges if he had been my employee.

However, there are some legal traps that even a well-behaved IT pro can fall into. For instance, monitoring too much can be a privacy invasion, monitoring not enough can be negligence. Because the IT word scales up so much, sometimes a minor mistake can end up with millions of dollars of consequences.

Re:Terry Childs was NOT an IT pro

[guruevi]

Even though Terry Childs might have been an idiot in the way he handled the case, he didn't do anything wrong from a legal standpoint. As an admin you are obliged to keep passwords to sensitive systems away from incompetent people (whom's access could result in damages) or people who can or will probably use it for malicious purposes (like financial officers of a company).

If you are entrusted with one of the keys to a double keyed nuclear defense system, would you give the keys to your boss (eg. the President) so he can do as he whims? If you do you are just as responsible for the results as the one that actually pushed the buttons. Is there any difference in responsibility between the guards at the Nazi concentration camps and Hitler?

Re:Terry Childs was NOT an IT pro

[CapOblivious2010]

Is there any difference in responsibility between the guards at the Nazi concentration camps and Hitler?

Um... yes?

If the guards didn't do as they were told, they'd likely end up on the other side of the bars... this pressure did not exist on Hitler himself. This mitigating factor creates a huge difference.

Note: I'm not saying "just following orders" should always give you a pass, just that I think the guard's crimes were lesser.

Re:Terry Childs was NOT an IT pro

[b4upoo]

Perhaps I am now misinformed but as I understand it liability for content never exists unless some censorship takes place on a network. Therefore it would seem to me that the very last thing one would ever want to do is look at any form of content flowing through a network.
              But I can not see failure to hand over a password being a crime. It may well have wreaked havoc with a system but that was not Terry's problem nor if he was dismissed did he have any obligation to hand over anything to a former employer. The fact that the employer did not have more than one way to access and control that network had nothing to do with Terry. The city was sloppy and negligent.

Re:Terry Childs was NOT an IT pro

[Anonymous Coward]

It's incredibly damaging to responsible professionals.

The constant attempt to remake the unfortunate Mr Childs into some kind of victim or even a hero around here is baffling and kind of weird. It's almost like folks are being baited and going for the Biggest Saddo trap hook, line, and sinker.

Re:Terry Childs was NOT an IT pro

[guruevi]

Even though they might get a lesser sentence, they have historically been held just as responsible. There is such a thing as moral obligations. If you do not agree with a certain order you (should) have the right to be a conscientious objector.

The Nuremberg trials obviously codified this: "The fact that a person acted pursuant to order of his Government or of a superior does not relieve him from responsibility under international law, provided a moral choice was in fact possible to him".

Re:Terry Childs was NOT an IT pro

[Anonymous Coward]

he didn't do anything wrong from a legal standpoint

Denial of service and denial to an authorized user are both wrong from a legal standpoint. The jury, which included at least one professional network administrator, had no trouble concluding that a denial of service did, in fact, occur. And, while it was more difficult to determine that denial to an authorized user occurred, they did come to the conclusion that he definitely knew that the individuals for whom he was denying access were, in fact, authorized to have that access.

Then there's the whole business of locking down the system and then trying to flee the State with the passwords....

Re:Terry Childs was NOT an IT pro

[Neil_Brown]

Perhaps I am now misinformed but as I understand it liability for content never exists unless some censorship takes place on a network. Therefore it would seem to me that the very last thing one would ever want to do is look at any form of content flowing through a network.

From a point of view of a network provider, I'd suggest that it is not necessarily "censorship", but rather "knowledge" or, in effect, the exercise of editorial control (which may or may not be considered "censorship") - in the US, it's s230, Communcations Deceny Act and s512, DMCA; in Europe it's Arts. 12-14, eCommerce directive (as implemented locally (e.g. the UK's implementing regulations, rather than the directive itself)).

Under the European regime, a network provider is not liable for the content which it carries (art. 12) or hosts (art. 14), subject to certain limitations:

• Art. 12 (carriage / "mere conduit"):
• • The service being provided "consists of the transmission in a communication network of information provided by a recipient of the service, or the provision of access to a communication network"; and
  • the service provider:
  • 1. does not initiate the transmission;
    2. does not select the receiver of the transmission; and
    3. does not select or modify the information contained in the transmission."

• Art. 14 (hosting)
• • The service "consists of the storage of information provided by a recipient of the service"; and
  • (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or
  • (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. (This is generally implemented as a notice and takedown procedure - it need not be external facing, but, once notice is received within an organisation (be it as a result of third party notification, or someone moderating a forum etc.), the host is obliged to remove the content, or else face being liable for its distribution / publication etc.

In Europe, at least, it's not a particularly effective system, to my mind, since (a) it encourages hosts to take stuff down without any form of validity / proportionality check (i.e. it enables abuse, and the ensuring "chilling effects" - a host is incentivised to act on a notice from a rightsholder, even if the use of the work in question is fair dealing etc., rather than run the risk - and costs - of ligitation), and (b) some jurisdictions are interpreting it very narrowly (for example, the Tiscali case in France, held that, by virtue of operating a website design tool, the hosting service offered by Tiscali did not "consist of the storage of information", but rather more, and so Tiscali was unable to benefit from the directive's protection), rather than giving effect to the intent of the directive, which was to promote the existence of information society services.

Re:Terry Childs was NOT an IT pro

[hagiwhat]

thanks for posting..

Re:Terry Childs was NOT an IT pro

[BorisAmmerlaan]

Even though they might get a lesser sentence, they have historically been held just as responsible. There is such a thing as moral obligations. If you do not agree with a certain order you (should) have the right to be a conscientious objector.

Yes, you should. When you are faced with this kind of moral dilemma however, you usually don't have the option. Well, you could sacrifice yourself, I suppose...

The Nuremberg trials obviously codified this: "The fact that a person acted pursuant to order of his Government or of a superior does not relieve him from responsibility under international law, provided a moral choice was in fact possible to him".

Which indicates that the person following orders will always remain somewhat responsible, not necessarily just as responsible.

Re:Terry Childs was NOT an IT pro

[Anonymous Coward]

He was a petulant child.

I know you are, but what am I?

Licensing

[CaptSlaq]

It's such a gigantic PITA to track all of the licensing for everything that I weep for any small to medium sized shop that can't afford to have a dedicated person/dedicated people for it.

Re:Licensing

[h4rr4r]

The solution to that is to not buy such software.
If it is not free or simply licensed, just do not use it.

Re:Licensing

[Dr Herbert West]

I can't tell you how many shops I've worked at where it was obvious that all the software was cracked. My favorite was a print vendor who would encourage his staff (college interns) to "bring in" some of their school software/plugins to "test in a real-world environment". Anytime someone had to send a job to print, all the workstations would have to be disconnected from the network or else there would be licensing conflicts with all the cracked warez. This was more than a decade ago, and the vendor in question has been out of business for a long time. Scumbag-- everything he did somehow reeked of illegality.

I remember I came in once (this was right after I started) only to find the entire staff (except the interns) had quit without warning. Everyone from the production managers to the secretaries-- gone. I soon followed, natch!

Re:Licensing

[toastar]

The solution to that is to not buy such software.
If it is not free or simply licensed, just do not use it.

... tell that to my boss.

Re:Licensing

[Actually, I do RTFA]

The solution to that is to not buy such software.

If it is not free or simply licensed, just do not use it.

If your word processing and checking your e-mail, fine. But some of us have real jobs. Jobs that require using the same tools as your customers, or simply access to specific applications.

Re:Licensing

[h4rr4r]

That is your job. You are his technical resource.

Re:Licensing

[h4rr4r]

In that case good luck. I offered a solution, not every solution will handle every use case.

If you have to use a specific application to do some task, you had better hope that company survives forever, cause they have you by the short and curlies.

Re:Licensing

[Anonymous Coward]

What's more interesting is in the little time after you started they didn't even bother to tell you what they were doing.

Speaks volumes my man.

Re:Licensing

[Brandee07]

Your job is to keep his copy of Microsoft Office working, not to tell him that he should switch to OpenOffice.

In my limited workplace experience, if you answer "Fix my software" with "Use this other software instead," you will either be ignored or fired. (I found myself ignored, but instilled with a profound desire to not attempt to be helpful again.)

Re:Licensing

[h4rr4r]

No, my job has no MS software involved. Helpdesk can go handle that.

We as a company have moved all non-managers over to openoffice. Money talks.

Re:Licensing

[Sponge Bath]

You are his technical resource.

Jeez, nothing dehumanizing about that title.

Re:Licensing

[Anonymous Coward]

Your job is to keep his copy of Microsoft Office working, not to tell him that he should switch to OpenOffice.

In my limited workplace experience, if you answer "Fix my software" with "Use this other software instead," you will either be ignored or fired. (I found myself ignored, but instilled with a profound desire to not attempt to be helpful again.)

Depends on how your phrase the question. Say "Switch to OpenOffice" then you've already failed. Talk about reducing company wide 10-year Licensing Fees by 100% and you have them hooked. IT has no place for ideals sadly, so I just sell them at their game.

Re:Licensing

[ultranova]

The solution is simple: use only GPL- or BSD-licensed stuff. Problem solved.

Using proprietary software at all is asking for trouble.

Re:Licensing

[jimicus]

I agree, but I'd go further - and my comments apply equally to free and commercial software.

We're a small shop and part of my job is to keep on top of licensing. After doing this job for some years, I have reached an inevitable conclusion.

You are not supposed to get it 100% right. Indeed, you are being set up for failure .

While some licenses are fairly straightforward, enough of them are sufficiently complicated that it is wholly unrealistic to expect any organisation to be entirely perfect. Whether this is by accident or design I wouldn't like to say, but I am dead certain that there is no organisation on God's sweet earth that would come out of a BSA audit without at least something wrong.

Re:Licensing

[HeronBlademaster]

I worked at a place where they had N licenses for $EXPENSIVE_PROCESSING_SOFTWARE. This software was business-critical. In order to meet processing demand, this software was installed on at least 3N machines... including all our desktops.

Plus most of the computers were running "legitimate" ("it's just a backup copy of our volume license disc", he promised) copies of Win2k and MS Office. At least the data servers were running Linux...

I did my best to avoid license violations while I worked there. I used my own laptop (until he banned it) for Windows-specific things (as far as I'm aware, the business-critical Win3.1-era software we used regularly was actually legit), and ran Linux on my work desktop for everything else.

Re:Licensing

[chrpai]

The solution to that is to not buy such software. If it is not free or simply licensed, just do not use it.

... tell that to my boss.

Simply buying less software doesn't solve the problem. I work in a development environment where sdk's, runtimes, libraries and so on that we don't "buy" are the hardest technologies to keep track of in terms of license compliance.

Re:Licensing

[24-bit Voxel]

I've seldom worked at a place that didn't pirate software. From fortune 500 to mom and pop shop, they all do it. The annoying part is I actually purchase mine, and in 3D that's not cheap. Ive spent easily 30K in the past 3 years keeping 'legal' with my software only to be underbid by these pirate shops. Now I am contracting at one because I can't win a bid against these pirates as their overhead is much lower than mine because of this.

My favorite part is negotiating my rate for a contract and I stipulate that it's cheaper if I can work from home because I have full support of my fully paid for software. They almost never get it at first, but when I mention my one caveat of not supporting or bug fixing/debugging scenes made with pirated versions. That wakes them up every time. Mostly because the first two weeks are at a preset lower rate while we get used to eachother. Only after those two weeks I am privy to all sorts of info (such as pirating) and then they are often afraid not to hire me in case I rat them out. It's a shitty system with a couple perks.

Re:Licensing

[changa]

This is one reason where I love the fact that Adobe has gone to activation so I can say:

"Sorry you can't have photoshop as we are out of activations.  Talk to (X) to get them to buy you a copy."

Office workers that just need to crop a photo does not need photoshop.

Re:Licensing

[Mr. Freeman]

"In my limited workplace experience, if you answer "Fix my software" with "Use this other software instead," you will either be ignored or fired."

As you should be. The solution to "I need to open this document so I can display it at a meeting in 10 minutes. I tested it yesterday but it's not working now." is not "go install other software and get that working, then try to unbreak all of the ms-specific formatting that OO.org can't handle".

Sure, as the IT guy it's your job to suggest that the company make a switch to whatever you believe will work better than the current situation, but it's not a place for you to push your ideals and certainly not during a time-critical situation.

Making the suggestion to switch to linux when your company depends on MS-only applications that have no open source equivalent is just fucking stupid. Making the suggestion to switch from MS office to OO might be a good idea, but not when you need twenty .doc files opened up for a meeting in ten fucking minutes.

There's a time and a place for everything, your office generally isn't it.

Re:Licensing

[Surt]

But the further you get from 'Emergency snack', the further you get from an honest assessment of reality, so given how much nerds like to keep things real, you have to find a balance.

Re:Licensing

[bickerdyke]

Don't use N... that sounds too much like a countable, natural number.

It's usually more like: We have N employees, each of them has at least one workstation, plus 0 to M old/test machines under his desk. Half of those secondary machines have been reinstalled once or twice, again half of those re-installs included an OS upgrade. Those were done using the OEM licences included with the new primary machines, as on those primary machines software licencsed by the companys volume licence has been used.

Now triple that for OS, Office and the software you're doing your actiual work with. (probably MSDev or some CAD or whatever.)

As a bottom line, you may know how many licencses you have in your volume licence, but won't know how many licences came bundled or not bundled with the hardware. And you won't know how many you actually need..

Re:Licensing

[bickerdyke]

...or a software licenced per concurrent user,controlled by a dedicated server.

Re:Licensing

[Luke has no name]

Or network monitoring, or running a call center, or running any kind of website, e-commerce business, or accounting, etc..

The only places where I personally have seen open-source be woefully lacking is in the engineering fields. Most general business and IT-oriented tasks have a capable open-source commercially backed component. Managers and others who don't "get" FOSS think "Free? I'm not getting anything, because I'm not blindly throwing money at a vendor!"

Re:Licensing

[Anonymous Coward]

I found myself ignored, but instilled with a profound desire to not attempt to be helpful again.

Perhaps you got ignored because you get petulant when you don't promote your own ideas well enough.

Re:Licensing

[Anonymous Coward]

Plenty of the expensive software come with a license manager. They are intended to prevent piracy but they also make tracking and managing licenses really easy. This is the one time copy protection comes with some benefits.

Re:Licensing

[Zak3056]

...or a software licensed per concurrent user,controlled by a dedicated server.

Even this doesn't always save you. For years, we've been running various engineering software from Bentley, who provides a license manager called SELECT Server for concurrent usage. Up until 2006 or so, it worked exactly the way you would expect it to--upon consuming all available licenses for $PROGRAM, it would inform the user that no licenses were available and disallow usage.

One day, they changed that behavior, and now usage is effectively unlimited--the SELECT server is merely an audit tool. When you exceed your license count, it still allows the user access, and logs an overage. Bentley claims this is for "user convenience" ("It's much better to allow the user access since it cuts down on frustration") but their sales reps will call you periodically claiming you have license problems, because you're exceeding your authorized usage "("You only have 8 seats of $APP, but you had 11 people using it at one point last month... I'll send you over a quote to resolve this ($TENS_OF_THOUSANDS)).

It's fairly sickening.

Re:Licensing

[John Whitley]

If it is not free or simply licensed, just do not use it.

That's an amazingly ignorant statement. Computers and the software that runs on them are just tools. These tools are evaluated based on a collection of merits. Licensing concerns are just one of many factors that influence decisions to adopt a particular software system. Compatibility, up-front costs, ongoing costs, and suitability to task are some important others.

In many cases there exists exactly zero FOSS software systems that satisfy certain application needs. We're not talking about boring stuff like MS Office vs. Open Office, either (and even that can't pass muster in many organizations). Examples of verticals where FOSS systems are weak or nonexistent include: scientific software systems (very hit or miss; some outstanding FOSS projects in scientific verticals and some huge voids), machine control, color-managed print workflows, just off the top of my head. There's a world of other examples. In some cases, open source solutions exist but simply aren't up to the standards of the competition and the organization's needs.

In the end, it's never really a matter of "FOSS or die". It's always a positive choice to solve the problems that need solving, using the available tools. If FOSS tools aren't even available, then they aren't a choice. Even when they are available, they may not measure up as the best choice, at least to anyone who isn't playing FOSS zealot.

Re:Licensing

[zcubed]

Point me in the direction of free Computer Aided Dispatch software for 911 dispatch centers.

Re:Licensing

[nametaken]

There's truth to this, but there's a trick to it. A switch to OpenOffice is pretty much always a poor suggestion unless you work for a small mechanic shop or something. Any business workstation user would insist that it just isn't as good as MS Office. Of course plenty people here would disagree, but getting down to long-winded techie arguments is ultimately irrelevant to what users would think. Workplace opinions count. A lot.

I have had good luck recommending various free (and some OSS) solutions though. It's just all about picking your battles wisely. Many of the free Google apps go over well. Well polished little apps like Paint.Net go over well. Linux systems for server functions are often an easy sell because they don't have to see anything weird. There are a number of apps that you can get acceptance for if you present them properly and choose wisely.

You just can't go straight for the heart and take their MS Office 2010 + Outlook and Exchange. That's a recipe for disaster.

Re:Licensing

[Anonymous Coward]

Microsoft's KMS will dish out as many activations as you request. It is not limited to how many licences you pay for. Likewise MAK has many more activations than licences you paid for. However KMS won't report back to Microsoft. They do give you the VAMT to try and audit activations.

Re:Licensing

[Trogre]

That's a shame for you. I guess your boss was a lot less rational than mine.

Re:Licensing

[darkpixel2k]

...or a software licenced per concurrent user,controlled by a dedicated server.

Yeah--but then you run into the shitty software that does something like "INSERT INTO CurrentSessions WorkstationName VALUES ('BILLS-PC')"...and when the application crashes, there's no delete. So you have to call the vendor to get a special 'unlock' password to clear that crap out of the database (if you're the kind of person that doesn't know SQL)... It's so much easier when software companies don't treat their users like criminals--because the criminals don't care, and the users are the ones jumping through all the hoops.

Re:Licensing

[bickerdyke]

It's fairly sickening.

Yes.

But at least you have a clue about how many licences you have, and how many you need.

But it would be fair to either optionally block overusage ur give the user a big, fat warning label. "Login in will cause overusage".

OTOH, some shops may prefer a more flexible pay-as-you-use model.

Re:Licensing

[bickerdyke]

You just can't go straight for the heart and take their MS Office 2010 + Outlook and Exchange. That's a recipe for disaster.

No need for that. That combination gives at least some added value over the single components.

But how often do you see people insisting on outlook without exchange backend? The only thing they get then is a bloated email client.

Re:Licensing

[Anonymous Coward]

In my limited workplace experience, "Fix this damn ribbon thingy" translated to "Use this other software instead" very smoothly and all were happy (except maybe MSFT, who didn't get a sale from the 60-day trial version). The users, frankly, don't give a damn what they're using. They want their documents and spreadsheets and presentations, not wrestling with this week's UI gimmick.

Re:Licensing

[batistuta]

No, that's not a simple solution. It is an alternative to *some* problems. Very often you don't have a GPL or BSD alternative to commercial software. CAD design is one example. Professional video editing is another one.

Plase don't give out your religious views about open source as universal solutions. Pleople will buy it once, and after hitting their heads on the wall will stop listening to you.

Re:Licensing

[tebee]

Now I am contracting at one because I can't win a bid against these pirates as their overhead is much lower than mine because of this.

But if we carry this to it's logical conclusion does' that mean that eventually all businesses who license things legitimately will be unable to compete, therefore get no work and go bust. So the only people left are the Pirates so the software companies all go bust too.

Or maybe just the whole of the US will go bust and all the work will flow to those counties with a laxer attitude to copyrights.

Re:Licensing

[Hognoxious]

The solution to "I need to open this document so I can display it at a meeting in 10 minutes. I tested it yesterday but it's not working now." is not "go install other software and get that working, then try to unbreak all of the ms-specific formatting that OO.org can't handle".

That problem can be caused by having the "wrong" version of Word. In that case the solution is to install other software, where "other software" == "the right version of Word".

Good luck getting hold of a legitimate and safe copy in ten minutes...

Re:Licensing

[Anonymous Coward]

Licensing is easy. Use GNU and other FLOSS software. Simple.

If you use commercial software, demand that those vendors provide network-based licenses that enforce their licensing. I've written commercial software and implemented network licensing. It isn't really that hard. Honestly, we implemented OUR license, but weren't able to implement the license for some of the 3rd party tools embedded in our product which had per-install licensing, not concurrent user.

Re:Licensing

[Anonymous Coward]

dumbass

You won't learn anything from my explanations, so I won't bother... so just go back to sticking your head up M$ofts ass and breathe the sweet smell of your money going out the door for no good reason.

Re:Licensing

[Anonymous Coward]

Bullshit!

I've been repeatedly assured by massive numbers of pirates that their thieving ways never hurt anyone and in fact, they've done you a HUGE favor!

I would prefer if you just said, "thank you", to the pirates and moved on.

Re:Licensing

[SirGarlon]

Well that is the strongest argument in favor of free software, isn't it?

With free software, you have to pay for support and the non-trivial cost of training, setup, and administration. With paid-license software you also have to pay all those costs plus the added non-trivial cost of administering the licenses. So it boils down to whether you think the cost of managing the licenses is negligible, or not (and whether you think support and training are better/cheaper for FOSS vs. proprietary software).

I am happy to say we get to use a lot of FOSS at work because my manager agrees with me, that spending a lot of my time to maintain the license server and police the licenses is a bad investment. He also agrees that violating the license terms (what some would call "piracy") is both an unacceptable risk, and an unethical business practice. :-)

Re:Licensing

[GooberToo]

No. That's not the logical conclusion at all.

Many things work on a basis of scale. In theory, once you've reached a certain level of income, the cost of software versus income becomes so proportionally small, its no longer a critical cost on the bottom line. Therefore, the logical conclusion is, small companies are forced to steal to be competitive with other companies who are more than willing to steal. And only after the company reaches a critical level of income can they consider becoming legitimate.

Which likely means, the companies which supply the software are far more likely to either see considerably smaller growth, which harms the overall economy, or will go bankrupt waiting for these pirate companies to reach the point where they can cost effectively purchase the software.

In a nut shell, the conclusion is, stealing hurts the economy. Piracy is bad for everyone who is interested in participating in the economy.

Re:Licensing

[Anonymous Coward]

In my industry(financial) I haven't seen any significant pirating of software since the .com boom. I say significant, because developers with admin rights sometimes veer off the road a bit, but that is pretty rare, and often I think they just do it for the jollies of it or to avoid the bureaucracy- and they often get caught. Even at a 10 man shop I was a part of, we were on the straight and narrow- though I must say that was at least in part because free or open source alternatives existed for just about everything we needed.

At the larger shops I have worked at, it is very difficult to install any program not packaged and managed by the firm, and even harder so to keep it working after a reboot. I am not sure where you worked, but I would be interested to hear.

The one shop I worked at that pirated with reckless abandon was a small ~30 man software consulting firm around the .com boom. I confronted my manager about it when I was an intern (I was the pc guy, among several other things) and he kind of shrugged me off and said they were following the spirit of the license, if not the letter- IE because they bought a few shrinkwrap boxes of software, they had the right to install it on each and every person in the firm's machine, and since they would never be using all those copies of software concurrently, they were on the straight and narrow. I was uncomfortable with this, but I liked the firm and the job and never really pressed the issue. They probably went on the straight and narrow the way most dev shops seem to these days- by using open source or free alternatives. Jbuilder->eclipse, oracle->mysql, exceed->putty, you can even get a decent version of visual studio for free these days.

Re:Licensing

[nosfucious]

First lesson: Developers never run with Admin rights.

Give your users admin rights before you give your developers admin rights.

Re:Licensing

[Actually, I do RTFA]

The only places where I personally have seen open-source be woefully lacking is in the engineering fields

Or software development (developing for Windows/OSX while on Linux?). Or video editing. Or 3D modeling. Or graphic design.

You're right in that I only focused on the client side of things... obviously OSS is great for the server-side. But all the examples you brought up seem to be either server-side or rely on in-house software.

Most general business and IT-oriented tasks have a capable open-source commercially backed component. Managers and others who don't "get" FOSS think "Free? I'm not getting anything, because I'm not blindly throwing money at a vendor!"

Actually, the biggest problem is that people already know how to use the non-F/OSS. Photoshop maintains it's dominance because most of the good graphics designers use it, and so most shops use it, and so most schools teach it, and so most good graphics designers use it...

The cost of training vs. forking over money to Adobe means that Adobe gets paid.

And that's without going into if GIMP really is everything a graphics designer needs. It's everything I need, but I am not a graphics designer.

Re:Licensing

[Fulcrum of Evil]

Great, now I need to call the helldesk to install my dev software. Good thing I can get debug privs separate from admin access.

Re:Licensing

[Anonymous Coward]

So you're saying a BSA audit is like getting your car inspected?

That was for the people who need a car analogy, of course.

Re:Licensing

[Anonymous Coward]

There are still a huge range of situations where the oss equivalent program can not do the needed task.

Since you used MS Office versus Open Office I can give you an example from work. Open Office can not import certain txt formats into Calc without massive amount of reformatting. Excel does not have this issue. It takes an additional 16 hours of work every month to use Open Office in just this one instance.

In the real world you pick the tool that does the job the best.

Re:Licensing

[Actually, I do RTFA]

In that case good luck. I offered a solution, not every solution will handle every use case.

Leaving aside that you called it "the solution", it doesn't count as a solution if it doesn't work. And your solution simply fails on most use cases. But beyond that, it was pretty arrogant.

It fails when the software doesn't exist, it fails when the user interaction model is too different from the old thing it is replacing. I want F/OSS to succeed - but that really means that someone has to take steps to make it pallitable, not merely insist it would be great.

The sad truth is, except for server applications administered by technical people, most F/OSS is not business ready.

If you have to use a specific application to do some task, you had better hope that company survives forever, cause they have you by the short and curlies.

Or that you have a source escrow account set up. Or that your license says in the event of dissolution of the supplier you gain infinite licenses. Or, well, there are numerous ways of handling this.

Re:Licensing

[l0b0]

Who has ever worked as a developer without admin rights without going crazy? I mean, unless you're working with Windows application programming, in which case you have pretty much one choice for IDE, why would you ever let yourself be constrained to the handful of apps that some random assembly of developers and/or managers have sanctified? I have a script to install all the software I need - It's some 40 packages, takes about five minutes to install, and covers everything from PNGCrush to Eclipse. I probably install on average two packages per day, if only to do some one-time task or check if it's a better alternative for something else. Not having admin rights would be like those developers (they do exist) who never use power tools because they might "stop working" suddenly and then they'll need to work in the equivalent of Notepad while the sysadmins restart, reboot, and/or reinstall.

How IT Pros Can Avoid Legal Trouble

[Michael Kristopeit]

not post in this thread.

Re:How IT Pros Can Avoid Legal Trouble

[Anonymous Coward]

Peter S. Vogel Has escaped from Volgon 6. Alert Volgon high command.

Terry Childs the new Mitnick?

[bsDaemon]

Are the same people claiming that Childs is some sort of mis-understood hero the same people who had "Free Kevin" schwag back in the day? If not, I'm not sure I get the mentality, because from what I know of the situation (maybe not enough), he did sort of grossly overstep the bounds. Maybe he didn't deserve jail time, but I'm not about to go emulating my career after him.

Re:Terry Childs the new Mitnick?

[FooAtWFU]

Whether Childs was ultimately right or wrong, I think the case *did* highlight concerns that "judges and juries are often not technically savvy enough to understand what IT pros do." So. There you go.

Re:Terry Childs the new Mitnick?

[Anonymous Coward]

Umm no. I disagree entirely. Are we forgetting there was a network engineer on the jury? Seriously? This is exactly the sort of thing that SHOULD happen. A jury of his "peers!"

It was described to the engineer, and he was the de-facto explainer for the group, but seriously Childs was working for the gov't too long and had too many bad habits of "fiefdom" creation that are everywhere in city and state organizations. He created a world, then he took the keys away from everyone and didn't give it up. He's not the first, nor will he be the last, but the lesson here should be to all comers "hit by bus strategy... always." Otherwise, things that together could be suspect or could be best practice BECOME suspect without a backup and recovery plan.

And no, an encrypted that's tattoo'd to an admin's ass doesn't count. Especially if there's a likelyhood of a flame thrower being involved at some point.

Re:Terry Childs the new Mitnick?

[phantomfive]

Really? One of the members of the jury was an 'IT pro.' It may be true that often judges and juries are not technically savvy enough, but I don't think that case was a very good illustration of that point.

Re:Terry Childs the new Mitnick?

[bws111]

Why is it a "concern" that judges and juries don't understand what IT pros do? Judges are supposed to understand the law. Period. Juries are supposed to be unbiased. Period. Is it a "concern" that judges and juries don't understand what police detectives do? Doctors? Hospital ethics boards? Accident reconstruction experts? Corporate officers? Accountants? Fund managers? Etc, etc. If the judge or jury needs to understand any of those things it is up to the parties in the case to educate them. There is nothing special about IT that makes it any more or less difficult to explain than anything else.

Re:Terry Childs the new Mitnick?

[XanC]

That network engineer, IIRC, said here something to the effect that he didn't think Childs had any criminal intent, and that he was doing what he thought was right for the city. The only reason for the conviction was that the letter of the law appeared to be against him.

This was a case where a fully informed jury should have acquitted, but unfortunately juries are not fully informed. A jury has the right, nay the responsibility, to judge the LAW as well as the FACTS.

Basically, put yourself in Childs' situation. You did what you thought was right. (Let's assume that's the case, since I believe that's what the juror said.) Wouldn't you hope that somebody would inject some common sense at some point rather than robotically reading the law?

That's why we have juries. But judges tell them all they can do is robotically read the law. It's awful.

http://fija.org/

Re:Terry Childs the new Mitnick?

[spire3661]

Good intentions rarely excuses malfeasance and is usually non-exonerating. You can have the best of intentions and still be found guilty. The law does take intent into account, but it isnt a free pass.

Re:Terry Childs the new Mitnick?

[XanC]

It certainly can be, depending on the situation. Especially in cases where the law and the situation are both so convoluted, like this one, that the defendant had no reasonable way to know ahead of time that he was committing a crime.

If it takes the jury more than a half hour to determine that a crime was even committed, and the defendant was in good faith attempting to fulfill all his obligations but struck a different, but still reasonable, balance from the one the jury would have picked, I don't see how anybody can possibly convict.

Re:Terry Childs the new Mitnick?

[MightyMartian]

Childs was a petulant prima dona with delusions of grandeur, and he paid the price, and so it should be. I know some folks seem to want to make the guy some martyr, but he was a complete twit, and I wouldn't hire the guy to wipe out floppies, let alone manage a large network. Not because he isn't skilled, but because he's a self-important ass hat.

Re:Terry Childs the new Mitnick?

[tool462]

Nonsense. The things I do are difficult, challenging, and require a vast intellect to understand. The things everybody else does are so simple and obvious a child could do them. /me removes tongue from cheek.

Re:Terry Childs the new Mitnick?

[_Sprocket_]

Are the same people claiming that Childs is some sort of mis-understood hero the same people who had "Free Kevin" schwag back in the day? If not, I'm not sure I get the mentality, because from what I know of the situation (maybe not enough), he did sort of grossly overstep the bounds. Maybe he didn't deserve jail time, but I'm not about to go emulating my career after him.

Mitnick's following wasn't because he was a swell guy. It was an issue of overzealous prosecution and inappropriate detainment (i.e. a belief he could launch nuclear missiles by whistling in to a prison pay phone). In the end, he was little more than a white-collar thief and con-man who was reported as being, and consequently treated as, a supervillian master-mind. Some people took offense to that.

Childs is interesting in a lot of ways. He's been portrayed as a criminally-minded digital tyrant holding a city hostage. And he's been portrayed as both genius architect and lone defender of the network fending off a horde of incompetence and mis-management. As the dust settled, I began to suspect that the truth lies with a combination of those two portrayals (although perhaps not the whole of them).

My first reaction was to think that Mitnick and Childs are entirely different cases. But as I think about it - there is at least one similarity; both involve an overzealous prosecution. The cases garner sympathy because many of us find ourselves in environments where what we do isn't well understood. We deal with incompetence and ignorance on a frequent enough basis to give us pause. And it is easy to look at these cases and ponder whether there but for the grace of God go us.

Re:Terry Childs the new Mitnick?

[david_thornley]

From what I gathered, Childs (a) broke the law, (b) didn't do the right thing (specifically, the city was in real trouble if he got hit by a bus), and (c) tried to run away, suggesting he thought he'd be in trouble.

Lack of criminal intent and good intentions go only so far in mitigating breaches of the law, and my common-sense injection would have been that Childs had gone over the line and should be convicted. Had Childs provided for the possibility of his sudden demise, I'd feel a lot better towards him, and I'm not at all sure he'd have been convicted.

Re:Terry Childs the new Mitnick?

[Itninja]

Childs was a petulant prima dona with delusions of grandeur....he's a self-important ass hat.

I don't think any of those things have 'price' to 'pay'. In fact, toss in ambition, and you have a nearly perfect description of the traits needed to be blindly successful (professionally anyway). I am pretty sure he 'paid the price' for being a scofflaw and (eventually) a convicted felon.

Re:Terry Childs the new Mitnick?

[Anonymous Coward]

http://en.wikipedia.org/wiki/Mens_rea

Re:Terry Childs the new Mitnick?

[Anonymous Coward]

The only reason for the conviction was that the letter of the law appeared to be against him.

then that jury failed in its duty to set precedent against bad law.

Re:Terry Childs the new Mitnick?

[Anonymous Coward]

There is nothing special about IT that makes it any more or less difficult to explain than anything else.

Yes there is.

IT is harder to understand than most other professions.

Re:Terry Childs the new Mitnick?

[Anonymous Coward]

Why is it a "concern" that judges and juries don't understand what IT pros do? Judges are supposed to understand the law. Period. Juries are supposed to be unbiased. Period. Is it a "concern" that judges and juries don't understand what police detectives do? Doctors? Hospital ethics boards? Accident reconstruction experts? Corporate officers? Accountants? Fund managers? Etc, etc. If the judge or jury needs to understand any of those things it is up to the parties in the case to educate them. There is nothing special about IT that makes it any more or less difficult to explain than anything else.

And I'm sure you want a public that's more susceptible to emotional stories than hard scientific evidence judging the autism/vaccine lawsuits too, don't you?

Re:Terry Childs the new Mitnick?

[bm_luethke]

Those are two very different cases - I'm one that felt the "Free Kevin" idea was the mostly correct one but Childs was an idiot and deserved what he got.

The issue with Kevin Mitnick wasn't what he did - very few people would have argued that what he did wasn't illegal and deserved punishment, the argument was what I would consider civil rights violations. One was the amount of time from his arrest to his final trial (and his plea bargain) was *enormous*. The people in charge of his trial were either so incompetent as to warrant criminal charges against them or they were doing it intentionally (my guess is intentionally - part of the furor against him was personal feelings). Because of a severe lack of technical knowledge some people who would have fought and stopped his treatment let it happen (long term isolated confinement for one thing). The prosecution - successfully - argued that as a hacker he could get angry, hack into the military's computers, and start a nuclear war so he had to be isolated. Much of the case is like reading the insane BS that RIAA claims about damages. I do not think he would face the same situation today due to increased knowledge of that type of crimes - probably similar length terms but not solitary confinement and some of the other insane punishments.

I guess I didn't figure he should have been "freed" - the guy clearly was a as much a thief as someone who physically broke into your house - but the punishment was above beyond simply because he did it with a computer.

Childs, OTOH, was not given extraordinary punishment. There were technical people on the jury and today most people can fathom what happened well enough to make a decision. Again, it being a computer should have no difference and if you did something similar (refuse to give your ex-employer access to their property because you felt they would screw it up) you would have gotten a similar sentence. We can certainly argue if you should be able to withhold items from your ex-employer if you think they are too incompetent to use it (though my general bet is that outside of a number on here on Slashdot that isn't going to go far), but it wasn't controversial in the same way Mitnick was.

Mitnick truly highlighted people not being technically savvy enough, Childs (along with a few others such as Hans Reiser - even after his admission and taking the police to the body mroe than a small handful *still* thought he was innocent) mostly highlights how some people will rally around people they view as in their social circle more than anything. That is more a human nature issue - pretty much any highly specialized group you are in will most likely have a sizable contingent that tries to protect their own from things they would crucify another for.

Re:Terry Childs the new Mitnick?

[slashqwerty]

Police and doctors are in the news and on TV all the time. Most people interact with doctors frequently. Many people interact with the police as well. That may not tell a person how doctors and police do their jobs but it is a pretty good start. Ethics boards are made up of people from the community. The job is pretty self-explanatory.

Accident reconstruction experts tend to be expert witnesses. It is not often that they are on trial for committing a crime on the job. They also tend to be well-trained and follow clear well-established guidelines.

You are correct that the other fields are not very well understood by juries. That is one reason it is so hard to hold corporate officers, accountants, and fund managers responsible for white-collar crime. The issues have been litigated, the weak points of the law are well-known, so that's where fund managers, et al focus their exploits.

Hard-sciences are different. People view hard-sciences as having the answer. When someone is accused of doing something that doesn't work out well people assume the suspect knew what was going to happen and that the suspect's intentions must have been malicious. People have been taught that computers are deterministic machines so IT is put in the category of a hard science.

From another perspective, there are few fields where someone can become an 'expert' from a four-hour class. IT is one of those fields. The police will send an officer off to a class to be trained on how to use EnCase. Since most people use computers in their day-to-day lives and since computers record information so well this so-called 'expert' will incriminate all kinds of people on shabby evidence. Few defendants can afford a real expert to counter the police so juries are left with little to go on.

Re:Terry Childs the new Mitnick?

[Anonymous Coward]

Why is it a "concern" that judges and juries don't understand what IT pros do? Judges are supposed to understand the law. Period....There is nothing special about IT that makes it any more or less difficult to explain than anything else.

Except that IT is the glue of American society. It is little understood precisely because nothing --even medicine, is as new and simultaneously obsolescence prone as this field is.

Guns need control laws. IT is still largely uncontrolled and run by idiots who we all work for. While Lawyers are still trying to "figure out" IP law, software patents, ownership and the ethics of access point sharing and borrowing, society is too apathetic to wait for them. IT has no other answer than to appeal to individuals and constantly change with them until lawyers deem things illegal. Remember that information technology in the music download aspect went from underground, to napster lawsuits, to "i'll claim i bought the cd and ripped under fair use" and "rip, mix AND burn now with the new Apple Mac!111" and eventually shifting the entire industry to allow iTunes to exist, sell and prosper with it (ignore remaining piracy for now.)

Before this year, it's probably been decades since anyone saw the banking industry, pharmacy industry and health insurance industries in the US have major legal overhauls: laws there are well cooked and clearcut, and lawyers have digested the letter of the law. Barring the blatant stealing that took the world into this recession, those important fields normally ONLY affected people dealing with banks, legal drug trials/failures/recalls, medical coverage and insurance fraud (separately, of course.)

On the other hand, IT's ramifications reach you even if you don't care that your cellphone, tv, gps, storage, office computers, doctors' office records, power grid, mail system, etc requires constant maintenance and hardware redesign or replacement --your body may be on pills, but that's monthly; mechanics and emergency services rarely see YOU directly. IT needs dedicated staff fixing infrastructure running government data, armies, news, climate or research supercomputers, phone networks... evaluating the latest OSs and patches, upgrading to faster networks, securing Wifi and persecuting website hacks and obcene/illegal content posters, and corrupting the web with more flash content. Businesses ignoring IT bite the dust to more IT-conscious ones like Google get bought out by larger ones that do.

Don't trust me that IT transcends our outdated laws? The most common problem we hear business phone operators use as scapegoat is not human failure --that would require penalties! ANY field giving you phone customer support will give you a tech calling "system down/system slow today" as something creating inconvenience in the same way tornadoes can't be humanly stopped. Said reps and secretaries never have a "backup" non-affected system to save you with, yet money is potentially going down the drain for every wasted minute a broken IT resource causes. We could not place "computer trouble" blames 40 years ago --everything was done on paper and laws didn't need to address our current-day superpowers and IT supervillains. That's important enough to create new problems, confusion and abuse... and merit new laws or fine-tuning old ones to fix that.

Re:Terry Childs the new Mitnick?

[sjames]

Except in the more extreme cases of negligence, intentions SHOULD make a huge difference in law. If nobody is actually harmed, then exoneration should be the result. That was once understood by requiring criminal intent for a law to be violated.

One purpose of juries is supposed to be so they will put themselves in the defendant's shoes and hopefully not convict if they realize they might have done the same thing or wouldn't have known what the right thing would be to do.

It is unfortunate that there is so much emphasis on robotically interpreting the law and the facts these days. When juries go along with that, they bring the police state palpably closer.

It is simply not possible to write a law that justly covers every corner case. When the law isn't quite right, the benefit of the doubt must go to the defendant even if they are technically guilty.

Obvious

[Locke2005]

Change jobs.

Re:Obvious

[yincrash]

Of course, why didn't I think of that sooner?!

Re:Obvious

[Anonymous Coward]

That was my answer. As a DBA at a company that handled credit card transactions I could see where our internal application could easily be fooled into spilling its very valuable guts. After pointing this out to Mgt. and having it verified by an external auditor, they refused to fix. I'm not voluntarily sitting on that kind of time boom so I left. They haven't been hacked yet, they may never be. But it's not my problem now.
AC

Re:Obvious

[Anonymous Coward]

Steve wont step down, else we could!

[/fanboi]

Re:Obvious

[Anonymous Coward]

like the company that can't switch away from badly licensed software due to management idiocy, the average employee has financial obligations of his own. he can't simply quit every time his boss asks him to do something some law does not allow. this is especially true when the current state of affairs basically demands that every 'IT pro' have a fucking masters in law. it's not reasonable at all. this situation is just another case of the top of the hierarchy passes off responsibility to the bottom tiers, and then passes judgement and punishment.

Re:Obvious

[Locke2005]

Look, you've got 3 choices:

1) Keep quiet and do what they say. In this case, the fact that they only want to discuss it verbally and refuse to leave a paper trail of their orders should be a clue: if anything happens, they are going to hang you out to dry, and you'll need a lawyer and a new job.

2) Complain about the request. In which case they are most likely going to fire your ass for complaining, and you'll need a new job.

3) Quit just as soon as you find a new job.

Note that in all cases, you're going to need a new job, so the instant they ask you to do something you believe is unlawful, you had better start looking!

Re:Obvious

[frank_adrian314159]

Even better, stop before the second step in that process of being re-hired. Potential liability problems... solved forever!

Re:Obvious

[Anonymous Coward]

yeah you're saying that's how it is and I"m saying that's not how it should be.

if the employee is expected by law to say NO, then he should be able to do so without repercussions. Otherwise he is under duress. telling someone he's fired if he doesn't do $ILLEGAL_ACTION when he's got a mortgage and a family to feed is akin to holding a gun to his head. he is powerless because he is now stuck between two entities who have total power over him and who want conflicting things. this powerlessness should grant him immunity to actions done either power's name. Perhaps this is a symptom of a larger problem: law conflicts too much with reality.

1. that's fine, but the liability should rest with those who are holding the mallets over the employee.

2. this wouldn't be an issue if he had immunity. he wouldn't have to complain.

3. so what is the probability that these two events will line up just so? are you serious?

Premeditated murder

[Peach Rings]

I'm a medical equipment technician at a California corrections facility. My boss routinely asks me to kill people in cold blood, and I've been doing it for a few years now... there's a lot of paperwork and everything, but I'm not entirely sure it's legal.

Does anyone else have experience with being ordered to kill somebody as part of their IT duties?

Re:Premeditated murder

[DWMorse]

You get to do what Batman cannot!

Re:Premeditated murder

[DIplomatic]

Does anyone else have experience with being ordered to kill somebody as part of their IT duties?

I... well, it's complicated.

My boss will routinely design intricate dream levels and then ask me to enter the dreams of a rival and extract corporate secrets. I haven't run in to any legal trouble yet but I do have to watch out for the dreamer's projections. They get very hostile if I take to long in the dream world.

Does this help you? I'm sorry... I'm having a lot of trouble focusing right now...

...Have we met before, or was I dreaming??

Re:Premeditated murder

[cosm]

I'm a medical equipment technician at a California corrections facility. My boss routinely asks me to kill people in cold blood, and I've been doing it for a few years now... there's a lot of paperwork and everything, but I'm not entirely sure it's legal.

I can't tell if your're trolling or serious. Are you responsible for the lethal injection equipment? Or are you Therac-25ing cons to oblivion during simple 'treatment' procedures? I guess the key piece of missing information is the 'medical equipment' in question.

Re:Premeditated murder

[Thinboy00]

I read that as suggesting the "people" are in comas or worse, but whatever.

Re:Premeditated murder

[Surt]

When I had to do that, I couldn't live with the moral qualms, so what I did, I hooked up the kill mechanism to a web server, and created this animated ad where if you punched the monkey it would kill the person.

Re:Premeditated murder

[Anonymous Coward]

I'm a medical equipment technician at a California corrections facility. My boss routinely asks me to kill people in cold blood, and I've been doing it for a few years now... there's a lot of paperwork and everything, but I'm not entirely sure it's legal.

Does anyone else have experience with being ordered to kill somebody as part of their IT duties?

All I can say is have fun with it :)...and if you find out what they did (IE: kill people) you can pull a Dexter on them and have some fun watching there reaction when they find out they are going to die

Re:Premeditated murder

[roman_mir]

Well yes, but in our case we have to convince the victim that he or she really has no reason to continue living, then we point out the conveniently located suicide booth. It's cheap too, only 25 cents, even at that cut-throat price some stupid robot just had to use a 'coin on a string' trick. Joke was on him, the machine only pretended to kill him, but he got hurt a lot later.

Blackberry Enterprise Server

[Monkeedude1212]

When someone at work has a blackberry, they are set up on the Blackberry enterprise server, which manages all their contacts and emails and calendar and such.

If they leave, or are terminated, we are told to send the kill command to their BES account. This will delete any emails off their phone AND their contact details. In some cases, a person will be let go - our IT staff will be let known first so their account can be disabled for security reasons. Then that recently laid off person has lost all of their contact details - including Mom and Dad and sweet Great Aunt Gertrude.

We haven't faced any legal suits yet - but it happened a couple times where people have gotten angry. As a precaution - we've started informing people that this happens - so anyone with a blackberry needs to back up their contacts constantly.

Re:Blackberry Enterprise Server

[Anonymous Coward]

Why are your employees using personal BB's on your companies BES? If your company requires mobile access to email, then should the company not be providing them with the hardware to perform this task? That is what the company I work for does. Then there is no gray area, the BB, and its contents are entirely company property.

Re:Blackberry Enterprise Server

[h4rr4r]

Then they can read all your sms or email, even non-work related stuff.

Here we just pay the cost of the plan, and tell people to backup their contacts.

Re:Blackberry Enterprise Server

[Anonymous Coward]

And? its company property and company servers, you really shouldn't be doing anything personal on them anyways. and it doesn't matter if the BB's are the employee's property or the companies, the admins will still have access to get into their mailboxes.

Maintain separate phones for work and personal. When i get home the work phone sits on the desk at home till the next morning when i go into the office. im not paid to be on the clock 24/7. im sure as hell not going to be reachable by the company 24/7. If there is a dire emergency that needs my attention the proper people have my personal number

Re:Blackberry Enterprise Server

[grasshoppa]

If the device is hooked up to a corporate BES server, then they can already read all of your sms / email.

Always better for the corporation to completely own the device, from start to finish, to prevent confusion.

Re:Blackberry Enterprise Server

[Shakrai]

If the device is hooked up to a corporate BES server, then they can already read all of your sms / email.

I pointed this out to a friend that uses her personal blackberry to access her company e-mail. Her response was "So what?" Then I asked her, "Don't you use text messaging to order that dried up plant material that's illegal in all 50 states?"

She bought a droid the very next day.....

Re:Blackberry Enterprise Server

[h4rr4r]

Which is why I just do not use a blackberry. If I am going to have a smartphone it might as well be a decent one.

Re:Blackberry Enterprise Server

[Lunar_Lamp]

its company property and company servers, you really shouldn't be doing anything personal on them anyways.

In many places I've worked (all in the UK) it's been a clear perk of the job that "reasonable" usage of a work-provided mobile phone for personal calls was acceptable.

Re:Blackberry Enterprise Server

[Anonymous Coward]

a device other than blackberry isn't going to protect you, the latest versions of exchange/outlook will also backup the contacts, txt messages, emails from the mobile device. The backing up of TXT messages and accessibility of them though outlook on the desktop is something. I believe this was introduced in exchange/outlook 2010, but maybe in the 2007 version. Im going to guess that likely your WinMo, Android, or iphone is using exchange push mail right?

In the end keep work and personal separate, no good can come of mixing the two

Re:Blackberry Enterprise Server

[jobugeek]

If these are company blackberrys then you are probably screwing up by telling people to back up their contact information. Many times IT departments are informed first, so that kind of information can not be backed up, particularly in cases of sales personnel or anyone who could take those contacts/emails to a competitor

Re:Blackberry Enterprise Server

[h4rr4r]

I do not use exchange nor outlook either.

My android phone is using imap idle for pushmail. We are using a competing mail server product, that is much cheaper and so far much less troublesome.

Re:Blackberry Enterprise Server

[Anonymous Coward]

If they leave, or are terminated, we are told to send the kill command to their BES account. This will delete any emails off their phone AND their contact details.

Not always the best choice. There are some odd cases where information on the blackberry doesn't get synced back to the BES, but you've just wiped it.

It's easier to just remotely change the password on the blackberry, and make sure your IT policy encrypts the contents (which you ought to do anyway).

We haven't faced any legal suits yet - but it happened a couple times where people have gotten angry. As a precaution - we've started informing people that this happens - so anyone with a blackberry needs to back up their contacts constantly.

It's company property. If they are storing personal information on company property, you're on very safe legal grounds.

Re:Blackberry Enterprise Server

[ultranova]

If these are company blackberrys then you are probably screwing up by telling people to back up their contact information. Many times IT departments are informed first, so that kind of information can not be backed up, particularly in cases of sales personnel or anyone who could take those contacts/emails to a competitor

And that actually works?

Were I a salesperson, I would backup all my company issued gear daily, precisely to avoid this kind of problems. Do you perhaps think that actual salespersons are such idiots that they don't?

Re:Blackberry Enterprise Server

[Monkeedude1212]

If your company requires mobile access to email, then should the company not be providing them with the hardware to perform this task?

Ideally, yes - but when you work for a small to medium sized company that's too cheap to shell out - you get this "Oh, you can just use YOUR phone" mentality from upper management. That way they save money, the sales team only needs 1 phone on them at all times, and they get to snoop through emails whenever things go sour. Everyone is happy but the IT team who feels dirty for having to be involved.

Re:Blackberry Enterprise Server

[Surt]

I guess I assume most salespeople are idiots because the base rate of psychopathy in the population isn't supposed to be all that high.

Re:Blackberry Enterprise Server

[ultranova]

I guess I assume most salespeople are idiots because the base rate of psychopathy in the population isn't supposed to be all that high.

Idiocy: lack of intelligence, which is the ability to figure out the likely consequences of a given action.

Psychopathy: lack of empathy, which is caring about how other people will be affected by the consequences of a given action.

The two things are not the same, and likely not even related. While both imply neurological damage, the brain areas affected aren't the same at all. Even dogs are capable of empathy, despite being stupid enough to eat their own shit.

Re:Blackberry Enterprise Server

[Surt]

Right, these are two completely separate theories for how one might arrive at a career in sales.

Re:Blackberry Enterprise Server

[russotto]

Were I a salesperson, I would backup all my company issued gear daily, precisely to avoid this kind of problems. Do you perhaps think that actual salespersons are such idiots that they don't?

They may not be technically savvy enough. But after the first time it happens, they'll do something about it, even down to keeping critical contact information only on paper, just so the company won't have it if they leave. They're not all stupid, but they are all mercenary.

Re:Blackberry Enterprise Server

[Grishnakh]

Over here in the USA, I'm pretty sure it's the same way. However, your employer has access to everything that goes on on your Blackberry, so why would you trust them with that information? I don't want my employer having access to my personal email (which, for instance, might show that I'm looking for another job).

It's not legal advice, just good practical advice: if you have an employer-provided phone, don't use it for personal stuff.

Even better, refuse to carry an employer-provided phone. Unless you need to be on call after hours, there's no good reason they need to contact you away from your desk.

Re:Blackberry Enterprise Server

[awyeah]

It's easier to just remotely change the password on the blackberry, and make sure your IT policy encrypts the contents (which you ought to do anyway).

Of course... if you were an asshole, and your IT department did that, just enter the wrong password ten times and let it wipe itself ;)

Re:Blackberry Enterprise Server

[bsDaemon]

you know, I would say "who would be stupid enough to order pot over sms?," but that's the sort of question that really just answers itself.

Re:Blackberry Enterprise Server

[Shakrai]

I didn't say she was the sharpest tack in the drawer. Still, she should have a reasonable expectation of privacy on her personally owned cell phone. I find it absurd that the Crackberry will share your SMS/call info with your employer when you own the device. I wonder how many customers they would lose if this was more widely known?

Re:Blackberry Enterprise Server

[grasshoppa]

Not many. Absolute control of the devices connecting up to a corporate network is a selling point for RIM and their customers, not a detriment.

This kind of underlines the point about hooking up personal devices to something as critical as corporate email services. It's a bad idea and should not be done as it gives up a significant amount of control over email and it's delivery. RIM understands this, and their BBs are the answer to this problem.

You're kidding...

[Un pobre guey]

What legally questionable scenarios have cropped up at your job?

You have got to be shitting me. This isn't phishing, this needs a new term all its own.

Re:You're kidding...

[bsDaemon]

like "snitching," "informing," "dropping dimes," etc?

Re:You're kidding...

[kindbud]

No it doesn't. The old term "dragnet" is perfectly applicable here.

Re:You're kidding...

[selven]

Sting operation?

Re:You're kidding...

[greg1104]

And "dragnet" already has an awesome theme song.

Re:You're kidding...

[Anonymous Coward]

"Slashing?"

Re:You're kidding...

[sjames]

It's called fishing (note no ph when doen in a legal/law enforcement context). As in "The cops don't know anything, they're just on a fishing expedition!".

Har Har

[poliscipirate]

'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'

Obviously, they've never visited slashdot.

Re:Har Har

[Un pobre guey]

Yeah. Suckers!

Re:Har Har

[medcalf]

If I only had mod points...

It's not that hard...

[Anonymous Coward]

Just make sure you never try to run an illegal instruction!

Re:It's not that hard...

[Anonymous Coward]

A Blue screen of Jail may result...

The BSA does not go after the techs but paper work

[Joe The Dragon]

The BSA does not go after the techs but they are a paper work b* and will hit for not having the paper work they want and some times it's not what you think you need to have.

Ever spy on the courts? I was asked to.

[Jailbrekr]

We were in creditor protection (Canadian version of Chapter 11 Bankruptcy), and the owner asked me to essentially spy on the Court appointed monitors and send him any email they sent or received when they were on site and using our computer systems. Thankfully, I had the presence of mind to know how wrong that was, and went to the Accounting controller to inform him of that request. In the end the courts were not told of his transgressions as that would have caused him a pile of trouble (he most probably would have been fired from his own company), and the accounting controller talked a bit of sense into him.

Re:Ever spy on the courts? I was asked to.

[temojen]

Why were they 1) on your network and 2) expecting privacy and/or not using an encrypted tunnel?

Re:Ever spy on the courts? I was asked to.

[Fulcrum of Evil]

well, 1) it's common to have people in that situation use your network and 2) they had a moral expectation, I'm sure, but it's still pretty stupid not to back that up with some assurances. My guess is crappy government IT or they just don't get security and see the encrypted tunnel as a chore.

Legally questionable scenarios?

[girlintraining]

Here's one: I worked for one of the top national retail firms. Their POS systems were booted using PXE, and there was no firwalling between the stores and corporate HQ. In other words, the network topology was completely flat. Setup a PXE server at any store, distribution center, or headquarters, and you could respond to PXE requests sent by the POS systems. The store's location was coded into the DNS RR, and followed an easy to understand naming convention -- they also were powered down every evening. Which means, you had about a 10 minute window each day where if you disabled or DDoS'd the one PXE server on the network, you would be able to send a bootable image to every POS server in that timezone.

They fired me three days after reporting this flaw, calling me a security risk.

Re:Legally questionable scenarios?

[Frequency Domain]

At first I thought POS meant "Point of Sale", but as I read through your post I realized it actually stands for "Piece of..."

Re:Legally questionable scenarios?

[Anonymous Coward]

Here's one: I worked for one of the top national retail firms. Their POS systems were booted using PXE, and there was no firwalling between the stores and corporate HQ. In other words, the network topology was completely flat. Setup a PXE server at any store, distribution center, or headquarters, and you could respond to PXE requests sent by the POS systems. The store's location was coded into the DNS RR, and followed an easy to understand naming convention -- they also were powered down every evening. Which means, you had about a 10 minute window each day where if you disabled or DDoS'd the one PXE server on the network, you would be able to send a bootable image to every POS server in that timezone.

They fired me three days after reporting this flaw, calling me a security risk.

Maybe you shouldn't have informed them via a custom Windows splash screen...

Re:Legally questionable scenarios?

[AnonymousClown]

I developed retail POS software years ago and I don't doubt what your saying. The system I worked on was real bare bones and so were the competitor's systems and I can't say too much more than that other than it was DOS right on top of Ethernet - no TCP/IP. Retail software has to work in a very small memory footprint on the cheapest machines you can imagine. Stores have to buy hundreds or thousands of them at a time and retailers want cheap, cheap, cheap!

That company was rather stupid for canning you. Actually, very stupid. They should have brought up the security risk to the vendor. We used to talk to retailer's IT people all the time.

But here's the thing, way back when I was working on that stuff (1996-1998), the regional office would have phones lines that the store server called: yep a modem. There wasn't anything over the internet - then anyway because they couldn't: no TCP/IP. Some companies had leased lines. Then again, considering how cheap retailers are, I wouldn't put it past them to move all that data and everything over the internet to save on the cost of phone lines or leased lines. That's assuming that the POS vendors have incorporated TCP/IP stacks into their systems.

Re:Legally questionable scenarios?

[idiot900]

They fired me three days after reporting this flaw, calling me a security risk.

What a brilliant idea by whoever fired you - producing a disgruntled former employee who knows how to steal money from the company.

Re:Legally questionable scenarios?

[FelixNZ]

Wow, that's incredible, unless you were a contractor, I am extremely glad to be in a country that has sane employment law right now.

Re:Legally questionable scenarios?

[_Sprocket_]

Whatever happened to TJ Max anyway?

Re:Legally questionable scenarios?

[RichardJenkins]

What was your job?

Re:Legally questionable scenarios?

[Anonymous Coward]

This is a situation you file an affidavit with your local police department for a violation of Sarbanes–Oxley then anonymously forward that affidavit, which is now officially public record, to the company shareholders and executives.

You will see how fast people start getting [i]arrested[/i].

They have a duty to keep credit card information secure; being fired for pointing out a security flaw to your companies infrastructure that you can drive a truck through is a criminal act punishable up to 10 years in prison.

From there it should be relatively easy to sue.

Re:Legally questionable scenarios?

[barzok]

That only works if the company is subject to SEC overview. If they're not publicly traded, SOX won't matter.

Re:Legally questionable scenarios?

[Anonymous Coward]

I've never heard of anyone arrested for violating SOX. In particular, managers and C level positions would be protected by the HR and the legal departments. Typically, people who complain about security are regarded as cranks and are treated as such by all levels of security, from juries and judges to employers. The BoD and shareholders don't care either. They listen to what the CEO has to say, not the Quasimodo idiot swinging in the rafters who was fired from IT.

Re:Legally questionable scenarios?

[10101001 10101001]

No, they created a disgruntled former employee who can be blamed for any money missing from the company; and without any solid evidence, it's possible nothing legal will happen. Lather, rinse, repeat.

Re:Legally questionable scenarios?

[Anonymous Coward]

So uh...are you under an NDA at present not to name the company?

'cause--I'd like to know who not to do business with, in the interests of keeping my credit card information secure. And ethically...well...how to put it. They've demonstrated by firing you they won't fix it--so everybody else is at risk. I realize you may think it wouldn't be right--but compare the risk to the company to the risk to the public if they don't fix it. They've had their 60 or 90 days as recommended...

Re:Legally questionable scenarios?

[LBt1st]

Sounds like you would have been better off exploiting the flaw.

Re:Legally questionable scenarios?

[alecto]

They fired me three days after reporting this flaw, calling me a security risk.

This is a lesson I learned early on--fortunately not at the cost of a job: don't make the people responsible for security look incompetent or they will label you a "hacker" (in the pejorative sense) and do everything in their power to harm your career. If security is not one of your job responsibilities, keep things like that to yourself.

Re:Legally questionable scenarios?

[Anonymous Coward]

Wait.. You didn't happen to work for Target did you?

Let Me Tell Ya 'Bout the Time We ...

[eldavojohn]

What legally questionable scenarios have cropped up at your job?

I'm a software developer for one of the big automotive companies and we almost got into some legal trouble a while back. We had another team that would test the embedded code we put in there and we were always playing pranks on each other between the two teams. So one time, I wrote a procedure that cause the accelerator to randomly speed up with no user interaction. It was very very rare that the procedure would trigger and then I called it right in the middle of the main block of the embedded code. Anyway, they run a bunch of tests a day and on the like the fortieth day, John drove his car right through the wall of the testing facility! Oh my, what a hoot, I haven't laughed so hard since they air lifted him out. But then there was all this legal BS about somebody getting hurt and this and that. Those law-talking guys have no sense of humor. So I realized I had to go in and comment out that procedure. So all I did was go in and comment out the signature block ... or at least I think that took care of it, but maybe it was that fancy ECC crap the smart guy put in ... I wonder if anyone ever went back in there and totally cleaned it up? Oh well ... dodged a bullet there ... am I right?

Re:Let Me Tell Ya 'Bout the Time We ...

[krray]

Let me guess. You work for Toyota?

Re:Let Me Tell Ya 'Bout the Time We ...

[Anonymous Coward]

Nah, I would have guessed Boeing Captain Obvious.

Re:Let Me Tell Ya 'Bout the Time We ...

[1080bogus]

You would'nt happen to work for Toyota would you? ;)

Has it shown that really???

[stephanruby]

Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do. 'That lack of understanding can lead them to conclude you're at fault or should have known better,'

Has it shown that really??? I recall the foreman of the jury for the Terry Childs case was a pretty smart IT guy. Also, the resumes of the other jurors were not all that bad technically either. If anything, I really do think that Terry Childs was judged by a jury of his peers (even if this doesn't always happen in other cases).

Terry Childs case not a good example

[linebackn]

Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do

As I recall, when the details finally came to light about what he did and how he went about it, the judge and jurry WERE technically savvy enough to understand what he did. It was all the people jumping to uninformed conclusions here on Slashdot that didn't understand.

I have no doubt there are plenty of cases where judges and juries fail to understand the facts at hand, but I don't think this was one of them.

Re:Terry Childs case not a good example

[Anonymous Coward]

What I recall the Childs case showing was that there should be a way for a jury to enter a guilty verdict that's contingent upon certain other people being punished in some way (fired, etc.) The juror who posted here basically said that what Childs did was illegal and unreasonable but only occurred because of some truly bad decisions and behavior of others he worked with and that the situation should have never gotten to the point it did.

So you're right that it doesn't show a failure of the people who responsible for implementing the judicial process, but it did show that the judicial process wasn't capable of appropriately assigning blame to all responsible for what happened, of which Childs was only one representative. Given the bureaucratic nature of city government, those people likely kept their jobs as well.

Re:Terry Childs case not a good example

[oneiros27]

Yep, the Cisco-certified network admin juror who voted guilty wasn't "technically savvy enough to understand what IT pros do"

how about makeing EULA that non legal types can re

[Joe The Dragon]

how about makeing EULA that non legal types can read and under stand not all work places have the means to take the time for legal to look at all of them.

Asked to use pirate software

[Rene S. Hollan]

I have often been either asked to use pirate copies of software (Borland Turbo C in the 1980s), or accept license agreements personally, where a corporate license would have been more fitting. Neither of these have occurred at my present place of employment, thankfully.

In other areas, I was once asked by a low-level manager at a client company of our contracting firm for my SSN for a "background check". I was told this person had a reputation of committing identity theft in the name of contractors, obtaining credit in their name, and threatening to insist they be removed from the assignment if they complained. I don't know if that was true, but did insist that any "background check" would be done by a recognized neutral party. I was requested removed from the assignment, and let go for lack of other work.

On the pirate software issue, I simply licensed my own copies, and took them with me when I left (well, wiped them off my work computer). Borland's license would let me use their compiler on any machine, even let someone else use it, one at a time.

The bottom line is that if your employer asks you to break the law, find another job... fast.

How about legally liable for the PHB and other hig

[Joe The Dragon]

How about legally liable for the PHB and other higher up people at the work place who don't know about IT but they buy stuff on the golf course buy they fail to buy the right licenses and they they tell the techs that proper license are done / the buying department took care of it.

In some places the IT guy do not buy any thing they just tell some what they need and hope to get it.

Re:how about makeing EULA that non legal types can

[Anonymous Coward]

Most EULAs aren't actually that difficult to read. They're just long and boring...

Do to cut backs he was the only guy on the job24/7

[Joe The Dragon]

Do to cut backs he was the only guy on the job 24/7 and lot of the people there did not have a clue at all. And giving the out the network pass word over a open phone call in a big meting room?

Re:Do to cut backs he was the only guy on the job2

[rilles]

If your boss tells you to give out the password on a phone call... guess what you do? That being said... what if your boss then says email all the city system passwords to tasteless-rag-newspaper.com?

Re:Do to cut backs he was the only guy on the job2

[h4rr4r]

You quit, explain why you are quiting then give it out over the phone call.
Is that the right answer?

Unions

[Anonymous Coward]

I work in the medical field and I am so thankful I have union representation to clarify legaly questionable requests from management.

People may speak ill of unions, but from my end they have literally been life savers.

Re:Do to cut backs he was the only guy on the job2

[Altus]

I get where you are coming from, and I totally agree that Childs was a toolbox and could easily have handled the situation better if he had any desire to do so.

However, if your boss tells you to violate the state policies on passwords and mail them off to someone (or provide them to a room full of people) and then something bad happens because of that, it is quite possible that you will be held legally liable for the damages caused. Just following orders may not be enough of an excuse.

Requirements vary by jurisdiction

[HikingStick]

One problem I see is that requirements may not be the same from state to state (in the US), and there are few formal resources available for IT professionals to know exactly what requirements apply. This is especially true for IT pros in smaller, or privately held firms that don't fall under the authority of some of the big bills that have been enacted. None of the college programs in my area even has a course addressing these issues, except for specific courses dealing with things like HIPPA. This seems to be a big gap, and I know I'd love to find a course (or even a website) that deals with specific requirements both at the State and Federal levels.

Legal tangles

[Sta7ic]

I haven't run afoul of any laws, writing software, but I'm always tangling with copyright readers and software licenses whenever I start up a project (which happens every year or two). Open source licenses especially, since the standing rule is that 'copyleft is bad, because we want to keep control of our work'.

Software licenses come up every couple months, but the shop does a good job keeping the site licenses for the software that we use, and personal software is discouraged. I have a couple sets of VS8/9/10 discs that I pass to the interns and new FTEs, but have the license codes squirreled away separately -- if the site license doesn't pick them up, it's IT's problem. I've had a license expire, which was inconvenient, but had the project money for the latest version.

Code plagiarism is another concern, but a pretty easy one ~ either don't copy it, or contact the original author. Pretty straightforwards.

the president of the company

[Anonymous Coward]

asked for a reprint of the customer listing. A couple of days later the two vp's asked for the same thing. The company was shut down about 3 months later and I was the only one hired by the parent company.

About two months later I was called in the attorney's office. I was asked if I distributed any unauthorized customer lists.

Damn.

Re:the president of the company

[pclminion]

Maybe I'm missing something... What would be bad about giving the president of the company a list of the company's customers? Huh?

Re:the president of the company

[Stargoat]

How was it unauthorized? If a VP or President asks for company information, it is authorized.

Re:the president of the company

[yukk]

If the company files for debtor protection or goes backrupt owing money then the assets (such as customer lists) are basically used to offset some of the debt and thus pretty much owned by the creditors. If the president and two VPs had made off with company BMWs before closing up the company would you see it as being wrong?

Re:the president of the company

[bickerdyke]

What always troubled my: How can some company OWN other peoples adresses and even have that counted as an asset?

Re:the president of the company

[Richard_at_work]

A former employer of mine spent thousands of hours, and thousands of GB Pounds putting together a very comprehensive list of commercial vehicle fleets in the UK. This list included such things as type of vehicle, maintenance history and periods, fleet age etc etc - the sort of stuff that you can only get from the long hard slog of research.

They sold access to this information for quite a large amount of money - it was a valued resource.

Now, my employer certainly didn't own the names and addresses, or even the fleet details - anyone can do the same research and invest the same time and money to gather the same information without issue - but they do own the collection of details that their investment resulted in.

Its not the individual facts that are valued, its the collection together that has value. A sorted and filtered marketing list is the same sort of deal.

Re:the president of the company

[tehcyder]

If you've got any sense, in those sort of situations, you only pass on information via your immediate boss. If you immediate boss is the President, I don't see how you can be blamed for that.

Re:the president of the company

[Anonymous Coward]

The UK has "database rights" but the US does not. You could arguably consider the list a trade secret here, but trade secret laws vary by state.

You're listing a sweat-of-the-brow-style right to compiled information, because of the time spent compiling the list. The US does not accept that notion.

Re:the president of the company

[Richard_at_work]

But nothing in my post relies on there being a law protecting the information - regardless of whether the US has a database rights law, the collection of information is still valuable and can indeed be sold on for lots of money, so it should be a protected asset of the company in liquidation circumstances, which was the original point.

Re:how about makeing EULA that non legal types can

[cjb658]

Because then some people might figure out what they're actually agreeing to and stop buying their software?

Get your boss to sign off on it

[Anonymous Coward]

Get your boss to sign off on it. But seriously, the best (in fact ONLY) way to avoid legal trouble that the article is talking about is to do nothing but ask your boss for access to a solicitor to sign off on work.

The article is like asking "How do you avoid legal problems with a video compression algorithm that you think has no patented by anyone else?". The answer: you can't. As MPEG-LA know, since they don't indemnify against other people's patents.

piece of...

[Dogbertius]

At first I thought POS meant "Point of Sale", but as I read through your post I realized it actually stands for "Piece of..."

...software?

Patents, open licences and cyberspace laws

[Yvanhoe]

I live in France so software patents, in theory, do not exist. But I have American and Japanese clients. What happens then ?

I offer (freely) some web services like IRC or forums. If someone infringes a silly law from a silly country by saying something illegal in either the country I live in, the country where the server is located or the country where the user is, how are the responsibilities split ?

Some of the code I develop at my work is open source (BSD). But BSD has no French translations and no transcription for French law. Cecil-B can work, but French copyright laws are subtly different from Americans', and the legality of viral open source licenses is an open debate here (no one cared about making a simple and quick law to clearly state they are legal).

We have a silly law named HADOPI that create an offense of "non-securization of an internet terminal" with very vague terms that don't really explain how to comply.

My biggest problem, in definitive, is that the law of my country is unadapted, inapplicable, written by persons who dismissed experts' advices. As a result, and being a law-abiding person, I tried to write to representatives and journalists, I joined the local pirate party that was mainly made from people with a technical background that understood the law were silly. But I quit as this was taking more time than coding. So now it is a matter of choice between being up-to-date with the latest sillinesses or coding interesting and useful stuff. I chose the latter, knowing that the clown-hammer of law is suspended over my head and that I am probably in a gray zone. Being legally safe is a luxury I can not afford but I do not wish to surrender to the Legalausaurus Rex. I put the little faith I still have in humanity in the hope that when the silliness of the current laws will be obvious (it is forbidden to be infected by virus ! An IP address is a proof of identity ! Linux is illegal !) they will be corrected.

Re:Patents, open licences and cyberspace laws

[PPH]

Is it too late to join the Foreign Legion?

Re:Patents, open licences and cyberspace laws

[Opportunist]

IT laws in your country have turned into a veritable Catch-22 situation. You are responsible for what your computer does. Now, hey, I would almost support that! Until I noticed that the law isn't supposed to make people more sensitive to keeping their computers free of infections, since it neither targets spambots nor makes people responsible for stolen password, its only purpose is to facilitate the prosecution of people engaging in file sharing. Or, in other words, another law Sarkozy created for his bit... darling wife.

Isn't nepotism a word with French roots? How fitting.

And IP address proof of identity. When I heard that, I felt SO tempted to find out what IP Adresses are used at the Elysee Palace and write a little tool that spoofs said IP adresses in an attempt to download copyrighted material. Here, look, Monsigneur petit Napoleon left his calling card, could we please arrest him for copyright infringement?

Do I have to go on?

These laws are rubberband laws if there have ever been any. They serve no purpose but to arrest whoever should go behind bars. It is trivial to frame someone.

Re:Patents, open licences and cyberspace laws

[alecto]

Isn't nepotism a word with French roots? How fitting.

Latin--but close enough! nepos, -otis, m.: nephew

Re:Patents, open licences and cyberspace laws

[Yvanhoe]

And IP address proof of identity. When I heard that, I felt SO tempted to find out what IP Adresses are used at the Elysee Palace and write a little tool that spoofs said IP adresses in an attempt to download copyrighted material. Here, look, Monsigneur petit Napoleon left his calling card, could we please arrest him for copyright infringement?

Do you think that a single French hacker did not think about it ? We told them this would happen when they discussed the laws and now this is happening thanks to scripts which seed erroneous addresses into bittorrent. Actually, the Elysée has been doing piracy of the worst kind : they took a news report, added the Elysee logo, burnt it on about 500 DVDs and handled it to guests without any sort of authorization.

its both

[RobertLTux]

as anybody that actually works in retail above the McD register level knows BOTH are correct.

Both wrong.

[Anonymous Coward]

Both wrong.

(a): there was no law demanding he hand over the keys unsecurely
(b): he did the right thing. If he'd been hit by a bus, they could reset the passwords by getting an engineer out to the sites.

Terry did the RIGHT thing according to law and the thing demanded by his employment contract. That contract stated who he could give the passwords to, where and who could override those orders.

A general cannot order a Private on Guard Duty (assigned as such by the Duty Officer) to leave his post. Doing so would be a court martial offence (potentially one that could see him shot, if it's a war zone or in time of war). The General may or may not be able to order the Duty Sergeant to order the private to leave his post. But if the general is not the Base Officer, OD can demand that the correct channels be used and the Base CO would have to order the Duty Officer to order the Private (note: even the Base CO cannot order a private off Guard Duty at his post).

Similarly, the captain of a ship outranks any officer on board ship, even a Port Admiral. At port, the captain can be removed from command by the Port Admiral. This is why Barratry is such a severe offence in the Navy.

But short version: both your statements are wrong.

Re:Both wrong.

[jroysdon]

They could not just reset the password. The routers/switches were configured with "no service password-recovery" and could not just be reset. If they had been, it would have wiped out the configuration on all of the devices and all of the agencies depending on them would have been down.

If the device configurations had been properly backed up and documented somewhere, this would not have been a problem (I don't know one way or another, but clearly no one in charge knew if they were or had enough of a clue). I didn't follow the case that closely, but even Cisco was involved and couldn't solve the problem (which is a good thing, you don't want a vendor to be able to recovery a configuration in a situation like that).

The point of a "no service password-recovery" is to prevent unauthorized access to a router/switch and configuration tampering. It is required in more secure environments, especially ones with FIPS and other requirements.

no service password-recovery

There is nothing wrong with "no service password-recovery", so long as you have the configurations backed up and others know where those backups are (documentation), such that if you are hit by a bus things can be properly maintained.

Re:Both wrong.

[david_thornley]

(a) There was policy that he had to hand over the keys securely, which he refused to do earlier. That is one of the things that led to conviction.
(b) If he'd had been hit by a bus, there was no way known at the time to reset passwords without destroying the configuration, which was not satisfactorily documented. (Think about this - you don't want people to be able to walk up to such a device and pwn it. Routers like those cannot necessarily be kept physically secure.)

Nor, apparently, did his contract state who should have the passwords. The terms of employment did say that he had to have the passwords recoverable by somebody else, and he didn't.

I'm not referring to the events after his dismissal in particular. Childs left the network vulnerable should he be hit by a truck. That is not ethical behavior on the part of a sysadmin, and if he made demands afterwards that could be illegal extortion. I don't remember exactly what he was convicted of, but it's often a short step from unethical to illegal.

people think anyone technical is a whiz kid

[Culture20]

'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'
Just because *I* am doesn't mean other IT people are.
IANAL, IANAMD, IANAE, IANARS, IANAMCSE

dont set up secret monitoring on childrens laptops

[mjwalshe]

A good recent example of how techs could get in trouble would be the techs that set up the spying on kids via webcam in Philadelphia. Congratulations you have just set up a child porn machine. I trust that all involved will never be able to work with kids and vunerable people again - and that would be getting off lightly, in the UK you would probaly have a tabloid lynch mob out for you.

one time at band camp

[AnAdventurer]

I was building a website and left a legally incorrect line as to the corporate status of the company the site was for. I thought I had saved the changes as I was working but did not. It was a low priority project and did not plan to resume work for a few months (I also thought it was not a publicly available beta). So not only am I a lazy designer sometimes, now I got cease and desist letters from the AG's of two states with threats of $25,000 fines for each instance of "X" that resulted from my error. There were no "X's" and one state has dropped it, I am still waiting to officially hear that state number 2 has dropped it. There are somethings you need to be on top of!

Protect ya neck

[KingAlanI]

In short, the articles advice to watch your ass legally, and provides some overview on doing so
Basic but functional, I suppose

Re:Do to cut backs he was the only guy on the job2

[Anonymous Coward]

It's DUE to cutbacks. Unless you were implying "Do to cutbacks as you would have them do unto you" ... (?)

Cure worse than the disease

[WinstonWolfIT]

To work around this problem I developed a time travel machine, and would just revert when scheduled to appear. I wound up trapped in Groundhog Day redux. So now I'm a sanitation engineer.

I make hints or tell the client directly

[bAdministrator]

Working in IT, you're bound to come across pirated software from time to time.

a) When I find some pirated software or license misuses, I could for instance tell the client that "I'm not the police, but..."
I might also make them aware that there is this company that looks out for software vendors--the business software alliance, for instance.
b) When a client is aware that they're asking me to do something illegal, like ignoring license agreements etc, I tell them that I don't care what people do privately (nor do I assist them in that case either), but this is not the act of doing serious business--or tell them sorry, and explain that the company I work for won't allow me to do this, etc. If they still insist, they are a lost cause. You can only spend so much energy on these matters.

I'd prefer that more commercial business software would come with some activation mechanism. I've seen cases where clients have ordered one license, then gone ahead installing the software on most every PC, and when confronted about this, they've argued that only one of them uses it at the time--but the license agreement does not allow it to be installed on more than one PC.

You'll most often find that objectivity is the first thing to be sacrificed in business, so hang on to it, tight, or lose it.

I'm always close to violating copyright laws

[Opportunist]

Why?

Because I'm in IT security. My job is to analyze and dissect malware, not only to find out what it does but also how it does it, what attack vectors are used, what system flaws are exploited, what means of communication with a controlling server are used and, if possible, I should also try to cut those lines and render the malware useless, preferably create some kind of remedy or even protection against it. All this can usually only be done by taking a closer look at the software than is possible by simply watching it run. In other words, disassembly and protocol sniffing and decoding are two of the main parts of my work. Both already illegal in some countries.

Now, fortunately my country provides protection for this (albeit ... well, I have a law that I might pull out of my ass should I need it, but it's anything but a certain victory in case anyone ever goes to court for it). But in theory, any writer of malware could pull any IT security company to court and stand a pretty good chance to win. Though he'd first have to admit that it was him who created the malware.

In other words, as odd as it may be, I may violate that copyright because the one who could drag me to court for it certainly has no interest to come forwards and claim ownership of the code.

And now let's ponder for a moment what will change should ACTA become reality and copyright violations get shifted from civil to criminal code. Technically, the State Attorney would have to step forward and protect the copyright of the writers of malware without them asking for it (because the SA has to act even without prompting from the injured party) and prosecute those that analyze malware and design protection and remedies against it.

You see, you don't have to be the bad guy to think that ACTA is a really, really bad idea...

Re:I'm always close to violating copyright laws

[Ocker3]

A contract isn't enforceable if the terms involve a criminal activity. http://en.wikipedia.org/wiki/Contract First the malware writers would have to know that you're doing the work (not impossible I guess), and then they'd have to bring charges or sue. What DA or judge is going to agree to try/see that kind of case? How would it look on their record, they'd never get elected to anything ever again.

Re:I'm always close to violating copyright laws

[Tuscatsi]

It's because of people like you that the virus writers will have to start including EULAs when their virus installs - and splash screens showing copyright notices each time they run. Until then, you have plausible deniability.

Re:I'm always close to violating copyright laws

[Opportunist]

Writing malware is not illegal in my country. It is, just like any software. It's not even illegal to infect another computer with it, else a lot of those "bundled" crapware that bloats PCs with page counters and "toolbar enhancements" would be in a lot of hot water as well. The only thing that makes malware actually "illegal" is harvesting personal data without the infected person's consent. Because, again, if harvesting data was illegal, a lot of "legit" companies (I use the term loosely here) would have troubles as well.

In other words, if they actually did include some sort of EULA, it might even be legal *shudder*. And what makes it all worse is that 99% of the idiots wouldn't even read that click-through EULA...

Re:I'm always close to violating copyright laws

[Opportunist]

No. No plausible deniability when it comes to copyright. You have to assume that a work is copyrighted, for the simple reason that any work is automatically at creation copyrighted to the person that created it (at least in my country). If the person chooses so, he may release the work into public domain or put it under a permissive license like the LGPL or the BSD license, but by default he has the full, only and to some degree even non-transferable sole copyright of the work.

So, no plausible deniability for me. My strongest defense is actually that I had a "good reason" to assume that the software was written and distributed for nefarious purposes and that breaking the copyright was permissible to prevent a more serious crime and hence it's "excusable". Even if I should receive a piece of software crafted to resemble malware but actually harmless, but if (again) I had "good reason" to assume it to be malware, I'd be off the hook (provocation).

But I sure as hell don't want to try that out in court. Considering how DAs have little and judges even less of an idea what software is, let alone malware, I do not want to be the one who gets to try that defense in a courtroom.

brainiac

[poor_boi]

"After all, many people think anyone technical is a whiz kid or brainiac on any topic."

This comment is just inflammatory. The question here is one of culpability, not one of assumed intelligence. Highly intelligent people should not be more culpable than those of average or even sub-average intelligence (barring retardation or insanity.)

Re:How about legally liable for the PHB and other

[duk242]

Policy in my work place states that I need to sight and make a copy of the licence agreement before the software is installed onto any machine. If you're in a workplace like that, you need to lay down some rules :P

Re:How about legally liable for the PHB and other

[bickerdyke]

Reminds me of the company I did an internship 10yrs ago.

Licencsing practice went as follows: The department had a bunch of CD-R with copied installation media for the volume-licensed software. You (personally) had to keep tabs of your installed software in an Excel sheet and IT would buy licenses based on the number of people using the software.

Worked quite well until we found out that IT didn't even knew about that Excel file.....

Retail credit card compliance

[Yanimal]

I set up a Point of Sale system for the restaurant I work for this winter. A few months ago we get some letters from our credit card processor saying we have to secure our customers CC info to be "PCI compliant". This consisted of filling out a form online where if i told the truth about our network (not firewalled, LANed through an unsecured wireless router, constantly writing down info to enter later for off-site orders) we would not be in compliance. Like a good employee I notified the boss about what it would cost to make the system secure. He determined it would cost too much. Nice to know that i could be prosecuted because my employer won't cough up $80 for an appropriate network switch.

Data protection

[dugeen]

Just boring old improper requests for data access. 'My friend's record doesn't look right', 'the police want the address of every staff member' (well, they of all people ought to know the proper way to request that information if they need it).

Legally binding?

[Drakkenmensch]

Can slashdot posts be considered confessions from a legal standpoint? Because I'm pretty sure that someone, somewhere, is just waiting for a lawsuit red flag to drop...

Simplify.

[Anonymous Coward]

Just count licenses purchased and software in use.
While this may well be against most EULAs, I consider it a practical way to stay out of trouble.
If a software company should ever try to sue you, you can always claim that no monetary harm was done and that they don't have a case.
Except for such insignificant things like using the same code number twice...

StumbleUpon Nightmares...

[RenoGeek]

I had problems with StumbleUpon bringing me to webpages, that while were safe for work, would bring up questionable material that, at the time, probably didn't look so good (i.e. "How to make Thermite" came up once while I was in the middle of a custody battle with my ex... The Police officer didn't seem amused when he questioned me.)

But, yes, lack of technical know-how in the non-technical community puts anyone who knows enough about technology to be dangerous (even if we never use it for that purpose), completely at risk. If I ever wanted a high-clearance job, that one incident will come up for the rest of my life, and I will, once again,have to spend hours and hours explaining what came up, bad timing, what happened, no I never read the article, no I never sent death threats to my ex., etc.

Was/is a NIGHTMARE!!!!!