Slashdot Mirror
Defending Self In a Case of On-Line Identity Theft?
SoccerDad41 writes "I am a systems administrator for an Indiana-based bricks-n-clicks retailer currently suspended because an unscrupulous typosquatter stole my name and registration information for his/her fraudulent domain registration. My company hired a third party service to protect their trademark by identifying and terminating infringing web sites. The third party identified a domain name, performed a WhoIs lookup & issued a complaint in compliance within ICANN's rules. This was presumably all reported back to our Legal department and it was noticed that the name on the domain registration matched mine. I have a locally uncommon ethnic last name so an immediate connection to me was made & although I protested my absolute innocence in the matter, I have been suspended on grounds of violating non-compete policies pending proof that it isn't me. The fraudulent domain registration was made with a different registrar (let's call them Registrar B) than the one my company uses (let's call them Registrar A). The public parts of the registration information at Registrar B match pretty exactly those of my legitimate domain registrations at Registrar A, including Registrar A's mailing address and phone number. The only things left out in the mailing address are the reference to a domain name and ATTN: Registrar A. Of course the anonymized email address differs as well. Surely I'm not the first in the Slashdot community to find myself in this situation. I'd like to avoid incurring the cost of a lawyer but I am intent on maintaining my good name and continued employment. What are my rights and responsibilities in this matter? What is my best course of action? How did you resolve this issue? How can I prove it's not me?"
See a lawyer.
Say it wasn't you.
I am sorry you are in this unfortunate situation. However, you have begged the question, and ACCEPTED AS FACT that they presume you guilty and that YOU MUST PROVE YOUR INNOCENCE.
That's not how it works.
Please in writing request a meeting with your boss and the corporate counsel.
Explain simply these NONTECHNICAL FACTS:
1. You have done nothing to violate your terms of employment, your noncompete, or other agreements.
2. If the company has PROOF that YOU did it, it is THEIR responsibility to show it.
3. Until they do so, you want your job and pay FULLY reinstated.
Offer them a concession:
If they fear you MIGHT be a risk, they can PAY YOU, put you on a PAID BREAK until it is resolved.
Additionally ONCE they do so, you ARE WILLING to help them figure it out.
If they ask you a bunch of stupid questions like:
1. Why wouldn't you want to clear your name?
2. Why won't you volunteer information?
3. Can we search your home/hard drive/etc?
4. When did you stop beating your wife?
BE POLITE, BE RESPECTFUL, and tell them you ARE willing to be cooperative, but FIRST they must
restore the rights of yours they have trampled (job, pay, respect), and after that you will help them but
you will not give up your CIVIL or CONSTITUTIONALLY or LEGALLY protected rights to do so.
You don't need a lawyer for this unless they insist on not giving you job/pay back.
In that case, hire a lawyer and you'll be happy to find many who will take a case like this on contingency.
Innocent until proven guilty.
Never give up your right to be innocent by begging the question of "But why am I suddenly guilty."
E
Grab a Nolo book or two (check your library, or www.nolo.com), file a "pro se" lawsuit against John Does 1-20, and via that lawsuit subpoena the domain name registrar. Get everything they have, IP address(es) used to register the domain (i.e., load the website), etc. Get records from wherever the site was hosted. Get ISP records corresponding to the IP addresses in use by the person/people who registere the domain name / set up the website. Etc. Document, document, document. Then summarize it in a memo to your employer, citing to the documents you've uncovered (include them as labeled exhibits, e.g., "As you can see from the Billing Information Statement ("Billing"), attached hereto as Exhibit A...")
And then, as long as you're already wet, go swimming. If you can come close to identifying these asshats, amend the complaint and sue 'em. (Service might be tricky, but if you can satisfy the diligence requirement, most jurisdictions will allow substitute service by publication. Then go for the default judgment... Satisfying it will likely be impossible, but having a civil judgment in your favor can't hurt your attempts to remain employed and clear your name.)
Disclaimer, I am a lawyer, but I am not licensed in Indiana, this is not legal advice, this does not create an attorney-client relationship.
geek. lawyer.
This sounds like a perfect example of a situation where there's lots more information that what we are given. It may be completely unrelated to the actual event, but is still relevant.
This falls under the category of "something weird". If a company really likes the employee involved with "something weird" they will probably believe the employee's story and not waste their time with legalities. If said employee is a nuisance (bad work ethic, loud mouth, does not get along well with others, causing problems, worthless at the job, superfluous) then this is a perfect chance to remove said employee without the hassle of unemployment, severance, back-pay, etc.
Basically, if the company wanted to keep the employee, this wouldn't be an issue. What's wrong is that the employee has been marked as unwanted, for whatever reason, and is currently being removed. The company chose this method because it looks legit on paper, but the real reason is probably completely unrelated.
The employee clearly doesn't realize this and is in complete shock as to why such a thing would interfere with his employment. The employee is looking for sympathy as, given the limited facts, this seems completely unfair. The employee should be looking outside the box to figure out why they were marked for removal.
Get in contact with a lawyer and check what your options are, but try to find a lawyer that knows what internet is about. Evidence on the net is always a tricky thing. If the registrar is in the country where you live you may have some legal options to use to get evidence behind who did the fraudulent registration.
If the domain points to a web server somewhere it's also possible to check who is owning that server and is behind the web page.
But if your address is on the registration you may actually be able to contact Registrar B and ask them to snail-mail you sufficient data to take control over the domain and then transfer it to the company that employs you. Go in and specify something like that you no longer is able to access the email account for the registration or something. When you are in control of it you may have a possibility to go back and ask them for logs about when it was registered and payment process. It's a case of following the money. However try the lawyer path first because if you find the money behind it then you can also find the culprit.
However placing you on suspension seems to be a bit hard, and you may have a case here too.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
However, you have begged the question, and ACCEPTED AS FACT that they presume you guilty and that YOU MUST PROVE YOUR INNOCENCE.
Isn't that how it works in the US where you have (at least in some states) employment "at will" and it is very easy for a company to fire someone? The innocent until proven guilty only works for criminal cases. This sort of thing is exactly why you need laws protecting employees....of course he really needs to talk to a lawyer to see whether there are any such laws applicable here.
I'm unclear on the problem. If the info at registrar B matches your info, then you can gain control of the account and terminate it. If it doesn't, then you'll have proof the lawsuit is baseless. If you can't get control, the denial letter from the registrar will serve as proof the lawsuit is baseless.
Of course, to use this proof in court, you'll need a lawyer. But hopefully just getting a lawyer will encourage your company to cool down and talk sense.
But once all this is over, you need to scrub your info from the registration and replace it with the company's info, since it's their domain. You'll then want to quit this job, since this company is more interested in lawsuits than business.
Not that this wasn't entirely predictable.
Wow. Two thoughts immediately come to mind:
1 - Seek some competent legal advice. Don't be a fucking moron: You're about to lose your job and reputation and maybe be sued out of existence and your biggest worry is to "avoid incurring the cost of a lawyer"? So you come to slashdot instead? Mindboggling. Maybe some other competent professional advice as well?
2 - Sounds like too many coincidences to convince a jury. To prove you've been framed you would have to find out who did it and how they benefited doing it or you'll just sound like your garden variety disgruntled employee / asshole too clever for is own good or something like that. If I were you I'd start looking for another job.
If the whois information identifies you are the registrant, then contact the registrar. Identify yourself and take control of the domain name.
If the registrar refuses, include them in the lawsuit.
Fight Spammers!
GET A LAWYER.
Any further action on your part may be detrimental otherwise.
better check your calculations....
weight of lawyer: 200 lbs
weight of lawyer: 2,916.67 troy ounces
price of gold : $1,246.72 USD per troy ounce
worth of lawyer : $3,636,270.82 USD
All lawyers are assholes until you need one.
Your id was stolen by someone to create a website that infringes on the trademark for a company that you work for? First, it's odd that somebody would steal your identity for the purpose of creating a website. But secondly, the website is one that infringes on the trademark for your company. And then your company actively looks for violations on this stuff? I think somebody wanted you fired. Possibly it is your own company - after all, they didn't need much 'proof' to suspend you, did they? If your company is big enough to have a legal dept, it seems they can afford to be (and should be) a little more thorough. Hire a lawyer.
...that it wasn't you? Seriously, folks: Maybe this individual is guilty as charged, and he's asking us about ways to defend his actions, or how to create a web of plausible deniability. Think about it: If this situation really happened to a truly innocent party, with looming consequences of job loss (especially in the current economy), don't you think said party would seek the advice of counsel before airing out his laundry on /.?
I know some of us are always willing to lend a hand to a fellow geek, but sometimes I have to shake my head at how quickly some of you jump to defend an individual who claims to be innocent, framed, whatever.
Consulting a lawyer is the only sensible thing to do at this point. Of course if you really want to go out in a blaze of irony, you could also register another domain in the head of HR's name or the CEO's name just as was done to you. :D
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
I'd like to avoid incurring the cost of a lawyer but I am intent on maintaining my good name and continued employment.
Right...so let me get this straight: You stand a good chance of losing your job, affecting your life and your family's well-being, and you're too cheap to hire a lawyer? I'm sorry, but you really have your priorities out of whack if you think posting your woes on /. is time well spent.
Plus also get a copy of any grievance and discipline procedure. I would also get in touch with an employment lawyer (not just any lawyer) for your jurisdiction.
It’s a moot point if the alleged misconduct is serious enough offence to warrant precautionary suspension - did you have any hearing at all. Precautionary suspension is only to stop people accused of serious crimes from fiddling with the evidence, which in this case I don’t see how that would be possible
How ever an “off the record” chat with your boss before getting lawyers involved might be worth pursuing. – Pointing out that if you prove your innocence you will be filing a grievance/lawsuit against the company as this will reflect very badly on the mangers involved and that legal and hr may wish to question the mangers concerned and this may well have a negative effect on them. BTW in the UK it looks like you would automatically win as it looks like the procedures haven’t been followed. The “ethnic” name also sets off some alarm bells as well.
IANL but I am a senior lay TMT union activist in the UK.
The lawyer will tell you basically that, unlike criminal cases, where you have to be shown to be guilty beyond a reasonable doubt, that in civil matters, the indicators of your innocence have to be more than the indicators of your guilt.
It's called "the balance of probabilities." So far, the balance of the probabilities, based on the "evidence", is all in their favour.
You've already told them you didn't do it. Your best option now, unless you live in a jurisdiction that isn't "at will", is to conserve your resources while you look for another job. If this were a small enough business that the people around you would find it totally out of character for you to do this, you wouldn't be in this situation right now - they would have believed you. As it is, they don't, and worse, they can't afford to back down at this point.
Pick your fights. You've told them you didn't do it - now tell them you're not comfortable working for a place that calls you a liar and you want to discuss a severance package that includes an agreement that you were RIF'ed if anyone should ask for references. Because even if you prove you didn't do it, your job there is history, and at some level you know this is true. Besides, do you want to work for a place that calls you a liar and a crook?
I'm not being mean here, even though the tone might come across as such - it's because you really need a bucket of water (or a brick) to the face to make you realize that you're in a no-win situation. It's the same "wake up and smell the coffee" advice I'd give to my closest friends if they were in the same situation. It sucks, but so does life in general. We can't change that, but we can change how we react to it. We can either stew on it, and let it turn into acid that eats through our guts and permeates our life and our personality, or we can move on.
We all know people who, a decade later, still won't stop talking about someone who screwed them over at EVERY occasion. Try it - go on a dinner date with someone who's divorced - sometimes it's like their ex is sitting at the table with you ... you want to say "you're obviously not over them. Maybe you two should get back together if you like arguing about each others actions so much. Call me when you're really single."
This is the same situation. Nobody, not a lawyer, not anyone on slashdot, can change what's happened. What we can do is give you the encouragement to help you deal with the situation in the most efficient, least destructive, way, both professionally and personally, and help you rebuild. The lawyer won't do that - their first interest is $$$. Before it's finished, this case will cost you a minimum of $20k, and probably a lot more.
If you can handle the legal stuff yourself, my advice would be a bit different, but not by much. Some things it's just best to agree to disagree, tell them that you've thought about it, and when they find the culprit, you'd like to be kept in the loop, that you won't use that info to hold them responsible, and if there's anything you can do to help, just call, and that you understand they're only trying to protect their business and the other employees, and then move on. You'll keep your respect and earn theirs. It's a small world. You never know, they may call back in a few years with good news - you should keep that door open.
I've had bosses who are dicks - even after I've quit, I tell them that if there's a problem, call me. They might be too proud to admit they made a mistake, but the smarter ones are not too proud to take my advice when they're stuck, and I'm not too proud to refuse to help them.
Actually that's about right according to the tables used by insurance companies.
Geeze man. Lawyers are expensive. Maybe the answer is "too poor" rather than "too cheap", especially depending on the circumstances.
I make a decent wage and a long court case would stretch my budget, I'd imagine that if the author of TFA is working at Best Buy or somewhere similar then a lawyer would be similarly expensive.
Winning one's job back isn't much of a victory if it costs more than a year's wage was worth... unless he makes big bucks suing the company or domain registrants (and it's more likely he'll just bleed cash whilst the company strings out the lawsuit).
You need to retain competent counsel. Do not file a pro se suit against anyone. Do not try to go it alone. Unfortunately, with the primitive protections provided in most At-Will states, you will be hung out to dry in short order. Your reputation will be damaged, possibly beyond repair, and you will have difficulty working as a sysadmin. Posting as much detail as you did on Slashdot was probably not the brightest idea you've ever had.
You'd be surprised how many banks, businesses, etc, just go by the name and never stop to think that just because your name ain't Joe smith that it might still be common as dirt. I had to switch banks because they had three of "me" (one of which actually had the same FML, same names for parents, and same name for sister! I actually met them, it was weird, but when you're Irish certain names are as common as Maria is to a Latina) and they would never bother to look at anything except a name. Hell in this digital age there must be thousands of "you" splattered out all over the place, and even if you think your name is unique it probably ain't. Hell my mother made up my late sister's name and when she went to high school there was no less than 4 with the SAME name! It turned out by tracing it back 2 girls had been born a few days after my sis, and when their mothers heard my mom and the nurses talking about the name thought "Hey, that's cute!" and named their girls that and it spread from there.
So if their FIRST reaction is to automatically assume that you did it and use it as an excuse to suspend you? Yeah that is a shithole company and I'd be talking to a lawyer while I hunted for another job. Life is too short to be treated like shit by a company that obviously don't give a shit about their employees.
ACs don't waste your time replying, your posts are never seen by me.
Problem: His company now sees him as a liability. Anything he does with this domain can backfire ten times. He claims nothing to do with the domain, so he should have nothing to do with it at all.
DO NOT DO ANYTHING RIGHT NOW BUT GET A LAWYER!
http://www.debunkingskeptics.com/
Unless the registrant paid cash, which is almost impossible online, they likely paid with a credit card. Check with your local prosecuting attorney about filing a fraud case against John Doe and see if they'll file subpoenas to the registrar and credit issuer for identification purposes.
This story doesn't seem to add up. Why wouldn't a competent SysAdmin just contact Registrar B either by an Abuse, or a Support resolution process? Worst case scenario, a competent registrar will want a letter on the victim company's official letterhead, or some notarized document, to prove identity. Best case scenario, you could take over the domain (registered in YOUR name), and shut the site down by lunch-time on Tuesday.
If it were me and I WANTED to keep my job, then I'd lawyer up, if that didn't work.
/^([Ss]ame [Bb]at (time, |channel.)){2}$/