Slashdot Mirror
How IT Pros Can Avoid Legal Trouble
snydeq writes "InfoWorld's Peter S. Vogel reports on the kinds of inadvertent transgressions that could land IT pros into legal trouble without realizing it. From confidentiality and privacy negligence, to copyright and source code violations, IT staff are legally liable for a lot more than they might think — in some cases because the law will not stop at your employer, instead holding individual IT employees responsible for violations even if the individuals are just 'doing their job.' Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do. 'That lack of understanding can lead them to conclude you're at fault or should have known better,' Vogel writes. 'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'"
What legally questionable scenarios have cropped up at your job?
I'm liable for first posts.
He was a petulant child.
This narrative that this ruling could affect non-sociopaths is FUD.
It's such a gigantic PITA to track all of the licensing for everything that I weep for any small to medium sized shop that can't afford to have a dedicated person/dedicated people for it.
not post in this thread.
Are the same people claiming that Childs is some sort of mis-understood hero the same people who had "Free Kevin" schwag back in the day? If not, I'm not sure I get the mentality, because from what I know of the situation (maybe not enough), he did sort of grossly overstep the bounds. Maybe he didn't deserve jail time, but I'm not about to go emulating my career after him.
I'm a medical equipment technician at a California corrections facility. My boss routinely asks me to kill people in cold blood, and I've been doing it for a few years now... there's a lot of paperwork and everything, but I'm not entirely sure it's legal.
Does anyone else have experience with being ordered to kill somebody as part of their IT duties?
When someone at work has a blackberry, they are set up on the Blackberry enterprise server, which manages all their contacts and emails and calendar and such.
If they leave, or are terminated, we are told to send the kill command to their BES account. This will delete any emails off their phone AND their contact details. In some cases, a person will be let go - our IT staff will be let known first so their account can be disabled for security reasons. Then that recently laid off person has lost all of their contact details - including Mom and Dad and sweet Great Aunt Gertrude.
We haven't faced any legal suits yet - but it happened a couple times where people have gotten angry. As a precaution - we've started informing people that this happens - so anyone with a blackberry needs to back up their contacts constantly.
What legally questionable scenarios have cropped up at your job?
You have got to be shitting me. This isn't phishing, this needs a new term all its own.
'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'
Obviously, they've never visited slashdot.
Here's one: I worked for one of the top national retail firms. Their POS systems were booted using PXE, and there was no firwalling between the stores and corporate HQ. In other words, the network topology was completely flat. Setup a PXE server at any store, distribution center, or headquarters, and you could respond to PXE requests sent by the POS systems. The store's location was coded into the DNS RR, and followed an easy to understand naming convention -- they also were powered down every evening. Which means, you had about a 10 minute window each day where if you disabled or DDoS'd the one PXE server on the network, you would be able to send a bootable image to every POS server in that timezone.
They fired me three days after reporting this flaw, calling me a security risk.
#fuckbeta #iamslashdot #dicemustdie
What legally questionable scenarios have cropped up at your job?
I'm a software developer for one of the big automotive companies and we almost got into some legal trouble a while back. We had another team that would test the embedded code we put in there and we were always playing pranks on each other between the two teams. So one time, I wrote a procedure that cause the accelerator to randomly speed up with no user interaction. It was very very rare that the procedure would trigger and then I called it right in the middle of the main block of the embedded code. Anyway, they run a bunch of tests a day and on the like the fortieth day, John drove his car right through the wall of the testing facility! Oh my, what a hoot, I haven't laughed so hard since they air lifted him out. But then there was all this legal BS about somebody getting hurt and this and that. Those law-talking guys have no sense of humor. So I realized I had to go in and comment out that procedure. So all I did was go in and comment out the signature block ... or at least I think that took care of it, but maybe it was that fancy ECC crap the smart guy put in ... I wonder if anyone ever went back in there and totally cleaned it up? Oh well ... dodged a bullet there ... am I right?
My work here is dung.
Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do. 'That lack of understanding can lead them to conclude you're at fault or should have known better,'
Has it shown that really??? I recall the foreman of the jury for the Terry Childs case was a pretty smart IT guy. Also, the resumes of the other jurors were not all that bad technically either. If anything, I really do think that Terry Childs was judged by a jury of his peers (even if this doesn't always happen in other cases).
Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do
As I recall, when the details finally came to light about what he did and how he went about it, the judge and jurry WERE technically savvy enough to understand what he did. It was all the people jumping to uninformed conclusions here on Slashdot that didn't understand.
I have no doubt there are plenty of cases where judges and juries fail to understand the facts at hand, but I don't think this was one of them.
I have often been either asked to use pirate copies of software (Borland Turbo C in the 1980s), or accept license agreements personally, where a corporate license would have been more fitting. Neither of these have occurred at my present place of employment, thankfully.
In other areas, I was once asked by a low-level manager at a client company of our contracting firm for my SSN for a "background check". I was told this person had a reputation of committing identity theft in the name of contractors, obtaining credit in their name, and threatening to insist they be removed from the assignment if they complained. I don't know if that was true, but did insist that any "background check" would be done by a recognized neutral party. I was requested removed from the assignment, and let go for lack of other work.
On the pirate software issue, I simply licensed my own copies, and took them with me when I left (well, wiped them off my work computer). Borland's license would let me use their compiler on any machine, even let someone else use it, one at a time.
The bottom line is that if your employer asks you to break the law, find another job... fast.
In Liberty, Rene
How about legally liable for the PHB and other higher up people at the work place who don't know about IT but they buy stuff on the golf course buy they fail to buy the right licenses and they they tell the techs that proper license are done / the buying department took care of it.
In some places the IT guy do not buy any thing they just tell some what they need and hope to get it.
Most EULAs aren't actually that difficult to read. They're just long and boring...
Do to cut backs he was the only guy on the job 24/7 and lot of the people there did not have a clue at all. And giving the out the network pass word over a open phone call in a big meting room?
You quit, explain why you are quiting then give it out over the phone call.
Is that the right answer?
I get where you are coming from, and I totally agree that Childs was a toolbox and could easily have handled the situation better if he had any desire to do so.
However, if your boss tells you to violate the state policies on passwords and mail them off to someone (or provide them to a room full of people) and then something bad happens because of that, it is quite possible that you will be held legally liable for the damages caused. Just following orders may not be enough of an excuse.
"In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson
One problem I see is that requirements may not be the same from state to state (in the US), and there are few formal resources available for IT professionals to know exactly what requirements apply. This is especially true for IT pros in smaller, or privately held firms that don't fall under the authority of some of the big bills that have been enacted. None of the college programs in my area even has a course addressing these issues, except for specific courses dealing with things like HIPPA. This seems to be a big gap, and I know I'd love to find a course (or even a website) that deals with specific requirements both at the State and Federal levels.
I use irony whenever I can, but my shirts are still wrinkled...
asked for a reprint of the customer listing. A couple of days later the two vp's asked for the same thing. The company was shut down about 3 months later and I was the only one hired by the parent company.
About two months later I was called in the attorney's office. I was asked if I distributed any unauthorized customer lists.
Damn.
Both wrong.
(a): there was no law demanding he hand over the keys unsecurely
(b): he did the right thing. If he'd been hit by a bus, they could reset the passwords by getting an engineer out to the sites.
Terry did the RIGHT thing according to law and the thing demanded by his employment contract. That contract stated who he could give the passwords to, where and who could override those orders.
A general cannot order a Private on Guard Duty (assigned as such by the Duty Officer) to leave his post. Doing so would be a court martial offence (potentially one that could see him shot, if it's a war zone or in time of war). The General may or may not be able to order the Duty Sergeant to order the private to leave his post. But if the general is not the Base Officer, OD can demand that the correct channels be used and the Base CO would have to order the Duty Officer to order the Private (note: even the Base CO cannot order a private off Guard Duty at his post).
Similarly, the captain of a ship outranks any officer on board ship, even a Port Admiral. At port, the captain can be removed from command by the Port Admiral. This is why Barratry is such a severe offence in the Navy.
But short version: both your statements are wrong.
A good recent example of how techs could get in trouble would be the techs that set up the spying on kids via webcam in Philadelphia. Congratulations you have just set up a child porn machine. I trust that all involved will never be able to work with kids and vunerable people again - and that would be getting off lightly, in the UK you would probaly have a tabloid lynch mob out for you.
yeah you're saying that's how it is and I"m saying that's not how it should be.
if the employee is expected by law to say NO, then he should be able to do so without repercussions. Otherwise he is under duress. telling someone he's fired if he doesn't do $ILLEGAL_ACTION when he's got a mortgage and a family to feed is akin to holding a gun to his head. he is powerless because he is now stuck between two entities who have total power over him and who want conflicting things. this powerlessness should grant him immunity to actions done either power's name. Perhaps this is a symptom of a larger problem: law conflicts too much with reality.
1. that's fine, but the liability should rest with those who are holding the mallets over the employee.
2. this wouldn't be an issue if he had immunity. he wouldn't have to complain.
3. so what is the probability that these two events will line up just so? are you serious?
Working in IT, you're bound to come across pirated software from time to time.
a) When I find some pirated software or license misuses, I could for instance tell the client that "I'm not the police, but..."
I might also make them aware that there is this company that looks out for software vendors--the business software alliance, for instance.
b) When a client is aware that they're asking me to do something illegal, like ignoring license agreements etc, I tell them that I don't care what people do privately (nor do I assist them in that case either), but this is not the act of doing serious business--or tell them sorry, and explain that the company I work for won't allow me to do this, etc. If they still insist, they are a lost cause. You can only spend so much energy on these matters.
I'd prefer that more commercial business software would come with some activation mechanism. I've seen cases where clients have ordered one license, then gone ahead installing the software on most every PC, and when confronted about this, they've argued that only one of them uses it at the time--but the license agreement does not allow it to be installed on more than one PC.
You'll most often find that objectivity is the first thing to be sacrificed in business, so hang on to it, tight, or lose it.
Why?
Because I'm in IT security. My job is to analyze and dissect malware, not only to find out what it does but also how it does it, what attack vectors are used, what system flaws are exploited, what means of communication with a controlling server are used and, if possible, I should also try to cut those lines and render the malware useless, preferably create some kind of remedy or even protection against it. All this can usually only be done by taking a closer look at the software than is possible by simply watching it run. In other words, disassembly and protocol sniffing and decoding are two of the main parts of my work. Both already illegal in some countries.
Now, fortunately my country provides protection for this (albeit ... well, I have a law that I might pull out of my ass should I need it, but it's anything but a certain victory in case anyone ever goes to court for it). But in theory, any writer of malware could pull any IT security company to court and stand a pretty good chance to win. Though he'd first have to admit that it was him who created the malware.
In other words, as odd as it may be, I may violate that copyright because the one who could drag me to court for it certainly has no interest to come forwards and claim ownership of the code.
And now let's ponder for a moment what will change should ACTA become reality and copyright violations get shifted from civil to criminal code. Technically, the State Attorney would have to step forward and protect the copyright of the writers of malware without them asking for it (because the SA has to act even without prompting from the injured party) and prosecute those that analyze malware and design protection and remedies against it.
You see, you don't have to be the bad guy to think that ACTA is a really, really bad idea...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.