Slashdot Mirror
Employees in the Dark About Data Retention Policy (betanews.com)
An anonymous reader shares a BetaNews article: A new study reveals that over half of office-based employees say their companies don't have written policies on data retention or personal use of work devices, or if they do, they aren't aware of them. The study conducted by Harris Poll for e-discovery company kCura reveals communication habits that could put organizations at risk of incurring increased data retention and discovery costs in today's increasingly litigious business environment. "Complete bans on the personal use of work devices would be difficult -- if not impossible -- to implement, and could be harmful to employee morale. However, companies do need to implement reasonable policies to mitigate risk," the report adds.
Fuck data retention.
Burn the motherfuckers down.
With how few employees actually remember what they sign I'm not amazed that most are not aware of them. Most people barely even remember reading the IT orientation packets they get on the first day let alone something they agreed to months or years ago.
What does data retention have to do with BOYD at work?
Like the manager I dealt with (not a direct report, thank goodness) who simultaneously:
1). Insisted she needed the data;
2). The data was in violation of the data retention policy;
3). Refused to change the policy or in any way initiate a policy review, get a policy exemption, or address the policy implications.
I've worked for a lot of different Fortune 500 companies in Silicon Valley. The one company that had any kind of data retention policy was eBay/PalPay when I worked there on different contracts. If an employee left the company, the hard drive from their PC got sent over to legal for them to create a backup image for future reference.
Before I left a horrible place I made sure source code and documentation was all checked into the shared repo and then I wiped everything local; my mail db, drives, unsubscribed from services, reset passwords for everything, y'know the works.
They didn't say boo about it while I was there or even through the exit interview but I found out after through the grapevine that apparently they wanted crap like that around and were in a huff about it, there were no formal policies they just expected people not to give a fuck when they left.
To this day I can't think of anything of value that might have been there or why anybody would get their panties in a bunch over it.
Anyway because of me there's a bullet point in their exit policy (-:
...Except legal, even though they created them they are always asking us to miracle up something that is over a year beyond the limit of our retention policies.
Management's policy process lack's the knowledge and (ugh, sorry) "agility" to adapt what they want to the ever-changing landscape of what and where data is and how it's accessed.
Whatever policy is on paper is likely woefully vague or out of date relative to technology. Much of the time the organization itself is willfully non-compliant as various centers within the company store and access data in various public clouds, social media sites, on personal or hand-held devices, and so on.
Even when everyone kind of has their shit together, the technology industry is subverting "corporate data" by turning themselves into personal technology companies, like Apple and now Microsoft, where they've figured out that if you sell to the individual end users as consumers you can essentially *make* corporations support (and sometimes buy) your product.
They probably don't have those policies and procedures written up because they can't end up having that meeting, or at least one that comes up with a solution. Head Honcho wants everything deleted after 6 months because of possible liablities and reveal. Low down managers don't want anything deleted because they are looking to cover their asses in possible liabilities and reveals. IT states they only have enough of a budget to store everything for one year. Workers point out that many of their projects last longer than one year and even go multiple years and they'll need all that information well past those timelines just to get the job done and support it. Legal is going to pop up and explain that things can be deleted after 6 months, except for these three corner cases they know about where they are legally obligated to hold information for up to ten years to forever, and there might be more such cases, and dependancies due to contracts. By the end of several hours, they have several conflicting policies demanded by different parts of management and half a dozen problems that need to be looked at with legal and economic issues as to why they can or can't adhere to any policy. Eventually, the day long meeting ends with another, similar meeting scheduled in another few months.
A friend works for a computer forensic recovery and analysis company that many big companies and three-letter agencies use to crawl through a company network, audit each machine it finds (either by breaking in or being given access), and scans for various types of files. It vacuums them up for review by a human. It's used for litigation discovery and spying. My friend is very proud that his company is partially responsible for bringing down some very highly placed Pillbilly Repugnican operatchiks for corruption and sexual escapades.
If you put your data on their device, they can copy it at any time. At that point, it's a question of trusting not only the company policy but also the staff with privileged access---most of whom you will never meet or even know by name.
A lot of places are doing HTTPS decryption and packet inspection at the perimeter, so even "secure" or "private" connections on these devices are not trustworthy. Any privacy you have is either an illusion or a convenience at best.
The bottom line: If you're not OK with it being printed and handed out, don't put it on an employer-owned asset.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Nothing digital ever dies. As Clinton found out when using Bleachbit. Of course, she was lauded and not prosecuted. Anyone else would be given thumb screws doing what she did.
Doesn't matter. Even if they don't find a smoking gun they will find something else. The engineer from BP found that out by getting accused of obstruction for deleting text messages. Which nearly everyone does anyway on a routine basis. But it looked bad at that moment in time.
Delete, don't delete, they will hang you for it anyway. It's what prosecutors do. They don't want you in court, they want a plea bargain from a scapegoat. Keeps those percentages high and makes their elected boss look good.
Most of the people who go on about policies have no idea what actual data retention is, or how backups work, or which "critical files" and logs are maintained.
Or are lawyers, so they just lie to you anyway.
-- Tigger warning: This post may contain tiggers! --
Hah! Pillbilly. I hadn't heard that one.
Would all the employees know about an email retention policy or would a server just do it?
and an awful lot of rambling on about personal stuff on company devices, vice-versa, and privacy policies regarding them as if there was any.
If your ISP is spying on you and Microsoft is spying on you, you should assume the actual owner of the computer is spying on you too.
These days, any cutting down on personal use of computers or phones just means employees will spend more time on their personal cell phones. Telling them they can't use cell phones will just typically be ignored or result in them using their work computers against policy. Either way, it's just going to cause headaches for the managers because they aren't going to use either against an employee unless they want them fired and need a policy to present as a clear cut reason, which hits morale of all the other employees because everybody is doing the same thing that other person got fired. Policy comes up for review and probably gets reversed till the next person gets fired and the cycle repeats.
He'll be very busy helping LE bring down the Bluepillbilly Democrap operatchiks for corruption and pedophilia then, or is he going to cover for them instead?
This is why I've been clicking on multiple pizza links and coupons on their device, just to make sure those people inspecting the data can feel the excitement before lunch. I do wonder if this is what made the pizza delivery boy coming in almost every lunch hour.
The only week it stopped is when I clicked on some links about sausage factories and rats eating rotten meat.
I'm sure someone four cubicles down is actually getting paid to do that for me anyway.