Slashdot Mirror
College Fires IT Admin, Loses Access To Google Email, Successfully Sues IT Admin For $250K (theregister.co.uk)
An anonymous reader quotes a report from The Register: Shortly after the American College of Education (ACE) in Indiana fired IT administrator Triano Williams in April, 2016, it found that it no longer had any employees with admin access to the Google email service used by the school. In a lawsuit [PDF] filed against Williams in July, 2016, the school alleges that it asked Williams to return his work laptop, which was supposed to have the password saved. But when Williams did so in May that year, the complaint says, the computer was returned wiped, with a new operating system, and damaged to the point it could no longer be used. ACE claimed that its students could not access their Google-hosted ACE email accounts or their online coursework. The school appealed to Google, but Google at the time refused to help because the ACE administrator account had been linked to William's personal email address. "By setting up the administrator account under a non-ACE work email address, Mr Williams violated ACE's standard protocol with respect to administrator accounts," the school's complaint states. "ACE was unaware that Mr Williams' administrator account was not linked to his work address until after his employment ended." According to the school's court filing, Williams, through his attorney, said he would help the school reinstate its Google administrator account, provided the school paid $200,000 to settle his dispute over the termination of his employment. That amount is less than half the estimated $500,000 in harm the school says it has suffered due to its inability to access its Google account, according to a letter from William's attorney in Illinois, Calvita J Frederick. Frederick's letter claims that another employee set up the Google account and made Williams an administrator, but not the controlling administrator. It says the school locked itself out of the admin account through too many failed password attempts. Williams, in a counter-suit [PDF] filed last month, claims his termination followed from a pattern of unlawful discrimination by the school in the wake of a change in management. Pointing to the complaint she filed with the court in Illinois, Frederick said Williams wrote a letter [PDF] to a supervisor complaining about the poor race relations at the school and, as a result of that letter, he was told he had to relocate to Indianapolis.
They got a default judgment against him, they did not win on the merits of the case. Default judgments are not so final when the other party wants to fight about it some more.
That wasn't really the case here. The IT shop apparently had a crew of a dozen or so people. They all had admin rights on the Google domain plus some root admin account. When they fired Williams, (according to the court docs), the laptop was sent back with the root account set to auto-login. Apparently the company they had outsourced the IT to either wiped the machine or did something to it where the root account got locked out or the password changed. The only other account that had admin access was William's personal google account (which was supposed to be removed from admin rights).
He didn't want to work with them anymore to help them recover their admin account, which they screwed up. They ended up suing him. He ended up losing because he didn't show up to all the court dates, because he couldn't travel to Indiana because he was not able to take his kid with him to Indiana (because of a ruling from family court).
If he would have shown up to court, he actually would have won. It was the school's responsibility to secure their property before firing him (including logins, etc.) They didn't, and they can't expect him to even answer his phone after they separated. He was actually in the right, by law, to ask for compensation for working with them, as a new contract work for hire. This is pretty standard case law, and the LRB has postings about it all the time. Now, he could have been in the wrong if there was a policy about not associating the domain admin account with your personal account, but that clearly wasn't the case since it was well known that it was done and they didn't bat an eyelash about it.
There are two thoughts any sysadmin should have:
Then think how many of those things you could do by accident if someone persuaded you they needed your help whilst drunk or, in many cases, merely by being knocked down by a bus and spending three months in hospital. The end result of this thinking should be.
An inexperienced young sysadmin may never have these thoughts, however the first time one of his colleagues leaves in bad circumstances he will be forced to have them as he tries to work out what his colleague might do now. If you haven't had the thought about what you could do for revenge then you aren't a serious experienced sysadmin.