Deleting Files is a Crime? 510
cemaco writes "A former employee of International Airport Centers, who is currently embroiled in a legal dispute with them, returned his company laptop as required. Hoping to find incriminating evidence, I.A.C. attempted to retrieve deleted information from the laptop in question with no success. This employee had beaten them to the punch. He had used 'secure delete' software, in order to make sure nothing could be recovered. He is now being charged with a violation of the Computer Fraud and Abuse Act."
Two-way crime (Score:5, Insightful)
What Rights? (Score:2, Insightful)
Adolf Hitler, when challenged by some people, said "I don't need you, I have your children."
Effectively one could say the same thing about those in government who have usurped the rights of the people since the ink dried on the Constitution and Bill of Rights. "I don't need you, I have the laws." Worst of all, they have a lot of the children too, because the children don't care or will vigorously defend the right of the government to deny them their very own rights.
Ideally, a judge would, like the article's author, take one look at the charges and say, "whaaaaat?" just before throwing the whole silly thing out. Now three loops have decided returning the drive clean is a crime, unanimously.
Ok, there's the thought that work on the laptop would be of value (a project of some sort or list of contacts and estimates valueable to the next to occupy the position) to the employer and the employee violated some work ethic, by destroying company property, but that's now how it reads. More likely the computer would only contain things meaningful to the employee in the context of producting the actual end work.
Next there will probably be some poor person sued for throwing out old yellowed paper-work, which had been in the bottom drawer of a desk for 30 years, when retiring.
Does this mean each person must approach the company gestapo for approval to destroy or discard anything?
A laughable concept. IAC are a bully and the U.S. Court of Appeals for the 7th Circuit are out of their league regarding workplaces and technology.
oy, he erased 'is name from the company directory! someone could get seriously lost looking for a former employee's cubicle and come to great harm! put 'im in irons!
Was it classified as evidence? (Score:5, Insightful)
On the other hand, if a document was issued classifying the harddrive as evidence before he deleted the contents of the drive, he did commit a crime.
Ideally, it should be as simple as that.
Some people don't get it (Score:2, Insightful)
Would this have even been posted on
Re:Two-way crime (Score:5, Insightful)
Seems to me what is lacking here is IAC arguing before the court what specific contents should be on the computer which were destroyed, without authorisation, thus doing harm to the company.
Lord knows, everywhere I've worked, when I left I was expected to clean out my desk, not have a bunch of business analysts doing it to be sure I didn't throw anything useful away. Gosh. To think the massive amount of crap which would litter my computer and desk if I didn't dispose of things is daunting. I must be trusted to use good sense and not throw valuable stuff away, huh?
Re:Kind of crazy.... (Score:3, Insightful)
Re:It's a *company* laptop... (Score:3, Insightful)
If the company had a set of policies in place, and had informed the employees about them, that ALL data that was put onto the system became the property of the company. Or if there was a clause on there about not putting personal data or programs on there.
In this case, they would pretty much need to PROVE that anything he deleted was possibly incriminating. Which, at this point, would be damn near impossible.
Where I work... (Score:3, Insightful)
We are required to wipe the drives when we leave with something like a hardware 3 pass low level uniquely random sequencer based on radioactive decay.
I got a little overboard there. I do not work in a secure environment. I believe this is for our privacy when we leave, or maybe it has to do with security for financial information, or maybe it has no reason, but it is a policy.
This guy got raped by the system before the real deal. Gotta love our freedoms!
What's "to get"??? (Score:3, Insightful)
Re:Two-way crime (Score:0, Insightful)
As in "Fuck you, you fucking hoe-bag cunt!!!
Re:It's a *company* laptop... (Score:4, Insightful)
Operative word being "Reasonable."
It would all depend on whether his company's acceptible use policy had an allowance for limited personal use or not. If they did say it was OK to use it for personal use, they had no legal grounds upon which to try and recover HIS personal (not work related) data since it was HIS.
Your analogy implies that EVERYTHING in a workspace is company property, when in most cases it's not. Having personal effects in my office, and removing them when I leave the employer, is no different form having some personal data on a computer.
Re:Was it classified as evidence? (Score:5, Insightful)
THEN they went looking for dirt on him.
That order right there is what's important. If the guy had been informed of an investigation, and had then returned the laptop, wiped, he could be guilty of destroying evidence.
But he returned the laptop, then an investigation was begun.
Sorry, no investigation first, no crime.
Granted, this COULD be an internal policy issue for the company too. However, they're not suing him for violating company policy. They're suing him under "hacking" charges. Which pretty much says that there was no policy in place regarding the data on the laptop. Moreover, the guy's employment contract, apparently, SPECIFICALLY allowed him the option of destroying data on the machine.
In agreeing to that, the company pretty much just abrogated ownership of the data.
This guy's in for a really long court battle. But, eventually, he's going to be acquitted.
Re:Two-way crime (Score:2, Insightful)
Oh, that's easy enough. It doesn't enter into it at all.
KFG
You mean you guys DON'T use secure delete? (Score:3, Insightful)
If you allow the employee to use the laptop for personal use (online banking eg.) then you have to expect them to take steps to protect themselves.
This is a bizarre ruling -- I expect some interesting repercussions.
Re:What Rights? (Score:2, Insightful)
You're right, that's damned worrying. I can see why they might decide that though. That doesn't make it right. You would have thought that at least one person would decide against it.
he's driving the speed limit, but he was probably speeding before he slowed down to it, let's write him a ticket
Good analogy. For the record, I always stick to the limit
Re:Wrong law (Score:1, Insightful)
it can be, but this seems wrong (Score:3, Insightful)
This decision seems wrong, however: preventing people from deleting files on laptops under their control was not what the Computer Fraud and Abuse Act was intended for (note, in particular, that it makes reference to a networked computer). Whether the employee was allowed to files should be a matter purely of their employment contract and the stated corporate policies.
Re:Two-way crime (Score:2, Insightful)
alarmist (Score:5, Insightful)
Ideally, a judge would, like the article's author, take one look at the charges and say, "whaaaaat?" just before throwing the whole silly thing out. Now three loops have decided returning the drive clean is a crime, unanimously.
RTFA. That's exactly what the judge did. The company appealled the decision, and the appeals court sent it back to the judge saying: no, you can't throw this out. The company might be right. You need to hold a trial to figure it out.
Having read the article, I agree. The issue is not so clear-cut that it should be dismissed out of hand: it deserves its day in court. The guy may have deleted incriminating information (which is a crime, see Enron paper shredders). He may also have been propping up his business at company's expense (i.e. using whatever data he acquired while making sure the company doesn't get a hold of it). That's for the judge to decide, and that's exactly what the appeals court said should happen.
Oh and, btw:
Adolf Hitler
you lose.
Re:it can be, but this seems wrong (Score:3, Insightful)
Next in the "Free" United States, a man will be convicted of murder because he was NOT in posession of the murder weapon...
If he deleted the files, uhh, how do you know that they were there in the first place? A file called "$vidence.dat" that is full of nulls is pretty shaky evidence. "Yes your honour we are SURE that this file contained x-y-z sensitive information..."
Re:What Rights? (Score:4, Insightful)
I urge you to consider the possibility that all the judges who have thus far ruled that it can be a criminal act to destroy information that does not belong to you may, in fact, not be "out of their league" regarding workplaces and technology, and even may understand the issues better than either you or Mr. McCullagh.
Re:Two-way crime (Score:5, Insightful)
Exactly! The 7th Circuit has merely stated that the action could be a violation of the act--something to be determined at a trial. They haven't convicted anybody or even claimed that a law was broken, only that the alleged act is conceivably a violation.
After a careful reading (Score:3, Insightful)
Or the third possibility is he does not delete the files, and there are no files which shows he violated his work contract. The crime was in deleting the files. There could not be a crime in leaving the files there.
What most likely happened was he used his employers laptop in starting his own buisness. Who knows how he did this, maybe he used trade secrets or something else. When he decided to quit, he wanted to remove the evidence of his actions, so he removed everything from the laptop.
The company has a right to issue the laptop and require it is returned in the same condition, and that would include the software and data on the laptop.
Is the laptop's data the property of the employer? That is the question. If the laptop is the property of the employer, and the employer has a right to the data on the laptop, then what this guy did is the same thing as if he deleted records from a PC in his cubicle. Or is it different because he can take a laptop out of the office?
My gut reaction is to want more privacy. But maybe that is not possible anymore. Heck, the government demanded search records from Yahoo, MSN, and Google a few months ago so they could see who was searching for prohibited porn and terrorism. Google was the only one who did not provide the data, but not because they wanted to protect their users privacy, but because they did not want other companies to see their data.
Re:What Rights? (Score:3, Insightful)
The most important thing to notice here is that this was not a final judgment. This was a ruling regarding an appeal to the case being dismissed. A case is only dismissed in this way if the plaintiff has no case even assuming that every disputed fact is in his favor. Dismissing the case is like saying, "You're so wrong, that even if you were right, you'd still be wrong." The ruling here just lets the case go forward. The guy could still be totally exonerated in the end.
Re:Some people don't get it (Score:3, Insightful)
If there was no evidence the corporate towers ever existed, nobody could say where they are, how big they were, what they were worth, and no construction company could ever be found that built them, then your analogy would be correct.
They are claiming he destroyed SOME data, but they don't know what it was, where it was, whether it was business or personal, and what if any value it had. You honestly think that should be a crime? How valuable could the data be to the company if the company can't even say for sure that it ever existed?
Re:What Rights? (Score:5, Insightful)
But there are things in the case that we don't know.. for example, what evidence does the company have that these files were even there in the first place? Maybe he was secure-deleting personal information that the company had no right to in the first place (where I work, we have an incidental use clause regarding technology--that is, we can use it for our own personal purposes as long as it doesn't degrade the system as a whole). Simply put, we don't know most of the facts of this case.
Re:Two-way crime (Score:5, Insightful)
"Jacob Citrin was once employed by International Airport Centers and given a laptop to use in his company's real estate related business. The work consisted of identifying "potential acquisition targets."
Essentially the product of his job was the information about which properties to acquire.
From the Judges decision (PDF here: http://www.ca7.uscourts.gov/tmp/R31363C0.pdf [uscourts.gov] ):
"decided to quit IAC in violation
of his employment contract, he resolved to destroy files that
incriminated himself and other files that were also the
property of his employer"
He apprently deleted the files containing the information he had been hired to collect after violating what sounds like a non-compete clause in his employment contract because he wanted to go into business for himself doing the exact same thing he'd been hired to do.
Poor analogy: As a surveyor for a mining company, it's my job to find mineral deposits for my employer. Using company time and equipment, I find such a site, but fail to disclose the location because I decide I want to start my own personal Survey firm. I'd say they'd have a pretty darn good case against me.
I also don't think the case from TFA is going to get laughed right out of court.
Re:Two-way crime (Score:1, Insightful)
Not necessarily. FTFA:
"IAC tried to undelete files on it to prove he did something wrong"
Maybe they would have simply not found what they were looking for even if he did not delete them
Not a criminal case (Score:2, Insightful)
It's important to point out that this decision was not made in a criminal case, but in a civil case. As such Critin wasn't found guilty of anything and therefore I believe this ruling does not count as a binding precedent for criminal cases merely a persuasive one. Nevertheless, it is disconcerting that the seventh circuit court of appeals made this ruling. However there are lots of caveats in the ruling that mean the question of what you can and can't delete from a computer when leaving a company is still relatively open. In the end, Citrin didn't just delete love letters and e-mails to personal friends from his computer - he deleted files concerning clients - files he knew his company would be interested in and didn't have a copy of. Personally, I think that it should be the responsibility of the company to make sure a copy of such files exist on their servers but that's just my opinion.
Sadly, once again Slashdot has chosen to report news with the most sensationalist slant possible. Despite the fact interest in the story would have probably been the same (or more) if it had reported a few extra details of the case. In the end, sensationalism diminishes, not increases, the value of a news service.
This reminds me.. (Score:3, Insightful)
hehe, the rebel i am.. i just emptied my recycle bin..
Is this a problem if it's SOP? (Score:3, Insightful)
However, for instance, I run "eraser" on a daily basis which scrubs all free space on all drives, plus slack space at the ends of files. I consider this simply standard operating procedure, because my computer does have sensitive data on it. In addition, I lock my machine when I leave, and all my data is held in an encrypted volume, so if someone reboots the machine to a boot CD or something, or steals the machine, they still get nothing.
If I undertake these actions as a general course of business because I consider them to be simply part of trying to do my job and take security seriously, I think that's a lot harder to prosecute against.
How stupid can people be ? (Score:2, Insightful)
To be the Devil's Advocate here... (Score:5, Insightful)
Basically the whole issue ended up being about timing.
When he decided to leave employ of the IAC to start his own venture, his authorization at that point to use the computer did not belong to him. Though he may have physically retained the computer, and had all access to it, he did not have legal rights to its contents.
At that point, he was a competitor to IAC, possibly with information on his person about IAC that a competitor should not.
IAC wondered what he had, and whether he was misusing this laptop for his own benefit, which would break all kinds of laws. They wanted to take a look at said laptop, and see if he'd used it or seen anything he shouldn't have recently.
This employee then accessed the laptop and deleted all kinds of stuff, akin to shredding documents Enron or Watergate style. He then returns the laptop to IAC, his former employer and now competitor.
Unsurprisingly, former employee is now sued, though his conviction is by a tenuous interpretation of a law.
WTF... (Score:4, Insightful)
His right to do this was in his contract. Can anyone tell me why a contract can no longer protect an individual from a company?
cleaning up work pc (Score:2, Insightful)
The Law is Seriously Bent... (Score:3, Insightful)
I understand the reasoning that Judges can only pass judgements based on the arguments presented by lawyers on behalf of their clients, and this was fine for hundreds of years, but the computing universe that a lot people spend a considerable amount of time living in is far too different to the physical domain we live in.
A Judge who is not computer literate should not be prevailing over a case based on IT. Even us geeks have trouble coming up with analogies that are accurate enough to explain things properly to ordinary people when we're fixing their computers.
Judges shouldn't need analogies or "translators" when they hear a case centred around IT, they should know what CPU, GPU, NTFS, EXT2, HFS, etc, all mean, otherwise they cannot seriously be expected to form an accurate picture of what is being argued, and therefore cannot be expected to come up with a ruling based on any sort of accuracy.
Judging, he he, from this bit in the article,
This Judge doesn't really know how a computer works.
Deleting files is certainly not the worst thing you can do to a computer. Hell, go ahead and delete critical operating system files. A restore disk, OS installation disk, or re-image later and the computer is back up and running.
It may seem like I'm arguing semantics, but it's just the way that phrase leapt out at me that leads me to think that the Judge seriously misunderstands the connection between the functions of a computer, and the way that data is stored within the computer.
Could he also misunderstand that the computer was probably going back to the company almost exactly as it had been issued, and therefore undamaged other than normal wear and tear?
Re:while otherwise you have some good points... (Score:2, Insightful)
Re:Deleting is deleting, period...judge should get (Score:1, Insightful)
When they're *your* files on *your* computer
But I don't think that logic applies to this case. Evenso, what would have prevented this guy from filling his hard drive with
If he did that often enough it would probably be very difficult to recover any data. Would he still be liable then?
Mistake in argument (Score:5, Insightful)
I think his mistake was in arguing about his authority to delete files at all. His argument should have been that all the files alleged to have been deleted were personal files, personal use of the laptop was authorized by his employment agreement (quote the relevant paragraph from the agreement, and the company has no right to demand that those files be turned over in the first place. You can't be charged under the law he was if the only things you "damaged" belonged to you.
Of course, this only works if he was scrupulous to avoid mixing his personal stuff with company data and can clearly show that all the files the company can prove were theirs are untouched. If he did delete files from an area normally or provably containing company data, he's pretty much SOL.
Re:Deleting is deleting, period...judge should get (Score:3, Insightful)
The company is alleging that the only proof that the guy violated his contract was on their laptop. Well what if the guy had put the data on his own computer? Would the company then be entitled to it? If he destroyed the data on his own personal computer, would that also be a crime?
This whole idiotic ruling creates a legal catch-22. You are an employee given access to confidential information. Suddenly you are no longer an employee. So, if you keep that information, you could be found to "gaining access to information that you do not have permission to access" and be guilty of computer fraud under the statues. NOW, if you destroy the information so that you cannot be found guilty of having access, you can be charged with "hacking or tampering with information you did not have permission to access" and be guilty of computer fraud under the statues. Damned if you do, damned if you don't.
-JoeShmoe
.
Why is this in criminal court? (Score:5, Insightful)
It is a testament to the broken state of our laws (and especially our computer crime laws) that his former employer was able to (convince a DA to) drag him into criminal court for this.
If the guy had hacked into company computers and destroyed data, then sure, he should be prosecuted under criminal laws. But wiping files from a hard drive? If the guy really did do damage to his former employer, or violated a contract with them, then it shouldn't be a criminal case. It should be a civil case.
Cart before the horse (Score:5, Insightful)
Of course it's BS. But so is the whole case.
The REAL case is that the guy was setting up his competing business, and they wanted the laptop data to prove it.
They shouldn't be going after him for "destruction of data on a networked device" but for violating his non-compete. Especially since, if they can't prove he violated the non-compete, then it IS his data to do as he pleases, even if it was sitting on their laptop.
Look at it this way: If they can't first show he violated his non-compete, then they have no claim to the data he erased, as it may have been "his" data just as much, or more, than theirs.
On the other hand, prove first that he violated his non-compete, and you can THEN also get him on the data destruction.
What you CAN'T do is the reverse - prove the destruction of your data if you can't first prove that it is uncontestedly your data.
Re:Two-way crime (Score:3, Insightful)
Catch-22 (Score:4, Insightful)
The employer can demand anything he wants. And the employee can say "sue me."
In this case, though, the employer is putting the cart before the horse - attempting to claim vandalism to their property (destruction of files on a networked computer) without first proving the files in question were their property. They wanted the files to show he broke his non-compete and, as such, was no longer an employee, and thus not authorized to delete the files. Seems to me, if they can't first show he broke his non-compete, they can't claim uncontested ownership to the files.
They're in a catch-22.
Re:Catch-22 (Score:2, Insightful)
The destruction of that data was willfull.
That is what the lawsuit is about. While a judgement against the employee on non-compete grounds would help any further suits including vandalism, it is not necessary. All they have to prove is that there was data on the lappy and it was deleted.
call me crazy...but use your own laptop (Score:2, Insightful)
had this guy bought a laptop (which he is likely going to need for his new company anyway) and used it for dealings w/ his new venture... his problems would be gone.
that said.... it is some bullshite to claim that deleting the files securely was a violation.
seems like most of the time when i hear about employement problems like this
Re:Cart before the horse (Score:3, Insightful)
Hey, the information you've transmitted over slashdot has damaged the company's lawyer's protected computer fund. Expect a warrant for your arrest.
Even if he was violating his agreement with the company, they loaned him the laptop. The law was not put in place to regulate how an employee may use an employer's computer, but to protect people from hackers. Non-case.
Why was the "critical data" on a laptop? (Score:2, Insightful)
So why the hell was this critical data on a laptop and not backed up or stored somewhere more secure? Their IT guys should be fired...
IANAL, but I think there's his defense right there. If the data was critical, any company worth it's salt has a policy that it needs to be stored (or at least copied) somewhere secure.
Re:Catch-22 (Score:5, Insightful)
Did Jesus just kill another kitten or something?
Nope. No more than if I put my lunch in a company-owned drawer, or install developer software bought, paid for, and licensed to ME on a company-owned computer, or even on their server.
Your theory of "company-owned" is more viral than Microsoft's "shared-source".
I leave, my stuff leaves with me.
I'll agree the guy WAS stupid to delete the files, and he WAS stupid to even bother using the company laptop. But lets reverse your argument - the company-owned laptop was at one point on an employee-owned resource - the employee's lap. Does that mean he owns it? Of course not. Ownership is not transferred by putting something next to, inside of, or on something. Its transferred by either mutual agreement or act of law.
Headline misses the legal point (Score:2, Insightful)
THAT is bullshit! (Score:5, Insightful)
A murderer CAN deny access to their property even having a dead body in the freezer, enless the police have a warrant. A company CAN refuse to turn over documents enless the police have a warrant. Police can't walk in anywhere they want and/or just take things because they may or may not be incriminating, it's called probable cause. They must have enough viable reason to further their investigation, you can't just bother every citizen because you may or may not know a partial bit of information about a crime.
Re:The judges are flat out wrong (Score:4, Insightful)
When I return a PC or laptop to a client site, they are entitle to:
That's it. Everything else on the machine is my personal property, and removing it is my right the same as cleaning out my desk when I finish a contract.
Re:Two-way crime (Score:5, Insightful)
Re:Two-way crime (Score:5, Insightful)
Do you have an ego problem or something? Just because someone minimizes something and doesn't want your nosy ass reading over their shoulder, or seeing what they are doing doesn't mean they are stupid. Perhaps what they are doing is none of your business?
Just because you are a sysadmin, and can technically do these things does not make them right, or even legal, depending on your jurisdiction. Depending on the company, even a mighty sysadmin can be fired for doing this without the proper authorization.
Do you think telephone technicians sit there and laugh saying "Man people are so stupid, they think their phone calls are private!"... no, they don't. It's understood that yes, they can and do listen to calls on occasion, and they have the integrity and ethics not to blab about it or let it leave the equipment room.
"Man people are so stupid, they think that their personal conversations at home are private, but I have this parabolic microphone!"... man, what ingorant people.
Re:Two-way crime (Score:3, Insightful)
Re:Two-way crime (Score:3, Insightful)
What about renting a VHS tape from Blockbuster and erasing the tape and returning it. I think BB would have to pursue the recourse from you as a civil matter, not the local police department. Who knows..
Circular Logic (Score:3, Insightful)
San Diego's Former Mayor (Score:2, Insightful)
Re:WTF... (Score:3, Insightful)
Whoa, whoa there. Every user should be using "secure delete" of some sort on any file that they are certain they do not want to undelete. It should be a standard feature of any operating system, although it is still most often part of an add-on security suite or standalone program.
It is the digital analogue (ha ha) to shredding documents. When you shred a document, you shred it. You don't put it complete and intact in a box marked "SHREDDED" for long term storage.
Jim
Re:Two-way crime (Score:3, Insightful)
This is more like what this is about. If the company gives me somethign to use, i use it for personal use as well as work, the personaly stuff doesn't automaticaly become the company's property.
It sounded more to me like the appropriate analogy would be that he was a programmer hired to write a program. He took his salary for a year, then as he finished up the program, realized he could get someone to pay him cash for the program and he could keep the source code and sell it to other people later too. So, he quits. Someone asks for his laptop back. He realizes that the code is on the laptop, so he deletes it.
What he deleted that the company was interested in was not personal stuff. It is his work product that he is stealing from the company for his own gain. I'm unclear whether he deleted it to prevent them from getting the source code to compete with him, or because he knew it was illegal (or at the very least, unethical and a violation of his contract) and wanted to destroy evidence. But he did not destroy it until after he was fired, and at that point he did not own the laptop, and certainly not any work-product on it. They didn't want his sun glasses, they wanted the company-owned equipment in the trunk that he took out and sold to someone after he was fired.
Re:Two-way crime (Score:3, Insightful)